From: Sasha Levin Date: Mon, 1 Mar 2021 03:19:08 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v4.4.259~70 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=415fb5e12894bc6bb973fdfffbc1bfc4d54d6487;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpica-fix-exception-code-class-checks.patch b/queue-4.19/acpica-fix-exception-code-class-checks.patch new file mode 100644 index 00000000000..e392246de46 --- /dev/null +++ b/queue-4.19/acpica-fix-exception-code-class-checks.patch @@ -0,0 +1,62 @@ +From cc8468a496c5a17f0afaee09eff37ce801cdc08c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 10:48:18 -0800 +Subject: ACPICA: Fix exception code class checks + +From: Maximilian Luz + +[ Upstream commit 3dfaea3811f8b6a89a347e8da9ab862cdf3e30fe ] + +ACPICA commit 1a3a549286ea9db07d7ec700e7a70dd8bcc4354e + +The macros to classify different AML exception codes are broken. For +instance, + + ACPI_ENV_EXCEPTION(Status) + +will always evaluate to zero due to + + #define AE_CODE_ENVIRONMENTAL 0x0000 + #define ACPI_ENV_EXCEPTION(Status) (Status & AE_CODE_ENVIRONMENTAL) + +Similarly, ACPI_AML_EXCEPTION(Status) will evaluate to a non-zero +value for error codes of type AE_CODE_PROGRAMMER, AE_CODE_ACPI_TABLES, +as well as AE_CODE_AML, and not just AE_CODE_AML as the name suggests. + +This commit fixes those checks. + +Fixes: d46b6537f0ce ("ACPICA: AML Parser: ignore all exceptions resulting from incorrect AML during table load") +Link: https://github.com/acpica/acpica/commit/1a3a5492 +Signed-off-by: Maximilian Luz +Signed-off-by: Bob Moore +Signed-off-by: Erik Kaneda +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/acpi/acexcep.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h +index 856c56ef01431..878b8e26c6c50 100644 +--- a/include/acpi/acexcep.h ++++ b/include/acpi/acexcep.h +@@ -59,11 +59,11 @@ struct acpi_exception_info { + + #define AE_OK (acpi_status) 0x0000 + +-#define ACPI_ENV_EXCEPTION(status) (status & AE_CODE_ENVIRONMENTAL) +-#define ACPI_AML_EXCEPTION(status) (status & AE_CODE_AML) +-#define ACPI_PROG_EXCEPTION(status) (status & AE_CODE_PROGRAMMER) +-#define ACPI_TABLE_EXCEPTION(status) (status & AE_CODE_ACPI_TABLES) +-#define ACPI_CNTL_EXCEPTION(status) (status & AE_CODE_CONTROL) ++#define ACPI_ENV_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ENVIRONMENTAL) ++#define ACPI_AML_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_AML) ++#define ACPI_PROG_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_PROGRAMMER) ++#define ACPI_TABLE_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ACPI_TABLES) ++#define ACPI_CNTL_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_CONTROL) + + /* + * Environmental exceptions +-- +2.27.0 + diff --git a/queue-4.19/amba-fix-resource-leak-for-drivers-without-.remove.patch b/queue-4.19/amba-fix-resource-leak-for-drivers-without-.remove.patch new file mode 100644 index 00000000000..00904d2f1bc --- /dev/null +++ b/queue-4.19/amba-fix-resource-leak-for-drivers-without-.remove.patch @@ -0,0 +1,83 @@ +From 3b97ab13e6aa9ab334573e6cd724390719caea96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 17:58:31 +0100 +Subject: amba: Fix resource leak for drivers without .remove +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit de5d7adb89367bbc87b4e5ce7afe7ae9bd86dc12 ] + +Consider an amba driver with a .probe but without a .remove callback (e.g. +pl061_gpio_driver). The function amba_probe() is called to bind a device +and so dev_pm_domain_attach() and others are called. As there is no remove +callback amba_remove() isn't called at unbind time however and so calling +dev_pm_domain_detach() is missed and the pm domain keeps active. + +To fix this always use the core driver callbacks and handle missing amba +callbacks there. For probe refuse registration as a driver without probe +doesn't make sense. + +Fixes: 7cfe249475fd ("ARM: AMBA: Add pclk support to AMBA bus infrastructure") +Reviewed-by: Ulf Hansson +Reviewed-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210126165835.687514-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/amba/bus.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index 41b706403ef72..2380ebd9b7fda 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -284,10 +284,11 @@ static int amba_remove(struct device *dev) + { + struct amba_device *pcdev = to_amba_device(dev); + struct amba_driver *drv = to_amba_driver(dev->driver); +- int ret; ++ int ret = 0; + + pm_runtime_get_sync(dev); +- ret = drv->remove(pcdev); ++ if (drv->remove) ++ ret = drv->remove(pcdev); + pm_runtime_put_noidle(dev); + + /* Undo the runtime PM settings in amba_probe() */ +@@ -304,7 +305,9 @@ static int amba_remove(struct device *dev) + static void amba_shutdown(struct device *dev) + { + struct amba_driver *drv = to_amba_driver(dev->driver); +- drv->shutdown(to_amba_device(dev)); ++ ++ if (drv->shutdown) ++ drv->shutdown(to_amba_device(dev)); + } + + /** +@@ -317,12 +320,13 @@ static void amba_shutdown(struct device *dev) + */ + int amba_driver_register(struct amba_driver *drv) + { +- drv->drv.bus = &amba_bustype; ++ if (!drv->probe) ++ return -EINVAL; + +-#define SETFN(fn) if (drv->fn) drv->drv.fn = amba_##fn +- SETFN(probe); +- SETFN(remove); +- SETFN(shutdown); ++ drv->drv.bus = &amba_bustype; ++ drv->drv.probe = amba_probe; ++ drv->drv.remove = amba_remove; ++ drv->drv.shutdown = amba_shutdown; + + return driver_register(&drv->drv); + } +-- +2.27.0 + diff --git a/queue-4.19/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch b/queue-4.19/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch new file mode 100644 index 00000000000..c36416e494a --- /dev/null +++ b/queue-4.19/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch @@ -0,0 +1,75 @@ +From 88a37adbd3424ba62aa39d4c178ac3fe7b1a6771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 10:47:24 +0100 +Subject: ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores + +From: Vladimir Murzin + +[ Upstream commit 2acb909750431030b65a0a2a17fd8afcbd813a84 ] + +It was observed that decompressor running on hardware implementing ARM v8.2 +Load/Store Multiple Atomicity and Ordering Control (LSMAOC), say, as guest, +would stuck just after: + +Uncompressing Linux... done, booting the kernel. + +The reason is that it clears nTLSMD bit when disabling caches: + + nTLSMD, bit [3] + + When ARMv8.2-LSMAOC is implemented: + + No Trap Load Multiple and Store Multiple to + Device-nGRE/Device-nGnRE/Device-nGnRnE memory. + + 0b0 All memory accesses by A32 and T32 Load Multiple and Store + Multiple at EL1 or EL0 that are marked at stage 1 as + Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and + generate a stage 1 Alignment fault. + + 0b1 All memory accesses by A32 and T32 Load Multiple and Store + Multiple at EL1 or EL0 that are marked at stage 1 as + Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped. + + This bit is permitted to be cached in a TLB. + + This field resets to 1. + + Otherwise: + + Reserved, RES1 + +So as effect we start getting traps we are not quite ready for. + +Looking into history it seems that mask used for SCTLR clear came from +the similar code for ARMv4, where bit[3] is the enable/disable bit for +the write buffer. That not applicable to ARMv7 and onwards, so retire +that bit from the masks. + +Fixes: 7d09e85448dfa78e3e58186c934449aaf6d49b50 ("[ARM] 4393/2: ARMv7: Add uncompressing code for the new CPU Id format") +Signed-off-by: Vladimir Murzin +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/head.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index e205bbbe27949..69e661f574a07 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -1090,9 +1090,9 @@ __armv4_mmu_cache_off: + __armv7_mmu_cache_off: + mrc p15, 0, r0, c1, c0 + #ifdef CONFIG_MMU +- bic r0, r0, #0x000d ++ bic r0, r0, #0x0005 + #else +- bic r0, r0, #0x000c ++ bic r0, r0, #0x0004 + #endif + mcr p15, 0, r0, c1, c0 @ turn MMU and cache off + mov r12, lr +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch b/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch new file mode 100644 index 00000000000..04d4ca6af82 --- /dev/null +++ b/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch @@ -0,0 +1,59 @@ +From b125ff78b63bfaadf54f3f3cf7a003fdb1d32978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 18:23:21 -0800 +Subject: ARM: dts: armada388-helios4: assign pinctrl to each fan + +From: Rosen Penev + +[ Upstream commit 46ecdfc1830eaa40a11d7f832089c82b0e67ea96 ] + +Split up the pins for each fan. This is needed in order to control them + +Fixes: ced8025b569e ("ARM: dts: armada388-helios4") + +Signed-off-by: Rosen Penev +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-388-helios4.dts | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts +index e0fa1391948c1..a94758090fb0d 100644 +--- a/arch/arm/boot/dts/armada-388-helios4.dts ++++ b/arch/arm/boot/dts/armada-388-helios4.dts +@@ -127,11 +127,15 @@ + fan1: j10-pwm { + compatible = "pwm-fan"; + pwms = <&gpio1 9 40000>; /* Target freq:25 kHz */ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&helios_fan1_pins>; + }; + + fan2: j17-pwm { + compatible = "pwm-fan"; + pwms = <&gpio1 23 40000>; /* Target freq:25 kHz */ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&helios_fan2_pins>; + }; + + usb2_phy: usb2-phy { +@@ -307,9 +311,12 @@ + "mpp54"; + marvell,function = "gpio"; + }; +- helios_fan_pins: helios-fan-pins { +- marvell,pins = "mpp41", "mpp43", +- "mpp48", "mpp55"; ++ helios_fan1_pins: helios_fan1_pins { ++ marvell,pins = "mpp41", "mpp43"; ++ marvell,function = "gpio"; ++ }; ++ helios_fan2_pins: helios_fan2_pins { ++ marvell,pins = "mpp48", "mpp55"; + marvell,function = "gpio"; + }; + microsom_spi1_cs_pins: spi1-cs-pins { +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch b/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch new file mode 100644 index 00000000000..7279a47cd02 --- /dev/null +++ b/queue-4.19/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch @@ -0,0 +1,64 @@ +From 7b5362f53b36879716d55d91910288d3a384115f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 18:23:20 -0800 +Subject: ARM: dts: armada388-helios4: assign pinctrl to LEDs + +From: Rosen Penev + +[ Upstream commit e011c9025a4691b5c734029577a920bd6c320994 ] + +Split up the pins to match earlier definitions. Allows LEDs to flash +properly. + +Fixes: ced8025b569e ("ARM: dts: armada388-helios4") + +Signed-off-by: Rosen Penev +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-388-helios4.dts | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts +index 705adfa8c680f..e0fa1391948c1 100644 +--- a/arch/arm/boot/dts/armada-388-helios4.dts ++++ b/arch/arm/boot/dts/armada-388-helios4.dts +@@ -70,6 +70,9 @@ + + system-leds { + compatible = "gpio-leds"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&helios_system_led_pins>; ++ + status-led { + label = "helios4:green:status"; + gpios = <&gpio0 24 GPIO_ACTIVE_LOW>; +@@ -86,6 +89,9 @@ + + io-leds { + compatible = "gpio-leds"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&helios_io_led_pins>; ++ + sata1-led { + label = "helios4:green:ata1"; + gpios = <&gpio1 17 GPIO_ACTIVE_LOW>; +@@ -291,9 +297,12 @@ + "mpp39", "mpp40"; + marvell,function = "sd0"; + }; +- helios_led_pins: helios-led-pins { +- marvell,pins = "mpp24", "mpp25", +- "mpp49", "mpp50", ++ helios_system_led_pins: helios-system-led-pins { ++ marvell,pins = "mpp24", "mpp25"; ++ marvell,function = "gpio"; ++ }; ++ helios_io_led_pins: helios-io-led-pins { ++ marvell,pins = "mpp49", "mpp50", + "mpp52", "mpp53", + "mpp54"; + marvell,function = "gpio"; +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-configure-missing-thermal-interrupt-for-4430.patch b/queue-4.19/arm-dts-configure-missing-thermal-interrupt-for-4430.patch new file mode 100644 index 00000000000..5254c77b645 --- /dev/null +++ b/queue-4.19/arm-dts-configure-missing-thermal-interrupt-for-4430.patch @@ -0,0 +1,52 @@ +From 4c055a0342cb8affb9386553e329ec84be7317cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Dec 2020 10:42:30 +0200 +Subject: ARM: dts: Configure missing thermal interrupt for 4430 + +From: Tony Lindgren + +[ Upstream commit 44f416879a442600b006ef7dec3a6dc98bcf59c6 ] + +We have gpio_86 wired internally to the bandgap thermal shutdown +interrupt on 4430 like we have it on 4460 according to the TRM. +This can be found easily by searching for TSHUT. + +For some reason the thermal shutdown interrupt was never added +for 4430, let's add it. I believe this is needed for the thermal +shutdown interrupt handler ti_bandgap_tshut_irq_handler() to call +orderly_poweroff(). + +Fixes: aa9bb4bb8878 ("arm: dts: add omap4430 thermal data") +Cc: Carl Philipp Klemm +Cc: Daniel Lezcano +Cc: Eduardo Valentin +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Peter Ujfalusi +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap443x.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi +index 86b9caf461dfa..6e320efd9fc1d 100644 +--- a/arch/arm/boot/dts/omap443x.dtsi ++++ b/arch/arm/boot/dts/omap443x.dtsi +@@ -33,10 +33,12 @@ + }; + + ocp { ++ /* 4430 has only gpio_86 tshut and no talert interrupt */ + bandgap: bandgap@4a002260 { + reg = <0x4a002260 0x4 + 0x4a00232C 0x4>; + compatible = "ti,omap4430-bandgap"; ++ gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>; + + #thermal-sensor-cells = <0>; + }; +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..600475899d3 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch @@ -0,0 +1,39 @@ +From 3b1107dca784eeb4e3ad7c5bb3e04a086f55cdbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:28:55 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5 + +From: Krzysztof Kozlowski + +[ Upstream commit cb31334687db31c691901269d65074a7ffaecb18 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: b004a34bd0ff ("ARM: dts: exynos: Add exynos3250-artik5 dtsi file for ARTIK5 module") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20201210212903.216728-1-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi +index 7c22cbf6f3d41..6e30db644c83a 100644 +--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi ++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi +@@ -68,7 +68,7 @@ + s2mps14_pmic@66 { + compatible = "samsung,s2mps14-pmic"; + interrupt-parent = <&gpx3>; +- interrupts = <5 IRQ_TYPE_NONE>; ++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&s2mps14_irq>; + reg = <0x66>; +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-2350 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-2350 new file mode 100644 index 00000000000..01091638a41 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-2350 @@ -0,0 +1,39 @@ +From 640ff0b66fd95025bbf049e6a6c585f9cf6eec2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:28:57 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato + +From: Krzysztof Kozlowski + +[ Upstream commit 437ae60947716bb479e2f32466f49445c0509b1e ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: faaf348ef468 ("ARM: dts: Add board dts file for exynos3250-rinato") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20201210212903.216728-3-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts +index 2a6b828c01b7c..29df4cfa9165f 100644 +--- a/arch/arm/boot/dts/exynos3250-rinato.dts ++++ b/arch/arm/boot/dts/exynos3250-rinato.dts +@@ -253,7 +253,7 @@ + s2mps14_pmic@66 { + compatible = "samsung,s2mps14-pmic"; + interrupt-parent = <&gpx0>; +- interrupts = <7 IRQ_TYPE_NONE>; ++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; + reg = <0x66>; + wakeup-source; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-24277 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-24277 new file mode 100644 index 00000000000..45e09f7a9ba --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-24277 @@ -0,0 +1,38 @@ +From 37d9dbd53b7c1156f7bfe4723fa8c6fdc10daeb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:28:58 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Spring + +From: Krzysztof Kozlowski + +[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-spring.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts +index 3d501926c2278..2355c53164840 100644 +--- a/arch/arm/boot/dts/exynos5250-spring.dts ++++ b/arch/arm/boot/dts/exynos5250-spring.dts +@@ -108,7 +108,7 @@ + compatible = "samsung,s5m8767-pmic"; + reg = <0x66>; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>; + wakeup-source; +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-32152 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-32152 new file mode 100644 index 00000000000..1a1c02197b5 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-32152 @@ -0,0 +1,39 @@ +From 8b912546aee429144b32c560d676942e3eecb392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:28:59 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale + Octa + +From: Krzysztof Kozlowski + +[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts +index a370857beac0d..fbaca74cbaea4 100644 +--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts ++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts +@@ -84,7 +84,7 @@ + reg = <0x66>; + + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&s2mps11_irq>; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-5218 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-5218 new file mode 100644 index 00000000000..35d6aa19537 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-5218 @@ -0,0 +1,39 @@ +From 27b2383d003fbeb5d166960d9d67251b1f5dc8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:29:00 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 + family + +From: Krzysztof Kozlowski + +[ Upstream commit 3e7d9a583a24f7582c6bc29a0d4d624feedbc2f9 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: aac4e0615341 ("ARM: dts: odroidxu3: Enable wake alarm of S2MPS11 RTC") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20201210212903.216728-6-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +index d476ba0f07b6b..ba7187a74be36 100644 +--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +@@ -136,7 +136,7 @@ + samsung,s2mps11-acokb-ground; + + interrupt-parent = <&gpx0>; +- interrupts = <4 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <4 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&s2mps11_irq>; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6430 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6430 new file mode 100644 index 00000000000..4aa31f43c79 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6430 @@ -0,0 +1,38 @@ +From a689a566d325caa5eba3764bf65390dfa3f0a9e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:28:56 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Monk + +From: Krzysztof Kozlowski + +[ Upstream commit 8528cda2b7c667e9cd173aef1a677c71b7d5a096 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: e0cefb3f79d3 ("ARM: dts: add board dts file for Exynos3250-based Monk board") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212903.216728-2-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250-monk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts +index 6ffedf4ed9f2b..d343dc13ceecd 100644 +--- a/arch/arm/boot/dts/exynos3250-monk.dts ++++ b/arch/arm/boot/dts/exynos3250-monk.dts +@@ -188,7 +188,7 @@ + s2mps14_pmic@66 { + compatible = "samsung,s2mps14-pmic"; + interrupt-parent = <&gpx0>; +- interrupts = <7 IRQ_TYPE_NONE>; ++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; + reg = <0x66>; + wakeup-source; + +-- +2.27.0 + diff --git a/queue-4.19/arm-s3c-fix-fiq-for-clang-ias.patch b/queue-4.19/arm-s3c-fix-fiq-for-clang-ias.patch new file mode 100644 index 00000000000..d38276e0d8c --- /dev/null +++ b/queue-4.19/arm-s3c-fix-fiq-for-clang-ias.patch @@ -0,0 +1,93 @@ +From e03827ff1ea149cc0bd87f1cd2567659bd60152c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 17:23:42 +0100 +Subject: ARM: s3c: fix fiq for clang IAS + +From: Arnd Bergmann + +[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ] + +Building with the clang integrated assembler produces a couple of +errors for the s3c24xx fiq support: + + arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified + subnes pc, lr, #4 @@ return, still have work to do + + arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition + s3c24xx_spi_fiq_txrx: + +There are apparently two problems: one with extraneous or duplicate +labels, and one with old-style opcode mnemonics. Stefan Agner has +previously fixed other problems like this, but missed this particular +file. + +Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support") +Cc: Stefan Agner +Signed-off-by: Arnd Bergmann +Reviewed-by: Nick Desaulniers +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c24xx-fiq.S | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-s3c24xx-fiq.S b/drivers/spi/spi-s3c24xx-fiq.S +index 059f2dc1fda2d..1565c792da079 100644 +--- a/drivers/spi/spi-s3c24xx-fiq.S ++++ b/drivers/spi/spi-s3c24xx-fiq.S +@@ -36,7 +36,6 @@ + @ and an offset to the irq acknowledgment word + + ENTRY(s3c24xx_spi_fiq_rx) +-s3c24xx_spi_fix_rx: + .word fiq_rx_end - fiq_rx_start + .word fiq_rx_irq_ack - fiq_rx_start + fiq_rx_start: +@@ -50,7 +49,7 @@ fiq_rx_start: + strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ] + + subs fiq_rcount, fiq_rcount, #1 +- subnes pc, lr, #4 @@ return, still have work to do ++ subsne pc, lr, #4 @@ return, still have work to do + + @@ set IRQ controller so that next op will trigger IRQ + mov fiq_rtmp, #0 +@@ -62,7 +61,6 @@ fiq_rx_irq_ack: + fiq_rx_end: + + ENTRY(s3c24xx_spi_fiq_txrx) +-s3c24xx_spi_fiq_txrx: + .word fiq_txrx_end - fiq_txrx_start + .word fiq_txrx_irq_ack - fiq_txrx_start + fiq_txrx_start: +@@ -77,7 +75,7 @@ fiq_txrx_start: + strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ] + + subs fiq_rcount, fiq_rcount, #1 +- subnes pc, lr, #4 @@ return, still have work to do ++ subsne pc, lr, #4 @@ return, still have work to do + + mov fiq_rtmp, #0 + str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ] +@@ -89,7 +87,6 @@ fiq_txrx_irq_ack: + fiq_txrx_end: + + ENTRY(s3c24xx_spi_fiq_tx) +-s3c24xx_spi_fix_tx: + .word fiq_tx_end - fiq_tx_start + .word fiq_tx_irq_ack - fiq_tx_start + fiq_tx_start: +@@ -102,7 +99,7 @@ fiq_tx_start: + strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ] + + subs fiq_rcount, fiq_rcount, #1 +- subnes pc, lr, #4 @@ return, still have work to do ++ subsne pc, lr, #4 @@ return, still have work to do + + mov fiq_rtmp, #0 + str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ] +-- +2.27.0 + diff --git a/queue-4.19/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch b/queue-4.19/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch new file mode 100644 index 00000000000..ffe5169f51e --- /dev/null +++ b/queue-4.19/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch @@ -0,0 +1,49 @@ +From 93a1e653c79a676bd45da875c069a8d3b2791f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 09:37:37 +0000 +Subject: arm64: Add missing ISB after invalidating TLB in __primary_switch + +From: Marc Zyngier + +[ Upstream commit 9d41053e8dc115c92b8002c3db5f545d7602498b ] + +Although there has been a bit of back and forth on the subject, it +appears that invalidating TLBs requires an ISB instruction when FEAT_ETS +is not implemented by the CPU. + +From the bible: + + | In an implementation that does not implement FEAT_ETS, a TLB + | maintenance instruction executed by a PE, PEx, can complete at any + | time after it is issued, but is only guaranteed to be finished for a + | PE, PEx, after the execution of DSB by the PEx followed by a Context + | synchronization event + +Add the missing ISB in __primary_switch, just in case. + +Fixes: 3c5e9f238bc4 ("arm64: head.S: move KASLR processing out of __enable_mmu()") +Suggested-by: Will Deacon +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Link: https://lore.kernel.org/r/20210224093738.3629662-3-maz@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/head.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S +index d22ab8d9edc95..c85ea70b92936 100644 +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -867,6 +867,7 @@ __primary_switch: + + tlbi vmalle1 // Remove any stale TLB entries + dsb nsh ++ isb + + msr sctlr_el1, x19 // re-enable the MMU + isb +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch b/queue-4.19/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch new file mode 100644 index 00000000000..fff42b19b3f --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch @@ -0,0 +1,61 @@ +From 9ed2aff9e05db68648223dd92c1a5ca34ecb59fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 15:26:28 +0000 +Subject: arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz + +From: Andre Przywara + +[ Upstream commit 948c657cc45e8ce48cb533d4e2106145fa765759 ] + +In contrast to the H6 (and later) manuals, the A64 datasheet does not +specify any limitations in the maximum possible frequency for eMMC +controllers. +However experimentation has found that a 150 MHz limit similar to other +SoCs and also the MMC0 and MMC1 controllers on the A64 seems to exist +for the MMC2 controller. + +Limit the frequency for the MMC2 controller to 150 MHz in the SoC .dtsi. +The Pinebook seems to be the an odd exception, since it apparently seems +to work with 200 MHz as well, so overwrite this in its board .dts file. + +Tested on a Pine64-LTS: 200 MHz HS-200 fails, 150 MHz HS-200 works. + +Fixes: 22be992faea7 ("arm64: allwinner: a64: Increase the MMC max frequency") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210113152630.28810-7-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 1 + + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +index b2f0729d92d2c..ecb3e10c85e07 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +@@ -105,6 +105,7 @@ + pinctrl-0 = <&mmc2_pins>; + vmmc-supply = <®_dcdc1>; + vqmmc-supply = <®_eldo1>; ++ max-frequency = <200000000>; + bus-width = <8>; + non-removable; + cap-mmc-hw-reset; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index 47949f14c49f4..30cc2e83a288e 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -264,7 +264,7 @@ + resets = <&ccu RST_BUS_MMC2>; + reset-names = "ahb"; + interrupts = ; +- max-frequency = <200000000>; ++ max-frequency = <150000000>; + status = "disabled"; + #address-cells = <1>; + #size-cells = <0>; +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch b/queue-4.19/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch new file mode 100644 index 00000000000..858fc9ef11f --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch @@ -0,0 +1,84 @@ +From 1254ac3a33ec5b6e0158c93ea9b62017e99afb8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 15:26:23 +0000 +Subject: arm64: dts: allwinner: A64: properly connect USB PHY to port 0 + +From: Andre Przywara + +[ Upstream commit cc72570747e43335f4933a24dd74d5653639176a ] + +In recent Allwinner SoCs the first USB host controller (HCI0) shares +the first PHY with the MUSB controller. Probably to make this sharing +work, we were avoiding to declare this in the DT. This has two +shortcomings: +- U-Boot (which uses the same .dts) cannot use this port in host mode + without a PHY linked, so we were loosing one USB port there. +- It requires the MUSB driver to be enabled and loaded, although we + don't actually use it. + +To avoid those issues, let's add this PHY link to the A64 .dtsi file. +After all PHY port 0 *is* connected to HCI0, so we should describe +it as this. Remove the part from the Pinebook DTS which already had +this property. + +This makes it work in U-Boot, also improves compatiblity when no MUSB +driver is loaded (for instance in distribution installers). + +Fixes: dc03a047df1d ("arm64: allwinner: a64: add EHCI0/OHCI0 nodes to A64 DTSI") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210113152630.28810-2-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 4 ---- + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 4 ++++ + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +index 897e60cbe38d1..b2f0729d92d2c 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +@@ -67,8 +67,6 @@ + }; + + &ehci0 { +- phys = <&usbphy 0>; +- phy-names = "usb"; + status = "okay"; + }; + +@@ -115,8 +113,6 @@ + }; + + &ohci0 { +- phys = <&usbphy 0>; +- phy-names = "usb"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index 7abc4ea305410..47949f14c49f4 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -312,6 +312,8 @@ + <&ccu CLK_USB_OHCI0>; + resets = <&ccu RST_BUS_OHCI0>, + <&ccu RST_BUS_EHCI0>; ++ phys = <&usbphy 0>; ++ phy-names = "usb"; + status = "disabled"; + }; + +@@ -322,6 +324,8 @@ + clocks = <&ccu CLK_BUS_OHCI0>, + <&ccu CLK_USB_OHCI0>; + resets = <&ccu RST_BUS_OHCI0>; ++ phys = <&usbphy 0>; ++ phy-names = "usb"; + status = "disabled"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch b/queue-4.19/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch new file mode 100644 index 00000000000..e0c0a032a2f --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch @@ -0,0 +1,46 @@ +From 74c963b6237e0c35bd46d06a63cb3b75543a5b18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 15:26:26 +0000 +Subject: arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card + +From: Andre Przywara + +[ Upstream commit 941432d007689f3774646e41a1439228b6c6ee0e ] + +The SD card on the SoPine SoM module is somewhat concealed, so was +originally defined as "non-removable". +However there is a working card-detect pin (tested on two different +SoM versions), and in certain SoM base boards it might be actually +accessible at runtime. +Also the Pine64-LTS shares the SoPine base .dtsi, so inherited the +non-removable flag, even though the SD card slot is perfectly accessible +and usable there. (It turns out that just *my* board has a broken card +detect switch, so I originally thought CD wouldn't work on the LTS.) + +Drop the "non-removable" flag to describe the SD card slot properly. + +Fixes: c3904a269891 ("arm64: allwinner: a64: add DTSI file for SoPine SoM") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210113152630.28810-5-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi +index 6723b8695e0bb..ca39084fddc0b 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi +@@ -51,7 +51,6 @@ + pinctrl-names = "default"; + pinctrl-0 = <&mmc0_pins>; + vmmc-supply = <®_dcdc1>; +- non-removable; + disable-wp; + bus-width = <4>; + cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */ +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch b/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch new file mode 100644 index 00000000000..6e520509117 --- /dev/null +++ b/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch @@ -0,0 +1,39 @@ +From e42a8b18351edc34830e94cb556d6de638335271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:29:01 +0100 +Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 + +From: Krzysztof Kozlowski + +[ Upstream commit e98e2367dfb4b6d7a80c8ce795c644124eff5f36 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: 01e5d2352152 ("arm64: dts: exynos: Add dts file for Exynos5433-based TM2 board") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20201210212903.216728-7-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi +index a1e3194b74837..d64f97d97c350 100644 +--- a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi +@@ -378,7 +378,7 @@ + s2mps13-pmic@66 { + compatible = "samsung,s2mps13-pmic"; + interrupt-parent = <&gpa0>; +- interrupts = <7 IRQ_TYPE_NONE>; ++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; + reg = <0x66>; + samsung,s2mps11-wrstbi-ground; + +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-23093 b/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-23093 new file mode 100644 index 00000000000..f7ae0e73e61 --- /dev/null +++ b/queue-4.19/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-23093 @@ -0,0 +1,38 @@ +From 6def12e05182cb441cc82d59a75962ed3b95d1ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:29:02 +0100 +Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso + +From: Krzysztof Kozlowski + +[ Upstream commit 1fea2eb2f5bbd3fbbe2513d2386b5f6e6db17fd7 ] + +The Samsung PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Fixes: 9589f7721e16 ("arm64: dts: Add S2MPS15 PMIC node on exynos7-espresso") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212903.216728-8-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +index d991eae5202f2..2ba62118ae906 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts ++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts +@@ -85,7 +85,7 @@ + s2mps15_pmic@66 { + compatible = "samsung,s2mps15-pmic"; + reg = <0x66>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&gpa0>; + pinctrl-names = "default"; + pinctrl-0 = <&pmic_irq>; +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch b/queue-4.19/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch new file mode 100644 index 00000000000..3bcc5280ac9 --- /dev/null +++ b/queue-4.19/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch @@ -0,0 +1,46 @@ +From c79a66763e434ada2748bde3b421ca40fc31a689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Jan 2021 11:44:16 +0100 +Subject: arm64: dts: msm8916: Fix reserved and rfsa nodes unit address + +From: Vincent Knecht + +[ Upstream commit d5ae2528b0b56cf054b27d48b0cb85330900082f ] + +Fix `reserved` and `rfsa` unit address according to their reg address + +Fixes: 7258e10e6a0b ("ARM: dts: msm8916: Update reserved-memory") + +Signed-off-by: Vincent Knecht +Link: https://lore.kernel.org/r/20210123104417.518105-1-vincent.knecht@mailoo.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 2c5193ae20277..ba42c62399226 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -64,7 +64,7 @@ + no-map; + }; + +- reserved@8668000 { ++ reserved@86680000 { + reg = <0x0 0x86680000 0x0 0x80000>; + no-map; + }; +@@ -77,7 +77,7 @@ + qcom,client-id = <1>; + }; + +- rfsa@867e00000 { ++ rfsa@867e0000 { + reg = <0x0 0x867e0000 0x0 0x20000>; + no-map; + }; +-- +2.27.0 + diff --git a/queue-4.19/asoc-cpcap-fix-microphone-timeslot-mask.patch b/queue-4.19/asoc-cpcap-fix-microphone-timeslot-mask.patch new file mode 100644 index 00000000000..2c5ed278655 --- /dev/null +++ b/queue-4.19/asoc-cpcap-fix-microphone-timeslot-mask.patch @@ -0,0 +1,65 @@ +From 91d026631d7fde744760a698395c5566b9b504db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Jan 2021 18:29:45 +0100 +Subject: ASoC: cpcap: fix microphone timeslot mask + +From: Sebastian Reichel + +[ Upstream commit de5bfae2fd962a9da99f56382305ec7966a604b9 ] + +The correct mask is 0x1f8 (Bit 3-8), but due to missing BIT() 0xf (Bit +0-3) was set instead. This means setting of CPCAP_BIT_MIC1_RX_TIMESLOT0 +(Bit 3) still worked (part of both masks). On the other hand the code +does not properly clear the other MIC timeslot bits. I think this +is not a problem, since they are probably initialized to 0 and not +touched by the driver anywhere else. But the mask also contains some +wrong bits, that will be cleared. Bit 0 (CPCAP_BIT_SMB_CDC) should be +safe, since the driver enforces it to be 0 anyways. + +Bit 1-2 are CPCAP_BIT_FS_INV and CPCAP_BIT_CLK_INV. This means enabling +audio recording forces the codec into SND_SOC_DAIFMT_NB_NF mode, which +is obviously bad. + +The bug probably remained undetected, because there are not many use +cases for routing microphone to the CPU on platforms using cpcap and +user base is small. I do remember having some issues with bad sound +quality when testing voice recording back when I wrote the driver. +It probably was this bug. + +Fixes: f6cdf2d3445d ("ASoC: cpcap: new codec") +Reported-by: Dan Carpenter +Signed-off-by: Sebastian Reichel +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210123172945.3958622-1-sre@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cpcap.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c +index d7f05b384f1fb..1902689c5ea2c 100644 +--- a/sound/soc/codecs/cpcap.c ++++ b/sound/soc/codecs/cpcap.c +@@ -1263,12 +1263,12 @@ static int cpcap_voice_hw_params(struct snd_pcm_substream *substream, + + if (direction == SNDRV_PCM_STREAM_CAPTURE) { + mask = 0x0000; +- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT0; +- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT1; +- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT2; +- mask |= CPCAP_BIT_MIC2_TIMESLOT0; +- mask |= CPCAP_BIT_MIC2_TIMESLOT1; +- mask |= CPCAP_BIT_MIC2_TIMESLOT2; ++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0); ++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT1); ++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT2); ++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT0); ++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT1); ++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT2); + val = 0x0000; + if (channels >= 2) + val = BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0); +-- +2.27.0 + diff --git a/queue-4.19/asoc-cs42l56-fix-up-error-handling-in-probe.patch b/queue-4.19/asoc-cs42l56-fix-up-error-handling-in-probe.patch new file mode 100644 index 00000000000..d2846db17e9 --- /dev/null +++ b/queue-4.19/asoc-cs42l56-fix-up-error-handling-in-probe.patch @@ -0,0 +1,46 @@ +From 1be1d6a2a2ab3d519ffe17ae4b8a4cc9a50bbceb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 13:07:59 +0300 +Subject: ASoC: cs42l56: fix up error handling in probe + +From: Dan Carpenter + +[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ] + +There are two issues with this code. The first error path forgot to set +the error code and instead returns success. The second error path +doesn't clean up. + +Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l56.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c +index a5c8736fad777..04f89b751304c 100644 +--- a/sound/soc/codecs/cs42l56.c ++++ b/sound/soc/codecs/cs42l56.c +@@ -1260,6 +1260,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client, + dev_err(&i2c_client->dev, + "CS42L56 Device ID (%X). Expected %X\n", + devid, CS42L56_DEVID); ++ ret = -EINVAL; + goto err_enable; + } + alpha_rev = reg & CS42L56_AREV_MASK; +@@ -1317,7 +1318,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client, + ret = devm_snd_soc_register_component(&i2c_client->dev, + &soc_component_dev_cs42l56, &cs42l56_dai, 1); + if (ret < 0) +- return ret; ++ goto err_enable; + + return 0; + +-- +2.27.0 + diff --git a/queue-4.19/ata-ahci_brcm-add-back-regulators-management.patch b/queue-4.19/ata-ahci_brcm-add-back-regulators-management.patch new file mode 100644 index 00000000000..a9397c4e160 --- /dev/null +++ b/queue-4.19/ata-ahci_brcm-add-back-regulators-management.patch @@ -0,0 +1,79 @@ +From 3b4492f8bfbd2c4bea5ab301551a56bab5c2753b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 10:28:45 -0800 +Subject: ata: ahci_brcm: Add back regulators management + +From: Florian Fainelli + +[ Upstream commit 10340f8d7b6dd54e616339c8ccb2f397133ebea0 ] + +While reworking the resources management and departing from using +ahci_platform_enable_resources() which did not allow a proper step +separation like we need, we unfortunately lost the ability to control +AHCI regulators. This broke some Broadcom STB systems that do expect +regulators to be turned on to link up with attached hard drives. + +Fixes: c0cdf2ac4b5b ("ata: ahci_brcm: Fix AHCI resources management") +Signed-off-by: Florian Fainelli +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci_brcm.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c +index 0192cab1b862f..e58b336d1324c 100644 +--- a/drivers/ata/ahci_brcm.c ++++ b/drivers/ata/ahci_brcm.c +@@ -370,6 +370,10 @@ static int brcm_ahci_resume(struct device *dev) + if (ret) + return ret; + ++ ret = ahci_platform_enable_regulators(hpriv); ++ if (ret) ++ goto out_disable_clks; ++ + brcm_sata_init(priv); + brcm_sata_phys_enable(priv); + brcm_sata_alpm_init(hpriv); +@@ -399,6 +403,8 @@ out_disable_platform_phys: + ahci_platform_disable_phys(hpriv); + out_disable_phys: + brcm_sata_phys_disable(priv); ++ ahci_platform_disable_regulators(hpriv); ++out_disable_clks: + ahci_platform_disable_clks(hpriv); + return ret; + } +@@ -471,6 +477,10 @@ static int brcm_ahci_probe(struct platform_device *pdev) + if (ret) + goto out_reset; + ++ ret = ahci_platform_enable_regulators(hpriv); ++ if (ret) ++ goto out_disable_clks; ++ + /* Must be first so as to configure endianness including that + * of the standard AHCI register space. + */ +@@ -480,7 +490,7 @@ static int brcm_ahci_probe(struct platform_device *pdev) + priv->port_mask = brcm_ahci_get_portmask(hpriv, priv); + if (!priv->port_mask) { + ret = -ENODEV; +- goto out_disable_clks; ++ goto out_disable_regulators; + } + + /* Must be done before ahci_platform_enable_phys() */ +@@ -505,6 +515,8 @@ out_disable_platform_phys: + ahci_platform_disable_phys(hpriv); + out_disable_phys: + brcm_sata_phys_disable(priv); ++out_disable_regulators: ++ ahci_platform_disable_regulators(hpriv); + out_disable_clks: + ahci_platform_disable_clks(hpriv); + out_reset: +-- +2.27.0 + diff --git a/queue-4.19/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch b/queue-4.19/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch new file mode 100644 index 00000000000..509cc79fd4e --- /dev/null +++ b/queue-4.19/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch @@ -0,0 +1,51 @@ +From 68041cd8c4cb9eef96934b9f3fa58d54ab2c7c24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 00:30:10 +0530 +Subject: ath10k: Fix error handling in case of CE pipe init failure + +From: Rakesh Pillai + +[ Upstream commit 31561e8557cd1eeba5806ac9ce820f8323b2201b ] + +Currently if the copy engine pipe init fails for snoc based +chipsets, the rri is not freed. + +Fix this error handling for copy engine pipe init +failure. + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1 + +Fixes: 4945af5b264f ("ath10k: enable SRRI/DRRI support on ddr for WCN3990") +Signed-off-by: Rakesh Pillai +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1607713210-18320-1-git-send-email-pillair@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/snoc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index e2d78f77edb70..241e6f0e1dfe2 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -789,13 +789,14 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar) + ret = ath10k_snoc_init_pipes(ar); + if (ret) { + ath10k_err(ar, "failed to initialize CE: %d\n", ret); +- goto err_wlan_enable; ++ goto err_free_rri; + } + + napi_enable(&ar->napi); + return 0; + +-err_wlan_enable: ++err_free_rri: ++ ath10k_ce_free_rri(ar); + ath10k_snoc_wlan_disable(ar); + + return ret; +-- +2.27.0 + diff --git a/queue-4.19/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch b/queue-4.19/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch new file mode 100644 index 00000000000..1752179f9f8 --- /dev/null +++ b/queue-4.19/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch @@ -0,0 +1,96 @@ +From 65c60dc9bf467220981156689a3eadb2587fb443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 09:53:44 +0200 +Subject: ath9k: fix data bus crash when setting nf_override via debugfs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +[ Upstream commit 12c8f3d1cdd84f01ee777b756db9dddc1f1c9d17 ] + +When trying to set the noise floor via debugfs, a "data bus error" +crash like the following can happen: + +[ 88.433133] Data bus error, epc == 80221c28, ra == 83314e60 +[ 88.438895] Oops[#1]: +[ 88.441246] CPU: 0 PID: 7263 Comm: sh Not tainted 4.14.195 #0 +[ 88.447174] task: 838a1c20 task.stack: 82d5e000 +[ 88.451847] $ 0 : 00000000 00000030 deadc0de 83141de4 +[ 88.457248] $ 4 : b810a2c4 0000a2c4 83230fd4 00000000 +[ 88.462652] $ 8 : 0000000a 00000000 00000001 00000000 +[ 88.468055] $12 : 7f8ef318 00000000 00000000 77f802a0 +[ 88.473457] $16 : 83230080 00000002 0000001b 83230080 +[ 88.478861] $20 : 83a1c3f8 00841000 77f7adb0 ffffff92 +[ 88.484263] $24 : 00000fa4 77edd860 +[ 88.489665] $28 : 82d5e000 82d5fda8 00000000 83314e60 +[ 88.495070] Hi : 00000000 +[ 88.498044] Lo : 00000000 +[ 88.501040] epc : 80221c28 ioread32+0x8/0x10 +[ 88.505671] ra : 83314e60 ath9k_hw_loadnf+0x88/0x520 [ath9k_hw] +[ 88.512049] Status: 1000fc03 KERNEL EXL IE +[ 88.516369] Cause : 5080801c (ExcCode 07) +[ 88.520508] PrId : 00019374 (MIPS 24Kc) +[ 88.524556] Modules linked in: ath9k ath9k_common pppoe ppp_async l2tp_ppp cdc_mbim batman_adv ath9k_hw ath sr9700 smsc95xx sierra_net rndis_host qmi_wwan pppox ppp_generic pl2303 nf_conntrack_ipv6 mcs7830 mac80211 kalmia iptable_nat ipt_REJECT ipt_MASQUERADE huawei_cdc_ncm ftdi_sio dm9601 cfg80211 cdc_subset cdc_ncm cdc_ether cdc_eem ax88179_178a asix xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_NETMAP xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CLASSIFY usbserial usbnet usbhid slhc rtl8150 r8152 pegasus nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack +[ 88.597894] libcrc32c kaweth iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hso hid_generic crc_ccitt compat cdc_wdm cdc_acm br_netfilter hid evdev input_core nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_beet ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel xfrm4_mode_tunnel xfrm4_mode_transport xfrm4_mode_beet ipcomp esp4 ah4 tunnel6 tunnel4 tun xfrm_user xfrm_ipcomp af_key xfrm_algo sha256_generic sha1_generic jitterentropy_rng drbg md5 hmac echainiv des_generic deflate zlib_inflate zlib_deflate cbc authenc crypto_acompress ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic +[ 88.671671] crypto_hash +[ 88.674292] Process sh (pid: 7263, threadinfo=82d5e000, task=838a1c20, tls=77f81efc) +[ 88.682279] Stack : 00008060 00000008 00000200 00000000 00000000 00000000 00000000 00000002 +[ 88.690916] 80500000 83230080 82d5fe22 00841000 77f7adb0 00000000 00000000 83156858 +[ 88.699553] 00000000 8352fa00 83ad62b0 835302a8 00000000 300a00f8 00000003 82d5fe38 +[ 88.708190] 82d5fef4 00000001 77f54dc4 77f80000 77f7adb0 c79fe901 00000000 00000000 +[ 88.716828] 80510000 00000002 00841000 77f54dc4 77f80000 801ce4cc 0000000b 41824292 +[ 88.725465] ... +[ 88.727994] Call Trace: +[ 88.730532] [<80221c28>] ioread32+0x8/0x10 +[ 88.734765] Code: 00000000 8c820000 0000000f <03e00008> 00000000 08088708 00000000 aca40000 03e00008 +[ 88.744846] +[ 88.746464] ---[ end trace db226b2de1b69b9e ]--- +[ 88.753477] Kernel panic - not syncing: Fatal exception +[ 88.759981] Rebooting in 3 seconds.. + +The "REG_READ(ah, AR_PHY_AGC_CONTROL)" in ath9k_hw_loadnf() does not +like being called when the hardware is asleep, leading to this crash. + +The easiest way to reproduce this is trying to set nf_override while +the hardware is down: + + $ ip link set down dev wlan0 + $ echo "-85" > /sys/kernel/debug/ieee80211/phy0/ath9k/nf_override + +Fixing this crash by waking the hardware up before trying to set the +noise floor. Similar to what other ath9k debugfs files do. + +Tested on a Lima board from 8devices, which has a QCA 4531 chipset. + +Fixes: b90189759a7f ("ath9k: add noise floor override option") +Cc: Simon Wunderlich +Signed-off-by: Linus Lüssing +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210209184352.4272-1-linus.luessing@c0d3.blue +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/debug.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c +index 0a6eb8a8c1ed0..84fe686709496 100644 +--- a/drivers/net/wireless/ath/ath9k/debug.c ++++ b/drivers/net/wireless/ath/ath9k/debug.c +@@ -1236,8 +1236,11 @@ static ssize_t write_file_nf_override(struct file *file, + + ah->nf_override = val; + +- if (ah->curchan) ++ if (ah->curchan) { ++ ath9k_ps_wakeup(sc); + ath9k_hw_loadnf(ah, ah->curchan); ++ ath9k_ps_restore(sc); ++ } + + return count; + } +-- +2.27.0 + diff --git a/queue-4.19/auxdisplay-ht16k33-fix-refresh-rate-handling.patch b/queue-4.19/auxdisplay-ht16k33-fix-refresh-rate-handling.patch new file mode 100644 index 00000000000..43353f56de6 --- /dev/null +++ b/queue-4.19/auxdisplay-ht16k33-fix-refresh-rate-handling.patch @@ -0,0 +1,37 @@ +From 9e968c577ff6601e9c81a03f76658c6d98514b57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jan 2021 16:39:40 +0100 +Subject: auxdisplay: ht16k33: Fix refresh rate handling + +From: Geert Uytterhoeven + +[ Upstream commit e89b0a426721a8ca5971bc8d70aa5ea35c020f90 ] + +Drop the call to msecs_to_jiffies(), as "HZ / fbdev->refresh_rate" is +already the number of jiffies to wait. + +Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + drivers/auxdisplay/ht16k33.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c +index 21393ec3b9a4a..194370ae37dd0 100644 +--- a/drivers/auxdisplay/ht16k33.c ++++ b/drivers/auxdisplay/ht16k33.c +@@ -117,8 +117,7 @@ static void ht16k33_fb_queue(struct ht16k33_priv *priv) + { + struct ht16k33_fbdev *fbdev = &priv->fbdev; + +- schedule_delayed_work(&fbdev->work, +- msecs_to_jiffies(HZ / fbdev->refresh_rate)); ++ schedule_delayed_work(&fbdev->work, HZ / fbdev->refresh_rate); + } + + /* +-- +2.27.0 + diff --git a/queue-4.19/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch b/queue-4.19/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch new file mode 100644 index 00000000000..3c970c3578a --- /dev/null +++ b/queue-4.19/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch @@ -0,0 +1,50 @@ +From 7476df444c395b9ba66a10da9a54b01ac97737ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 12:05:32 +0000 +Subject: b43: N-PHY: Fix the update of coef for the PHY revision >= 3case + +From: Colin Ian King + +[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ] + +The documentation for the PHY update [1] states: + +Loop 4 times with index i + + If PHY Revision >= 3 + Copy table[i] to coef[i] + Otherwise + Set coef[i] to 0 + +the copy of the table to coef is currently implemented the wrong way +around, table is being updated from uninitialized values in coeff. +Fix this by swapping the assignment around. + +[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/ + +Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration") +Addresses-Coverity: ("Uninitialized scalar variable") +Signed-off-by: Colin Ian King +Acked-by: Larry Finger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index 44ab080d65182..88446258e7751 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -5320,7 +5320,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev) + + for (i = 0; i < 4; i++) { + if (dev->phy.rev >= 3) +- table[i] = coef[i]; ++ coef[i] = table[i]; + else + coef[i] = 0; + } +-- +2.27.0 + diff --git a/queue-4.19/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch b/queue-4.19/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch new file mode 100644 index 00000000000..e3566e3772c --- /dev/null +++ b/queue-4.19/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch @@ -0,0 +1,83 @@ +From 86b14b8007294907ec5b5432ebe66dbb10a0f5f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 10:46:58 +0100 +Subject: Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in + the probe function + +From: Christophe JAILLET + +[ Upstream commit 9a39a927be01d89e53f04304ab99a8761e08910d ] + +Some resource should be released in the error handling path of the probe +function, as already done in the remove function. + +The remove function was fixed in commit 5052de8deff5 ("soc: qcom: smd: +Transition client drivers from smd to rpmsg") + +Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btqcomsmd.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c +index 7df3eed1ef5e9..874172aa8e417 100644 +--- a/drivers/bluetooth/btqcomsmd.c ++++ b/drivers/bluetooth/btqcomsmd.c +@@ -166,8 +166,10 @@ static int btqcomsmd_probe(struct platform_device *pdev) + + btq->cmd_channel = qcom_wcnss_open_channel(wcnss, "APPS_RIVA_BT_CMD", + btqcomsmd_cmd_callback, btq); +- if (IS_ERR(btq->cmd_channel)) +- return PTR_ERR(btq->cmd_channel); ++ if (IS_ERR(btq->cmd_channel)) { ++ ret = PTR_ERR(btq->cmd_channel); ++ goto destroy_acl_channel; ++ } + + /* The local-bd-address property is usually injected by the + * bootloader which has access to the allocated BD address. +@@ -179,8 +181,10 @@ static int btqcomsmd_probe(struct platform_device *pdev) + } + + hdev = hci_alloc_dev(); +- if (!hdev) +- return -ENOMEM; ++ if (!hdev) { ++ ret = -ENOMEM; ++ goto destroy_cmd_channel; ++ } + + hci_set_drvdata(hdev, btq); + btq->hdev = hdev; +@@ -194,14 +198,21 @@ static int btqcomsmd_probe(struct platform_device *pdev) + hdev->set_bdaddr = qca_set_bdaddr_rome; + + ret = hci_register_dev(hdev); +- if (ret < 0) { +- hci_free_dev(hdev); +- return ret; +- } ++ if (ret < 0) ++ goto hci_free_dev; + + platform_set_drvdata(pdev, btq); + + return 0; ++ ++hci_free_dev: ++ hci_free_dev(hdev); ++destroy_cmd_channel: ++ rpmsg_destroy_ept(btq->cmd_channel); ++destroy_acl_channel: ++ rpmsg_destroy_ept(btq->acl_channel); ++ ++ return ret; + } + + static int btqcomsmd_remove(struct platform_device *pdev) +-- +2.27.0 + diff --git a/queue-4.19/bluetooth-drop-hci-device-reference-before-return.patch b/queue-4.19/bluetooth-drop-hci-device-reference-before-return.patch new file mode 100644 index 00000000000..ebf4a21fa90 --- /dev/null +++ b/queue-4.19/bluetooth-drop-hci-device-reference-before-return.patch @@ -0,0 +1,35 @@ +From 1608f937ff682eca669dba659c62b744b50fe97e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 23:34:19 -0800 +Subject: Bluetooth: drop HCI device reference before return + +From: Pan Bian + +[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ] + +Call hci_dev_put() to decrement reference count of HCI device hdev if +fails to duplicate memory. + +Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt") +Signed-off-by: Pan Bian +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/a2mp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index 888813342cfc8..e09ea78356c36 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -519,6 +519,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL); + if (!assoc) { + amp_ctrl_put(ctrl); ++ hci_dev_put(hdev); + return -ENOMEM; + } + +-- +2.27.0 + diff --git a/queue-4.19/bluetooth-fix-initializing-response-id-after-clearin.patch b/queue-4.19/bluetooth-fix-initializing-response-id-after-clearin.patch new file mode 100644 index 00000000000..52d3e14759c --- /dev/null +++ b/queue-4.19/bluetooth-fix-initializing-response-id-after-clearin.patch @@ -0,0 +1,39 @@ +From cca00a381af198cc5a9a6e10822142dbaef4bd4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Dec 2020 19:12:32 -0800 +Subject: Bluetooth: Fix initializing response id after clearing struct + +From: Christopher William Snowhill + +[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ] + +Looks like this was missed when patching the source to clear the structures +throughout, causing this one instance to clear the struct after the response +id is assigned. + +Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members") +Signed-off-by: Christopher William Snowhill +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/a2mp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index be9640e9ca006..888813342cfc8 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -388,9 +388,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, + hdev = hci_dev_get(req->id); + if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) { + struct a2mp_amp_assoc_rsp rsp; +- rsp.id = req->id; + + memset(&rsp, 0, sizeof(rsp)); ++ rsp.id = req->id; + + if (tmp) { + rsp.status = A2MP_STATUS_COLLISION_OCCURED; +-- +2.27.0 + diff --git a/queue-4.19/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch b/queue-4.19/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch new file mode 100644 index 00000000000..886de5d4b9b --- /dev/null +++ b/queue-4.19/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch @@ -0,0 +1,40 @@ +From 0b5daa26fd7f650ab2998be58cdff4eef4868cda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 00:10:45 -0800 +Subject: Bluetooth: Put HCI device if inquiry procedure interrupts + +From: Pan Bian + +[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ] + +Jump to the label done to decrement the reference count of HCI device +hdev on path that the Inquiry procedure is interrupted. + +Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage") +Signed-off-by: Pan Bian +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index e03faca84919e..04d6f50798c98 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1316,8 +1316,10 @@ int hci_inquiry(void __user *arg) + * cleared). If it is interrupted by a signal, return -EINTR. + */ + if (wait_on_bit(&hdev->flags, HCI_INQUIRY, +- TASK_INTERRUPTIBLE)) +- return -EINTR; ++ TASK_INTERRUPTIBLE)) { ++ err = -EINTR; ++ goto done; ++ } + } + + /* for unlimited number of responses we will use buffer with +-- +2.27.0 + diff --git a/queue-4.19/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch b/queue-4.19/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch new file mode 100644 index 00000000000..26abbf22238 --- /dev/null +++ b/queue-4.19/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch @@ -0,0 +1,42 @@ +From 2c824b8a60624018eedd4e25a65225c53613d3b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 02:24:23 -0500 +Subject: bnxt_en: reverse order of TX disable and carrier off + +From: Edwin Peer + +[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ] + +A TX queue can potentially immediately timeout after it is stopped +and the last TX timestamp on that queue was more than 5 seconds ago with +carrier still up. Prevent these intermittent false TX timeouts +by bringing down carrier first before calling netif_tx_disable(). + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index db1a23b8d531d..44ed2f6e2d96c 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6298,9 +6298,10 @@ void bnxt_tx_disable(struct bnxt *bp) + txr->dev_state = BNXT_DEV_STATE_CLOSING; + } + } ++ /* Drop carrier first to prevent TX timeout */ ++ netif_carrier_off(bp->dev); + /* Stop all TX queues */ + netif_tx_disable(bp->dev); +- netif_carrier_off(bp->dev); + } + + void bnxt_tx_enable(struct bnxt *bp) +-- +2.27.0 + diff --git a/queue-4.19/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch b/queue-4.19/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch new file mode 100644 index 00000000000..735d5c40842 --- /dev/null +++ b/queue-4.19/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch @@ -0,0 +1,41 @@ +From 1e79fe016672deeef4cdb8446a74a11585eebece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jan 2021 23:55:15 -0800 +Subject: bpf: Avoid warning when re-casting __bpf_call_base into + __bpf_call_base_args + +From: Andrii Nakryiko + +[ Upstream commit 6943c2b05bf09fd5c5729f7d7d803bf3f126cb9a ] + +BPF interpreter uses extra input argument, so re-casts __bpf_call_base into +__bpf_call_base_args. Avoid compiler warning about incompatible function +prototypes by casting to void * first. + +Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter") +Reported-by: kernel test robot +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20210112075520.4103414-3-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/filter.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/filter.h b/include/linux/filter.h +index d61dc72ebb960..117f9380069a8 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -746,7 +746,7 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp); + u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); + #define __bpf_call_base_args \ + ((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \ +- __bpf_call_base) ++ (void *)__bpf_call_base) + + struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); + void bpf_jit_compile(struct bpf_prog *prog); +-- +2.27.0 + diff --git a/queue-4.19/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch b/queue-4.19/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch new file mode 100644 index 00000000000..6a2d76e7050 --- /dev/null +++ b/queue-4.19/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch @@ -0,0 +1,86 @@ +From 3d696b72a4a595ca771aa31711833a8d6fc3f2ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 14:38:14 +0100 +Subject: bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx + +From: Jesper Dangaard Brouer + +[ Upstream commit 2c0a10af688c02adcf127aad29e923e0056c6b69 ] + +BPF end-user on Cilium slack-channel (Carlo Carraro) wants to use +bpf_fib_lookup for doing MTU-check, but *prior* to extending packet size, +by adjusting fib_params 'tot_len' with the packet length plus the expected +encap size. (Just like the bpf_check_mtu helper supports). He discovered +that for SKB ctx the param->tot_len was not used, instead skb->len was used +(via MTU check in is_skb_forwardable() that checks against netdev MTU). + +Fix this by using fib_params 'tot_len' for MTU check. If not provided (e.g. +zero) then keep existing TC behaviour intact. Notice that 'tot_len' for MTU +check is done like XDP code-path, which checks against FIB-dst MTU. + +V16: +- Revert V13 optimization, 2nd lookup is against egress/resulting netdev + +V13: +- Only do ifindex lookup one time, calling dev_get_by_index_rcu(). + +V10: +- Use same method as XDP for 'tot_len' MTU check + +Fixes: 4c79579b44b1 ("bpf: Change bpf_fib_lookup to return lookup status") +Reported-by: Carlo Carraro +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/161287789444.790810.15247494756551413508.stgit@firesoul +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 557bd5cc8f94c..bbf5dbb95644d 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -4500,6 +4500,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb, + { + struct net *net = dev_net(skb->dev); + int rc = -EAFNOSUPPORT; ++ bool check_mtu = false; + + if (plen < sizeof(*params)) + return -EINVAL; +@@ -4507,22 +4508,28 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb, + if (flags & ~(BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT)) + return -EINVAL; + ++ if (params->tot_len) ++ check_mtu = true; ++ + switch (params->family) { + #if IS_ENABLED(CONFIG_INET) + case AF_INET: +- rc = bpf_ipv4_fib_lookup(net, params, flags, false); ++ rc = bpf_ipv4_fib_lookup(net, params, flags, check_mtu); + break; + #endif + #if IS_ENABLED(CONFIG_IPV6) + case AF_INET6: +- rc = bpf_ipv6_fib_lookup(net, params, flags, false); ++ rc = bpf_ipv6_fib_lookup(net, params, flags, check_mtu); + break; + #endif + } + +- if (!rc) { ++ if (rc == BPF_FIB_LKUP_RET_SUCCESS && !check_mtu) { + struct net_device *dev; + ++ /* When tot_len isn't provided by user, check skb ++ * against MTU of FIB lookup resulting net_device ++ */ + dev = dev_get_by_index_rcu(net, params->ifindex); + if (!is_skb_forwardable(dev, skb)) + rc = BPF_FIB_LKUP_RET_FRAG_NEEDED; +-- +2.27.0 + diff --git a/queue-4.19/bpf_lru_list-read-double-checked-variable-once-witho.patch b/queue-4.19/bpf_lru_list-read-double-checked-variable-once-witho.patch new file mode 100644 index 00000000000..cbb83326cae --- /dev/null +++ b/queue-4.19/bpf_lru_list-read-double-checked-variable-once-witho.patch @@ -0,0 +1,65 @@ +From b39cf7bfa867d130df614929b284dc8f462c0a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 12:27:01 +0100 +Subject: bpf_lru_list: Read double-checked variable once without lock + +From: Marco Elver + +[ Upstream commit 6df8fb83301d68ea0a0c0e1cbcc790fcc333ed12 ] + +For double-checked locking in bpf_common_lru_push_free(), node->type is +read outside the critical section and then re-checked under the lock. +However, concurrent writes to node->type result in data races. + +For example, the following concurrent access was observed by KCSAN: + + write to 0xffff88801521bc22 of 1 bytes by task 10038 on cpu 1: + __bpf_lru_node_move_in kernel/bpf/bpf_lru_list.c:91 + __local_list_flush kernel/bpf/bpf_lru_list.c:298 + ... + read to 0xffff88801521bc22 of 1 bytes by task 10043 on cpu 0: + bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:507 + bpf_lru_push_free kernel/bpf/bpf_lru_list.c:555 + ... + +Fix the data races where node->type is read outside the critical section +(for double-checked locking) by marking the access with READ_ONCE() as +well as ensuring the variable is only accessed once. + +Fixes: 3a08c2fd7634 ("bpf: LRU List") +Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com +Reported-by: syzbot+516acdb03d3e27d91bcd@syzkaller.appspotmail.com +Signed-off-by: Marco Elver +Signed-off-by: Andrii Nakryiko +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20210209112701.3341724-1-elver@google.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_lru_list.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c +index e6ef4401a1380..9b5eeff72fd37 100644 +--- a/kernel/bpf/bpf_lru_list.c ++++ b/kernel/bpf/bpf_lru_list.c +@@ -505,13 +505,14 @@ struct bpf_lru_node *bpf_lru_pop_free(struct bpf_lru *lru, u32 hash) + static void bpf_common_lru_push_free(struct bpf_lru *lru, + struct bpf_lru_node *node) + { ++ u8 node_type = READ_ONCE(node->type); + unsigned long flags; + +- if (WARN_ON_ONCE(node->type == BPF_LRU_LIST_T_FREE) || +- WARN_ON_ONCE(node->type == BPF_LRU_LOCAL_LIST_T_FREE)) ++ if (WARN_ON_ONCE(node_type == BPF_LRU_LIST_T_FREE) || ++ WARN_ON_ONCE(node_type == BPF_LRU_LOCAL_LIST_T_FREE)) + return; + +- if (node->type == BPF_LRU_LOCAL_LIST_T_PENDING) { ++ if (node_type == BPF_LRU_LOCAL_LIST_T_PENDING) { + struct bpf_lru_locallist *loc_l; + + loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu); +-- +2.27.0 + diff --git a/queue-4.19/btrfs-clarify-error-returns-values-in-__load_free_sp.patch b/queue-4.19/btrfs-clarify-error-returns-values-in-__load_free_sp.patch new file mode 100644 index 00000000000..6b08c3a03a2 --- /dev/null +++ b/queue-4.19/btrfs-clarify-error-returns-values-in-__load_free_sp.patch @@ -0,0 +1,60 @@ +From dccaab6c1a12c93c956c0f0bec67873de6153aec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 09:08:04 +0800 +Subject: btrfs: clarify error returns values in __load_free_space_cache + +From: Zhihao Cheng + +[ Upstream commit 3cc64e7ebfb0d7faaba2438334c43466955a96e8 ] + +Return value in __load_free_space_cache is not properly set after +(unlikely) memory allocation failures and 0 is returned instead. +This is not a problem for the caller load_free_space_cache because only +value 1 is considered as 'cache loaded' but for clarity it's better +to set the errors accordingly. + +Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/free-space-cache.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 652b0b16e93e2..6511cb71986c9 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -743,8 +743,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode, + while (num_entries) { + e = kmem_cache_zalloc(btrfs_free_space_cachep, + GFP_NOFS); +- if (!e) ++ if (!e) { ++ ret = -ENOMEM; + goto free_cache; ++ } + + ret = io_ctl_read_entry(&io_ctl, e, &type); + if (ret) { +@@ -753,6 +755,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode, + } + + if (!e->bytes) { ++ ret = -1; + kmem_cache_free(btrfs_free_space_cachep, e); + goto free_cache; + } +@@ -773,6 +776,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode, + e->bitmap = kmem_cache_zalloc( + btrfs_free_space_bitmap_cachep, GFP_NOFS); + if (!e->bitmap) { ++ ret = -ENOMEM; + kmem_cache_free( + btrfs_free_space_cachep, e); + goto free_cache; +-- +2.27.0 + diff --git a/queue-4.19/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch b/queue-4.19/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch new file mode 100644 index 00000000000..b3573f841c6 --- /dev/null +++ b/queue-4.19/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch @@ -0,0 +1,62 @@ +From abb44fdd52624eeae0a495150041c8eed5a665d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Dec 2020 09:42:00 -0600 +Subject: capabilities: Don't allow writing ambiguous v3 file capabilities + +From: Eric W. Biederman + +[ Upstream commit 95ebabde382c371572297915b104e55403674e73 ] + +The v3 file capabilities have a uid field that records the filesystem +uid of the root user of the user namespace the file capabilities are +valid in. + +When someone is silly enough to have the same underlying uid as the +root uid of multiple nested containers a v3 filesystem capability can +be ambiguous. + +In the spirit of don't do that then, forbid writing a v3 filesystem +capability if it is ambiguous. + +Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities") +Reviewed-by: Andrew G. Morgan +Reviewed-by: Serge Hallyn +Signed-off-by: Eric W. Biederman +Signed-off-by: Sasha Levin +--- + security/commoncap.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/security/commoncap.c b/security/commoncap.c +index a1dee0ab345a2..1bc40e78fa7ff 100644 +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -506,7 +506,8 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) + __u32 magic, nsmagic; + struct inode *inode = d_backing_inode(dentry); + struct user_namespace *task_ns = current_user_ns(), +- *fs_ns = inode->i_sb->s_user_ns; ++ *fs_ns = inode->i_sb->s_user_ns, ++ *ancestor; + kuid_t rootid; + size_t newsize; + +@@ -529,6 +530,15 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size) + if (nsrootid == -1) + return -EINVAL; + ++ /* ++ * Do not allow allow adding a v3 filesystem capability xattr ++ * if the rootid field is ambiguous. ++ */ ++ for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) { ++ if (from_kuid(ancestor, rootid) == 0) ++ return -EINVAL; ++ } ++ + newsize = sizeof(struct vfs_ns_cap_data); + nscap = kmalloc(newsize, GFP_ATOMIC); + if (!nscap) +-- +2.27.0 + diff --git a/queue-4.19/certs-fix-blacklist-flag-type-confusion.patch b/queue-4.19/certs-fix-blacklist-flag-type-confusion.patch new file mode 100644 index 00000000000..e9ff21250b8 --- /dev/null +++ b/queue-4.19/certs-fix-blacklist-flag-type-confusion.patch @@ -0,0 +1,107 @@ +From 8ce716694f530a6510e7f06e2654c8780aa2dd49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 19:04:23 +0100 +Subject: certs: Fix blacklist flag type confusion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Howells + +[ Upstream commit 4993e1f9479a4161fd7d93e2b8b30b438f00cb0f ] + +KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(), +as these only take KEY_ALLOC_* flags. KEY_FLAG_KEEP has the same value as +KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update() +uses it. LSMs using the key_alloc hook don't check that flag. + +KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot +write to the blacklist keyring, so it is not possible to remove a key/hash +from it. + +Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set +KEY_FLAG_KEEP on the new key. blacklist_init() can then, correctly, pass +this to keyring_alloc(). + +We can also use this in ima_mok_init() rather than setting the flag +manually. + +Note that this doesn't fix an observable bug with the current +implementation but it is required to allow addition of new hashes to the +blacklist in the future without making it possible for them to be removed. + +Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring") +Reported-by: Mickaël Salaün +Signed-off-by: David Howells +cc: Mickaël Salaün +cc: Mimi Zohar +Cc: David Woodhouse +Signed-off-by: Sasha Levin +--- + certs/blacklist.c | 2 +- + include/linux/key.h | 1 + + security/integrity/ima/ima_mok.c | 5 ++--- + security/keys/key.c | 2 ++ + 4 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/certs/blacklist.c b/certs/blacklist.c +index 3a507b9e2568a..e9f3f81c51f96 100644 +--- a/certs/blacklist.c ++++ b/certs/blacklist.c +@@ -157,7 +157,7 @@ static int __init blacklist_init(void) + KEY_USR_VIEW | KEY_USR_READ | + KEY_USR_SEARCH, + KEY_ALLOC_NOT_IN_QUOTA | +- KEY_FLAG_KEEP, ++ KEY_ALLOC_SET_KEEP, + NULL, NULL); + if (IS_ERR(blacklist_keyring)) + panic("Can't allocate system blacklist keyring\n"); +diff --git a/include/linux/key.h b/include/linux/key.h +index e58ee10f6e585..3683c6a6fca30 100644 +--- a/include/linux/key.h ++++ b/include/linux/key.h +@@ -249,6 +249,7 @@ extern struct key *key_alloc(struct key_type *type, + #define KEY_ALLOC_BUILT_IN 0x0004 /* Key is built into kernel */ + #define KEY_ALLOC_BYPASS_RESTRICTION 0x0008 /* Override the check on restricted keyrings */ + #define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */ ++#define KEY_ALLOC_SET_KEEP 0x0020 /* Set the KEEP flag on the key/keyring */ + + extern void key_revoke(struct key *key); + extern void key_invalidate(struct key *key); +diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c +index 073ddc9bce5ba..3e7a1523663b8 100644 +--- a/security/integrity/ima/ima_mok.c ++++ b/security/integrity/ima/ima_mok.c +@@ -43,13 +43,12 @@ __init int ima_mok_init(void) + (KEY_POS_ALL & ~KEY_POS_SETATTR) | + KEY_USR_VIEW | KEY_USR_READ | + KEY_USR_WRITE | KEY_USR_SEARCH, +- KEY_ALLOC_NOT_IN_QUOTA, ++ KEY_ALLOC_NOT_IN_QUOTA | ++ KEY_ALLOC_SET_KEEP, + restriction, NULL); + + if (IS_ERR(ima_blacklist_keyring)) + panic("Can't allocate IMA blacklist keyring."); +- +- set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); + return 0; + } + device_initcall(ima_mok_init); +diff --git a/security/keys/key.c b/security/keys/key.c +index d5fa8c4fc5544..d3ebc0533e3ad 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -305,6 +305,8 @@ struct key *key_alloc(struct key_type *type, const char *desc, + key->flags |= 1 << KEY_FLAG_BUILTIN; + if (flags & KEY_ALLOC_UID_KEYRING) + key->flags |= 1 << KEY_FLAG_UID_KEYRING; ++ if (flags & KEY_ALLOC_SET_KEEP) ++ key->flags |= 1 << KEY_FLAG_KEEP; + + #ifdef KEY_DEBUGGING + key->magic = KEY_DEBUG_MAGIC; +-- +2.27.0 + diff --git a/queue-4.19/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch b/queue-4.19/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch new file mode 100644 index 00000000000..325bb5a927f --- /dev/null +++ b/queue-4.19/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch @@ -0,0 +1,39 @@ +From 083c5597c7d74836b7c567b94e966116cb802001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Dec 2020 13:15:54 +0100 +Subject: clk: meson: clk-pll: fix initializing the old rate (fallback) for a + PLL + +From: Martin Blumenstingl + +[ Upstream commit 2f290b7c67adf6459a17a4c978102af35cd62e4a ] + +The "rate" parameter in meson_clk_pll_set_rate() contains the new rate. +Retrieve the old rate with clk_hw_get_rate() so we don't inifinitely try +to switch from the new rate to the same rate again. + +Fixes: 7a29a869434e8b ("clk: meson: Add support for Meson clock controller") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20201226121556.975418-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/clk-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c +index 3e04617ac47f6..6fdad22a583d9 100644 +--- a/drivers/clk/meson/clk-pll.c ++++ b/drivers/clk/meson/clk-pll.c +@@ -197,7 +197,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate, + if (parent_rate == 0 || rate == 0) + return -EINVAL; + +- old_rate = rate; ++ old_rate = clk_hw_get_rate(hw); + + pllt = meson_clk_get_pll_settings(rate, pll); + if (!pllt) +-- +2.27.0 + diff --git a/queue-4.19/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch b/queue-4.19/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch new file mode 100644 index 00000000000..8fc49d5e44c --- /dev/null +++ b/queue-4.19/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch @@ -0,0 +1,387 @@ +From 5c83bd5f7009c0ed0352a8903eda9dfd9d078e77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 23:10:54 +0100 +Subject: clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs + +From: AngeloGioacchino Del Regno + +[ Upstream commit 292f75ecff07e8a07fe2e3e19b4b567d0b698842 ] + +All of the GPLLs in the MSM8998 Global Clock Controller are Fabia PLLs +and not generic alphas: this was producing bad effects over the entire +clock tree of MSM8998, where any GPLL child clock was declaring a false +clock rate, due to their parent also showing the same. + +The issue resides in the calculation of the clock rate for the specific +Alpha PLL type, where Fabia has a different register layout; switching +the MSM8998 GPLLs to the correct Alpha Fabia PLL type fixes the rate +(calculation) reading. While at it, also make these PLLs fixed since +their rate is supposed to *never* be changed while the system runs, as +this would surely crash the entire SoC. + +Now all the children of all the PLLs are also complying with their +specified clock table and system stability is improved. + +Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210114221059.483390-7-angelogioacchino.delregno@somainline.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8998.c | 100 ++++++++++++++++----------------- + 1 file changed, 50 insertions(+), 50 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c +index 772a08101ddf2..0ccd6b79cb5e7 100644 +--- a/drivers/clk/qcom/gcc-msm8998.c ++++ b/drivers/clk/qcom/gcc-msm8998.c +@@ -124,7 +124,7 @@ static struct pll_vco fabia_vco[] = { + + static struct clk_alpha_pll gpll0 = { + .offset = 0x0, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .vco_table = fabia_vco, + .num_vco = ARRAY_SIZE(fabia_vco), + .clkr = { +@@ -134,58 +134,58 @@ static struct clk_alpha_pll gpll0 = { + .name = "gpll0", + .parent_names = (const char *[]){ "xo" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_ops, ++ .ops = &clk_alpha_pll_fixed_fabia_ops, + } + }, + }; + + static struct clk_alpha_pll_postdiv gpll0_out_even = { + .offset = 0x0, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_even", + .parent_names = (const char *[]){ "gpll0" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll0_out_main = { + .offset = 0x0, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_main", + .parent_names = (const char *[]){ "gpll0" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll0_out_odd = { + .offset = 0x0, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_odd", + .parent_names = (const char *[]){ "gpll0" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll0_out_test = { + .offset = 0x0, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_test", + .parent_names = (const char *[]){ "gpll0" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll gpll1 = { + .offset = 0x1000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .vco_table = fabia_vco, + .num_vco = ARRAY_SIZE(fabia_vco), + .clkr = { +@@ -195,58 +195,58 @@ static struct clk_alpha_pll gpll1 = { + .name = "gpll1", + .parent_names = (const char *[]){ "xo" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_ops, ++ .ops = &clk_alpha_pll_fixed_fabia_ops, + } + }, + }; + + static struct clk_alpha_pll_postdiv gpll1_out_even = { + .offset = 0x1000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll1_out_even", + .parent_names = (const char *[]){ "gpll1" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll1_out_main = { + .offset = 0x1000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll1_out_main", + .parent_names = (const char *[]){ "gpll1" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll1_out_odd = { + .offset = 0x1000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll1_out_odd", + .parent_names = (const char *[]){ "gpll1" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll1_out_test = { + .offset = 0x1000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll1_out_test", + .parent_names = (const char *[]){ "gpll1" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll gpll2 = { + .offset = 0x2000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .vco_table = fabia_vco, + .num_vco = ARRAY_SIZE(fabia_vco), + .clkr = { +@@ -256,58 +256,58 @@ static struct clk_alpha_pll gpll2 = { + .name = "gpll2", + .parent_names = (const char *[]){ "xo" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_ops, ++ .ops = &clk_alpha_pll_fixed_fabia_ops, + } + }, + }; + + static struct clk_alpha_pll_postdiv gpll2_out_even = { + .offset = 0x2000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll2_out_even", + .parent_names = (const char *[]){ "gpll2" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll2_out_main = { + .offset = 0x2000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll2_out_main", + .parent_names = (const char *[]){ "gpll2" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll2_out_odd = { + .offset = 0x2000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll2_out_odd", + .parent_names = (const char *[]){ "gpll2" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll2_out_test = { + .offset = 0x2000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll2_out_test", + .parent_names = (const char *[]){ "gpll2" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll gpll3 = { + .offset = 0x3000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .vco_table = fabia_vco, + .num_vco = ARRAY_SIZE(fabia_vco), + .clkr = { +@@ -317,58 +317,58 @@ static struct clk_alpha_pll gpll3 = { + .name = "gpll3", + .parent_names = (const char *[]){ "xo" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_ops, ++ .ops = &clk_alpha_pll_fixed_fabia_ops, + } + }, + }; + + static struct clk_alpha_pll_postdiv gpll3_out_even = { + .offset = 0x3000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll3_out_even", + .parent_names = (const char *[]){ "gpll3" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll3_out_main = { + .offset = 0x3000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll3_out_main", + .parent_names = (const char *[]){ "gpll3" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll3_out_odd = { + .offset = 0x3000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll3_out_odd", + .parent_names = (const char *[]){ "gpll3" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll3_out_test = { + .offset = 0x3000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll3_out_test", + .parent_names = (const char *[]){ "gpll3" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll gpll4 = { + .offset = 0x77000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .vco_table = fabia_vco, + .num_vco = ARRAY_SIZE(fabia_vco), + .clkr = { +@@ -378,52 +378,52 @@ static struct clk_alpha_pll gpll4 = { + .name = "gpll4", + .parent_names = (const char *[]){ "xo" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_ops, ++ .ops = &clk_alpha_pll_fixed_fabia_ops, + } + }, + }; + + static struct clk_alpha_pll_postdiv gpll4_out_even = { + .offset = 0x77000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll4_out_even", + .parent_names = (const char *[]){ "gpll4" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll4_out_main = { + .offset = 0x77000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll4_out_main", + .parent_names = (const char *[]){ "gpll4" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll4_out_odd = { + .offset = 0x77000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll4_out_odd", + .parent_names = (const char *[]){ "gpll4" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + + static struct clk_alpha_pll_postdiv gpll4_out_test = { + .offset = 0x77000, +- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA], + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll4_out_test", + .parent_names = (const char *[]){ "gpll4" }, + .num_parents = 1, +- .ops = &clk_alpha_pll_postdiv_ops, ++ .ops = &clk_alpha_pll_postdiv_fabia_ops, + }, + }; + +-- +2.27.0 + diff --git a/queue-4.19/clk-sunxi-ng-h6-fix-cec-clock.patch b/queue-4.19/clk-sunxi-ng-h6-fix-cec-clock.patch new file mode 100644 index 00000000000..4aa86b3b7b0 --- /dev/null +++ b/queue-4.19/clk-sunxi-ng-h6-fix-cec-clock.patch @@ -0,0 +1,42 @@ +From 27057b30c83988f13e428c2b37b90bebf2c497f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jan 2021 14:32:46 +0000 +Subject: clk: sunxi-ng: h6: Fix CEC clock + +From: Andre Przywara + +[ Upstream commit 756650820abd4770c4200763505b634a3c04e05e ] + +The CEC clock on the H6 SoC is a bit special, since it uses a fixed +pre-dividier for one source clock (the PLL), but conveys the other clock +(32K OSC) directly. +We are using a fixed predivider array for that, but fail to use the right +flag to actually activate that. + +Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU") +Reported-by: Jernej Skrabec +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210106143246.11255-1-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +index d425b47cef179..3449dcf1908ef 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +@@ -662,7 +662,7 @@ static struct ccu_mux hdmi_cec_clk = { + + .common = { + .reg = 0xb10, +- .features = CCU_FEATURE_VARIABLE_PREDIV, ++ .features = CCU_FEATURE_FIXED_PREDIV, + .hw.init = CLK_HW_INIT_PARENTS("hdmi-cec", + hdmi_cec_parents, + &ccu_mux_ops, +-- +2.27.0 + diff --git a/queue-4.19/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch b/queue-4.19/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch new file mode 100644 index 00000000000..51607bded42 --- /dev/null +++ b/queue-4.19/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch @@ -0,0 +1,67 @@ +From 105052912dc892ba7d06810cd796c935e43dbcfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 00:09:12 +0000 +Subject: clk: sunxi-ng: h6: Fix clock divider range on some clocks + +From: Andre Przywara + +[ Upstream commit 04ef679591c76571a9e7d5ca48316cc86fa0ef12 ] + +While comparing clocks between the H6 and H616, some of the M factor +ranges were found to be wrong: the manual says they are only covering +two bits [1:0], but our code had "5" in the number-of-bits field. + +By writing 0xff into that register in U-Boot and via FEL, it could be +confirmed that bits [4:2] are indeed masked off, so the manual is right. + +Change to number of bits in the affected clock's description. + +Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU") +Signed-off-by: Andre Przywara +Reviewed-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20210118000912.28116-1-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +index 3449dcf1908ef..1197ace591247 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +@@ -223,7 +223,7 @@ static const char * const psi_ahb1_ahb2_parents[] = { "osc24M", "osc32k", + static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2", + psi_ahb1_ahb2_parents, + 0x510, +- 0, 5, /* M */ ++ 0, 2, /* M */ + 8, 2, /* P */ + 24, 2, /* mux */ + 0); +@@ -232,19 +232,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k", + "psi-ahb1-ahb2", + "pll-periph0" }; + static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c, +- 0, 5, /* M */ ++ 0, 2, /* M */ + 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520, +- 0, 5, /* M */ ++ 0, 2, /* M */ + 8, 2, /* P */ + 24, 2, /* mux */ + 0); + + static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524, +- 0, 5, /* M */ ++ 0, 2, /* M */ + 8, 2, /* P */ + 24, 2, /* mux */ + 0); +-- +2.27.0 + diff --git a/queue-4.19/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch b/queue-4.19/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch new file mode 100644 index 00000000000..862a900526e --- /dev/null +++ b/queue-4.19/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch @@ -0,0 +1,49 @@ +From 8098a70b60c4b3c528e6263a4d323b06781554e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 13:19:55 -0800 +Subject: clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is + defined +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tom Rix + +[ Upstream commit 7da390694afbaed8e0f05717a541dfaf1077ba51 ] + +When DEBUG is defined this error occurs + +drivers/clocksource/mxs_timer.c:138:1: error: + expected ‘;’ before ‘}’ token + +The preceding statement needs a semicolon. +Replace pr_info() with pr_debug() and remove the unneeded ifdef. + +Fixes: eb8703e2ef7c ("clockevents/drivers/mxs: Migrate to new 'set-state' interface") +Signed-off-by: Tom Rix +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210118211955.763609-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/mxs_timer.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c +index f6ddae30933f7..dae8c0c2e606f 100644 +--- a/drivers/clocksource/mxs_timer.c ++++ b/drivers/clocksource/mxs_timer.c +@@ -138,10 +138,7 @@ static void mxs_irq_clear(char *state) + + /* Clear pending interrupt */ + timrot_irq_acknowledge(); +- +-#ifdef DEBUG +- pr_info("%s: changing mode to %s\n", __func__, state) +-#endif /* DEBUG */ ++ pr_debug("%s: changing mode to %s\n", __func__, state); + } + + static int mxs_shutdown(struct clock_event_device *evt) +-- +2.27.0 + diff --git a/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch new file mode 100644 index 00000000000..96f799381e0 --- /dev/null +++ b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch @@ -0,0 +1,38 @@ +From 33e4b3ffd312e5ccb364dc185ac42db9ce8ec084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jan 2021 15:26:44 +0100 +Subject: cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() + +From: Christophe JAILLET + +[ Upstream commit 3657f729b6fb5f2c0bf693742de2dcd49c572aa1 ] + +If 'cpufreq_unregister_driver()' fails, just WARN and continue, so that +other resources are freed. + +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Signed-off-by: Christophe JAILLET +[ Viresh: Updated Subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 1514c9846c5d5..a3c82f530d608 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -723,8 +723,7 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev) + int ret; + + ret = cpufreq_unregister_driver(&brcm_avs_driver); +- if (ret) +- return ret; ++ WARN_ON(ret); + + brcm_avs_prepare_uninit(pdev); + +-- +2.27.0 + diff --git a/queue-4.19/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch new file mode 100644 index 00000000000..87f36c5d456 --- /dev/null +++ b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch @@ -0,0 +1,77 @@ +From c9058f3c36c02168e984ce0238d4f22a939283c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jan 2021 15:26:35 +0100 +Subject: cpufreq: brcmstb-avs-cpufreq: Free resources in error path + +From: Christophe JAILLET + +[ Upstream commit 05f456286fd489558c72a4711d22a5612c965685 ] + +If 'cpufreq_register_driver()' fails, we must release the resources +allocated in 'brcm_avs_prepare_init()' as already done in the remove +function. + +To do that, introduce a new function 'brcm_avs_prepare_uninit()' in order +to avoid code duplication. This also makes the code more readable (IMHO). + +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Signed-off-by: Christophe JAILLET +[ Viresh: Updated Subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 77b0e5d0fb134..1514c9846c5d5 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -566,6 +566,16 @@ unmap_base: + return ret; + } + ++static void brcm_avs_prepare_uninit(struct platform_device *pdev) ++{ ++ struct private_data *priv; ++ ++ priv = platform_get_drvdata(pdev); ++ ++ iounmap(priv->avs_intr_base); ++ iounmap(priv->base); ++} ++ + static int brcm_avs_cpufreq_init(struct cpufreq_policy *policy) + { + struct cpufreq_frequency_table *freq_table; +@@ -701,21 +711,22 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev) + + brcm_avs_driver.driver_data = pdev; + +- return cpufreq_register_driver(&brcm_avs_driver); ++ ret = cpufreq_register_driver(&brcm_avs_driver); ++ if (ret) ++ brcm_avs_prepare_uninit(pdev); ++ ++ return ret; + } + + static int brcm_avs_cpufreq_remove(struct platform_device *pdev) + { +- struct private_data *priv; + int ret; + + ret = cpufreq_unregister_driver(&brcm_avs_driver); + if (ret) + return ret; + +- priv = platform_get_drvdata(pdev); +- iounmap(priv->base); +- iounmap(priv->avs_intr_base); ++ brcm_avs_prepare_uninit(pdev); + + return 0; + } +-- +2.27.0 + diff --git a/queue-4.19/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch b/queue-4.19/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch new file mode 100644 index 00000000000..de26fb17761 --- /dev/null +++ b/queue-4.19/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch @@ -0,0 +1,83 @@ +From 7dba94b7a8038f14e2862ae6e5c2aa043fd908da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jan 2021 00:02:37 +0100 +Subject: crypto: bcm - Rename struct device_private to bcm_device_private + +From: Jiri Olsa + +[ Upstream commit f7f2b43eaf6b4cfe54c75100709be31d5c4b52c8 ] + +Renaming 'struct device_private' to 'struct bcm_device_private', +because it clashes with 'struct device_private' from +'drivers/base/base.h'. + +While it's not a functional problem, it's causing two distinct +type hierarchies in BTF data. It also breaks build with options: + CONFIG_DEBUG_INFO_BTF=y + CONFIG_CRYPTO_DEV_BCM_SPU=y + +as reported by Qais Yousef [1]. + +[1] https://lore.kernel.org/lkml/20201229151352.6hzmjvu3qh6p2qgg@e107158-lin/ + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Jiri Olsa +Tested-by: Qais Yousef +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/cipher.c | 2 +- + drivers/crypto/bcm/cipher.h | 4 ++-- + drivers/crypto/bcm/util.c | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index c2736274ad634..c63992fbbc988 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -52,7 +52,7 @@ + + /* ================= Device Structure ================== */ + +-struct device_private iproc_priv; ++struct bcm_device_private iproc_priv; + + /* ==================== Parameters ===================== */ + +diff --git a/drivers/crypto/bcm/cipher.h b/drivers/crypto/bcm/cipher.h +index 763c425c41cae..36452d26c7c5c 100644 +--- a/drivers/crypto/bcm/cipher.h ++++ b/drivers/crypto/bcm/cipher.h +@@ -431,7 +431,7 @@ struct spu_hw { + u32 num_chan; + }; + +-struct device_private { ++struct bcm_device_private { + struct platform_device *pdev; + + struct spu_hw spu; +@@ -478,6 +478,6 @@ struct device_private { + struct mbox_chan **mbox; + }; + +-extern struct device_private iproc_priv; ++extern struct bcm_device_private iproc_priv; + + #endif +diff --git a/drivers/crypto/bcm/util.c b/drivers/crypto/bcm/util.c +index a912c6ad3e850..f96d1dade010a 100644 +--- a/drivers/crypto/bcm/util.c ++++ b/drivers/crypto/bcm/util.c +@@ -400,7 +400,7 @@ char *spu_alg_name(enum spu_cipher_alg alg, enum spu_cipher_mode mode) + static ssize_t spu_debugfs_read(struct file *filp, char __user *ubuf, + size_t count, loff_t *offp) + { +- struct device_private *ipriv; ++ struct bcm_device_private *ipriv; + char *buf; + ssize_t ret, out_offset, out_count; + int i; +-- +2.27.0 + diff --git a/queue-4.19/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch b/queue-4.19/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch new file mode 100644 index 00000000000..19e6fab1abe --- /dev/null +++ b/queue-4.19/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch @@ -0,0 +1,41 @@ +From 202f2f3dd5c7649896f5abbeb4ba8bc812f247a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Feb 2021 11:28:37 +0000 +Subject: crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() + +From: Daniele Alessandrelli + +[ Upstream commit a53ab94eb6850c3657392e2d2ce9b38c387a2633 ] + +The length ('len' parameter) passed to crypto_ecdh_decode_key() is never +checked against the length encoded in the passed buffer ('buf' +parameter). This could lead to an out-of-bounds access when the passed +length is less than the encoded length. + +Add a check to prevent that. + +Fixes: 3c4b23901a0c7 ("crypto: ecdh - Add ECDH software support") +Signed-off-by: Daniele Alessandrelli +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/ecdh_helper.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/crypto/ecdh_helper.c b/crypto/ecdh_helper.c +index d3af8e8b0b5e4..25711de445848 100644 +--- a/crypto/ecdh_helper.c ++++ b/crypto/ecdh_helper.c +@@ -71,6 +71,9 @@ int crypto_ecdh_decode_key(const char *buf, unsigned int len, + if (secret.type != CRYPTO_KPP_SECRET_TYPE_ECDH) + return -EINVAL; + ++ if (unlikely(len < secret.len)) ++ return -EINVAL; ++ + ptr = ecdh_unpack_data(¶ms->curve_id, ptr, sizeof(params->curve_id)); + ptr = ecdh_unpack_data(¶ms->key_size, ptr, sizeof(params->key_size)); + if (secret.len != crypto_ecdh_key_len(params)) +-- +2.27.0 + diff --git a/queue-4.19/crypto-sun4i-ss-fix-kmap-usage.patch b/queue-4.19/crypto-sun4i-ss-fix-kmap-usage.patch new file mode 100644 index 00000000000..063ec93ca6d --- /dev/null +++ b/queue-4.19/crypto-sun4i-ss-fix-kmap-usage.patch @@ -0,0 +1,254 @@ +From 7894698a4823a13453d477389ce4967e7d182aed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 20:02:30 +0000 +Subject: crypto: sun4i-ss - fix kmap usage + +From: Corentin Labbe + +[ Upstream commit 9bc3dd24e7dccd50757db743a3635ad5b0497e6e ] + +With the recent kmap change, some tests which were conditional on +CONFIG_DEBUG_HIGHMEM now are enabled by default. +This permit to detect a problem in sun4i-ss usage of kmap. + +sun4i-ss uses two kmap via sg_miter (one for input, one for output), but +using two kmap at the same time is hard: +"the ordering has to be correct and with sg_miter that's probably hard to get +right." (quoting Tlgx) + +So the easiest solution is to never have two sg_miter/kmap open at the same time. +After each use of sg_miter, I store the current index, for being able to +resume sg_miter to the right place. + +Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 109 +++++++++++++--------- + 1 file changed, 65 insertions(+), 44 deletions(-) + +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 22e4918579254..178096e4e77da 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -34,6 +34,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + unsigned int ileft = areq->cryptlen; + unsigned int oleft = areq->cryptlen; + unsigned int todo; ++ unsigned long pi = 0, po = 0; /* progress for in and out */ ++ bool miter_err; + struct sg_mapping_iter mi, mo; + unsigned int oi, oo; /* offset for in and out */ + unsigned long flags; +@@ -64,39 +66,51 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + } + writel(mode, ss->base + SS_CTL); + +- sg_miter_start(&mi, areq->src, sg_nents(areq->src), +- SG_MITER_FROM_SG | SG_MITER_ATOMIC); +- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst), +- SG_MITER_TO_SG | SG_MITER_ATOMIC); +- sg_miter_next(&mi); +- sg_miter_next(&mo); +- if (!mi.addr || !mo.addr) { +- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); +- err = -EINVAL; +- goto release_ss; +- } + + ileft = areq->cryptlen / 4; + oleft = areq->cryptlen / 4; + oi = 0; + oo = 0; + do { +- todo = min(rx_cnt, ileft); +- todo = min_t(size_t, todo, (mi.length - oi) / 4); +- if (todo) { +- ileft -= todo; +- writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +- oi += todo * 4; +- } +- if (oi == mi.length) { +- sg_miter_next(&mi); +- oi = 0; ++ if (ileft) { ++ sg_miter_start(&mi, areq->src, sg_nents(areq->src), ++ SG_MITER_FROM_SG | SG_MITER_ATOMIC); ++ if (pi) ++ sg_miter_skip(&mi, pi); ++ miter_err = sg_miter_next(&mi); ++ if (!miter_err || !mi.addr) { ++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); ++ err = -EINVAL; ++ goto release_ss; ++ } ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); ++ if (todo) { ++ ileft -= todo; ++ writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); ++ oi += todo * 4; ++ } ++ if (oi == mi.length) { ++ pi += mi.length; ++ oi = 0; ++ } ++ sg_miter_stop(&mi); + } + + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + ++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst), ++ SG_MITER_TO_SG | SG_MITER_ATOMIC); ++ if (po) ++ sg_miter_skip(&mo, po); ++ miter_err = sg_miter_next(&mo); ++ if (!miter_err || !mo.addr) { ++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); ++ err = -EINVAL; ++ goto release_ss; ++ } + todo = min(tx_cnt, oleft); + todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { +@@ -105,9 +119,10 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + oo += todo * 4; + } + if (oo == mo.length) { +- sg_miter_next(&mo); + oo = 0; ++ po += mo.length; + } ++ sg_miter_stop(&mo); + } while (oleft); + + if (areq->iv) { +@@ -118,8 +133,6 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + } + + release_ss: +- sg_miter_stop(&mi); +- sg_miter_stop(&mo); + writel(0, ss->base + SS_CTL); + spin_unlock_irqrestore(&ss->slock, flags); + return err; +@@ -148,6 +161,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + unsigned int oleft = areq->cryptlen; + unsigned int todo; + struct sg_mapping_iter mi, mo; ++ unsigned long pi = 0, po = 0; /* progress for in and out */ ++ bool miter_err; + unsigned int oi, oo; /* offset for in and out */ + char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */ + char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */ +@@ -200,17 +215,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + } + writel(mode, ss->base + SS_CTL); + +- sg_miter_start(&mi, areq->src, sg_nents(areq->src), +- SG_MITER_FROM_SG | SG_MITER_ATOMIC); +- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst), +- SG_MITER_TO_SG | SG_MITER_ATOMIC); +- sg_miter_next(&mi); +- sg_miter_next(&mo); +- if (!mi.addr || !mo.addr) { +- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); +- err = -EINVAL; +- goto release_ss; +- } + ileft = areq->cryptlen; + oleft = areq->cryptlen; + oi = 0; +@@ -218,6 +222,16 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + + while (oleft) { + if (ileft) { ++ sg_miter_start(&mi, areq->src, sg_nents(areq->src), ++ SG_MITER_FROM_SG | SG_MITER_ATOMIC); ++ if (pi) ++ sg_miter_skip(&mi, pi); ++ miter_err = sg_miter_next(&mi); ++ if (!miter_err || !mi.addr) { ++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); ++ err = -EINVAL; ++ goto release_ss; ++ } + /* + * todo is the number of consecutive 4byte word that we + * can read from current SG +@@ -250,31 +264,38 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + } + } + if (oi == mi.length) { +- sg_miter_next(&mi); ++ pi += mi.length; + oi = 0; + } ++ sg_miter_stop(&mi); + } + + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, +- "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", +- mode, +- oi, mi.length, ileft, areq->cryptlen, rx_cnt, +- oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); + + if (!tx_cnt) + continue; ++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst), ++ SG_MITER_TO_SG | SG_MITER_ATOMIC); ++ if (po) ++ sg_miter_skip(&mo, po); ++ miter_err = sg_miter_next(&mo); ++ if (!miter_err || !mo.addr) { ++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n"); ++ err = -EINVAL; ++ goto release_ss; ++ } + /* todo in 4bytes word */ + todo = min(tx_cnt, oleft / 4); + todo = min_t(size_t, todo, (mo.length - oo) / 4); ++ + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; + oo += todo * 4; + if (oo == mo.length) { +- sg_miter_next(&mo); ++ po += mo.length; + oo = 0; + } + } else { +@@ -299,12 +320,14 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + obo += todo; + oo += todo; + if (oo == mo.length) { ++ po += mo.length; + sg_miter_next(&mo); + oo = 0; + } + } while (obo < obl); + /* bufo must be fully used here */ + } ++ sg_miter_stop(&mo); + } + if (areq->iv) { + for (i = 0; i < 4 && i < ivsize / 4; i++) { +@@ -314,8 +337,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + } + + release_ss: +- sg_miter_stop(&mi); +- sg_miter_stop(&mo); + writel(0, ss->base + SS_CTL); + spin_unlock_irqrestore(&ss->slock, flags); + +-- +2.27.0 + diff --git a/queue-4.19/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch b/queue-4.19/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch new file mode 100644 index 00000000000..85f9a1f3abb --- /dev/null +++ b/queue-4.19/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch @@ -0,0 +1,160 @@ +From 7c8e4bdd3a84bfe987681cc74b289e90b1e20188 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 18:57:24 +0000 +Subject: crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size + error) + +From: Christophe Leroy + +[ Upstream commit 416b846757bcea20006a9197e67ba3a8b5b2a680 ] + +Talitos Security Engine AESU considers any input +data size that is not a multiple of 16 bytes to be an error. +This is not a problem in general, except for Counter mode +that is a stream cipher and can have an input of any size. + +Test Manager for ctr(aes) fails on 4th test vector which has +a length of 499 while all previous vectors which have a 16 bytes +multiple length succeed. + +As suggested by Freescale, round up the input data length to the +nearest 16 bytes. + +Fixes: 5e75ae1b3cef ("crypto: talitos - add new crypto modes") +Signed-off-by: Christophe Leroy +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/talitos.c | 28 ++++++++++++++++------------ + drivers/crypto/talitos.h | 1 + + 2 files changed, 17 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index c70a7c4f5b739..7a55baa861e58 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -1066,11 +1066,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev, + */ + static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count, + unsigned int offset, int datalen, int elen, +- struct talitos_ptr *link_tbl_ptr) ++ struct talitos_ptr *link_tbl_ptr, int align) + { + int n_sg = elen ? sg_count + 1 : sg_count; + int count = 0; + int cryptlen = datalen + elen; ++ int padding = ALIGN(cryptlen, align) - cryptlen; + + while (cryptlen && sg && n_sg--) { + unsigned int len = sg_dma_len(sg); +@@ -1094,7 +1095,7 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count, + offset += datalen; + } + to_talitos_ptr(link_tbl_ptr + count, +- sg_dma_address(sg) + offset, len, 0); ++ sg_dma_address(sg) + offset, sg_next(sg) ? len : len + padding, 0); + to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0); + count++; + cryptlen -= len; +@@ -1117,10 +1118,11 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src, + unsigned int len, struct talitos_edesc *edesc, + struct talitos_ptr *ptr, int sg_count, + unsigned int offset, int tbl_off, int elen, +- bool force) ++ bool force, int align) + { + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); ++ int aligned_len = ALIGN(len, align); + + if (!src) { + to_talitos_ptr(ptr, 0, 0, is_sec1); +@@ -1128,22 +1130,22 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src, + } + to_talitos_ptr_ext_set(ptr, elen, is_sec1); + if (sg_count == 1 && !force) { +- to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1); ++ to_talitos_ptr(ptr, sg_dma_address(src) + offset, aligned_len, is_sec1); + return sg_count; + } + if (is_sec1) { +- to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1); ++ to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, aligned_len, is_sec1); + return sg_count; + } + sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen, +- &edesc->link_tbl[tbl_off]); ++ &edesc->link_tbl[tbl_off], align); + if (sg_count == 1 && !force) { + /* Only one segment now, so no link tbl needed*/ + copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1); + return sg_count; + } + to_talitos_ptr(ptr, edesc->dma_link_tbl + +- tbl_off * sizeof(struct talitos_ptr), len, is_sec1); ++ tbl_off * sizeof(struct talitos_ptr), aligned_len, is_sec1); + to_talitos_ptr_ext_or(ptr, DESC_PTR_LNKTBL_JUMP, is_sec1); + + return sg_count; +@@ -1155,7 +1157,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src, + unsigned int offset, int tbl_off) + { + return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset, +- tbl_off, 0, false); ++ tbl_off, 0, false, 1); + } + + /* +@@ -1224,7 +1226,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + + ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4], + sg_count, areq->assoclen, tbl_off, elen, +- false); ++ false, 1); + + if (ret > 1) { + tbl_off += ret; +@@ -1244,7 +1246,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + elen = 0; + ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5], + sg_count, areq->assoclen, tbl_off, elen, +- is_ipsec_esp && !encrypt); ++ is_ipsec_esp && !encrypt, 1); + tbl_off += ret; + + /* ICV data */ +@@ -1554,6 +1556,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc, + bool sync_needed = false; + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); ++ bool is_ctr = (desc->hdr & DESC_HDR_SEL0_MASK) == DESC_HDR_SEL0_AESU && ++ (desc->hdr & DESC_HDR_MODE0_AESU_MASK) == DESC_HDR_MODE0_AESU_CTR; + + /* first DWORD empty */ + +@@ -1574,8 +1578,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc, + /* + * cipher in + */ +- sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc, +- &desc->ptr[3], sg_count, 0, 0); ++ sg_count = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[3], ++ sg_count, 0, 0, 0, false, is_ctr ? 16 : 1); + if (sg_count > 1) + sync_needed = true; + +diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h +index cb0137e131cc8..16f96c57de341 100644 +--- a/drivers/crypto/talitos.h ++++ b/drivers/crypto/talitos.h +@@ -377,6 +377,7 @@ static inline bool has_ftr_sec1(struct talitos_private *priv) + + /* primary execution unit mode (MODE0) and derivatives */ + #define DESC_HDR_MODE0_ENCRYPT cpu_to_be32(0x00100000) ++#define DESC_HDR_MODE0_AESU_MASK cpu_to_be32(0x00600000) + #define DESC_HDR_MODE0_AESU_CBC cpu_to_be32(0x00200000) + #define DESC_HDR_MODE0_AESU_CTR cpu_to_be32(0x00600000) + #define DESC_HDR_MODE0_DEU_CBC cpu_to_be32(0x00400000) +-- +2.27.0 + diff --git a/queue-4.19/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch b/queue-4.19/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch new file mode 100644 index 00000000000..b453c2d4430 --- /dev/null +++ b/queue-4.19/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch @@ -0,0 +1,105 @@ +From 108e0ac4d2a86aaa86a1bcafc56045571fd53c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 17:12:26 +0530 +Subject: cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in + cxgb4 and ulds + +From: Ayush Sawal + +[ Upstream commit 2355a6773a2cb0d2dce13432dde78497f1d6617b ] + +The Max imm data size in cxgb4 is not similar to the max imm data size +in the chtls. This caused an mismatch in output of is_ofld_imm() of +cxgb4 and chtls. So fixed this by keeping the max wreq size of imm data +same in both chtls and cxgb4 as MAX_IMM_OFLD_TX_DATA_WR_LEN. + +As cxgb4's max imm. data value for ofld packets is changed to +MAX_IMM_OFLD_TX_DATA_WR_LEN. Using the same in cxgbit also. + +Fixes: 36bedb3f2e5b8 ("crypto: chtls - Inline TLS record Tx") +Signed-off-by: Ayush Sawal +Acked-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/crypto/chelsio/chtls/chtls_cm.h | 3 --- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 3 +++ + drivers/net/ethernet/chelsio/cxgb4/sge.c | 11 ++++++++--- + drivers/target/iscsi/cxgbit/cxgbit_target.c | 3 +-- + 4 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h +index 4282d8a4eae48..ef72610724348 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_cm.h ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h +@@ -53,9 +53,6 @@ + #define MIN_RCV_WND (24 * 1024U) + #define LOOPBACK(x) (((x) & htonl(0xff000000)) == htonl(0x7f000000)) + +-/* ulp_mem_io + ulptx_idata + payload + padding */ +-#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8) +- + /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */ + #define TX_HEADER_LEN \ + (sizeof(struct fw_ofld_tx_data_wr) + sizeof(struct sge_opaque_hdr)) +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h +index de9ad311dacd8..ea0758de8ac89 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h +@@ -44,6 +44,9 @@ + + #define MAX_ULD_QSETS 16 + ++/* ulp_mem_io + ulptx_idata + payload + padding */ ++#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8) ++ + /* CPL message priority levels */ + enum { + CPL_PRIORITY_DATA = 0, /* data messages */ +diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c +index 7801f2aeeb30e..0a2d10a000ca4 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c +@@ -2084,17 +2084,22 @@ int t4_mgmt_tx(struct adapter *adap, struct sk_buff *skb) + * @skb: the packet + * + * Returns true if a packet can be sent as an offload WR with immediate +- * data. We currently use the same limit as for Ethernet packets. ++ * data. ++ * FW_OFLD_TX_DATA_WR limits the payload to 255 bytes due to 8-bit field. ++ * However, FW_ULPTX_WR commands have a 256 byte immediate only ++ * payload limit. + */ + static inline int is_ofld_imm(const struct sk_buff *skb) + { + struct work_request_hdr *req = (struct work_request_hdr *)skb->data; + unsigned long opcode = FW_WR_OP_G(ntohl(req->wr_hi)); + +- if (opcode == FW_CRYPTO_LOOKASIDE_WR) ++ if (unlikely(opcode == FW_ULPTX_WR)) ++ return skb->len <= MAX_IMM_ULPTX_WR_LEN; ++ else if (opcode == FW_CRYPTO_LOOKASIDE_WR) + return skb->len <= SGE_MAX_WR_LEN; + else +- return skb->len <= MAX_IMM_TX_PKT_LEN; ++ return skb->len <= MAX_IMM_OFLD_TX_DATA_WR_LEN; + } + + /** +diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c +index 25eb3891e34b8..56bfb30b0ef58 100644 +--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c ++++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c +@@ -89,8 +89,7 @@ static int cxgbit_is_ofld_imm(const struct sk_buff *skb) + if (likely(cxgbit_skcb_flags(skb) & SKCBF_TX_ISO)) + length += sizeof(struct cpl_tx_data_iso); + +-#define MAX_IMM_TX_PKT_LEN 256 +- return length <= MAX_IMM_TX_PKT_LEN; ++ return length <= MAX_IMM_OFLD_TX_DATA_WR_LEN; + } + + /* +-- +2.27.0 + diff --git a/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch b/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch new file mode 100644 index 00000000000..4e48809f548 --- /dev/null +++ b/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch @@ -0,0 +1,51 @@ +From d8ee727875ed5c4133e6308ba72d73ef80e3f447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 17:06:14 +0100 +Subject: dmaengine: fsldma: Fix a resource leak in an error handling path of + the probe function + +From: Christophe JAILLET + +[ Upstream commit b202d4e82531a62a33a6b14d321dd2aad491578e ] + +In case of error, the previous 'fsl_dma_chan_probe()' calls must be undone +by some 'fsl_dma_chan_remove()', as already done in the remove function. + +It was added in the remove function in commit 77cd62e8082b ("fsldma: allow +Freescale Elo DMA driver to be compiled as a module") + +Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201212160614.92576-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsldma.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c +index e3412be957122..e7ca3175dbc30 100644 +--- a/drivers/dma/fsldma.c ++++ b/drivers/dma/fsldma.c +@@ -1218,6 +1218,7 @@ static int fsldma_of_probe(struct platform_device *op) + { + struct fsldma_device *fdev; + struct device_node *child; ++ unsigned int i; + int err; + + fdev = kzalloc(sizeof(*fdev), GFP_KERNEL); +@@ -1296,6 +1297,10 @@ static int fsldma_of_probe(struct platform_device *op) + return 0; + + out_free_fdev: ++ for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) { ++ if (fdev->chan[i]) ++ fsl_dma_chan_remove(fdev->chan[i]); ++ } + irq_dispose_mapping(fdev->irq); + iounmap(fdev->regs); + out_free: +-- +2.27.0 + diff --git a/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch b/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch new file mode 100644 index 00000000000..10ebaad0038 --- /dev/null +++ b/queue-4.19/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch @@ -0,0 +1,42 @@ +From 211fd287723174335b96da6b4f8962a32a5e7e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 17:05:16 +0100 +Subject: dmaengine: fsldma: Fix a resource leak in the remove function + +From: Christophe JAILLET + +[ Upstream commit cbc0ad004c03ad7971726a5db3ec84dba3dcb857 ] + +A 'irq_dispose_mapping()' call is missing in the remove function. +Add it. + +This is needed to undo the 'irq_of_parse_and_map() call from the probe +function and already part of the error handling path of the probe function. + +It was added in the probe function only in commit d3f620b2c4fe ("fsldma: +simplify IRQ probing and handling") + +Fixes: 77cd62e8082b ("fsldma: allow Freescale Elo DMA driver to be compiled as a module") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201212160516.92515-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsldma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c +index 1117b5123a6fc..e3412be957122 100644 +--- a/drivers/dma/fsldma.c ++++ b/drivers/dma/fsldma.c +@@ -1318,6 +1318,7 @@ static int fsldma_of_remove(struct platform_device *op) + if (fdev->chan[i]) + fsl_dma_chan_remove(fdev->chan[i]); + } ++ irq_dispose_mapping(fdev->irq); + + iounmap(fdev->regs); + kfree(fdev); +-- +2.27.0 + diff --git a/queue-4.19/dmaengine-hsu-disable-spurious-interrupt.patch b/queue-4.19/dmaengine-hsu-disable-spurious-interrupt.patch new file mode 100644 index 00000000000..0b257e3d746 --- /dev/null +++ b/queue-4.19/dmaengine-hsu-disable-spurious-interrupt.patch @@ -0,0 +1,76 @@ +From 7cf152af778c94ffe5a9643a2c91d344bb6261e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 23:37:49 +0100 +Subject: dmaengine: hsu: disable spurious interrupt + +From: Ferry Toth + +[ Upstream commit 035b73b2b3b2e074a56489a7bf84b6a8012c0e0d ] + +On Intel Tangier B0 and Anniedale the interrupt line, disregarding +to have different numbers, is shared between HSU DMA and UART IPs. +Thus on such SoCs we are expecting that IRQ handler is called in +UART driver only. hsu_pci_irq was handling the spurious interrupt +from HSU DMA by returning immediately. This wastes CPU time and +since HSU DMA and HSU UART interrupt occur simultaneously they race +to be handled causing delay to the HSU UART interrupt handling. +Fix this by disabling the interrupt entirely. + +Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case") +Signed-off-by: Ferry Toth +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210112223749.97036-1-ftoth@exalondelft.nl +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/hsu/pci.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/dma/hsu/pci.c b/drivers/dma/hsu/pci.c +index ad45cd344bbae..78836526d2e07 100644 +--- a/drivers/dma/hsu/pci.c ++++ b/drivers/dma/hsu/pci.c +@@ -29,22 +29,12 @@ + static irqreturn_t hsu_pci_irq(int irq, void *dev) + { + struct hsu_dma_chip *chip = dev; +- struct pci_dev *pdev = to_pci_dev(chip->dev); + u32 dmaisr; + u32 status; + unsigned short i; + int ret = 0; + int err; + +- /* +- * On Intel Tangier B0 and Anniedale the interrupt line, disregarding +- * to have different numbers, is shared between HSU DMA and UART IPs. +- * Thus on such SoCs we are expecting that IRQ handler is called in +- * UART driver only. +- */ +- if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA) +- return IRQ_HANDLED; +- + dmaisr = readl(chip->regs + HSU_PCI_DMAISR); + for (i = 0; i < chip->hsu->nr_channels; i++) { + if (dmaisr & 0x1) { +@@ -108,6 +98,17 @@ static int hsu_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (ret) + goto err_register_irq; + ++ /* ++ * On Intel Tangier B0 and Anniedale the interrupt line, disregarding ++ * to have different numbers, is shared between HSU DMA and UART IPs. ++ * Thus on such SoCs we are expecting that IRQ handler is called in ++ * UART driver only. Instead of handling the spurious interrupt ++ * from HSU DMA here and waste CPU time and delay HSU UART interrupt ++ * handling, disable the interrupt entirely. ++ */ ++ if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA) ++ disable_irq_nosync(chip->irq); ++ + pci_set_drvdata(pdev, chip); + + return 0; +-- +2.27.0 + diff --git a/queue-4.19/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch b/queue-4.19/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch new file mode 100644 index 00000000000..3e64ae5accc --- /dev/null +++ b/queue-4.19/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch @@ -0,0 +1,38 @@ +From 302ccbcfd98fa8d578bfd7d4c64ff9247a96c2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 17:25:35 +0100 +Subject: dmaengine: owl-dma: Fix a resource leak in the remove function + +From: Christophe JAILLET + +[ Upstream commit 1f0a16f04113f9f0ab0c8e6d3abe661edab549e6 ] + +A 'dma_pool_destroy()' call is missing in the remove function. +Add it. + +This call is already made in the error handling path of the probe function. + +Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201212162535.95727-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/owl-dma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c +index 7ff04bf04b31b..da5050ab7f387 100644 +--- a/drivers/dma/owl-dma.c ++++ b/drivers/dma/owl-dma.c +@@ -932,6 +932,7 @@ static int owl_dma_remove(struct platform_device *pdev) + owl_dma_free(od); + + clk_disable_unprepare(od->clk); ++ dma_pool_destroy(od->lli_pool); + + return 0; + } +-- +2.27.0 + diff --git a/queue-4.19/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch b/queue-4.19/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch new file mode 100644 index 00000000000..70c8e470eb6 --- /dev/null +++ b/queue-4.19/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch @@ -0,0 +1,45 @@ +From be2a95d8d1f95d3ee97b87e7966fcb59733bfce9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 08:08:25 +0100 +Subject: Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() + +From: Andrea Parri (Microsoft) + +[ Upstream commit e3fa4b747f085d2cda09bba0533b86fa76038635 ] + +When channel->device_obj is non-NULL, vmbus_onoffer_rescind() could +invoke put_device(), that will eventually release the device and free +the channel object (cf. vmbus_device_release()). However, a pointer +to the object is dereferenced again later to load the primary_channel. +The use-after-free can be avoided by noticing that this load/check is +redundant if device_obj is non-NULL: primary_channel must be NULL if +device_obj is non-NULL, cf. vmbus_add_channel_work(). + +Fixes: 54a66265d6754b ("Drivers: hv: vmbus: Fix rescind handling") +Reported-by: Juan Vazquez +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20201209070827.29335-5-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel_mgmt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 7920b0d7e35a7..ac9617671757c 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -1001,8 +1001,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) + vmbus_device_unregister(channel->device_obj); + put_device(dev); + } +- } +- if (channel->primary_channel != NULL) { ++ } else if (channel->primary_channel != NULL) { + /* + * Sub-channel is being rescinded. Following is the channel + * close sequence when initiated from the driveri (refer to +-- +2.27.0 + diff --git a/queue-4.19/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch b/queue-4.19/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch new file mode 100644 index 00000000000..8a8ce4d65af --- /dev/null +++ b/queue-4.19/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch @@ -0,0 +1,59 @@ +From a562764bf9c9a8c2bc5a312bc63925fbdf79be60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 07:17:02 +0100 +Subject: drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth + reduction. + +From: Mario Kleiner + +[ Upstream commit 1916866dfa4aaceba1a70db83fde569387649d93 ] + +In set_clamp(), the comments and definitions for the COLOR_DEPTH_101010 +and COLOR_DEPTH_121212 cases directly contradict the code comment which +explains how this should work, whereas the COLOR_DEPTH_888 case +is consistent with the code comments. Comment says the bitmask should +be chosen to align to the top-most 10 or 12 MSB's on a 14 bit bus, but +the implementation contradicts that: 10 bit case sets a mask for 12 bpc +clamping, whereas 12 bit case sets a mask for 14 bpc clamping. + +Note that during my limited testing on DCE-8.3 (HDMI deep color) +and DCE-11.2 (DP deep color), this didn't have any obvious ill +effects, neither did fixing it change anything obvious for the +better, so this fix may be inconsequential on DCE, and just +reduce the confusion of innocent bystanders when reading the code +and trying to investigate problems with 10 bpc+ output. + +Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") + +Signed-off-by: Mario Kleiner +Cc: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index ab63d0d0304cb..6fd57cfb112f5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -429,12 +429,12 @@ static void set_clamp( + clamp_max = 0x3FC0; + break; + case COLOR_DEPTH_101010: +- /* 10bit MSB aligned on 14 bit bus '11 1111 1111 1100' */ +- clamp_max = 0x3FFC; ++ /* 10bit MSB aligned on 14 bit bus '11 1111 1111 0000' */ ++ clamp_max = 0x3FF0; + break; + case COLOR_DEPTH_121212: +- /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1111' */ +- clamp_max = 0x3FFF; ++ /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1100' */ ++ clamp_max = 0x3FFC; + break; + default: + clamp_max = 0x3FC0; +-- +2.27.0 + diff --git a/queue-4.19/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch b/queue-4.19/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch new file mode 100644 index 00000000000..728859520f0 --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch @@ -0,0 +1,38 @@ +From 2166bbc62ed1d952867f4d54e3fba9677455a24d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Dec 2020 16:56:07 +0800 +Subject: drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if + condition + +From: Chenyang Li + +[ Upstream commit 956e20eb0fbb206e5e795539db5469db099715c8 ] + +Add an underscore in amdgpu_trace.h line 24 "_AMDGPU_TRACE_H". + +Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") +Reviewed-by: Guchun Chen +Reviewed-by: Paul Menzel +Signed-off-by: Chenyang Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +index 7206a0025b17a..db9907fb99f3f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +@@ -21,7 +21,7 @@ + * + */ + +-#if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ) ++#if !defined(_AMDGPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ) + #define _AMDGPU_TRACE_H_ + + #include +-- +2.27.0 + diff --git a/queue-4.19/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch b/queue-4.19/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch new file mode 100644 index 00000000000..a8e7d86401c --- /dev/null +++ b/queue-4.19/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch @@ -0,0 +1,48 @@ +From 9323e507657aaa982478401232e354c0ef897aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 08:56:36 +0300 +Subject: drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() + +From: Dan Carpenter + +[ Upstream commit c915ef890d5dc79f483e1ca3b3a5b5f1a170690c ] + +If the user passes a "level" value which is higher than 31 then that +leads to shift wrapping. The undefined behavior will lead to a +syzkaller stack dump. + +Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)") +Signed-off-by: Dan Carpenter +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +index e63a253eb4255..cbb969a870f6a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -617,7 +617,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev, + static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) + { + int ret; +- long level; ++ unsigned long level; + char *sub_str = NULL; + char *tmp; + char buf_cpy[AMDGPU_MASK_BUF_MAX + 1]; +@@ -633,8 +633,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) + while (tmp[0]) { + sub_str = strsep(&tmp, delimiter); + if (strlen(sub_str)) { +- ret = kstrtol(sub_str, 0, &level); +- if (ret) ++ ret = kstrtoul(sub_str, 0, &level); ++ if (ret || level > 31) + return -EINVAL; + *mask |= 1 << level; + } else +-- +2.27.0 + diff --git a/queue-4.19/drm-gma500-fix-error-return-code-in-psb_driver_load.patch b/queue-4.19/drm-gma500-fix-error-return-code-in-psb_driver_load.patch new file mode 100644 index 00000000000..35145a63eb3 --- /dev/null +++ b/queue-4.19/drm-gma500-fix-error-return-code-in-psb_driver_load.patch @@ -0,0 +1,38 @@ +From a604d7694632eacb6cec46490e19537759bd3010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 10:02:16 +0800 +Subject: drm/gma500: Fix error return code in psb_driver_load() + +From: Jialin Zhang + +[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers") +Reported-by: Hulk Robot +Signed-off-by: Jialin Zhang +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/psb_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c +index ac32ab5aa0027..2fa3c7fc4b6d5 100644 +--- a/drivers/gpu/drm/gma500/psb_drv.c ++++ b/drivers/gpu/drm/gma500/psb_drv.c +@@ -316,6 +316,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags) + if (ret) + goto out_err; + ++ ret = -ENOMEM; ++ + dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0); + if (!dev_priv->mmu) + goto out_err; +-- +2.27.0 + diff --git a/queue-4.19/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch b/queue-4.19/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch new file mode 100644 index 00000000000..846f434c094 --- /dev/null +++ b/queue-4.19/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch @@ -0,0 +1,37 @@ +From 2a8e1f4474bdb1c3f7960db6543a1542c2907d4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 17:15:58 +0100 +Subject: drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) + +From: Konrad Dybcio + +[ Upstream commit 33a7808ce1aea6e2edc1af25db25928137940c02 ] + +The previous registers were *almost* correct, but instead of +PHYs, they were pointing at DSI PLLs, resulting in the PHY id +autodetection failing miserably. + +Fixes: dcefc117cc19 ("drm/msm/dsi: Add support for msm8x94") +Signed-off-by: Konrad Dybcio +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c +index 1ca6c69516f57..4c037d855b272 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c +@@ -147,7 +147,7 @@ const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs = { + .disable = dsi_20nm_phy_disable, + .init = msm_dsi_phy_init_common, + }, +- .io_start = { 0xfd998300, 0xfd9a0300 }, ++ .io_start = { 0xfd998500, 0xfd9a0500 }, + .num_dsi_phy = 2, + }; + +-- +2.27.0 + diff --git a/queue-4.19/ext4-fix-potential-htree-index-checksum-corruption.patch b/queue-4.19/ext4-fix-potential-htree-index-checksum-corruption.patch new file mode 100644 index 00000000000..626a9cb49aa --- /dev/null +++ b/queue-4.19/ext4-fix-potential-htree-index-checksum-corruption.patch @@ -0,0 +1,55 @@ +From c5a4ccbfcadddd49125d4a49cac96ebc05249121 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 00:05:20 -0500 +Subject: ext4: fix potential htree index checksum corruption + +From: Theodore Ts'o + +[ Upstream commit b5776e7524afbd4569978ff790864755c438bba7 ] + +In the case where we need to do an interior node split, and +immediately afterwards, we are unable to allocate a new directory leaf +block due to ENOSPC, the directory index checksum's will not be filled +in correctly (and indeed, will not be correctly journalled). + +This looks like a bug that was introduced when we added largedir +support. The original code doesn't make any sense (and should have +been caught in code review), but it was hidden because most of the +time, the index node checksum will be set by do_split(). But if +do_split bails out due to ENOSPC, then ext4_handle_dirty_dx_node() +won't get called, and so the directory index checksum field will not +get set, leading to: + +EXT4-fs error (device sdb): dx_probe:858: inode #6635543: block 4022: comm nfsd: Directory index failed checksum + +Google-Bug-Id: 176345532 +Fixes: e08ac99fa2a2 ("ext4: add largedir feature") +Cc: Artem Blagodarenko +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 8f7e0ad5b5ef1..0dde6385a1258 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2315,11 +2315,10 @@ again: + (frame - 1)->bh); + if (err) + goto journal_error; +- if (restart) { +- err = ext4_handle_dirty_dx_node(handle, dir, +- frame->bh); ++ err = ext4_handle_dirty_dx_node(handle, dir, ++ frame->bh); ++ if (err) + goto journal_error; +- } + } else { + struct dx_root *dxroot; + memcpy((char *) entries2, (char *) entries, +-- +2.27.0 + diff --git a/queue-4.19/f2fs-fix-to-avoid-inconsistent-quota-data.patch b/queue-4.19/f2fs-fix-to-avoid-inconsistent-quota-data.patch new file mode 100644 index 00000000000..d78015cb0b4 --- /dev/null +++ b/queue-4.19/f2fs-fix-to-avoid-inconsistent-quota-data.patch @@ -0,0 +1,100 @@ +From 841bd350c3dd7576204fdb7758fd9f864d170b7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 17:02:56 +0800 +Subject: f2fs: fix to avoid inconsistent quota data + +From: Yi Chen + +[ Upstream commit 25fb04dbce6a0e165d28fd1fa8a1d7018c637fe8 ] + +Occasionally, quota data may be corrupted detected by fsck: + +Info: checkpoint state = 45 : crc compacted_summary unmount +[QUOTA WARNING] Usage inconsistent for ID 0:actual (1543036928, 762) != expected (1543032832, 762) +[ASSERT] (fsck_chk_quota_files:1986) --> Quota file is missing or invalid quota file content found. +[QUOTA WARNING] Usage inconsistent for ID 0:actual (1352478720, 344) != expected (1352474624, 344) +[ASSERT] (fsck_chk_quota_files:1986) --> Quota file is missing or invalid quota file content found. + +[FSCK] Unreachable nat entries [Ok..] [0x0] +[FSCK] SIT valid block bitmap checking [Ok..] +[FSCK] Hard link checking for regular file [Ok..] [0x0] +[FSCK] valid_block_count matching with CP [Ok..] [0xdf299] +[FSCK] valid_node_count matcing with CP (de lookup) [Ok..] [0x2b01] +[FSCK] valid_node_count matcing with CP (nat lookup) [Ok..] [0x2b01] +[FSCK] valid_inode_count matched with CP [Ok..] [0x2665] +[FSCK] free segment_count matched with CP [Ok..] [0xcb04] +[FSCK] next block offset is free [Ok..] +[FSCK] fixing SIT types +[FSCK] other corrupted bugs [Fail] + +The root cause is: +If we open file w/ readonly flag, disk quota info won't be initialized +for this file, however, following mmap() will force to convert inline +inode via f2fs_convert_inline_inode(), which may increase block usage +for this inode w/o updating quota data, it causes inconsistent disk quota +info. + +The issue will happen in following stack: +open(file, O_RDONLY) +mmap(file) +- f2fs_convert_inline_inode + - f2fs_convert_inline_page + - f2fs_reserve_block + - f2fs_reserve_new_block + - f2fs_reserve_new_blocks + - f2fs_i_blocks_write + - dquot_claim_block +inode->i_blocks increase, but the dqb_curspace keep the size for the dquots +is NULL. + +To fix this issue, let's call dquot_initialize() anyway in both +f2fs_truncate() and f2fs_convert_inline_inode() functions to avoid potential +inconsistent quota data issue. + +Fixes: 0abd675e97e6 ("f2fs: support plain user/group quota") +Signed-off-by: Daiyue Zhang +Signed-off-by: Dehe Gu +Signed-off-by: Junchao Jiang +Signed-off-by: Ge Qiu +Signed-off-by: Yi Chen +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 4 ++++ + fs/f2fs/inline.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 59b5c0b032bb5..79e692a6c8b27 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -675,6 +675,10 @@ int f2fs_truncate(struct inode *inode) + return -EIO; + } + ++ err = dquot_initialize(inode); ++ if (err) ++ return err; ++ + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 2fabeb0bb28fd..299f295fcb6c7 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -193,6 +193,10 @@ int f2fs_convert_inline_inode(struct inode *inode) + if (!f2fs_has_inline_data(inode)) + return 0; + ++ err = dquot_initialize(inode); ++ if (err) ++ return err; ++ + page = f2fs_grab_cache_page(inode->i_mapping, 0, false); + if (!page) + return -ENOMEM; +-- +2.27.0 + diff --git a/queue-4.19/fbdev-aty-sparc64-requires-fb_aty_ct.patch b/queue-4.19/fbdev-aty-sparc64-requires-fb_aty_ct.patch new file mode 100644 index 00000000000..28cb9220f89 --- /dev/null +++ b/queue-4.19/fbdev-aty-sparc64-requires-fb_aty_ct.patch @@ -0,0 +1,62 @@ +From 897dbc592b61466e71ce6c7b485468a2443ddb99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 19:17:52 -0800 +Subject: fbdev: aty: SPARC64 requires FB_ATY_CT + +From: Randy Dunlap + +[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ] + +It looks like SPARC64 requires FB_ATY_CT to build without errors, +so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled +instead of using "default y if SPARC64 && PCI", which is not strong +enough to prevent build errors. + +As it currently is, FB_ATY_CT can be disabled, resulting in build +errors: + +ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined! +ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined! + +Reviewed-by: Geert Uytterhoeven +Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev") +Signed-off-by: Randy Dunlap +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Tomi Valkeinen +Cc: dri-devel@lists.freedesktop.org +Cc: linux-fbdev@vger.kernel.org +Cc: Daniel Vetter +Cc: David Airlie +Cc: Bartlomiej Zolnierkiewicz +Cc: Geert Uytterhoeven +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +index f99558d006bf4..97c4319797d5c 100644 +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -1303,6 +1303,7 @@ config FB_ATY + select FB_CFB_IMAGEBLIT + select FB_BACKLIGHT if FB_ATY_BACKLIGHT + select FB_MACMODES if PPC ++ select FB_ATY_CT if SPARC64 && PCI + help + This driver supports graphics boards with the ATI Mach64 chips. + Say Y if you have such a graphics board. +@@ -1313,7 +1314,6 @@ config FB_ATY + config FB_ATY_CT + bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support" + depends on PCI && FB_ATY +- default y if SPARC64 && PCI + help + Say Y here to support use of ATI's 64-bit Rage boards (or other + boards based on the Mach64 CT, VT, GT, and LT chipsets) as a +-- +2.27.0 + diff --git a/queue-4.19/fdt-properly-handle-no-map-field-in-the-memory-regio.patch b/queue-4.19/fdt-properly-handle-no-map-field-in-the-memory-regio.patch new file mode 100644 index 00000000000..08a63d08ebe --- /dev/null +++ b/queue-4.19/fdt-properly-handle-no-map-field-in-the-memory-regio.patch @@ -0,0 +1,42 @@ +From 9ecbb26962f1042e808a25c373ab1ca0c9d16c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 11:45:43 +0000 +Subject: fdt: Properly handle "no-map" field in the memory region + +From: KarimAllah Ahmed + +[ Upstream commit 86588296acbfb1591e92ba60221e95677ecadb43 ] + +Mark the memory region with NOMAP flag instead of completely removing it +from the memory blocks. That makes the FDT handling consistent with the EFI +memory map handling. + +Cc: Rob Herring +Cc: Frank Rowand +Cc: devicetree@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: KarimAllah Ahmed +Signed-off-by: Quentin Perret +Link: https://lore.kernel.org/r/20210115114544.1830068-2-qperret@google.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 800ad252cf9c6..aa15e5d183c18 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -1173,7 +1173,7 @@ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base, + phys_addr_t size, bool nomap) + { + if (nomap) +- return memblock_remove(base, size); ++ return memblock_mark_nomap(base, size); + return memblock_reserve(base, size); + } + +-- +2.27.0 + diff --git a/queue-4.19/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch b/queue-4.19/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch new file mode 100644 index 00000000000..a284a979bcb --- /dev/null +++ b/queue-4.19/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch @@ -0,0 +1,39 @@ +From 34c5ca4de0544e7e9026802e2e240d4c4e96e04a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 13:01:08 +0000 +Subject: fs/jfs: fix potential integer overflow on shift of a int + +From: Colin Ian King + +[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ] + +The left shift of int 32 bit integer constant 1 is evaluated using 32 bit +arithmetic and then assigned to a signed 64 bit integer. In the case where +l2nb is 32 or more this can lead to an overflow. Avoid this by shifting +the value 1LL instead. + +Addresses-Coverity: ("Uninitentional integer overflow") +Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem") +Signed-off-by: Colin Ian King +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 49263e220dbcf..687b07b9b4f62 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -1669,7 +1669,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen) + } else if (rc == -ENOSPC) { + /* search for next smaller log2 block */ + l2nb = BLKSTOL2(nblocks) - 1; +- nblocks = 1 << l2nb; ++ nblocks = 1LL << l2nb; + } else { + /* Trim any already allocated blocks */ + jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n"); +-- +2.27.0 + diff --git a/queue-4.19/gma500-clean-up-error-handling-in-init.patch b/queue-4.19/gma500-clean-up-error-handling-in-init.patch new file mode 100644 index 00000000000..35cbbe5e190 --- /dev/null +++ b/queue-4.19/gma500-clean-up-error-handling-in-init.patch @@ -0,0 +1,73 @@ +From 1b9c2df7950bf05dec9495a6da055a69ab727cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 11:40:48 +0300 +Subject: gma500: clean up error handling in init + +From: Dan Carpenter + +[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ] + +The main problem with this error handling was that it didn't clean up if +i2c_add_numbered_adapter() failed. This code is pretty old, and doesn't +match with today's checkpatch.pl standards so I took the opportunity to +tidy it up a bit. I changed the NULL comparison, and removed the +WARNING message if kzalloc() fails and updated the label names. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Signed-off-by: Dan Carpenter +Signed-off-by: Patrik Jakobsson +Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c +index e281070611480..fc9a34ed58bd1 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c ++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c +@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev) + hdmi_dev = pci_get_drvdata(dev); + + i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL); +- if (i2c_dev == NULL) { +- DRM_ERROR("Can't allocate interface\n"); +- ret = -ENOMEM; +- goto exit; +- } ++ if (!i2c_dev) ++ return -ENOMEM; + + i2c_dev->adap = &oaktrail_hdmi_i2c_adapter; + i2c_dev->status = I2C_STAT_INIT; +@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev) + oaktrail_hdmi_i2c_adapter.name, hdmi_dev); + if (ret) { + DRM_ERROR("Failed to request IRQ for I2C controller\n"); +- goto err; ++ goto free_dev; + } + + /* Adapter registration */ + ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter); +- return ret; ++ if (ret) { ++ DRM_ERROR("Failed to add I2C adapter\n"); ++ goto free_irq; ++ } + +-err: ++ return 0; ++ ++free_irq: ++ free_irq(dev->irq, hdmi_dev); ++free_dev: + kfree(i2c_dev); +-exit: ++ + return ret; + } + +-- +2.27.0 + diff --git a/queue-4.19/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch b/queue-4.19/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch new file mode 100644 index 00000000000..44642131864 --- /dev/null +++ b/queue-4.19/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch @@ -0,0 +1,51 @@ +From b5bed1534d0569ddcb3d75ffb8c6301ccc9fd10a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Dec 2020 17:12:21 -0800 +Subject: HID: core: detect and skip invalid inputs to snto32() + +From: Randy Dunlap + +[ Upstream commit a0312af1f94d13800e63a7d0a66e563582e39aec ] + +Prevent invalid (0, 0) inputs to hid-core's snto32() function. + +Maybe it is just the dummy device here that is causing this, but +there are hundreds of calls to snto32(0, 0). Having n (bits count) +of 0 is causing the current UBSAN trap with a shift value of +0xffffffff (-1, or n - 1 in this function). + +Either of the value to shift being 0 or the bits count being 0 can be +handled by just returning 0 to the caller, avoiding the following +complex shift + OR operations: + + return value & (1 << (n - 1)) ? value | (~0U << n) : value; + +Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") +Signed-off-by: Randy Dunlap +Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com +Cc: Jiri Kosina +Cc: Benjamin Tissoires +Cc: linux-input@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index bde5cef3290f5..9b66eb1d42c2d 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1128,6 +1128,9 @@ EXPORT_SYMBOL_GPL(hid_open_report); + + static s32 snto32(__u32 value, unsigned n) + { ++ if (!value || !n) ++ return 0; ++ + switch (n) { + case 8: return ((__s8)value); + case 16: return ((__s16)value); +-- +2.27.0 + diff --git a/queue-4.19/hwrng-timeriomem-fix-cooldown-period-calculation.patch b/queue-4.19/hwrng-timeriomem-fix-cooldown-period-calculation.patch new file mode 100644 index 00000000000..f8fcbc6b00b --- /dev/null +++ b/queue-4.19/hwrng-timeriomem-fix-cooldown-period-calculation.patch @@ -0,0 +1,35 @@ +From 1bac356ca7e0aa04207184294e8d633426f28740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Feb 2021 16:14:59 +0100 +Subject: hwrng: timeriomem - Fix cooldown period calculation + +From: Jan Henrik Weinstock + +[ Upstream commit e145f5565dc48ccaf4cb50b7cfc48777bed8c100 ] + +Ensure cooldown period tolerance of 1% is actually accounted for. + +Fixes: ca3bff70ab32 ("hwrng: timeriomem - Improve performance...") +Signed-off-by: Jan Henrik Weinstock +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/timeriomem-rng.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c +index f615684028af7..ba01f24db6db0 100644 +--- a/drivers/char/hw_random/timeriomem-rng.c ++++ b/drivers/char/hw_random/timeriomem-rng.c +@@ -72,7 +72,7 @@ static int timeriomem_rng_read(struct hwrng *hwrng, void *data, + */ + if (retval > 0) + usleep_range(period_us, +- period_us + min(1, period_us / 100)); ++ period_us + max(1, period_us / 100)); + + *(u32 *)data = readl(priv->io_base); + retval += sizeof(u32); +-- +2.27.0 + diff --git a/queue-4.19/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch b/queue-4.19/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch new file mode 100644 index 00000000000..e87d9bd9eb3 --- /dev/null +++ b/queue-4.19/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch @@ -0,0 +1,40 @@ +From 96d002bbab6f9451da34332c4b45ff549d8ee91b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:11:01 +0100 +Subject: i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition + +From: Maxime Ripard + +[ Upstream commit a1858ce0cfe31368b23ba55794e409fb57ced4a4 ] + +The brcmstb_send_i2c_cmd currently has a condition that is (CMD_RD || +CMD_WR) which always evaluates to true, while the obvious fix is to test +whether the cmd variable passed as parameter holds one of these two +values. + +Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver") +Reported-by: Dave Stevenson +Signed-off-by: Maxime Ripard +Acked-by: Florian Fainelli +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-brcmstb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c +index 826d320499961..2086a96307bf9 100644 +--- a/drivers/i2c/busses/i2c-brcmstb.c ++++ b/drivers/i2c/busses/i2c-brcmstb.c +@@ -318,7 +318,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev, + goto cmd_out; + } + +- if ((CMD_RD || CMD_WR) && ++ if ((cmd == CMD_RD || cmd == CMD_WR) && + bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) { + rc = -EREMOTEIO; + dev_dbg(dev->device, "controller received NOACK intr for %s\n", +-- +2.27.0 + diff --git a/queue-4.19/i40e-add-zero-initialization-of-aq-command-structure.patch b/queue-4.19/i40e-add-zero-initialization-of-aq-command-structure.patch new file mode 100644 index 00000000000..63ad452b525 --- /dev/null +++ b/queue-4.19/i40e-add-zero-initialization-of-aq-command-structure.patch @@ -0,0 +1,62 @@ +From 5ccd23aa60c3144489eb8dc56a11cb80cfe0a5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 10:35:37 +0000 +Subject: i40e: Add zero-initialization of AQ command structures +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mateusz Palczewski + +[ Upstream commit d2c788f739b6f68090e968a2ee31b543701e795f ] + +Zero-initialize AQ command data structures to comply with +API specifications. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Fixes: f4492db16df8 ("i40e: Add NPAR BW get and set functions") +Signed-off-by: Andrzej Sawuła +Signed-off-by: Mateusz Palczewski +Reviewed-by: Arkadiusz Kubalewski +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index a728b6a7872cb..2518e2d6484c0 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7007,6 +7007,8 @@ int i40e_add_del_cloud_filter(struct i40e_vsi *vsi, + if (filter->flags >= ARRAY_SIZE(flag_table)) + return I40E_ERR_CONFIG; + ++ memset(&cld_filter, 0, sizeof(cld_filter)); ++ + /* copy element needed to add cloud filter from filter */ + i40e_set_cld_element(filter, &cld_filter); + +@@ -7074,6 +7076,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi, + !ipv6_addr_any(&filter->ip.v6.src_ip6)) + return -EOPNOTSUPP; + ++ memset(&cld_filter, 0, sizeof(cld_filter)); ++ + /* copy element needed to add cloud filter from filter */ + i40e_set_cld_element(filter, &cld_filter.element); + +@@ -11107,6 +11111,8 @@ i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf) + struct i40e_aqc_configure_partition_bw_data bw_data; + i40e_status status; + ++ memset(&bw_data, 0, sizeof(bw_data)); ++ + /* Set the valid bit for this PF */ + bw_data.pf_valid_bits = cpu_to_le16(BIT(pf->hw.pf_id)); + bw_data.max_bw[pf->hw.pf_id] = pf->max_bw & I40E_ALT_BW_VALUE_MASK; +-- +2.27.0 + diff --git a/queue-4.19/i40e-fix-add-tc-filter-for-ipv6.patch b/queue-4.19/i40e-fix-add-tc-filter-for-ipv6.patch new file mode 100644 index 00000000000..9e332b91e41 --- /dev/null +++ b/queue-4.19/i40e-fix-add-tc-filter-for-ipv6.patch @@ -0,0 +1,51 @@ +From 16c02ba76e531cc04d47bc403f310a9bfd35919e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Dec 2020 11:38:00 +0100 +Subject: i40e: Fix add TC filter for IPv6 + +From: Mateusz Palczewski + +[ Upstream commit 61c1e0eb8375def7c891bfe857bb795a57090526 ] + +Fix insufficient distinction between IPv4 and IPv6 addresses +when creating a filter. +IPv4 and IPv6 are kept in the same memory area. If IPv6 is added, +then it's caught by IPv4 check, which leads to err -95. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Reviewed-by: Jaroslaw Gawin +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index eba6f7b118a9b..fe9da568ee196 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7071,7 +7071,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi, + return -EOPNOTSUPP; + + /* adding filter using src_port/src_ip is not supported at this stage */ +- if (filter->src_port || filter->src_ipv4 || ++ if (filter->src_port || ++ (filter->src_ipv4 && filter->n_proto != ETH_P_IPV6) || + !ipv6_addr_any(&filter->ip.v6.src_ip6)) + return -EOPNOTSUPP; + +@@ -7100,7 +7101,7 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi, + cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_MAC_VLAN_PORT); + } + +- } else if (filter->dst_ipv4 || ++ } else if ((filter->dst_ipv4 && filter->n_proto != ETH_P_IPV6) || + !ipv6_addr_any(&filter->ip.v6.dst_ip6)) { + cld_filter.element.flags = + cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_IP_PORT); +-- +2.27.0 + diff --git a/queue-4.19/i40e-fix-flow-for-ipv6-next-header-extension-header.patch b/queue-4.19/i40e-fix-flow-for-ipv6-next-header-extension-header.patch new file mode 100644 index 00000000000..f56993feb10 --- /dev/null +++ b/queue-4.19/i40e-fix-flow-for-ipv6-next-header-extension-header.patch @@ -0,0 +1,63 @@ +From 836b02e94a0255c2ba2a935a4a6669607e9ada13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 07:57:04 +0000 +Subject: i40e: Fix flow for IPv6 next header (extension header) + +From: Slawomir Laba + +[ Upstream commit 92c6058024e87087cf1b99b0389d67c0a886360e ] + +When a packet contains an IPv6 header with next header which is +an extension header and not a protocol one, the kernel function +skb_transport_header called with such sk_buff will return a +pointer to the extension header and not to the TCP one. + +The above explained call caused a problem with packet processing +for skb with encapsulation for tunnel with I40E_TX_CTX_EXT_IP_IPV6. +The extension header was not skipped at all. + +The ipv6_skip_exthdr function does check if next header of the IPV6 +header is an extension header and doesn't modify the l4_proto pointer +if it points to a protocol header value so its safe to omit the +comparison of exthdr and l4.hdr pointers. The ipv6_skip_exthdr can +return value -1. This means that the skipping process failed +and there is something wrong with the packet so it will be dropped. + +Fixes: a3fd9d8876a5 ("i40e/i40evf: Handle IPv6 extension headers in checksum offload") +Signed-off-by: Slawomir Laba +Signed-off-by: Przemyslaw Patynowski +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index b5042d1a63c0b..9ccbcd88bf1e6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3070,13 +3070,16 @@ static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags, + + l4_proto = ip.v4->protocol; + } else if (*tx_flags & I40E_TX_FLAGS_IPV6) { ++ int ret; ++ + tunnel |= I40E_TX_CTX_EXT_IP_IPV6; + + exthdr = ip.hdr + sizeof(*ip.v6); + l4_proto = ip.v6->nexthdr; +- if (l4.hdr != exthdr) +- ipv6_skip_exthdr(skb, exthdr - skb->data, +- &l4_proto, &frag_off); ++ ret = ipv6_skip_exthdr(skb, exthdr - skb->data, ++ &l4_proto, &frag_off); ++ if (ret < 0) ++ return -1; + } + + /* define outer transport */ +-- +2.27.0 + diff --git a/queue-4.19/i40e-fix-overwriting-flow-control-settings-during-dr.patch b/queue-4.19/i40e-fix-overwriting-flow-control-settings-during-dr.patch new file mode 100644 index 00000000000..366dca17060 --- /dev/null +++ b/queue-4.19/i40e-fix-overwriting-flow-control-settings-during-dr.patch @@ -0,0 +1,87 @@ +From b5a55fda123e72011a5ba4e150ac780244f0aaf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 15:08:27 +0000 +Subject: i40e: Fix overwriting flow control settings during driver loading + +From: Mateusz Palczewski + +[ Upstream commit 4cdb9f80dcd46aab3c0020b4a6920c22735c5d6e ] + +During driver loading flow control settings were written to FW +using a variable which was always zero, since it was being set +only by ethtool. This behavior has been corrected and driver +no longer overwrites the default FW/NVM settings. + +Fixes: 373149fc99a0 ("i40e: Decrease the scope of rtnl lock") +Signed-off-by: Dawid Lukwinski +Signed-off-by: Mateusz Palczewski +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 27 --------------------- + 1 file changed, 27 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2518e2d6484c0..7a9d8bf2e1d5f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -9403,7 +9403,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + { + struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi]; + struct i40e_hw *hw = &pf->hw; +- u8 set_fc_aq_fail = 0; + i40e_status ret; + u32 val; + int v; +@@ -9484,13 +9483,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + i40e_stat_str(&pf->hw, ret), + i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status)); + +- /* make sure our flow control settings are restored */ +- ret = i40e_set_fc(&pf->hw, &set_fc_aq_fail, true); +- if (ret) +- dev_dbg(&pf->pdev->dev, "setting flow control: ret = %s last_status = %s\n", +- i40e_stat_str(&pf->hw, ret), +- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status)); +- + /* Rebuild the VSIs and VEBs that existed before reset. + * They are still in our local switch element arrays, so only + * need to rebuild the switch model in the HW. +@@ -13629,7 +13621,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + int err; + u32 val; + u32 i; +- u8 set_fc_aq_fail; + + err = pci_enable_device_mem(pdev); + if (err) +@@ -13909,24 +13900,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + } + INIT_LIST_HEAD(&pf->vsi[pf->lan_vsi]->ch_list); + +- /* Make sure flow control is set according to current settings */ +- err = i40e_set_fc(hw, &set_fc_aq_fail, true); +- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_GET) +- dev_dbg(&pf->pdev->dev, +- "Set fc with err %s aq_err %s on get_phy_cap\n", +- i40e_stat_str(hw, err), +- i40e_aq_str(hw, hw->aq.asq_last_status)); +- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_SET) +- dev_dbg(&pf->pdev->dev, +- "Set fc with err %s aq_err %s on set_phy_config\n", +- i40e_stat_str(hw, err), +- i40e_aq_str(hw, hw->aq.asq_last_status)); +- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_UPDATE) +- dev_dbg(&pf->pdev->dev, +- "Set fc with err %s aq_err %s on get_link_info\n", +- i40e_stat_str(hw, err), +- i40e_aq_str(hw, hw->aq.asq_last_status)); +- + /* if FDIR VSI was set up, start it now */ + for (i = 0; i < pf->num_alloc_vsi; i++) { + if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) { +-- +2.27.0 + diff --git a/queue-4.19/i40e-fix-vfs-not-created.patch b/queue-4.19/i40e-fix-vfs-not-created.patch new file mode 100644 index 00000000000..80da27fe256 --- /dev/null +++ b/queue-4.19/i40e-fix-vfs-not-created.patch @@ -0,0 +1,52 @@ +From b1ad125eb5113857b4a9a9097146206c8a6e2510 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 11:23:01 +0000 +Subject: i40e: Fix VFs not created + +From: Sylwester Dziedziuch + +[ Upstream commit dc8812626440fa6a27f1f3f654f6dc435e042e42 ] + +When creating VFs they were sometimes not getting resources. +It was caused by not executing i40e_reset_all_vfs due to +flag __I40E_VF_DISABLE being set on PF. Because of this +IAVF was never able to finish setup sequence never +getting reset indication from PF. +Changed test_and_set_bit __I40E_VF_DISABLE in +i40e_sync_filters_subtask to test_bit and removed clear_bit. +This function should not set this bit it should only check +if it hasn't been already set. + +Fixes: a7542b876075 ("i40e: check __I40E_VF_DISABLE bit in i40e_sync_filters_subtask") +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 7a9d8bf2e1d5f..eba6f7b118a9b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2577,7 +2577,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + return; + if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state)) + return; +- if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) { ++ if (test_bit(__I40E_VF_DISABLE, pf->state)) { + set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state); + return; + } +@@ -2595,7 +2595,6 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + } + } + } +- clear_bit(__I40E_VF_DISABLE, pf->state); + } + + /** +-- +2.27.0 + diff --git a/queue-4.19/ib-umad-return-eio-in-case-of-when-device-disassocia.patch b/queue-4.19/ib-umad-return-eio-in-case-of-when-device-disassocia.patch new file mode 100644 index 00000000000..81bcd378ec7 --- /dev/null +++ b/queue-4.19/ib-umad-return-eio-in-case-of-when-device-disassocia.patch @@ -0,0 +1,54 @@ +From 82ceac33c1f50064de50ea6e49c663ab6b7b90e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 14:13:38 +0200 +Subject: IB/umad: Return EIO in case of when device disassociated + +From: Shay Drory + +[ Upstream commit 4fc5461823c9cad547a9bdfbf17d13f0da0d6bb5 ] + +MAD message received by the user has EINVAL error in all flows +including when the device is disassociated. That makes it impossible +for the applications to treat such flow differently. + +Change it to return EIO, so the applications will be able to perform +disassociation recovery. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/20210125121339.837518-2-leon@kernel.org +Signed-off-by: Shay Drory +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/user_mad.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index a18f3f8ad77fe..db2ac5218c371 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -366,6 +366,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, + + mutex_lock(&file->mutex); + ++ if (file->agents_dead) { ++ mutex_unlock(&file->mutex); ++ return -EIO; ++ } ++ + while (list_empty(&file->recv_list)) { + mutex_unlock(&file->mutex); + +@@ -508,7 +513,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf, + + agent = __get_agent(file, packet->mad.hdr.id); + if (!agent) { +- ret = -EINVAL; ++ ret = -EIO; + goto err_up; + } + +-- +2.27.0 + diff --git a/queue-4.19/ib-umad-return-epollerr-in-case-of-when-device-disas.patch b/queue-4.19/ib-umad-return-epollerr-in-case-of-when-device-disas.patch new file mode 100644 index 00000000000..f44ab00cff5 --- /dev/null +++ b/queue-4.19/ib-umad-return-epollerr-in-case-of-when-device-disas.patch @@ -0,0 +1,66 @@ +From fb56fa2ab2baeea352e56c64e9fb515314c2bd3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 14:13:39 +0200 +Subject: IB/umad: Return EPOLLERR in case of when device disassociated + +From: Shay Drory + +[ Upstream commit def4cd43f522253645b72c97181399c241b54536 ] + +Currently, polling a umad device will always works, even if the device was +disassociated. A disassociated device should immediately return EPOLLERR +from poll(). Otherwise userspace is endlessly hung on poll() with no idea +that the device has been removed from the system. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/20210125121339.837518-3-leon@kernel.org +Signed-off-by: Shay Drory +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/user_mad.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index db2ac5218c371..471a824be86c4 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -384,6 +384,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, + mutex_lock(&file->mutex); + } + ++ if (file->agents_dead) { ++ mutex_unlock(&file->mutex); ++ return -EIO; ++ } ++ + packet = list_entry(file->recv_list.next, struct ib_umad_packet, list); + list_del(&packet->list); + +@@ -642,10 +647,14 @@ static __poll_t ib_umad_poll(struct file *filp, struct poll_table_struct *wait) + /* we will always be able to post a MAD send */ + __poll_t mask = EPOLLOUT | EPOLLWRNORM; + ++ mutex_lock(&file->mutex); + poll_wait(filp, &file->recv_wait, wait); + + if (!list_empty(&file->recv_list)) + mask |= EPOLLIN | EPOLLRDNORM; ++ if (file->agents_dead) ++ mask = EPOLLERR; ++ mutex_unlock(&file->mutex); + + return mask; + } +@@ -1262,6 +1271,7 @@ static void ib_umad_kill_port(struct ib_umad_port *port) + list_for_each_entry(file, &port->file_list, port_list) { + mutex_lock(&file->mutex); + file->agents_dead = 1; ++ wake_up_interruptible(&file->recv_wait); + mutex_unlock(&file->mutex); + + for (id = 0; id < IB_UMAD_MAX_AGENTS; ++id) +-- +2.27.0 + diff --git a/queue-4.19/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch b/queue-4.19/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch new file mode 100644 index 00000000000..0313ba43aae --- /dev/null +++ b/queue-4.19/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch @@ -0,0 +1,48 @@ +From 377ce5dab25444cbd2e0ac8f93cbe792eb996da7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 20:48:40 -0600 +Subject: ibmvnic: add memory barrier to protect long term buffer + +From: Lijun Pan + +[ Upstream commit 42557dab78edc8235aba5b441f2eb35f725a0ede ] + +dma_rmb() barrier is added to load the long term buffer before copying +it to socket buffer; and dma_wmb() barrier is added to update the +long term buffer before it being accessed by VIOS (virtual i/o server). + +Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Lijun Pan +Acked-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 5518b56c2a967..788d944b3b51b 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1521,6 +1521,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + skb_copy_from_linear_data(skb, dst, skb->len); + } + ++ /* post changes to long_term_buff *dst before VIOS accessing it */ ++ dma_wmb(); ++ + tx_pool->consumer_index = + (tx_pool->consumer_index + 1) % tx_pool->num_buffers; + +@@ -2186,6 +2189,8 @@ restart_poll: + offset = be16_to_cpu(next->rx_comp.off_frame_data); + flags = next->rx_comp.flags; + skb = rx_buff->skb; ++ /* load long_term_buff before copying to skb */ ++ dma_rmb(); + skb_copy_to_linear_data(skb, rx_buff->data + offset, + length); + +-- +2.27.0 + diff --git a/queue-4.19/ibmvnic-set-to-closed-state-even-on-error.patch b/queue-4.19/ibmvnic-set-to-closed-state-even-on-error.patch new file mode 100644 index 00000000000..be1448ca2d5 --- /dev/null +++ b/queue-4.19/ibmvnic-set-to-closed-state-even-on-error.patch @@ -0,0 +1,42 @@ +From 3b689b790cd22170b2da080df7c7d12cd17c7697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 17:41:43 -0800 +Subject: ibmvnic: Set to CLOSED state even on error + +From: Sukadev Bhattiprolu + +[ Upstream commit d4083d3c00f60a09ad82e3bf17ff57fec69c8aa6 ] + +If set_link_state() fails for any reason, we still cleanup the adapter +state and cannot recover from a partial close anyway. So set the adapter +to CLOSED state. That way if a new soft/hard reset is processed, the +adapter will remain in the CLOSED state until the next ibmvnic_open(). + +Fixes: 01d9bd792d16 ("ibmvnic: Reorganize device close") +Signed-off-by: Sukadev Bhattiprolu +Reported-by: Abdul Haleem +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 68d5971c200a1..5518b56c2a967 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1257,10 +1257,8 @@ static int __ibmvnic_close(struct net_device *netdev) + + adapter->state = VNIC_CLOSING; + rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_DN); +- if (rc) +- return rc; + adapter->state = VNIC_CLOSED; +- return 0; ++ return rc; + } + + static int ibmvnic_close(struct net_device *netdev) +-- +2.27.0 + diff --git a/queue-4.19/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch b/queue-4.19/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch new file mode 100644 index 00000000000..03054703fde --- /dev/null +++ b/queue-4.19/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch @@ -0,0 +1,45 @@ +From 12da5a61d229894f5753b3faf365ee4294a3d493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 20:49:00 -0600 +Subject: ibmvnic: skip send_request_unmap for timeout reset + +From: Lijun Pan + +[ Upstream commit 7d3a7b9ea59ddb223aec59b45fa1713c633aaed4 ] + +Timeout reset will trigger the VIOS to unmap it automatically, +similarly as FAILVOER and MOBILITY events. If we unmap it +in the linux side, we will see errors like +"30000003: Error 4 in REQUEST_UNMAP_RSP". +So, don't call send_request_unmap for timeout reset. + +Fixes: ed651a10875f ("ibmvnic: Updated reset handling") +Signed-off-by: Lijun Pan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 788d944b3b51b..0c7c0206b1be5 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -212,8 +212,13 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter, + if (!ltb->buff) + return; + ++ /* VIOS automatically unmaps the long term buffer at remote ++ * end for the following resets: ++ * FAILOVER, MOBILITY, TIMEOUT. ++ */ + if (adapter->reset_reason != VNIC_RESET_FAILOVER && +- adapter->reset_reason != VNIC_RESET_MOBILITY) ++ adapter->reset_reason != VNIC_RESET_MOBILITY && ++ adapter->reset_reason != VNIC_RESET_TIMEOUT) + send_request_unmap(adapter, ltb->map_id); + dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); + } +-- +2.27.0 + diff --git a/queue-4.19/ima-free-ima-measurement-buffer-after-kexec-syscall.patch b/queue-4.19/ima-free-ima-measurement-buffer-after-kexec-syscall.patch new file mode 100644 index 00000000000..2b5369748d6 --- /dev/null +++ b/queue-4.19/ima-free-ima-measurement-buffer-after-kexec-syscall.patch @@ -0,0 +1,80 @@ +From 813bb79dc321d960d07fd4b35899202bc12fdbd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 09:49:51 -0800 +Subject: ima: Free IMA measurement buffer after kexec syscall + +From: Lakshmi Ramasubramanian + +[ Upstream commit f31e3386a4e92ba6eda7328cb508462956c94c64 ] + +IMA allocates kernel virtual memory to carry forward the measurement +list, from the current kernel to the next kernel on kexec system call, +in ima_add_kexec_buffer() function. This buffer is not freed before +completing the kexec system call resulting in memory leak. + +Add ima_buffer field in "struct kimage" to store the virtual address +of the buffer allocated for the IMA measurement list. +Free the memory allocated for the IMA measurement list in +kimage_file_post_load_cleanup() function. + +Signed-off-by: Lakshmi Ramasubramanian +Suggested-by: Tyler Hicks +Reviewed-by: Thiago Jung Bauermann +Reviewed-by: Tyler Hicks +Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list") +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + include/linux/kexec.h | 5 +++++ + kernel/kexec_file.c | 5 +++++ + security/integrity/ima/ima_kexec.c | 2 ++ + 3 files changed, 12 insertions(+) + +diff --git a/include/linux/kexec.h b/include/linux/kexec.h +index 9e4e638fb5051..fe9f6f2dd811d 100644 +--- a/include/linux/kexec.h ++++ b/include/linux/kexec.h +@@ -260,6 +260,11 @@ struct kimage { + /* Information for loading purgatory */ + struct purgatory_info purgatory_info; + #endif ++ ++#ifdef CONFIG_IMA_KEXEC ++ /* Virtual address of IMA measurement buffer for kexec syscall */ ++ void *ima_buffer; ++#endif + }; + + /* kexec interface functions */ +diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c +index c6a3b6851372c..2fbdb78d66c80 100644 +--- a/kernel/kexec_file.c ++++ b/kernel/kexec_file.c +@@ -168,6 +168,11 @@ void kimage_file_post_load_cleanup(struct kimage *image) + vfree(pi->sechdrs); + pi->sechdrs = NULL; + ++#ifdef CONFIG_IMA_KEXEC ++ vfree(image->ima_buffer); ++ image->ima_buffer = NULL; ++#endif /* CONFIG_IMA_KEXEC */ ++ + /* See if architecture has anything to cleanup post load */ + arch_kimage_file_post_load_cleanup(image); + +diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c +index 9f8449dea5b69..6a10d4d8b6e1d 100644 +--- a/security/integrity/ima/ima_kexec.c ++++ b/security/integrity/ima/ima_kexec.c +@@ -134,6 +134,8 @@ void ima_add_kexec_buffer(struct kimage *image) + return; + } + ++ image->ima_buffer = kexec_buffer; ++ + pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n", + kbuf.mem); + } +-- +2.27.0 + diff --git a/queue-4.19/ima-free-ima-measurement-buffer-on-error.patch b/queue-4.19/ima-free-ima-measurement-buffer-on-error.patch new file mode 100644 index 00000000000..db5ca0e8580 --- /dev/null +++ b/queue-4.19/ima-free-ima-measurement-buffer-on-error.patch @@ -0,0 +1,41 @@ +From dd0c5422c6564b7c96744f5648bd64477ffce391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 09:49:50 -0800 +Subject: ima: Free IMA measurement buffer on error + +From: Lakshmi Ramasubramanian + +[ Upstream commit 6d14c6517885fa68524238787420511b87d671df ] + +IMA allocates kernel virtual memory to carry forward the measurement +list, from the current kernel to the next kernel on kexec system call, +in ima_add_kexec_buffer() function. In error code paths this memory +is not freed resulting in memory leak. + +Free the memory allocated for the IMA measurement list in +the error code paths in ima_add_kexec_buffer() function. + +Signed-off-by: Lakshmi Ramasubramanian +Suggested-by: Tyler Hicks +Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list") +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_kexec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c +index 16bd18747cfa0..9f8449dea5b69 100644 +--- a/security/integrity/ima/ima_kexec.c ++++ b/security/integrity/ima/ima_kexec.c +@@ -124,6 +124,7 @@ void ima_add_kexec_buffer(struct kimage *image) + ret = kexec_add_buffer(&kbuf); + if (ret) { + pr_err("Error passing over kexec measurement buffer.\n"); ++ vfree(kexec_buffer); + return; + } + +-- +2.27.0 + diff --git a/queue-4.19/input-elo-fix-an-error-code-in-elo_connect.patch b/queue-4.19/input-elo-fix-an-error-code-in-elo_connect.patch new file mode 100644 index 00000000000..6e805c2aa5b --- /dev/null +++ b/queue-4.19/input-elo-fix-an-error-code-in-elo_connect.patch @@ -0,0 +1,40 @@ +From 5e914ef973605b764126d5c02f647fafd81715b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 20:29:05 -0800 +Subject: Input: elo - fix an error code in elo_connect() + +From: Dan Carpenter + +[ Upstream commit 0958351e93fa0ac142f6dd8bd844441594f30a57 ] + +If elo_setup_10() fails then this should return an error code instead +of success. + +Fixes: fae3006e4b42 ("Input: elo - add support for non-pressure-sensitive touchscreens") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/elo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c +index 7f2942f3cec6e..0f3146bcfcd0f 100644 +--- a/drivers/input/touchscreen/elo.c ++++ b/drivers/input/touchscreen/elo.c +@@ -345,8 +345,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv) + switch (elo->id) { + + case 0: /* 10-byte protocol */ +- if (elo_setup_10(elo)) ++ if (elo_setup_10(elo)) { ++ err = -EIO; + goto fail3; ++ } + + break; + +-- +2.27.0 + diff --git a/queue-4.19/input-sur40-fix-an-error-code-in-sur40_probe.patch b/queue-4.19/input-sur40-fix-an-error-code-in-sur40_probe.patch new file mode 100644 index 00000000000..e6a85968267 --- /dev/null +++ b/queue-4.19/input-sur40-fix-an-error-code-in-sur40_probe.patch @@ -0,0 +1,36 @@ +From 84e0f9a201bdf1421cdb2b935075e301962e8da3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 20:30:45 -0800 +Subject: Input: sur40 - fix an error code in sur40_probe() + +From: Dan Carpenter + +[ Upstream commit b0b7d2815839024e5181bd2572f5d8d4f65363b3 ] + +If v4l2_ctrl_handler_setup() fails then probe() should return an error +code instead of returning success. + +Fixes: cee1e3e2ef39 ("media: add video control handlers using V4L2 control framework") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YBKFkbATXa5fA3xj@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/sur40.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c +index caa3aca2ea541..d5956854ac983 100644 +--- a/drivers/input/touchscreen/sur40.c ++++ b/drivers/input/touchscreen/sur40.c +@@ -778,6 +778,7 @@ static int sur40_probe(struct usb_interface *interface, + dev_err(&interface->dev, + "Unable to register video controls."); + v4l2_ctrl_handler_free(&sur40->hdl); ++ error = sur40->hdl.error; + goto err_unreg_v4l2; + } + +-- +2.27.0 + diff --git a/queue-4.19/isofs-release-buffer-head-before-return.patch b/queue-4.19/isofs-release-buffer-head-before-return.patch new file mode 100644 index 00000000000..fb51e185efb --- /dev/null +++ b/queue-4.19/isofs-release-buffer-head-before-return.patch @@ -0,0 +1,49 @@ +From 0f52beda4cc5320c4c8b77fbb2e3c657cf07335a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 04:04:55 -0800 +Subject: isofs: release buffer head before return + +From: Pan Bian + +[ Upstream commit 0a6dc67a6aa45f19bd4ff89b4f468fc50c4b8daa ] + +Release the buffer_head before returning error code in +do_isofs_readdir() and isofs_find_entry(). + +Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem") +Link: https://lore.kernel.org/r/20210118120455.118955-1-bianpan2016@163.com +Signed-off-by: Pan Bian +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/isofs/dir.c | 1 + + fs/isofs/namei.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c +index 947ce22f5b3c3..55df4d80793ba 100644 +--- a/fs/isofs/dir.c ++++ b/fs/isofs/dir.c +@@ -152,6 +152,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file, + printk(KERN_NOTICE "iso9660: Corrupted directory entry" + " in block %lu of inode %lu\n", block, + inode->i_ino); ++ brelse(bh); + return -EIO; + } + +diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c +index cac468f04820e..558e7c51ce0d4 100644 +--- a/fs/isofs/namei.c ++++ b/fs/isofs/namei.c +@@ -102,6 +102,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry, + printk(KERN_NOTICE "iso9660: Corrupted directory entry" + " in block %lu of inode %lu\n", block, + dir->i_ino); ++ brelse(bh); + return 0; + } + +-- +2.27.0 + diff --git a/queue-4.19/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch b/queue-4.19/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch new file mode 100644 index 00000000000..725c87379d4 --- /dev/null +++ b/queue-4.19/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch @@ -0,0 +1,58 @@ +From 2423d487bca77083d795fd138a7d6496d556f297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Dec 2020 06:56:04 -0800 +Subject: jffs2: fix use after free in jffs2_sum_write_data() + +From: Tom Rix + +[ Upstream commit 19646447ad3a680d2ab08c097585b7d96a66126b ] + +clang static analysis reports this problem + +fs/jffs2/summary.c:794:31: warning: Use of memory after it is freed + c->summary->sum_list_head = temp->u.next; + ^~~~~~~~~~~~ + +In jffs2_sum_write_data(), in a loop summary data is handles a node at +a time. When it has written out the node it is removed the summary list, +and the node is deleted. In the corner case when a +JFFS2_FEATURE_RWCOMPAT_COPY is seen, a call is made to +jffs2_sum_disable_collecting(). jffs2_sum_disable_collecting() deletes +the whole list which conflicts with the loop's deleting the list by parts. + +To preserve the old behavior of stopping the write midway, bail out of +the loop after disabling summary collection. + +Fixes: 6171586a7ae5 ("[JFFS2] Correct handling of JFFS2_FEATURE_RWCOMPAT_COPY nodes.") +Signed-off-by: Tom Rix +Reviewed-by: Nathan Chancellor +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/jffs2/summary.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c +index be7c8a6a57480..4fe64519870f1 100644 +--- a/fs/jffs2/summary.c ++++ b/fs/jffs2/summary.c +@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock + dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n", + je16_to_cpu(temp->u.nodetype)); + jffs2_sum_disable_collecting(c->summary); ++ /* The above call removes the list, nothing more to do */ ++ goto bail_rwcompat; + } else { + BUG(); /* unknown node in summary information */ + } +@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock + + c->summary->sum_num--; + } ++ bail_rwcompat: + + jffs2_sum_reset_collected(c->summary); + +-- +2.27.0 + diff --git a/queue-4.19/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch b/queue-4.19/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch new file mode 100644 index 00000000000..b840ab96fa0 --- /dev/null +++ b/queue-4.19/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch @@ -0,0 +1,79 @@ +From ef3f12f44c8569533af775140b5e03dc06feefe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Jan 2021 15:32:01 +0100 +Subject: KVM: PPC: Make the VMX instruction emulation routines static +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Le Goater + +[ Upstream commit 9236f57a9e51c72ce426ccd2e53e123de7196a0f ] + +These are only used locally. It fixes these W=1 compile errors : + +../arch/powerpc/kvm/powerpc.c:1521:5: error: no previous prototype for ‘kvmppc_get_vmx_dword’ [-Werror=missing-prototypes] + 1521 | int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val) + | ^~~~~~~~~~~~~~~~~~~~ +../arch/powerpc/kvm/powerpc.c:1539:5: error: no previous prototype for ‘kvmppc_get_vmx_word’ [-Werror=missing-prototypes] + 1539 | int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val) + | ^~~~~~~~~~~~~~~~~~~ +../arch/powerpc/kvm/powerpc.c:1557:5: error: no previous prototype for ‘kvmppc_get_vmx_hword’ [-Werror=missing-prototypes] + 1557 | int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val) + | ^~~~~~~~~~~~~~~~~~~~ +../arch/powerpc/kvm/powerpc.c:1575:5: error: no previous prototype for ‘kvmppc_get_vmx_byte’ [-Werror=missing-prototypes] + 1575 | int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val) + | ^~~~~~~~~~~~~~~~~~~ + +Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction mmio emulation with analyse_instr() input") +Signed-off-by: Cédric Le Goater +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210104143206.695198-19-clg@kaod.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/powerpc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 51cd66dc1bb09..7c8354dfe80e2 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -1497,7 +1497,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu, + return emulated; + } + +-int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val) ++static int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val) + { + union kvmppc_one_reg reg; + int vmx_offset = 0; +@@ -1515,7 +1515,7 @@ int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val) + return result; + } + +-int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val) ++static int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val) + { + union kvmppc_one_reg reg; + int vmx_offset = 0; +@@ -1533,7 +1533,7 @@ int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val) + return result; + } + +-int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val) ++static int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val) + { + union kvmppc_one_reg reg; + int vmx_offset = 0; +@@ -1551,7 +1551,7 @@ int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val) + return result; + } + +-int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val) ++static int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val) + { + union kvmppc_one_reg reg; + int vmx_offset = 0; +-- +2.27.0 + diff --git a/queue-4.19/mac80211-fix-potential-overflow-when-multiplying-to-.patch b/queue-4.19/mac80211-fix-potential-overflow-when-multiplying-to-.patch new file mode 100644 index 00000000000..d5de157089a --- /dev/null +++ b/queue-4.19/mac80211-fix-potential-overflow-when-multiplying-to-.patch @@ -0,0 +1,40 @@ +From 4b67f502260425b5c8eba4abc087382c12e5406e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 17:53:52 +0000 +Subject: mac80211: fix potential overflow when multiplying to u32 integers + +From: Colin Ian King + +[ Upstream commit 6194f7e6473be78acdc5d03edd116944bdbb2c4e ] + +The multiplication of the u32 variables tx_time and estimated_retx is +performed using a 32 bit multiplication and the result is stored in +a u64 result. This has a potential u32 overflow issue, so avoid this +by casting tx_time to a u64 to force a 64 bit multiply. + +Addresses-Coverity: ("Unintentional integer overflow") +Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210205175352.208841-1-colin.king@canonical.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_hwmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c +index 6219b6b0c7e17..18158855d98c4 100644 +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -355,7 +355,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local, + */ + tx_time = (device_constant + 10 * test_frame_len / rate); + estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err)); +- result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT); ++ result = ((u64)tx_time * estimated_retx) >> (2 * ARITH_SHIFT); + return (u32)result; + } + +-- +2.27.0 + diff --git a/queue-4.19/media-camss-missing-error-code-in-msm_video_register.patch b/queue-4.19/media-camss-missing-error-code-in-msm_video_register.patch new file mode 100644 index 00000000000..b7406e6c665 --- /dev/null +++ b/queue-4.19/media-camss-missing-error-code-in-msm_video_register.patch @@ -0,0 +1,36 @@ +From f967ca25c28674c0b6fff2b182678ea438d4b38d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 07:51:30 +0100 +Subject: media: camss: missing error code in msm_video_register() + +From: Dan Carpenter + +[ Upstream commit 9c67ed2ab299123872be14a3dc2ea44ce7e4538b ] + +This error path returns success but it should return -EINVAL. + +Fixes: cba3819d1e93 ("media: camss: Format configuration per hardware version") +Signed-off-by: Dan Carpenter +Reviewed-by: Robert Foss +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss-video.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c +index c9bb0d023db48..e81ebeb0506e4 100644 +--- a/drivers/media/platform/qcom/camss/camss-video.c ++++ b/drivers/media/platform/qcom/camss/camss-video.c +@@ -901,6 +901,7 @@ int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev, + video->nformats = ARRAY_SIZE(formats_rdi_8x96); + } + } else { ++ ret = -EINVAL; + goto error_video_register; + } + +-- +2.27.0 + diff --git a/queue-4.19/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch b/queue-4.19/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch new file mode 100644 index 00000000000..635947cad19 --- /dev/null +++ b/queue-4.19/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch @@ -0,0 +1,46 @@ +From 9e92e4200efde7b8bc91b2bd86e0b5578cf34c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Jan 2021 22:21:46 +0100 +Subject: media: cx25821: Fix a bug when reallocating some dma memory + +From: Christophe JAILLET + +[ Upstream commit b2de3643c5024fc4fd128ba7767c7fb8b714bea7 ] + +This function looks like a realloc. + +However, if 'risc->cpu != NULL', the memory will be freed, but never +reallocated with the bigger 'size'. +Explicitly set 'risc->cpu' to NULL, so that the reallocation is +correctly performed a few lines below. + +[hverkuil: NULL != risc->cpu -> risc->cpu] + +Fixes: 5ede94c70553 ("[media] cx25821: remove bogus btcx_risc dependency) +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx25821/cx25821-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 2f0171134f7e1..e04fe9f17b7aa 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -986,8 +986,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci, + __le32 *cpu; + dma_addr_t dma = 0; + +- if (NULL != risc->cpu && risc->size < size) ++ if (risc->cpu && risc->size < size) { + pci_free_consistent(pci, risc->size, risc->cpu, risc->dma); ++ risc->cpu = NULL; ++ } + if (NULL == risc->cpu) { + cpu = pci_zalloc_consistent(pci, size, &dma); + if (NULL == cpu) +-- +2.27.0 + diff --git a/queue-4.19/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch b/queue-4.19/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch new file mode 100644 index 00000000000..aa23babf9fd --- /dev/null +++ b/queue-4.19/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch @@ -0,0 +1,46 @@ +From 219e29fb67fb72b4d15823670b2ebf2d3cd8c095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Dec 2020 14:02:05 +0100 +Subject: media: em28xx: Fix use-after-free in em28xx_alloc_urbs + +From: Dinghao Liu + +[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ] + +When kzalloc() fails, em28xx_uninit_usb_xfer() will free +usb_bufs->buf and set it to NULL. Thus the later access +to usb_bufs->buf[i] will lead to null pointer dereference. +Also the kfree(usb_bufs->buf) after that is redundant. + +Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers") +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-core.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c +index 69445c8e38e28..d0f95a5cb4d23 100644 +--- a/drivers/media/usb/em28xx/em28xx-core.c ++++ b/drivers/media/usb/em28xx/em28xx-core.c +@@ -955,14 +955,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk, + + usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL); + if (!usb_bufs->buf[i]) { +- em28xx_uninit_usb_xfer(dev, mode); +- + for (i--; i >= 0; i--) + kfree(usb_bufs->buf[i]); + +- kfree(usb_bufs->buf); +- usb_bufs->buf = NULL; +- ++ em28xx_uninit_usb_xfer(dev, mode); + return -ENOMEM; + } + +-- +2.27.0 + diff --git a/queue-4.19/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch b/queue-4.19/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch new file mode 100644 index 00000000000..18fdfeb6e1e --- /dev/null +++ b/queue-4.19/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch @@ -0,0 +1,43 @@ +From dc018b58d337f23d8d68eb044950c8a3bef04554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Dec 2020 18:52:20 +0100 +Subject: media: i2c: ov5670: Fix PIXEL_RATE minimum value + +From: Jacopo Mondi + +[ Upstream commit dc1eb7c9c290cba52937c9a224b22a400bb0ffd7 ] + +The driver currently reports a single supported value for +V4L2_CID_PIXEL_RATE and initializes the control's minimum value to 0, +which is very risky, as userspace might accidentally use it as divider +when calculating the time duration of a line. + +Fix this by using as minimum the only supported value when registering +the control. + +Fixes: 5de35c9b8dcd1 ("media: i2c: Add Omnivision OV5670 5M sensor support") +Signed-off-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5670.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c +index 53dd30d96e691..62dfdcb6e0bd6 100644 +--- a/drivers/media/i2c/ov5670.c ++++ b/drivers/media/i2c/ov5670.c +@@ -2081,7 +2081,8 @@ static int ov5670_init_controls(struct ov5670 *ov5670) + + /* By default, V4L2_CID_PIXEL_RATE is read only */ + ov5670->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov5670_ctrl_ops, +- V4L2_CID_PIXEL_RATE, 0, ++ V4L2_CID_PIXEL_RATE, ++ link_freq_configs[0].pixel_rate, + link_freq_configs[0].pixel_rate, + 1, + link_freq_configs[0].pixel_rate); +-- +2.27.0 + diff --git a/queue-4.19/media-lmedm04-fix-misuse-of-comma.patch b/queue-4.19/media-lmedm04-fix-misuse-of-comma.patch new file mode 100644 index 00000000000..e72e2ba6392 --- /dev/null +++ b/queue-4.19/media-lmedm04-fix-misuse-of-comma.patch @@ -0,0 +1,40 @@ +From adba09d8790f62cca3f211299322f9a67e0ccdda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 20:13:31 +0200 +Subject: media: lmedm04: Fix misuse of comma + +From: Joe Perches + +[ Upstream commit 59a3e78f8cc33901fe39035c1ab681374bba95ad ] + +There's a comma used instead of a semicolon that causes multiple +statements to be executed after an if instead of just the intended +single statement. + +Replace the comma with a semicolon. + +Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") +Signed-off-by: Joe Perches +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index 0750a975bcb89..316edb2dd6c4a 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -436,7 +436,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); + + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) +- lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa), ++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + + lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + +-- +2.27.0 + diff --git a/queue-4.19/media-media-pci-fix-memleak-in-empress_init.patch b/queue-4.19/media-media-pci-fix-memleak-in-empress_init.patch new file mode 100644 index 00000000000..9dec504b37e --- /dev/null +++ b/queue-4.19/media-media-pci-fix-memleak-in-empress_init.patch @@ -0,0 +1,42 @@ +From 369ba4f9ad552b12a6c54d6186c178bceadfa1b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Jan 2021 07:27:22 +0100 +Subject: media: media/pci: Fix memleak in empress_init + +From: Dinghao Liu + +[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ] + +When vb2_queue_init() fails, dev->empress_dev +should be released just like other error handling +paths. + +Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2") +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c +index 66acfd35ffc60..8680eb08b654d 100644 +--- a/drivers/media/pci/saa7134/saa7134-empress.c ++++ b/drivers/media/pci/saa7134/saa7134-empress.c +@@ -293,8 +293,11 @@ static int empress_init(struct saa7134_dev *dev) + q->lock = &dev->lock; + q->dev = &dev->pci->dev; + err = vb2_queue_init(q); +- if (err) ++ if (err) { ++ video_device_release(dev->empress_dev); ++ dev->empress_dev = NULL; + return err; ++ } + dev->empress_dev->queue = q; + + video_set_drvdata(dev->empress_dev, dev); +-- +2.27.0 + diff --git a/queue-4.19/media-pxa_camera-declare-variable-when-debug-is-defi.patch b/queue-4.19/media-pxa_camera-declare-variable-when-debug-is-defi.patch new file mode 100644 index 00000000000..7f02e1797b9 --- /dev/null +++ b/queue-4.19/media-pxa_camera-declare-variable-when-debug-is-defi.patch @@ -0,0 +1,46 @@ +From 6a9fff019d4440beabb5a13c79bb5967e94054df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 14:45:13 +0100 +Subject: media: pxa_camera: declare variable when DEBUG is defined +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tom Rix + +[ Upstream commit 031b9212eeee365443aaef013360ea6cded7b2c4 ] + +When DEBUG is defined this error occurs + +drivers/media/platform/pxa_camera.c:1410:7: error: + ‘i’ undeclared (first use in this function) + for (i = 0; i < vb->num_planes; i++) + ^ +The variable 'i' is missing, so declare it. + +Fixes: 6f28435d1c15 ("[media] media: platform: pxa_camera: trivial move of functions") +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/pxa_camera.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c +index 406ac673ad84c..0281b8e53fef2 100644 +--- a/drivers/media/platform/pxa_camera.c ++++ b/drivers/media/platform/pxa_camera.c +@@ -1452,6 +1452,9 @@ static int pxac_vb2_prepare(struct vb2_buffer *vb) + struct pxa_camera_dev *pcdev = vb2_get_drv_priv(vb->vb2_queue); + struct pxa_buffer *buf = vb2_to_pxa_buffer(vb); + int ret = 0; ++#ifdef DEBUG ++ int i; ++#endif + + switch (pcdev->channels) { + case 1: +-- +2.27.0 + diff --git a/queue-4.19/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch b/queue-4.19/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch new file mode 100644 index 00000000000..0056bfcf08d --- /dev/null +++ b/queue-4.19/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch @@ -0,0 +1,43 @@ +From b9f61351ce5b5458d789aca4e027b2d0d0e63ecf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 02:34:37 +0100 +Subject: media: qm1d1c0042: fix error return code in qm1d1c0042_init() + +From: Luo Meng + +[ Upstream commit fcf8d018bdca0453b8d6359062e6bc1512d04c38 ] + +Fix to return a negative error code from the error handling case +instead of 0 in function qm1d1c0042_init(), as done elsewhere +in this function. + +Fixes: ab4d14528fdf ("[media] em28xx: add support for PLEX PX-BCUD (ISDB-S)") +Reported-by: Hulk Robot +Signed-off-by: Luo Meng +Acked-by: Akihiro Tsukada +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/qm1d1c0042.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/tuners/qm1d1c0042.c b/drivers/media/tuners/qm1d1c0042.c +index 83ca5dc047ea2..baa9950783b66 100644 +--- a/drivers/media/tuners/qm1d1c0042.c ++++ b/drivers/media/tuners/qm1d1c0042.c +@@ -343,8 +343,10 @@ static int qm1d1c0042_init(struct dvb_frontend *fe) + if (val == reg_initval[reg_index][0x00]) + break; + } +- if (reg_index >= QM1D1C0042_NUM_REG_ROWS) ++ if (reg_index >= QM1D1C0042_NUM_REG_ROWS) { ++ ret = -EINVAL; + goto failed; ++ } + memcpy(state->regs, reg_initval[reg_index], QM1D1C0042_NUM_REGS); + usleep_range(2000, 3000); + +-- +2.27.0 + diff --git a/queue-4.19/media-tm6000-fix-memleak-in-tm6000_start_stream.patch b/queue-4.19/media-tm6000-fix-memleak-in-tm6000_start_stream.patch new file mode 100644 index 00000000000..d24b00a1d9d --- /dev/null +++ b/queue-4.19/media-tm6000-fix-memleak-in-tm6000_start_stream.patch @@ -0,0 +1,40 @@ +From 66b2155504701880e84b45e98174fc872799db6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Jan 2021 09:26:37 +0100 +Subject: media: tm6000: Fix memleak in tm6000_start_stream + +From: Dinghao Liu + +[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ] + +When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer +and dvb->bulk_urb should be freed just like when +usb_submit_urb() fails. + +Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support") +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c +index 3db2fd7f5d7c4..e4f2160f46ff1 100644 +--- a/drivers/media/usb/tm6000/tm6000-dvb.c ++++ b/drivers/media/usb/tm6000/tm6000-dvb.c +@@ -149,6 +149,10 @@ static int tm6000_start_stream(struct tm6000_core *dev) + if (ret < 0) { + printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n", + ret, __func__); ++ ++ kfree(dvb->bulk_urb->transfer_buffer); ++ usb_free_urb(dvb->bulk_urb); ++ dvb->bulk_urb = NULL; + return ret; + } else + printk(KERN_ERR "tm6000: pipe resetted\n"); +-- +2.27.0 + diff --git a/queue-4.19/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch b/queue-4.19/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch new file mode 100644 index 00000000000..e7da7db0db6 --- /dev/null +++ b/queue-4.19/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch @@ -0,0 +1,82 @@ +From 7f93493d564e5e59350648080c83c1ad6380cfe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Dec 2020 15:11:13 +0100 +Subject: media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +[ Upstream commit dc9455ffae02d7b7fb51ba1e007fffcb9dc5d890 ] + +The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and +bFrameIndex values when negotiating the video probe and commit controls. +The UVC descriptors report a single supported format and frame size, +with bFormatIndex and bFrameIndex both equal to 2, but the video probe +and commit controls report bFormatIndex and bFrameIndex set to 1. + +The device otherwise operates correctly, but the driver rejects the +values and fails the format try operation. Fix it by ignoring the +invalid indices, and assuming that the format and frame requested by the +driver are accepted by the device. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767 + +Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2") +Reported-by: Till Dörges +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_v4l2.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 0921c95a1dca5..06167c51af128 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -253,7 +253,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, + goto done; + + /* After the probe, update fmt with the values returned from +- * negotiation with the device. ++ * negotiation with the device. Some devices return invalid bFormatIndex ++ * and bFrameIndex values, in which case we can only assume they have ++ * accepted the requested format as-is. + */ + for (i = 0; i < stream->nformats; ++i) { + if (probe->bFormatIndex == stream->format[i].index) { +@@ -262,11 +264,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, + } + } + +- if (i == stream->nformats) { +- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n", ++ if (i == stream->nformats) ++ uvc_trace(UVC_TRACE_FORMAT, ++ "Unknown bFormatIndex %u, using default\n", + probe->bFormatIndex); +- return -EINVAL; +- } + + for (i = 0; i < format->nframes; ++i) { + if (probe->bFrameIndex == format->frame[i].bFrameIndex) { +@@ -275,11 +276,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, + } + } + +- if (i == format->nframes) { +- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n", ++ if (i == format->nframes) ++ uvc_trace(UVC_TRACE_FORMAT, ++ "Unknown bFrameIndex %u, using default\n", + probe->bFrameIndex); +- return -EINVAL; +- } + + fmt->fmt.pix.width = frame->wWidth; + fmt->fmt.pix.height = frame->wHeight; +-- +2.27.0 + diff --git a/queue-4.19/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch b/queue-4.19/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch new file mode 100644 index 00000000000..098acbd25b2 --- /dev/null +++ b/queue-4.19/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch @@ -0,0 +1,43 @@ +From dd3648a1d0602206c02479357511ba43903916b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 18:41:19 +0100 +Subject: media: vsp1: Fix an error handling path in the probe function + +From: Christophe JAILLET + +[ Upstream commit 7113469dafc2d545fa4fa9bc649c31dc27db492e ] + +A previous 'rcar_fcp_get()' call must be undone in the error handling path, +as already done in the remove function. + +Fixes: 94fcdf829793 ("[media] v4l: vsp1: Add FCP support") +Signed-off-by: Christophe JAILLET +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vsp1/vsp1_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c +index 4e6530ee809af..022f84569d0e5 100644 +--- a/drivers/media/platform/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/vsp1/vsp1_drv.c +@@ -882,8 +882,10 @@ static int vsp1_probe(struct platform_device *pdev) + } + + done: +- if (ret) ++ if (ret) { + pm_runtime_disable(&pdev->dev); ++ rcar_fcp_put(vsp1->fcp); ++ } + + return ret; + } +-- +2.27.0 + diff --git a/queue-4.19/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch b/queue-4.19/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch new file mode 100644 index 00000000000..3ed3eb9245f --- /dev/null +++ b/queue-4.19/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch @@ -0,0 +1,55 @@ +From d4fddf0fe2618e92a238c2545488de5f438853b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 01:03:59 -0800 +Subject: memory: ti-aemif: Drop child node when jumping out loop + +From: Pan Bian + +[ Upstream commit 94e9dd43cf327366388c8f146bccdc6322c0d999 ] + +Call of_node_put() to decrement the reference count of the child node +child_np when jumping out of the loop body of +for_each_available_child_of_node(), which is a macro that increments and +decrements the reference count of child node. If the loop is broken, the +reference of the child node should be dropped manually. + +Fixes: 5a7c81547c1d ("memory: ti-aemif: introduce AEMIF driver") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210121090359.61763-1-bianpan2016@163.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/ti-aemif.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c +index 475e5b3790edb..be3d978648f57 100644 +--- a/drivers/memory/ti-aemif.c ++++ b/drivers/memory/ti-aemif.c +@@ -381,8 +381,10 @@ static int aemif_probe(struct platform_device *pdev) + */ + for_each_available_child_of_node(np, child_np) { + ret = of_aemif_parse_abus_config(pdev, child_np); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(child_np); + goto error; ++ } + } + } else if (pdata && pdata->num_abus_data > 0) { + for (i = 0; i < pdata->num_abus_data; i++, aemif->num_cs++) { +@@ -408,8 +410,10 @@ static int aemif_probe(struct platform_device *pdev) + for_each_available_child_of_node(np, child_np) { + ret = of_platform_populate(child_np, NULL, + dev_lookup, dev); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(child_np); + goto error; ++ } + } + } else if (pdata) { + for (i = 0; i < pdata->num_sub_devices; i++) { +-- +2.27.0 + diff --git a/queue-4.19/mfd-bd9571mwv-use-devm_mfd_add_devices.patch b/queue-4.19/mfd-bd9571mwv-use-devm_mfd_add_devices.patch new file mode 100644 index 00000000000..a241860bb6c --- /dev/null +++ b/queue-4.19/mfd-bd9571mwv-use-devm_mfd_add_devices.patch @@ -0,0 +1,43 @@ +From 6b29ad39eeb64de936996931fe404f56f8bd6bfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 18:00:56 +0900 +Subject: mfd: bd9571mwv: Use devm_mfd_add_devices() + +From: Yoshihiro Shimoda + +[ Upstream commit c58ad0f2b052b5675d6394e03713ee41e721b44c ] + +To remove mfd devices when unload this driver, should use +devm_mfd_add_devices() instead. + +Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver") +Signed-off-by: Yoshihiro Shimoda +Acked-for-MFD-by: Lee Jones +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Matti Vaittinen +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/bd9571mwv.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c +index fab3cdc27ed64..19d57a45134c6 100644 +--- a/drivers/mfd/bd9571mwv.c ++++ b/drivers/mfd/bd9571mwv.c +@@ -185,9 +185,9 @@ static int bd9571mwv_probe(struct i2c_client *client, + return ret; + } + +- ret = mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO, bd9571mwv_cells, +- ARRAY_SIZE(bd9571mwv_cells), NULL, 0, +- regmap_irq_get_domain(bd->irq_data)); ++ ret = devm_mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO, ++ bd9571mwv_cells, ARRAY_SIZE(bd9571mwv_cells), ++ NULL, 0, regmap_irq_get_domain(bd->irq_data)); + if (ret) { + regmap_del_irq_chip(bd->irq, bd->irq_data); + return ret; +-- +2.27.0 + diff --git a/queue-4.19/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch b/queue-4.19/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch new file mode 100644 index 00000000000..3234cb84a93 --- /dev/null +++ b/queue-4.19/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch @@ -0,0 +1,44 @@ +From 313948e4844f4c41f130d40481ca9529a6139dcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 17:37:24 +0300 +Subject: mfd: wm831x-auxadc: Prevent use after free in + wm831x_auxadc_read_irq() + +From: Dan Carpenter + +[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ] + +The "req" struct is always added to the "wm831x->auxadc_pending" list, +but it's only removed from the list on the success path. If a failure +occurs then the "req" struct is freed but it's still on the list, +leading to a use after free. + +Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions") +Signed-off-by: Dan Carpenter +Acked-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/wm831x-auxadc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c +index fd789d2eb0f52..9f7ae1e1ebcd6 100644 +--- a/drivers/mfd/wm831x-auxadc.c ++++ b/drivers/mfd/wm831x-auxadc.c +@@ -98,11 +98,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x, + wait_for_completion_timeout(&req->done, msecs_to_jiffies(500)); + + mutex_lock(&wm831x->auxadc_lock); +- +- list_del(&req->list); + ret = req->val; + + out: ++ list_del(&req->list); + mutex_unlock(&wm831x->auxadc_lock); + + kfree(req); +-- +2.27.0 + diff --git a/queue-4.19/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch b/queue-4.19/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch new file mode 100644 index 00000000000..e1ae7afaa29 --- /dev/null +++ b/queue-4.19/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch @@ -0,0 +1,45 @@ +From a7d3b6b59cdae2248f008573e76360aa1a19ca14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jan 2021 13:34:56 -0700 +Subject: MIPS: c-r4k: Fix section mismatch for loongson2_sc_init + +From: Nathan Chancellor + +[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ] + +When building with clang, the following section mismatch warning occurs: + +WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in +reference from the function r4k_cache_init() to the function +.init.text:loongson2_sc_init() + +This should have been fixed with commit ad4fddef5f23 ("mips: fix Section +mismatch in reference") but it was missed. Remove the improper __init +annotation like that commit did. + +Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code") +Link: https://github.com/ClangBuiltLinux/linux/issues/787 +Signed-off-by: Nathan Chancellor +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/c-r4k.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 7650edd5cf7ff..60fe72170856d 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -1673,7 +1673,7 @@ static int probe_scache(void) + return 1; + } + +-static void __init loongson2_sc_init(void) ++static void loongson2_sc_init(void) + { + struct cpuinfo_mips *c = ¤t_cpu_data; + +-- +2.27.0 + diff --git a/queue-4.19/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch b/queue-4.19/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch new file mode 100644 index 00000000000..c6a5ab9caaf --- /dev/null +++ b/queue-4.19/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch @@ -0,0 +1,55 @@ +From a3068b8c7ff80ec6b591708f64874c747606a227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jan 2021 13:15:48 -0700 +Subject: MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 + +From: Nathan Chancellor + +[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ] + +When building xway_defconfig with clang: + +arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant +operand [-Werror,-Wconstant-logical-operand] + if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT) + ^ ~~~~~~~~~~~~~~~~~ +arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation + if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT) + ^~ + & +arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this +warning + if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT) + ~^~~~~~~~~~~~~~~~~~~~ +1 error generated. + +Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the +warning. Additionally, remove the unnecessary parentheses as this is a +simple conditional statement and shorthand '== 0' to '!'. + +Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support") +Link: https://github.com/ClangBuiltLinux/linux/issues/807 +Reported-by: Dmitry Golovin +Signed-off-by: Nathan Chancellor +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c +index 37caeadb2964c..0476d7e97a03f 100644 +--- a/arch/mips/lantiq/irq.c ++++ b/arch/mips/lantiq/irq.c +@@ -244,7 +244,7 @@ static void ltq_hw_irq_handler(struct irq_desc *desc) + generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq)); + + /* if this is a EBU irq, we need to ack it or get a deadlock */ +- if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT) ++ if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0) + ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10, + LTQ_EBU_PCC_ISTAT); + } +-- +2.27.0 + diff --git a/queue-4.19/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch b/queue-4.19/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch new file mode 100644 index 00000000000..ede2914a553 --- /dev/null +++ b/queue-4.19/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch @@ -0,0 +1,38 @@ +From 3b3d25c4d9b5d9b105fb5e94255c9099af10ca24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 10:42:52 +0530 +Subject: misc: eeprom_93xx46: Add module alias to avoid breaking support for + non device tree users + +From: Aswath Govindraju + +[ Upstream commit 4540b9fbd8ebb21bb3735796d300a1589ee5fbf2 ] + +Module alias "spi:93xx46" is used by non device tree users like +drivers/misc/eeprom/digsy_mtc_eeprom.c and removing it will +break support for them. + +Fix this by adding back the module alias "spi:93xx46". + +Fixes: 13613a2246bf ("misc: eeprom_93xx46: Fix module alias to enable module autoprobe") +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20210113051253.15061-1-a-govindraju@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index afaa717207b37..a3248ebd28c62 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -522,4 +522,5 @@ module_spi_driver(eeprom_93xx46_driver); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs"); + MODULE_AUTHOR("Anatolij Gustschin "); ++MODULE_ALIAS("spi:93xx46"); + MODULE_ALIAS("spi:eeprom-93xx46"); +-- +2.27.0 + diff --git a/queue-4.19/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch b/queue-4.19/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch new file mode 100644 index 00000000000..cbbbaa07e2e --- /dev/null +++ b/queue-4.19/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch @@ -0,0 +1,34 @@ +From 3ac797347c0e7b73ad350b975afbe0aa3b841be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 22:09:53 +0530 +Subject: misc: eeprom_93xx46: Fix module alias to enable module autoprobe + +From: Aswath Govindraju + +[ Upstream commit 13613a2246bf531f5fc04e8e62e8f21a3d39bf1c ] + +Fix module autoprobe by correcting module alias to match the string from +/sys/class/.../spi1.0/modalias content. + +Fixes: 06b4501e88ad ("misc/eeprom: add driver for microwire 93xx46 EEPROMs") +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20210107163957.28664-2-a-govindraju@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93xx46.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index 38766968bfa20..afaa717207b37 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -522,4 +522,4 @@ module_spi_driver(eeprom_93xx46_driver); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs"); + MODULE_AUTHOR("Anatolij Gustschin "); +-MODULE_ALIAS("spi:93xx46"); ++MODULE_ALIAS("spi:eeprom-93xx46"); +-- +2.27.0 + diff --git a/queue-4.19/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch b/queue-4.19/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch new file mode 100644 index 00000000000..0ba196eb0ab --- /dev/null +++ b/queue-4.19/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch @@ -0,0 +1,46 @@ +From 0c7a2f63e3e28bc317835042804d743882493f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:06:50 -0800 +Subject: mm/hugetlb: fix potential double free in hugetlb_register_node() + error path + +From: Miaohe Lin + +[ Upstream commit cc2205a67dec5a700227a693fc113441e73e4641 ] + +In hugetlb_sysfs_add_hstate(), we would do kobject_put() on hstate_kobjs +when failed to create sysfs group but forget to set hstate_kobjs to NULL. +Then in hugetlb_register_node() error path, we may free it again via +hugetlb_unregister_node(). + +Link: https://lkml.kernel.org/r/20210107123249.36964-1-linmiaohe@huawei.com +Fixes: a3437870160c ("hugetlb: new sysfs interface") +Signed-off-by: Miaohe Lin +Reviewed-by: Mike Kravetz +Reviewed-by: Muchun Song +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/hugetlb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index df89aed023029..9eb5c25fabc9e 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2648,8 +2648,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent, + return -ENOMEM; + + retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group); +- if (retval) ++ if (retval) { + kobject_put(hstate_kobjs[hi]); ++ hstate_kobjs[hi] = NULL; ++ } + + return retval; + } +-- +2.27.0 + diff --git a/queue-4.19/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch b/queue-4.19/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch new file mode 100644 index 00000000000..ba605d49cc4 --- /dev/null +++ b/queue-4.19/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch @@ -0,0 +1,66 @@ +From 3f5b3af6db94d18f4bbc24869c35f120f152dceb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:04:33 -0800 +Subject: mm/memory.c: fix potential pte_unmap_unlock pte error + +From: Miaohe Lin + +[ Upstream commit 90a3e375d324b2255b83e3dd29e99e2b05d82aaf ] + +Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged +high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed, +we would break the loop with pte unchanged. Then the wrong pte - 1 would +be passed to pte_unmap_unlock. + +Andi said: + + "While the fix is correct, I'm not sure if it actually is a real bug. + Is there any architecture that would do something else than unlocking + the underlying page? If it's just the underlying page then it should + be always the same page, so no bug" + +Link: https://lkml.kernel.org/r/20210109080118.20885-1-linmiaohe@huawei.com +Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings") +Signed-off-by: Hongxiang Lou +Signed-off-by: Miaohe Lin +Cc: Thomas Gleixner +Cc: Dave Hansen +Cc: Andi Kleen +Cc: Josh Poimboeuf +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memory.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/mm/memory.c b/mm/memory.c +index eeae63bd95027..4bd37296df89b 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1995,11 +1995,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, + unsigned long addr, unsigned long end, + unsigned long pfn, pgprot_t prot) + { +- pte_t *pte; ++ pte_t *pte, *mapped_pte; + spinlock_t *ptl; + int err = 0; + +- pte = pte_alloc_map_lock(mm, pmd, addr, &ptl); ++ mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl); + if (!pte) + return -ENOMEM; + arch_enter_lazy_mmu_mode(); +@@ -2013,7 +2013,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, + pfn++; + } while (pte++, addr += PAGE_SIZE, addr != end); + arch_leave_lazy_mmu_mode(); +- pte_unmap_unlock(pte - 1, ptl); ++ pte_unmap_unlock(mapped_pte, ptl); + return err; + } + +-- +2.27.0 + diff --git a/queue-4.19/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch b/queue-4.19/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch new file mode 100644 index 00000000000..7fb5241b2cf --- /dev/null +++ b/queue-4.19/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch @@ -0,0 +1,56 @@ +From 034b6d04d9b480979eeeea60f8b567eeaf113545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:18:09 -0800 +Subject: mm/rmap: fix potential pte_unmap on an not mapped pte + +From: Miaohe Lin + +[ Upstream commit 5d5d19eda6b0ee790af89c45e3f678345be6f50f ] + +For PMD-mapped page (usually THP), pvmw->pte is NULL. For PTE-mapped THP, +pvmw->pte is mapped. But for HugeTLB pages, pvmw->pte is not mapped and +set to the relevant page table entry. So in page_vma_mapped_walk_done(), +we may do pte_unmap() for HugeTLB pte which is not mapped. Fix this by +checking pvmw->page against PageHuge before trying to do pte_unmap(). + +Link: https://lkml.kernel.org/r/20210127093349.39081-1-linmiaohe@huawei.com +Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()") +Signed-off-by: Hongxiang Lou +Signed-off-by: Miaohe Lin +Tested-by: Sedat Dilek +Cc: Kees Cook +Cc: Nathan Chancellor +Cc: Mike Kravetz +Cc: Shakeel Butt +Cc: Johannes Weiner +Cc: Vlastimil Babka +Cc: Michel Lespinasse +Cc: Nick Desaulniers +Cc: "Kirill A. Shutemov" +Cc: Wei Yang +Cc: Dmitry Safonov <0x7f454c46@gmail.com> +Cc: Brian Geffon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/rmap.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/rmap.h b/include/linux/rmap.h +index 988d176472df7..d7d6d4eb17949 100644 +--- a/include/linux/rmap.h ++++ b/include/linux/rmap.h +@@ -214,7 +214,8 @@ struct page_vma_mapped_walk { + + static inline void page_vma_mapped_walk_done(struct page_vma_mapped_walk *pvmw) + { +- if (pvmw->pte) ++ /* HugeTLB pte is set to the relevant page table entry without pte_mapped. */ ++ if (pvmw->pte && !PageHuge(pvmw->page)) + pte_unmap(pvmw->pte); + if (pvmw->ptl) + spin_unlock(pvmw->ptl); +-- +2.27.0 + diff --git a/queue-4.19/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch b/queue-4.19/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch new file mode 100644 index 00000000000..6568a93ed62 --- /dev/null +++ b/queue-4.19/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch @@ -0,0 +1,44 @@ +From da8caa74b875591bbba981cc1eeacf58e12b887f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Dec 2020 19:29:31 +0900 +Subject: mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to + 128-bytes + +From: Takeshi Saito + +[ Upstream commit d7aefb2887601cf1fc3f86f55d43b2c9aece5e8f ] + +According to the latest datasheet, the internal DMAC buffer alignment +R-Car Gen3 SDHI HW should be 128-bytes. So, fix it. + +Signed-off-by: Takeshi Saito +[shimoda: revise commit description, rebase] +Fixes: 2a68ea7896e3 ("mmc: renesas-sdhi: add support for R-Car Gen3 SDHI DMAC") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Wolfram Sang +Tested-by: Wolfram Sang +Link: https://lore.kernel.org/r/1608114572-1892-2-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/renesas_sdhi_internal_dmac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +index 74eea8247490d..6e2685c9e9cb5 100644 +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -180,8 +180,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host, + mmc_get_dma_dir(data))) + goto force_pio; + +- /* This DMAC cannot handle if buffer is not 8-bytes alignment */ +- if (!IS_ALIGNED(sg_dma_address(sg), 8)) ++ /* This DMAC cannot handle if buffer is not 128-bytes alignment */ ++ if (!IS_ALIGNED(sg_dma_address(sg), 128)) + goto force_pio_with_unmap; + + if (data->flags & MMC_DATA_READ) { +-- +2.27.0 + diff --git a/queue-4.19/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch b/queue-4.19/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch new file mode 100644 index 00000000000..bcf0aaa982f --- /dev/null +++ b/queue-4.19/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch @@ -0,0 +1,46 @@ +From d141ed739ca140f41d8410c9e7178cbfdc39e203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Dec 2020 22:09:22 +0100 +Subject: mmc: usdhi6rol0: Fix a resource leak in the error handling path of + the probe + +From: Christophe JAILLET + +[ Upstream commit 6052b3c370fb82dec28bcfff6d7ec0da84ac087a ] + +A call to 'ausdhi6_dma_release()' to undo a previous call to +'usdhi6_dma_request()' is missing in the error handling path of the probe +function. + +It is already present in the remove function. + +Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201217210922.165340-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/usdhi6rol0.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c +index cdfeb15b6f051..ef3aa8b520787 100644 +--- a/drivers/mmc/host/usdhi6rol0.c ++++ b/drivers/mmc/host/usdhi6rol0.c +@@ -1866,10 +1866,12 @@ static int usdhi6_probe(struct platform_device *pdev) + + ret = mmc_add_host(mmc); + if (ret < 0) +- goto e_clk_off; ++ goto e_release_dma; + + return 0; + ++e_release_dma: ++ usdhi6_dma_release(host); + e_clk_off: + clk_disable_unprepare(host->clk); + e_free_mmc: +-- +2.27.0 + diff --git a/queue-4.19/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch b/queue-4.19/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch new file mode 100644 index 00000000000..6dc8d76de10 --- /dev/null +++ b/queue-4.19/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch @@ -0,0 +1,78 @@ +From 4693c452a4a046f97f9b4b77b622f82900fbd041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 00:37:08 +0530 +Subject: net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning + +From: Shyam Sundar S K + +[ Upstream commit 186edbb510bd60e748f93975989ccba25ee99c50 ] + +The current driver calls netif_carrier_off() late in the link tear down +which can result in a netdev watchdog timeout. + +Calling netif_carrier_off() immediately after netif_tx_stop_all_queues() +avoids the warning. + + ------------[ cut here ]------------ + NETDEV WATCHDOG: enp3s0f2 (amd-xgbe): transmit queue 0 timed out + WARNING: CPU: 3 PID: 0 at net/sched/sch_generic.c:461 dev_watchdog+0x20d/0x220 + Modules linked in: amd_xgbe(E) amd-xgbe 0000:03:00.2 enp3s0f2: Link is Down + CPU: 3 PID: 0 Comm: swapper/3 Tainted: G E + Hardware name: AMD Bilby-RV2/Bilby-RV2, BIOS RBB1202A 10/18/2019 + RIP: 0010:dev_watchdog+0x20d/0x220 + Code: 00 49 63 4e e0 eb 92 4c 89 e7 c6 05 c6 e2 c1 00 01 e8 e7 ce fc ff 89 d9 48 + RSP: 0018:ffff90cfc28c3e88 EFLAGS: 00010286 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006 + RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff90cfc28d63c0 + RBP: ffff90cfb977845c R08: 0000000000000050 R09: 0000000000196018 + R10: ffff90cfc28c3ef8 R11: 0000000000000000 R12: ffff90cfb9778000 + R13: 0000000000000003 R14: ffff90cfb9778480 R15: 0000000000000010 + FS: 0000000000000000(0000) GS:ffff90cfc28c0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f240ff2d9d0 CR3: 00000001e3e0a000 CR4: 00000000003406e0 + Call Trace: + + ? pfifo_fast_reset+0x100/0x100 + call_timer_fn+0x2b/0x130 + run_timer_softirq+0x3e8/0x440 + ? enqueue_hrtimer+0x39/0x90 + +Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Shyam Sundar S K +Acked-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 + + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 - + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 5519eff584417..80cf6af822f72 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1444,6 +1444,7 @@ static void xgbe_stop(struct xgbe_prv_data *pdata) + return; + + netif_tx_stop_all_queues(netdev); ++ netif_carrier_off(pdata->netdev); + + xgbe_stop_timers(pdata); + flush_workqueue(pdata->dev_workqueue); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 8a3a60bb26888..4d5506d928973 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1396,7 +1396,6 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata) + pdata->phy_if.phy_impl.stop(pdata); + + pdata->phy.link = 0; +- netif_carrier_off(pdata->netdev); + + xgbe_phy_adjust_link(pdata); + } +-- +2.27.0 + diff --git a/queue-4.19/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch b/queue-4.19/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch new file mode 100644 index 00000000000..6037d5c3169 --- /dev/null +++ b/queue-4.19/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch @@ -0,0 +1,41 @@ +From a39f68003aa1c8770903a5759d7e0a6824b781a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 00:37:10 +0530 +Subject: net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP + +From: Shyam Sundar S K + +[ Upstream commit 9eab3fdb419916f66a72d1572f68d82cd9b3f963 ] + +Frequent link up/down events can happen when a Bel Fuse SFP part is +connected to the amd-xgbe device. Try to avoid the frequent link +issues by resetting the PHY as documented in Bel Fuse SFP datasheets. + +Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Shyam Sundar S K +Acked-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 1a617d6d2bf86..54753c8a6a9d7 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -912,6 +912,9 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata) + if ((phy_id & 0xfffffff0) != 0x03625d10) + return false; + ++ /* Reset PHY - wait for self-clearing reset bit to clear */ ++ genphy_soft_reset(phy_data->phydev); ++ + /* Disable RGMII mode */ + phy_write(phy_data->phydev, 0x18, 0x7007); + reg = phy_read(phy_data->phydev, 0x18); +-- +2.27.0 + diff --git a/queue-4.19/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch b/queue-4.19/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch new file mode 100644 index 00000000000..e17784c6d94 --- /dev/null +++ b/queue-4.19/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch @@ -0,0 +1,66 @@ +From 5fe1c20eb2890ca2e625d843270470f0d0ae6a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 00:37:09 +0530 +Subject: net: amd-xgbe: Reset link when the link never comes back + +From: Shyam Sundar S K + +[ Upstream commit 84fe68eb67f9499309cffd97c1ba269de125ff14 ] + +Normally, auto negotiation and reconnect should be automatically done by +the hardware. But there seems to be an issue where auto negotiation has +to be restarted manually. This happens because of link training and so +even though still connected to the partner the link never "comes back". +This needs an auto-negotiation restart. + +Also, a change in xgbe-mdio is needed to get ethtool to recognize the +link down and get the link change message. This change is only +required in a backplane connection mode. + +Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Shyam Sundar S K +Acked-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 2 +- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 4d5506d928973..156a0bc8ab01d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1345,7 +1345,7 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata) + &an_restart); + if (an_restart) { + xgbe_phy_config_aneg(pdata); +- return; ++ goto adjust_link; + } + + if (pdata->phy.link) { +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 828d12bf523fe..1a617d6d2bf86 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -2595,6 +2595,14 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) + if (reg & MDIO_STAT1_LSTATUS) + return 1; + ++ if (pdata->phy.autoneg == AUTONEG_ENABLE && ++ phy_data->port_mode == XGBE_PORT_MODE_BACKPLANE) { ++ if (!test_bit(XGBE_LINK_INIT, &pdata->dev_state)) { ++ netif_carrier_off(pdata->netdev); ++ *an_restart = 1; ++ } ++ } ++ + /* No link, attempt a receiver reset cycle */ + if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) { + phy_data->rrc_count = 0; +-- +2.27.0 + diff --git a/queue-4.19/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch b/queue-4.19/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch new file mode 100644 index 00000000000..731815a02fd --- /dev/null +++ b/queue-4.19/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch @@ -0,0 +1,128 @@ +From 425799b9a7d5dd48b65bb89902648ba939239332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 00:37:07 +0530 +Subject: net: amd-xgbe: Reset the PHY rx data path when mailbox command + timeout + +From: Shyam Sundar S K + +[ Upstream commit 30b7edc82ec82578f4f5e6706766f0a9535617d3 ] + +Sometimes mailbox commands timeout when the RX data path becomes +unresponsive. This prevents the submission of new mailbox commands to DXIO. +This patch identifies the timeout and resets the RX data path so that the +next message can be submitted properly. + +Fixes: 549b32af9f7c ("amd-xgbe: Simplify mailbox interface rate change code") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Shyam Sundar S K +Acked-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 +++++++++++ + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 28 ++++++++++++++++++++- + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +index b40d4377cc71d..b2cd3bdba9f89 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +@@ -1279,10 +1279,18 @@ + #define MDIO_PMA_10GBR_FECCTRL 0x00ab + #endif + ++#ifndef MDIO_PMA_RX_CTRL1 ++#define MDIO_PMA_RX_CTRL1 0x8051 ++#endif ++ + #ifndef MDIO_PCS_DIG_CTRL + #define MDIO_PCS_DIG_CTRL 0x8000 + #endif + ++#ifndef MDIO_PCS_DIGITAL_STAT ++#define MDIO_PCS_DIGITAL_STAT 0x8010 ++#endif ++ + #ifndef MDIO_AN_XNP + #define MDIO_AN_XNP 0x0016 + #endif +@@ -1358,6 +1366,8 @@ + #define XGBE_KR_TRAINING_ENABLE BIT(1) + + #define XGBE_PCS_CL37_BP BIT(12) ++#define XGBE_PCS_PSEQ_STATE_MASK 0x1c ++#define XGBE_PCS_PSEQ_STATE_POWER_GOOD 0x10 + + #define XGBE_AN_CL37_INT_CMPLT BIT(0) + #define XGBE_AN_CL37_INT_MASK 0x01 +@@ -1375,6 +1385,10 @@ + #define XGBE_PMA_CDR_TRACK_EN_OFF 0x00 + #define XGBE_PMA_CDR_TRACK_EN_ON 0x01 + ++#define XGBE_PMA_RX_RST_0_MASK BIT(4) ++#define XGBE_PMA_RX_RST_0_RESET_ON 0x10 ++#define XGBE_PMA_RX_RST_0_RESET_OFF 0x00 ++ + /* Bit setting and getting macros + * The get macro will extract the current bit field value from within + * the variable +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 3ceb4f95ca7ca..828d12bf523fe 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -1942,6 +1942,27 @@ static void xgbe_phy_set_redrv_mode(struct xgbe_prv_data *pdata) + xgbe_phy_put_comm_ownership(pdata); + } + ++static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata) ++{ ++ int reg; ++ ++ reg = XMDIO_READ_BITS(pdata, MDIO_MMD_PCS, MDIO_PCS_DIGITAL_STAT, ++ XGBE_PCS_PSEQ_STATE_MASK); ++ if (reg == XGBE_PCS_PSEQ_STATE_POWER_GOOD) { ++ /* Mailbox command timed out, reset of RX block is required. ++ * This can be done by asseting the reset bit and wait for ++ * its compeletion. ++ */ ++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1, ++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_ON); ++ ndelay(20); ++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1, ++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_OFF); ++ usleep_range(40, 50); ++ netif_err(pdata, link, pdata->netdev, "firmware mailbox reset performed\n"); ++ } ++} ++ + static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + unsigned int cmd, unsigned int sub_cmd) + { +@@ -1949,9 +1970,11 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + unsigned int wait; + + /* Log if a previous command did not complete */ +- if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) ++ if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) { + netif_dbg(pdata, link, pdata->netdev, + "firmware mailbox not ready for command\n"); ++ xgbe_phy_rx_reset(pdata); ++ } + + /* Construct the command */ + XP_SET_BITS(s0, XP_DRIVER_SCRATCH_0, COMMAND, cmd); +@@ -1973,6 +1996,9 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, + + netif_dbg(pdata, link, pdata->netdev, + "firmware mailbox command did not complete\n"); ++ ++ /* Reset on error */ ++ xgbe_phy_rx_reset(pdata); + } + + static void xgbe_phy_rrc(struct xgbe_prv_data *pdata) +-- +2.27.0 + diff --git a/queue-4.19/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch b/queue-4.19/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch new file mode 100644 index 00000000000..2ea6df6d1e0 --- /dev/null +++ b/queue-4.19/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch @@ -0,0 +1,39 @@ +From d8c16cf2b510754e1564e6e49d206b45e2a895fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Feb 2021 22:35:59 +0800 +Subject: net/mlx4_core: Add missed mlx4_free_cmd_mailbox() + +From: Chuhong Yuan + +[ Upstream commit 8eb65fda4a6dbd59cd5de24b106a10b6ee0d2176 ] + +mlx4_do_mirror_rule() forgets to call mlx4_free_cmd_mailbox() to +free the memory region allocated by mlx4_alloc_cmd_mailbox() before +an exit. +Add the missed call to fix it. + +Fixes: 78efed275117 ("net/mlx4_core: Support mirroring VF DMFS rules on both ports") +Signed-off-by: Chuhong Yuan +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20210221143559.390277-1-hslester96@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index a4c1ed65f620c..550e4893253ee 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -4990,6 +4990,7 @@ static int mlx4_do_mirror_rule(struct mlx4_dev *dev, struct res_fs_rule *fs_rule + + if (!fs_rule->mirr_mbox) { + mlx4_err(dev, "rule mirroring mailbox is null\n"); ++ mlx4_free_cmd_mailbox(dev, mailbox); + return -EINVAL; + } + memcpy(mailbox->buf, fs_rule->mirr_mbox, fs_rule->mirr_mbox_size); +-- +2.27.0 + diff --git a/queue-4.19/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch b/queue-4.19/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch new file mode 100644 index 00000000000..e537d1178c9 --- /dev/null +++ b/queue-4.19/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch @@ -0,0 +1,55 @@ +From 1b5f41e02413a2ed00dd1bb09541f036bea6a50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 10:25:35 +0100 +Subject: net: mvneta: Remove per-cpu queue mapping for Armada 3700 + +From: Maxime Chevallier + +[ Upstream commit cf9bf871280d9e0a8869d98c2602d29caf69dfa3 ] + +According to Errata #23 "The per-CPU GbE interrupt is limited to Core +0", we can't use the per-cpu interrupt mechanism on the Armada 3700 +familly. + +This is correctly checked for RSS configuration, but the initial queue +mapping is still done by having the queues spread across all the CPUs in +the system, both in the init path and in the cpu_hotplug path. + +Fixes: 2636ac3cc2b4 ("net: mvneta: Add network support for Armada 3700 SoC") +Signed-off-by: Maxime Chevallier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 30a16cf796c7a..fda5dd8c71ebd 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3022,7 +3022,9 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp, + } + + /* Setup XPS mapping */ +- if (txq_number > 1) ++ if (pp->neta_armada3700) ++ cpu = 0; ++ else if (txq_number > 1) + cpu = txq->id % num_present_cpus(); + else + cpu = pp->rxq_def % num_present_cpus(); +@@ -3667,6 +3669,11 @@ static int mvneta_cpu_online(unsigned int cpu, struct hlist_node *node) + node_online); + struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu); + ++ /* Armada 3700's per-cpu interrupt for mvneta is broken, all interrupts ++ * are routed to CPU 0, so we don't need all the cpu-hotplug support ++ */ ++ if (pp->neta_armada3700) ++ return 0; + + spin_lock(&pp->lock); + /* +-- +2.27.0 + diff --git a/queue-4.19/ocfs2-fix-a-use-after-free-on-error.patch b/queue-4.19/ocfs2-fix-a-use-after-free-on-error.patch new file mode 100644 index 00000000000..bbc52186186 --- /dev/null +++ b/queue-4.19/ocfs2-fix-a-use-after-free-on-error.patch @@ -0,0 +1,60 @@ +From 50b51724f0bedf064c06a854c1c2f69f5132986b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:00:41 -0800 +Subject: ocfs2: fix a use after free on error + +From: Dan Carpenter + +[ Upstream commit c57d117f2b2f2a19b570c36f2819ef8d8210af20 ] + +The error handling in this function frees "reg" but it is still on the +"o2hb_all_regions" list so it will lead to a use after freew. Joseph Qi +points out that we need to clear the bit in the "o2hb_region_bitmap" as +well + +Link: https://lkml.kernel.org/r/YBk4M6HUG8jB/jc7@mwanda +Fixes: 1cf257f51191 ("ocfs2: fix memory leak") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/cluster/heartbeat.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c +index 9b2ed62dd6385..19b0d358a0d6e 100644 +--- a/fs/ocfs2/cluster/heartbeat.c ++++ b/fs/ocfs2/cluster/heartbeat.c +@@ -2154,7 +2154,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g + o2hb_nego_timeout_handler, + reg, NULL, ®->hr_handler_list); + if (ret) +- goto free; ++ goto remove_item; + + ret = o2net_register_handler(O2HB_NEGO_APPROVE_MSG, reg->hr_key, + sizeof(struct o2hb_nego_msg), +@@ -2173,6 +2173,12 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g + + unregister_handler: + o2net_unregister_handler_list(®->hr_handler_list); ++remove_item: ++ spin_lock(&o2hb_live_lock); ++ list_del(®->hr_all_item); ++ if (o2hb_global_heartbeat_active()) ++ clear_bit(reg->hr_region_num, o2hb_region_bitmap); ++ spin_unlock(&o2hb_live_lock); + free: + kfree(reg); + return ERR_PTR(ret); +-- +2.27.0 + diff --git a/queue-4.19/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch b/queue-4.19/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch new file mode 100644 index 00000000000..c30b68be5b4 --- /dev/null +++ b/queue-4.19/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch @@ -0,0 +1,80 @@ +From f7e168fef5ae2b4e579f554564cd2d6e2084e633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 11:45:44 +0000 +Subject: of/fdt: Make sure no-map does not remove already reserved regions + +From: Nicolas Boichat + +[ Upstream commit 8a5a75e5e9e55de1cef5d83ca3589cb4899193ef ] + +If the device tree is incorrectly configured, and attempts to +define a "no-map" reserved memory that overlaps with the kernel +data/code, the kernel would crash quickly after boot, with no +obvious clue about the nature of the issue. + +For example, this would happen if we have the kernel mapped at +these addresses (from /proc/iomem): +40000000-41ffffff : System RAM + 40080000-40dfffff : Kernel code + 40e00000-411fffff : reserved + 41200000-413e0fff : Kernel data + +And we declare a no-map shared-dma-pool region at a fixed address +within that range: +mem_reserved: mem_region { + compatible = "shared-dma-pool"; + reg = <0 0x40000000 0 0x01A00000>; + no-map; +}; + +To fix this, when removing memory regions at early boot (which is +what "no-map" regions do), we need to make sure that the memory +is not already reserved. If we do, __reserved_mem_reserve_reg +will throw an error: +[ 0.000000] OF: fdt: Reserved memory: failed to reserve memory + for node 'mem_region': base 0x0000000040000000, size 26 MiB +and the code that will try to use the region should also fail, +later on. + +We do not do anything for non-"no-map" regions, as memblock +explicitly allows reserved regions to overlap, and the commit +that this fixes removed the check for that precise reason. + +[ qperret: fixed conflicts caused by the usage of memblock_mark_nomap ] + +Fixes: 094cb98179f19b7 ("of/fdt: memblock_reserve /memreserve/ regions in the case of partial overlap") +Signed-off-by: Nicolas Boichat +Reviewed-by: Stephen Boyd +Signed-off-by: Quentin Perret +Link: https://lore.kernel.org/r/20210115114544.1830068-3-qperret@google.com +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index aa15e5d183c18..21160a08ead4b 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -1172,8 +1172,16 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size) + int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base, + phys_addr_t size, bool nomap) + { +- if (nomap) ++ if (nomap) { ++ /* ++ * If the memory is already reserved (by another region), we ++ * should not allow it to be marked nomap. ++ */ ++ if (memblock_is_region_reserved(base, size)) ++ return -EBUSY; ++ + return memblock_mark_nomap(base, size); ++ } + return memblock_reserve(base, size); + } + +-- +2.27.0 + diff --git a/queue-4.19/pci-align-checking-of-syscall-user-config-accessors.patch b/queue-4.19/pci-align-checking-of-syscall-user-config-accessors.patch new file mode 100644 index 00000000000..b786013ff86 --- /dev/null +++ b/queue-4.19/pci-align-checking-of-syscall-user-config-accessors.patch @@ -0,0 +1,80 @@ +From 19a2f1c635e23d2e46352d004f73ec7dd67fbfe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Jan 2021 16:39:32 +0100 +Subject: PCI: Align checking of syscall user config accessors + +From: Heiner Kallweit + +[ Upstream commit ef9e4005cbaf022c6251263aa27836acccaef65d ] + +After 34e3207205ef ("PCI: handle positive error codes"), +pci_user_read_config_*() and pci_user_write_config_*() return 0 or negative +errno values, not PCIBIOS_* values like PCIBIOS_SUCCESSFUL or +PCIBIOS_BAD_REGISTER_NUMBER. + +Remove comparisons with PCIBIOS_SUCCESSFUL and check only for non-zero. It +happens that PCIBIOS_SUCCESSFUL is zero, so this is not a functional +change, but it aligns this code with the user accessors. + +[bhelgaas: commit log] +Fixes: 34e3207205ef ("PCI: handle positive error codes") +Link: https://lore.kernel.org/r/f1220314-e518-1e18-bf94-8e6f8c703758@gmail.com +Signed-off-by: Heiner Kallweit +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/syscall.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c +index d96626c614f56..a7bdd10fccf33 100644 +--- a/drivers/pci/syscall.c ++++ b/drivers/pci/syscall.c +@@ -19,7 +19,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, + u16 word; + u32 dword; + long err; +- long cfg_ret; ++ int cfg_ret; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; +@@ -45,7 +45,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, + } + + err = -EIO; +- if (cfg_ret != PCIBIOS_SUCCESSFUL) ++ if (cfg_ret) + goto error; + + switch (len) { +@@ -103,7 +103,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, + if (err) + break; + err = pci_user_write_config_byte(dev, off, byte); +- if (err != PCIBIOS_SUCCESSFUL) ++ if (err) + err = -EIO; + break; + +@@ -112,7 +112,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, + if (err) + break; + err = pci_user_write_config_word(dev, off, word); +- if (err != PCIBIOS_SUCCESSFUL) ++ if (err) + err = -EIO; + break; + +@@ -121,7 +121,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, + if (err) + break; + err = pci_user_write_config_dword(dev, off, dword); +- if (err != PCIBIOS_SUCCESSFUL) ++ if (err) + err = -EIO; + break; + +-- +2.27.0 + diff --git a/queue-4.19/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch b/queue-4.19/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch new file mode 100644 index 00000000000..4f721821cff --- /dev/null +++ b/queue-4.19/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch @@ -0,0 +1,41 @@ +From 372eb48d198ddfc9c5ad89944ed1c9e7d1b7f2ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 19:53:47 +0200 +Subject: perf intel-pt: Fix missing CYC processing in PSB + +From: Adrian Hunter + +[ Upstream commit 03fb0f859b45d1eb05c984ab4bd3bef67e45ede2 ] + +Add missing CYC packet processing when walking through PSB+. This +improves the accuracy of timestamps that follow PSB+, until the next +MTC. + +Fixes: 3d49807870f08 ("perf tools: Add new Intel PT packet definitions") +Signed-off-by: Adrian Hunter +Reviewed-by: Andi Kleen +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20210205175350.23817-2-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index 6522b6513895c..e2f038f84dbc1 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -1596,6 +1596,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder) + break; + + case INTEL_PT_CYC: ++ intel_pt_calc_cyc_timestamp(decoder); ++ break; ++ + case INTEL_PT_VMCS: + case INTEL_PT_MNT: + case INTEL_PT_PAD: +-- +2.27.0 + diff --git a/queue-4.19/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch b/queue-4.19/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch new file mode 100644 index 00000000000..d162b9e1d37 --- /dev/null +++ b/queue-4.19/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch @@ -0,0 +1,73 @@ +From 19cee1b3624000c3a189048e111e0adc621af38a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Feb 2021 18:16:38 +0900 +Subject: perf test: Fix unaligned access in sample parsing test + +From: Namhyung Kim + +[ Upstream commit c5c97cadd7ed13381cb6b4bef5c841a66938d350 ] + +The ubsan reported the following error. It was because sample's raw +data missed u32 padding at the end. So it broke the alignment of the +array after it. + +The raw data contains an u32 size prefix so the data size should have +an u32 padding after 8-byte aligned data. + +27: Sample parsing :util/synthetic-events.c:1539:4: + runtime error: store to misaligned address 0x62100006b9bc for type + '__u64' (aka 'unsigned long long'), which requires 8 byte alignment +0x62100006b9bc: note: pointer points here + 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ^ + #0 0x561532a9fc96 in perf_event__synthesize_sample util/synthetic-events.c:1539:13 + #1 0x5615327f4a4f in do_test tests/sample-parsing.c:284:8 + #2 0x5615327f3f50 in test__sample_parsing tests/sample-parsing.c:381:9 + #3 0x56153279d3a1 in run_test tests/builtin-test.c:424:9 + #4 0x56153279c836 in test_and_print tests/builtin-test.c:454:9 + #5 0x56153279b7eb in __cmd_test tests/builtin-test.c:675:4 + #6 0x56153279abf0 in cmd_test tests/builtin-test.c:821:9 + #7 0x56153264e796 in run_builtin perf.c:312:11 + #8 0x56153264cf03 in handle_internal_command perf.c:364:8 + #9 0x56153264e47d in run_argv perf.c:408:2 + #10 0x56153264c9a9 in main perf.c:538:3 + #11 0x7f137ab6fbbc in __libc_start_main (/lib64/libc.so.6+0x38bbc) + #12 0x561532596828 in _start ... + +SUMMARY: UndefinedBehaviorSanitizer: misaligned-pointer-use + util/synthetic-events.c:1539:4 in + +Fixes: 045f8cd8542d ("perf tests: Add a sample parsing test") +Signed-off-by: Namhyung Kim +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/r/20210214091638.519643-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/sample-parsing.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c +index 0e2d00d69e6e2..66e46bc8d6f1d 100644 +--- a/tools/perf/tests/sample-parsing.c ++++ b/tools/perf/tests/sample-parsing.c +@@ -173,7 +173,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format) + .data = {1, 211, 212, 213}, + }; + u64 regs[64]; +- const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL}; ++ const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 }; + const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL}; + struct perf_sample sample = { + .ip = 101, +-- +2.27.0 + diff --git a/queue-4.19/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch b/queue-4.19/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch new file mode 100644 index 00000000000..16e51420197 --- /dev/null +++ b/queue-4.19/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch @@ -0,0 +1,101 @@ +From dc1f7377e785530a43d9b4156bdf21e1c7a41a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 09:52:47 -0300 +Subject: perf tools: Fix DSO filtering when not finding a map for a sampled + address + +From: Arnaldo Carvalho de Melo + +[ Upstream commit c69bf11ad3d30b6bf01cfa538ddff1a59467c734 ] + +When we lookup an address and don't find a map we should filter that +sample if the user specified a list of --dso entries to filter on, fix +it. + +Before: + + $ perf script + sleep 274800 2843.556162: 1 cycles:u: ffffffffbb26bff4 [unknown] ([unknown]) + sleep 274800 2843.556168: 1 cycles:u: ffffffffbb2b047d [unknown] ([unknown]) + sleep 274800 2843.556171: 1 cycles:u: ffffffffbb2706b2 [unknown] ([unknown]) + sleep 274800 2843.556174: 6 cycles:u: ffffffffbb2b0267 [unknown] ([unknown]) + sleep 274800 2843.556176: 59 cycles:u: ffffffffbb2b03b1 [unknown] ([unknown]) + sleep 274800 2843.556180: 691 cycles:u: ffffffffbb26bff4 [unknown] ([unknown]) + sleep 274800 2843.556189: 9160 cycles:u: 7fa9550eeaa3 __GI___tunables_init+0xf3 (/usr/lib64/ld-2.32.so) + sleep 274800 2843.556312: 86937 cycles:u: 7fa9550e157b _dl_lookup_symbol_x+0x4b (/usr/lib64/ld-2.32.so) + $ + +So we have some samples we somehow didn't find in a map for, if we now +do: + + $ perf report --stdio --dso /usr/lib64/ld-2.32.so + # dso: /usr/lib64/ld-2.32.so + # + # Total Lost Samples: 0 + # + # Samples: 8 of event 'cycles:u' + # Event count (approx.): 96856 + # + # Overhead Command Symbol + # ........ ....... ........................ + # + 89.76% sleep [.] _dl_lookup_symbol_x + 9.46% sleep [.] __GI___tunables_init + 0.71% sleep [k] 0xffffffffbb26bff4 + 0.06% sleep [k] 0xffffffffbb2b03b1 + 0.01% sleep [k] 0xffffffffbb2b0267 + 0.00% sleep [k] 0xffffffffbb2706b2 + 0.00% sleep [k] 0xffffffffbb2b047d + $ + +After this patch we get the right output with just entries for the DSOs +specified in --dso: + + $ perf report --stdio --dso /usr/lib64/ld-2.32.so + # dso: /usr/lib64/ld-2.32.so + # + # Total Lost Samples: 0 + # + # Samples: 8 of event 'cycles:u' + # Event count (approx.): 96856 + # + # Overhead Command Symbol + # ........ ....... ........................ + # + 89.76% sleep [.] _dl_lookup_symbol_x + 9.46% sleep [.] __GI___tunables_init + $ + # + +Fixes: 96415e4d3f5fdf9c ("perf symbols: Avoid unnecessary symbol loading when dso list is specified") +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ingo Molnar +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210128131209.GD775562@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/event.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c +index 9c22729e2ad60..538c935b40b8b 100644 +--- a/tools/perf/util/event.c ++++ b/tools/perf/util/event.c +@@ -1660,6 +1660,8 @@ int machine__resolve(struct machine *machine, struct addr_location *al, + } + + al->sym = map__find_symbol(al->map, al->addr); ++ } else if (symbol_conf.dso_list) { ++ al->filtered |= (1 << HIST_FILTER__DSO); + } + + if (symbol_conf.sym_list && +-- +2.27.0 + diff --git a/queue-4.19/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch b/queue-4.19/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch new file mode 100644 index 00000000000..fec4583d025 --- /dev/null +++ b/queue-4.19/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch @@ -0,0 +1,36 @@ +From e3174e8af9cbdf065b82c520a58aaf5c545ec37c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Dec 2020 14:57:31 +0200 +Subject: power: reset: at91-sama5d2_shdwc: fix wkupdbc mask + +From: Claudiu Beznea + +[ Upstream commit 95aa21a3f1183260db1b0395e03df5bebc5ed641 ] + +According to datasheet WKUPDBC mask is b/w bits 26..24. + +Fixes: f80cb48843987 ("power: reset: at91-shdwc: add new shutdown controller driver") +Signed-off-by: Claudiu Beznea +Reviewed-by: Alexandre Belloni +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/reset/at91-sama5d2_shdwc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c +index d9493e893d64e..7cf59e764ef28 100644 +--- a/drivers/power/reset/at91-sama5d2_shdwc.c ++++ b/drivers/power/reset/at91-sama5d2_shdwc.c +@@ -36,7 +36,7 @@ + + #define AT91_SHDW_MR 0x04 /* Shut Down Mode Register */ + #define AT91_SHDW_WKUPDBC_SHIFT 24 +-#define AT91_SHDW_WKUPDBC_MASK GENMASK(31, 16) ++#define AT91_SHDW_WKUPDBC_MASK GENMASK(26, 24) + #define AT91_SHDW_WKUPDBC(x) (((x) << AT91_SHDW_WKUPDBC_SHIFT) \ + & AT91_SHDW_WKUPDBC_MASK) + +-- +2.27.0 + diff --git a/queue-4.19/powerpc-47x-disable-256k-page-size.patch b/queue-4.19/powerpc-47x-disable-256k-page-size.patch new file mode 100644 index 00000000000..104a4a3cdc2 --- /dev/null +++ b/queue-4.19/powerpc-47x-disable-256k-page-size.patch @@ -0,0 +1,41 @@ +From 82f6b2a4b98161212d5e10533db570b62b8ad7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 07:49:13 +0000 +Subject: powerpc/47x: Disable 256k page size + +From: Christophe Leroy + +[ Upstream commit 910a0cb6d259736a0c86e795d4c2f42af8d0d775 ] + +PPC47x_TLBE_SIZE isn't defined for 256k pages, leading to a build +break if 256k pages is selected. + +So change the kconfig so that 256k pages can't be selected for 47x. + +Fixes: e7f75ad01d59 ("powerpc/47x: Base ppc476 support") +Reported-by: kernel test robot +Signed-off-by: Christophe Leroy +[mpe: Expand change log to mention build break] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/2fed79b1154c872194f98bac4422c23918325e61.1611128938.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index d18ea3c1f4fac..6dd2a14e1ebcd 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -709,7 +709,7 @@ config PPC_64K_PAGES + + config PPC_256K_PAGES + bool "256k page size" +- depends on 44x && !STDBINUTILS ++ depends on 44x && !STDBINUTILS && !PPC_47x + help + Make the page size 256k. + +-- +2.27.0 + diff --git a/queue-4.19/powerpc-8xx-fix-software-emulation-interrupt.patch b/queue-4.19/powerpc-8xx-fix-software-emulation-interrupt.patch new file mode 100644 index 00000000000..e537e611c41 --- /dev/null +++ b/queue-4.19/powerpc-8xx-fix-software-emulation-interrupt.patch @@ -0,0 +1,40 @@ +From 070c8d3af4dc32b47acdd1b054d0ac75a43446ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 08:56:13 +0000 +Subject: powerpc/8xx: Fix software emulation interrupt + +From: Christophe Leroy + +[ Upstream commit 903178d0ce6bb30ef80a3604ab9ee2b57869fbc9 ] + +For unimplemented instructions or unimplemented SPRs, the 8xx triggers +a "Software Emulation Exception" (0x1000). That interrupt doesn't set +reason bits in SRR1 as the "Program Check Exception" does. + +Go through emulation_assist_interrupt() to set REASON_ILLEGAL. + +Fixes: fbbcc3bb139e ("powerpc/8xx: Remove SoftwareEmulation()") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/ad782af87a222efc79cfb06079b0fd23d4224eaf.1612515180.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index dc99258f2e8c6..08c16aa0dd534 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -269,7 +269,7 @@ SystemCall: + /* On the MPC8xx, this is a software emulation interrupt. It occurs + * for all unimplemented and illegal instructions. + */ +- EXCEPTION(0x1000, SoftEmu, program_check_exception, EXC_XFER_STD) ++ EXCEPTION(0x1000, SoftEmu, emulation_assist_interrupt, EXC_XFER_STD) + + . = 0x1100 + /* +-- +2.27.0 + diff --git a/queue-4.19/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch b/queue-4.19/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch new file mode 100644 index 00000000000..326b6738f34 --- /dev/null +++ b/queue-4.19/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch @@ -0,0 +1,65 @@ +From 1efabef699b40b4ba2b11ba875bb358ecc0aa920 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jan 2021 20:59:00 -0600 +Subject: powerpc/pseries/dlpar: handle ibm, configure-connector delay status + +From: Nathan Lynch + +[ Upstream commit 768d70e19ba525debd571b36e6d0ab19956c63d7 ] + +dlpar_configure_connector() has two problems in its handling of +ibm,configure-connector's return status: + +1. When the status is -2 (busy, call again), we call + ibm,configure-connector again immediately without checking whether + to schedule, which can result in monopolizing the CPU. +2. Extended delay status (9900..9905) goes completely unhandled, + causing the configuration to unnecessarily terminate. + +Fix both of these issues by using rtas_busy_delay(). + +Fixes: ab519a011caa ("powerpc/pseries: Kernel DLPAR Infrastructure") +Signed-off-by: Nathan Lynch +Reviewed-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210107025900.410369-1-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/dlpar.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index c5ffcadab7302..90fd03b9d3c25 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -132,7 +132,6 @@ void dlpar_free_cc_nodes(struct device_node *dn) + #define NEXT_PROPERTY 3 + #define PREV_PARENT 4 + #define MORE_MEMORY 5 +-#define CALL_AGAIN -2 + #define ERR_CFG_USE -9003 + + struct device_node *dlpar_configure_connector(__be32 drc_index, +@@ -173,6 +172,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index, + + spin_unlock(&rtas_data_buf_lock); + ++ if (rtas_busy_delay(rc)) ++ continue; ++ + switch (rc) { + case COMPLETE: + break; +@@ -221,9 +223,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index, + last_dn = last_dn->parent; + break; + +- case CALL_AGAIN: +- break; +- + case MORE_MEMORY: + case ERR_CFG_USE: + default: +-- +2.27.0 + diff --git a/queue-4.19/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch b/queue-4.19/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch new file mode 100644 index 00000000000..d4cf0767740 --- /dev/null +++ b/queue-4.19/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch @@ -0,0 +1,43 @@ +From 906818b901df396540869bd79443a019b0d51dc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 11:12:06 -0500 +Subject: pwm: rockchip: rockchip_pwm_probe(): Remove superfluous + clk_unprepare() + +From: Simon South + +[ Upstream commit d5d8d675865ccddfe4da26c85f22c55cec663bf2 ] + +If rockchip_pwm_probe() fails to register a PWM device it calls +clk_unprepare() for the device's PWM clock, without having first disabled +the clock and before jumping to an error handler that also unprepares +it. This is likely to produce warnings from the kernel about the clock +being unprepared when it is still enabled, and then being unprepared when +it has already been unprepared. + +Prevent these warnings by removing this unnecessary call to +clk_unprepare(). + +Fixes: 48cf973cae33 ("pwm: rockchip: Avoid glitches on already running PWMs") +Signed-off-by: Simon South +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-rockchip.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c +index 4d99d468df09a..48bcc853d57a7 100644 +--- a/drivers/pwm/pwm-rockchip.c ++++ b/drivers/pwm/pwm-rockchip.c +@@ -370,7 +370,6 @@ static int rockchip_pwm_probe(struct platform_device *pdev) + + ret = pwmchip_add(&pc->chip); + if (ret < 0) { +- clk_unprepare(pc->clk); + dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret); + goto err_pclk; + } +-- +2.27.0 + diff --git a/queue-4.19/quota-fix-memory-leak-when-handling-corrupted-quota-.patch b/queue-4.19/quota-fix-memory-leak-when-handling-corrupted-quota-.patch new file mode 100644 index 00000000000..af0339c504a --- /dev/null +++ b/queue-4.19/quota-fix-memory-leak-when-handling-corrupted-quota-.patch @@ -0,0 +1,55 @@ +From 5764ee7c883195d28a13d6cdf5b0a17e612e8d58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Dec 2020 12:09:53 +0100 +Subject: quota: Fix memory leak when handling corrupted quota file + +From: Jan Kara + +[ Upstream commit a4db1072e1a3bd7a8d9c356e1902b13ac5deb8ef ] + +When checking corrupted quota file we can bail out and leak allocated +info structure. Properly free info structure on error return. + +Reported-by: syzbot+77779c9b52ab78154b08@syzkaller.appspotmail.com +Fixes: 11c514a99bb9 ("quota: Sanity-check quota file headers on load") +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/quota_v2.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c +index d99710270a373..addfaae8decfd 100644 +--- a/fs/quota/quota_v2.c ++++ b/fs/quota/quota_v2.c +@@ -165,19 +165,24 @@ static int v2_read_file_info(struct super_block *sb, int type) + quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).", + (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits, + i_size_read(sb_dqopt(sb)->files[type])); +- goto out; ++ goto out_free; + } + if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) { + quota_error(sb, "Free block number too big (%u >= %u).", + qinfo->dqi_free_blk, qinfo->dqi_blocks); +- goto out; ++ goto out_free; + } + if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) { + quota_error(sb, "Block with free entry too big (%u >= %u).", + qinfo->dqi_free_entry, qinfo->dqi_blocks); +- goto out; ++ goto out_free; + } + ret = 0; ++out_free: ++ if (ret) { ++ kfree(info->dqi_priv); ++ info->dqi_priv = NULL; ++ } + out: + up_read(&dqopt->dqio_sem); + return ret; +-- +2.27.0 + diff --git a/queue-4.19/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch b/queue-4.19/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch new file mode 100644 index 00000000000..53db3bcc68e --- /dev/null +++ b/queue-4.19/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch @@ -0,0 +1,54 @@ +From 545698057dfcc1acbdb3030e83001aa99720fd32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 16:05:19 +0100 +Subject: r8169: fix jumbo packet handling on RTL8168e +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Heiner Kallweit + +[ Upstream commit 6cf739131a15e4177e58a1b4f2bede9d5da78552 ] + +Josef reported [0] that using jumbo packets fails on RTL8168e. +Aligning the values for register MaxTxPacketSize with the +vendor driver fixes the problem. + +[0] https://bugzilla.kernel.org/show_bug.cgi?id=211827 + +Fixes: d58d46b5d851 ("r8169: jumbo fixes.") +Reported-by: Josef OÅ¡kera +Tested-by: Josef OÅ¡kera +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/b15ddef7-0d50-4320-18f4-6a3f86fbfd3e@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 6b901bf1cd54d..6fd1a639ec533 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -4365,7 +4365,7 @@ static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp) + + static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp) + { +- RTL_W8(tp, MaxTxPacketSize, 0x3f); ++ RTL_W8(tp, MaxTxPacketSize, 0x24); + RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0); + RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01); + rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_512B); +@@ -4373,7 +4373,7 @@ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp) + + static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp) + { +- RTL_W8(tp, MaxTxPacketSize, 0x0c); ++ RTL_W8(tp, MaxTxPacketSize, 0x3f); + RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0); + RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01); + rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B); +-- +2.27.0 + diff --git a/queue-4.19/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch b/queue-4.19/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch new file mode 100644 index 00000000000..b311bac8c0c --- /dev/null +++ b/queue-4.19/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch @@ -0,0 +1,40 @@ +From 377717530c6a6b011330eec18ae9280ccbd8e50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Dec 2020 15:01:19 +0200 +Subject: RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation + +From: Yishai Hadas + +[ Upstream commit 8798e4ad0abe0ba1221928a46561981c510be0c6 ] + +Use the correct obj_id upon DEVX TIR creation by strictly taking the tirn +24 bits and not the general obj_id which is 32 bits. + +Fixes: 7efce3691d33 ("IB/mlx5: Add obj create and destroy functionality") +Link: https://lore.kernel.org/r/20201230130121.180350-2-leon@kernel.org +Signed-off-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 4c90a007e09db..c89aec834972e 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -572,7 +572,9 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din, + MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_RQT); + break; + case MLX5_CMD_OP_CREATE_TIR: +- MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIR); ++ *obj_id = MLX5_GET(create_tir_out, out, tirn); ++ MLX5_SET(destroy_tir_in, din, opcode, MLX5_CMD_OP_DESTROY_TIR); ++ MLX5_SET(destroy_tir_in, din, tirn, *obj_id); + break; + case MLX5_CMD_OP_CREATE_TIS: + MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIS); +-- +2.27.0 + diff --git a/queue-4.19/rdma-rxe-correct-skb-on-loopback-path.patch b/queue-4.19/rdma-rxe-correct-skb-on-loopback-path.patch new file mode 100644 index 00000000000..74189aaab8a --- /dev/null +++ b/queue-4.19/rdma-rxe-correct-skb-on-loopback-path.patch @@ -0,0 +1,43 @@ +From f3217e7e77e7ef9d6680ec2f4bdbc99e5c4a44c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 12:23:02 -0600 +Subject: RDMA/rxe: Correct skb on loopback path + +From: Bob Pearson + +[ Upstream commit 5120bf0a5fc15dec210a0fe0f39e4a256bb6e349 ] + +rxe_net.c sends packets at the IP layer with skb->data pointing at the IP +header but receives packets from a UDP tunnel with skb->data pointing at +the UDP header. On the loopback path this was not correctly accounted +for. This patch corrects for this by using sbk_pull() to strip the IP +header from the skb on received packets. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20210128182301.16859-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_net.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 7903bd5c639ea..04bfc36cc8d76 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -500,6 +500,11 @@ int rxe_send(struct rxe_pkt_info *pkt, struct sk_buff *skb) + + void rxe_loopback(struct sk_buff *skb) + { ++ if (skb->protocol == htons(ETH_P_IP)) ++ skb_pull(skb, sizeof(struct iphdr)); ++ else ++ skb_pull(skb, sizeof(struct ipv6hdr)); ++ + rxe_rcv(skb); + } + +-- +2.27.0 + diff --git a/queue-4.19/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch b/queue-4.19/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch new file mode 100644 index 00000000000..860aa37af93 --- /dev/null +++ b/queue-4.19/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch @@ -0,0 +1,67 @@ +From 47991324728ff7f4c619cfddb872b43e4c94942c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 15:45:01 -0600 +Subject: RDMA/rxe: Fix coding error in rxe_recv.c + +From: Bob Pearson + +[ Upstream commit 7d9ae80e31df57dd3253e1ec514f0000aa588a81 ] + +check_type_state() in rxe_recv.c is written as if the type bits in the +packet opcode were a bit mask which is not correct. This patch corrects +this code to compare all 3 type bits to the required type. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20210127214500.3707-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index b8f3e65402d1d..d94e2c5bc317d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -36,21 +36,26 @@ + #include "rxe.h" + #include "rxe_loc.h" + ++/* check that QP matches packet opcode type and is in a valid state */ + static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt, + struct rxe_qp *qp) + { ++ unsigned int pkt_type; ++ + if (unlikely(!qp->valid)) + goto err1; + ++ pkt_type = pkt->opcode & 0xe0; ++ + switch (qp_type(qp)) { + case IB_QPT_RC: +- if (unlikely((pkt->opcode & IB_OPCODE_RC) != 0)) { ++ if (unlikely(pkt_type != IB_OPCODE_RC)) { + pr_warn_ratelimited("bad qp type\n"); + goto err1; + } + break; + case IB_QPT_UC: +- if (unlikely(!(pkt->opcode & IB_OPCODE_UC))) { ++ if (unlikely(pkt_type != IB_OPCODE_UC)) { + pr_warn_ratelimited("bad qp type\n"); + goto err1; + } +@@ -58,7 +63,7 @@ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt, + case IB_QPT_UD: + case IB_QPT_SMI: + case IB_QPT_GSI: +- if (unlikely(!(pkt->opcode & IB_OPCODE_UD))) { ++ if (unlikely(pkt_type != IB_OPCODE_UD)) { + pr_warn_ratelimited("bad qp type\n"); + goto err1; + } +-- +2.27.0 + diff --git a/queue-4.19/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch b/queue-4.19/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch new file mode 100644 index 00000000000..5f3be03ec8d --- /dev/null +++ b/queue-4.19/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch @@ -0,0 +1,60 @@ +From a069aafa0f56f2cb43d66767e8e5e131b9aebad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jan 2021 15:06:30 +0800 +Subject: regmap: sdw: use _no_pm functions in regmap_read/write + +From: Bard Liao + +[ Upstream commit d288a5712ef961e16d588bbdb2d846e00b5ef154 ] + +sdw_update_slave_status will be invoked when a codec is attached, +and the codec driver will initialize the codec with regmap functions +while the codec device is pm_runtime suspended. + +regmap routines currently rely on regular SoundWire IO functions, +which will call pm_runtime_get_sync()/put_autosuspend. + +This causes a deadlock where the resume routine waits for an +initialization complete signal that while the initialization complete +can only be reached when the resume completes. + +The only solution if we allow regmap functions to be used in resume +operations as well as during codec initialization is to use _no_pm +routines. The duty of making sure the bus is operational needs to be +handled above the regmap level. + +Fixes: 7c22ce6e21840 ('regmap: Add SoundWire bus support') +Signed-off-by: Bard Liao +Acked-by: Mark Brown +Link: https://lore.kernel.org/r/20210122070634.12825-6-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap-sdw.c b/drivers/base/regmap/regmap-sdw.c +index 50a66382d87d0..e75168b941d0c 100644 +--- a/drivers/base/regmap/regmap-sdw.c ++++ b/drivers/base/regmap/regmap-sdw.c +@@ -12,7 +12,7 @@ static int regmap_sdw_write(void *context, unsigned int reg, unsigned int val) + struct device *dev = context; + struct sdw_slave *slave = dev_to_sdw_dev(dev); + +- return sdw_write(slave, reg, val); ++ return sdw_write_no_pm(slave, reg, val); + } + + static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val) +@@ -21,7 +21,7 @@ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val) + struct sdw_slave *slave = dev_to_sdw_dev(dev); + int read; + +- read = sdw_read(slave, reg); ++ read = sdw_read_no_pm(slave, reg); + if (read < 0) + return read; + +-- +2.27.0 + diff --git a/queue-4.19/regulator-axp20x-fix-reference-cout-leak.patch b/queue-4.19/regulator-axp20x-fix-reference-cout-leak.patch new file mode 100644 index 00000000000..cf95bb66043 --- /dev/null +++ b/queue-4.19/regulator-axp20x-fix-reference-cout-leak.patch @@ -0,0 +1,52 @@ +From fb16fd93c9af17f21ebba7de1a6c29f1dc5116db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 04:33:13 -0800 +Subject: regulator: axp20x: Fix reference cout leak + +From: Pan Bian + +[ Upstream commit e78bf6be7edaacb39778f3a89416caddfc6c6d70 ] + +Decrements the reference count of device node and its child node. + +Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210120123313.107640-1-bianpan2016@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/axp20x-regulator.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c +index 91b8ff8bac157..c9e3677ac734b 100644 +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -558,7 +558,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq) + static int axp20x_regulator_parse_dt(struct platform_device *pdev) + { + struct device_node *np, *regulators; +- int ret; ++ int ret = 0; + u32 dcdcfreq = 0; + + np = of_node_get(pdev->dev.parent->of_node); +@@ -573,13 +573,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev) + ret = axp20x_set_dcdc_freq(pdev, dcdcfreq); + if (ret < 0) { + dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret); +- return ret; + } +- + of_node_put(regulators); + } + +- return 0; ++ of_node_put(np); ++ return ret; + } + + static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode) +-- +2.27.0 + diff --git a/queue-4.19/regulator-s5m8767-drop-regulators-of-node-reference.patch b/queue-4.19/regulator-s5m8767-drop-regulators-of-node-reference.patch new file mode 100644 index 00000000000..5b93feae5ee --- /dev/null +++ b/queue-4.19/regulator-s5m8767-drop-regulators-of-node-reference.patch @@ -0,0 +1,49 @@ +From c490819c5836ffbb406921649e99190970da44cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:59:14 +0100 +Subject: regulator: s5m8767: Drop regulators OF node reference + +From: Krzysztof Kozlowski + +[ Upstream commit a5872bd3398d0ff2ce4c77794bc7837899c69024 ] + +The device node reference obtained with of_get_child_by_name() should be +dropped on error paths. + +Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210121155914.48034-1-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/s5m8767.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 667d16dc83ce1..7ff94695eee72 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -548,14 +548,18 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev, + rdata = devm_kcalloc(&pdev->dev, + pdata->num_regulators, sizeof(*rdata), + GFP_KERNEL); +- if (!rdata) ++ if (!rdata) { ++ of_node_put(regulators_np); + return -ENOMEM; ++ } + + rmode = devm_kcalloc(&pdev->dev, + pdata->num_regulators, sizeof(*rmode), + GFP_KERNEL); +- if (!rmode) ++ if (!rmode) { ++ of_node_put(regulators_np); + return -ENOMEM; ++ } + + pdata->regulators = rdata; + pdata->opmode = rmode; +-- +2.27.0 + diff --git a/queue-4.19/rtc-s5m-select-regmap_i2c.patch b/queue-4.19/rtc-s5m-select-regmap_i2c.patch new file mode 100644 index 00000000000..beafb653a33 --- /dev/null +++ b/queue-4.19/rtc-s5m-select-regmap_i2c.patch @@ -0,0 +1,37 @@ +From aa7e8909f47d4d534e9e1e5b9c6f7a5814f03a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 11:22:17 +0100 +Subject: rtc: s5m: select REGMAP_I2C + +From: Bartosz Golaszewski + +[ Upstream commit 1f0cbda3b452b520c5f3794f8f0e410e8bc7386a ] + +The rtc-s5m uses the I2C regmap but doesn't select it in Kconfig so +depending on the configuration the build may fail. Fix it. + +Fixes: 959df7778bbd ("rtc: Enable compile testing for Maxim and Samsung drivers") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20210114102219.23682-2-brgl@bgdev.pl +Signed-off-by: Sasha Levin +--- + drivers/rtc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index 28a4505a1bc82..b5845f16a3a26 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -639,6 +639,7 @@ config RTC_DRV_S5M + tristate "Samsung S2M/S5M series" + depends on MFD_SEC_CORE || COMPILE_TEST + select REGMAP_IRQ ++ select REGMAP_I2C + help + If you say yes here you will get support for the + RTC of Samsung S2MPS14 and S5M PMIC series. +-- +2.27.0 + diff --git a/queue-4.19/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch b/queue-4.19/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch new file mode 100644 index 00000000000..74fc61d1de4 --- /dev/null +++ b/queue-4.19/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch @@ -0,0 +1,57 @@ +From f21b07fe6f9101c8e907a61d9ddf14b568bdab06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Feb 2021 11:24:28 -0800 +Subject: scsi: bnx2fc: Fix Kconfig warning & CNIC build errors + +From: Randy Dunlap + +[ Upstream commit eefb816acb0162e94a85a857f3a55148f671d5a5 ] + +CNIC depends on MMU, but since 'select' does not follow any dependency +chains, SCSI_BNX2X_FCOE also needs to depend on MMU, so that erroneous +configs are not generated, which cause build errors in cnic. + +WARNING: unmet direct dependencies detected for CNIC + Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && MMU [=n] + Selected by [y]: + - SCSI_BNX2X_FCOE [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && LIBFC [=y] && LIBFCOE [=y] + +riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L154': +cnic.c:(.text+0x1094): undefined reference to `uio_event_notify' +riscv64-linux-ld: cnic.c:(.text+0x10bc): undefined reference to `uio_event_notify' +riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L1442': +cnic.c:(.text+0x96a8): undefined reference to `__uio_register_device' +riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L0 ': +cnic.c:(.text.unlikely+0x68): undefined reference to `uio_unregister_device' + +Link: https://lore.kernel.org/r/20210213192428.22537-1-rdunlap@infradead.org +Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver") +Cc: Saurav Kashyap +Cc: Javed Hasan +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig +index d401a096dfc7e..2eb2476852b11 100644 +--- a/drivers/scsi/bnx2fc/Kconfig ++++ b/drivers/scsi/bnx2fc/Kconfig +@@ -4,6 +4,7 @@ config SCSI_BNX2X_FCOE + depends on (IPV6 || IPV6=n) + depends on LIBFC + depends on LIBFCOE ++ depends on MMU + select NETDEVICES + select ETHERNET + select NET_VENDOR_BROADCOM +-- +2.27.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 0394e707dd5..17f59d82a2f 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,157 @@ bfq-avoid-false-bfq-queue-merging.patch alsa-usb-audio-fix-pcm-buffer-allocation-in-non-vmalloc-mode.patch mips-vmlinux.lds.s-add-missing-page_aligned_data-section.patch random-fix-the-rndreseedcrng-ioctl.patch +ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch +bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch +bluetooth-fix-initializing-response-id-after-clearin.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6430 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-2350 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-24277 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-32152 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-5218 +arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch +arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-23093 +bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch +arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch +arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch +arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch +cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch +cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch +acpica-fix-exception-code-class-checks.patch +usb-gadget-u_audio-free-requests-only-after-callback.patch +bluetooth-drop-hci-device-reference-before-return.patch +bluetooth-put-hci-device-if-inquiry-procedure-interr.patch +memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch +arm-dts-configure-missing-thermal-interrupt-for-4430.patch +usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch +usb-dwc2-abort-transaction-after-errors-with-unknown.patch +usb-dwc2-make-trimming-xfer-length-a-debug-message.patch +staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch +arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch +arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch +arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch +arm-s3c-fix-fiq-for-clang-ias.patch +soc-aspeed-snoop-add-clock-control-logic.patch +bpf_lru_list-read-double-checked-variable-once-witho.patch +ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch +ibmvnic-set-to-closed-state-even-on-error.patch +bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch +xen-netback-fix-spurious-event-detection-for-common-.patch +mac80211-fix-potential-overflow-when-multiplying-to-.patch +bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch +tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch +cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch +b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch +ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch +ibmvnic-skip-send_request_unmap-for-timeout-reset.patch +net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch +net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch +net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch +net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch +net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch +fbdev-aty-sparc64-requires-fb_aty_ct.patch +drm-gma500-fix-error-return-code-in-psb_driver_load.patch +gma500-clean-up-error-handling-in-init.patch +crypto-sun4i-ss-fix-kmap-usage.patch +drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch +mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch +mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch +media-i2c-ov5670-fix-pixel_rate-minimum-value.patch +media-camss-missing-error-code-in-msm_video_register.patch +media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch +media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch +media-media-pci-fix-memleak-in-empress_init.patch +media-tm6000-fix-memleak-in-tm6000_start_stream.patch +asoc-cs42l56-fix-up-error-handling-in-probe.patch +crypto-bcm-rename-struct-device_private-to-bcm_devic.patch +drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch +media-lmedm04-fix-misuse-of-comma.patch +media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch +media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch +media-pxa_camera-declare-variable-when-debug-is-defi.patch +media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch +crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch +ata-ahci_brcm-add-back-regulators-management.patch +asoc-cpcap-fix-microphone-timeslot-mask.patch +f2fs-fix-to-avoid-inconsistent-quota-data.patch +drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch +drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch +btrfs-clarify-error-returns-values-in-__load_free_sp.patch +hwrng-timeriomem-fix-cooldown-period-calculation.patch +crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch +ima-free-ima-measurement-buffer-on-error.patch +ima-free-ima-measurement-buffer-after-kexec-syscall.patch +fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch +jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch +capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch +clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch +quota-fix-memory-leak-when-handling-corrupted-quota-.patch +spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch +clk-sunxi-ng-h6-fix-cec-clock.patch +hid-core-detect-and-skip-invalid-inputs-to-snto32.patch +dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch +dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch +dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch +dmaengine-hsu-disable-spurious-interrupt.patch +mfd-bd9571mwv-use-devm_mfd_add_devices.patch +fdt-properly-handle-no-map-field-in-the-memory-regio.patch +of-fdt-make-sure-no-map-does-not-remove-already-rese.patch +power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch +rtc-s5m-select-regmap_i2c.patch +clocksource-drivers-mxs_timer-add-missing-semicolon-.patch +rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch +clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch +regulator-axp20x-fix-reference-cout-leak.patch +certs-fix-blacklist-flag-type-confusion.patch +spi-atmel-put-allocated-master-before-return.patch +regulator-s5m8767-drop-regulators-of-node-reference.patch +isofs-release-buffer-head-before-return.patch +auxdisplay-ht16k33-fix-refresh-rate-handling.patch +ib-umad-return-eio-in-case-of-when-device-disassocia.patch +ib-umad-return-epollerr-in-case-of-when-device-disas.patch +kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch +powerpc-47x-disable-256k-page-size.patch +mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch +mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch +arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch +amba-fix-resource-leak-for-drivers-without-.remove.patch +tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch +perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch +rdma-rxe-fix-coding-error-in-rxe_recv.c.patch +rdma-rxe-correct-skb-on-loopback-path.patch +spi-stm32-properly-handle-0-byte-transfer.patch +mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch +powerpc-pseries-dlpar-handle-ibm-configure-connector.patch +powerpc-8xx-fix-software-emulation-interrupt.patch +clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch +spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch +input-sur40-fix-an-error-code-in-sur40_probe.patch +perf-intel-pt-fix-missing-cyc-processing-in-psb.patch +perf-test-fix-unaligned-access-in-sample-parsing-tes.patch +input-elo-fix-an-error-code-in-elo_connect.patch +sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch +misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch +misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch +pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch +vmci-use-set_page_dirty_lock-when-unregistering-gues.patch +pci-align-checking-of-syscall-user-config-accessors.patch +drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch +ext4-fix-potential-htree-index-checksum-corruption.patch +regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch +i40e-fix-flow-for-ipv6-next-header-extension-header.patch +i40e-add-zero-initialization-of-aq-command-structure.patch +i40e-fix-overwriting-flow-control-settings-during-dr.patch +i40e-fix-vfs-not-created.patch +take-mmap-lock-in-cacheflush-syscall.patch +i40e-fix-add-tc-filter-for-ipv6.patch +net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch +vxlan-move-debug-check-after-netdev-unregister.patch +ocfs2-fix-a-use-after-free-on-error.patch +mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch +mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch +r8169-fix-jumbo-packet-handling-on-rtl8168e.patch +arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch +i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch +mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch +scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch diff --git a/queue-4.19/soc-aspeed-snoop-add-clock-control-logic.patch b/queue-4.19/soc-aspeed-snoop-add-clock-control-logic.patch new file mode 100644 index 00000000000..01a3e68024c --- /dev/null +++ b/queue-4.19/soc-aspeed-snoop-add-clock-control-logic.patch @@ -0,0 +1,110 @@ +From d16f27d16b70a08aea7d315024e3d5440aefd829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 17:17:47 +0800 +Subject: soc: aspeed: snoop: Add clock control logic + +From: Jae Hyun Yoo + +[ Upstream commit 3f94cf15583be554df7aaa651b8ff8e1b68fbe51 ] + +If LPC SNOOP driver is registered ahead of lpc-ctrl module, LPC +SNOOP block will be enabled without heart beating of LCLK until +lpc-ctrl enables the LCLK. This issue causes improper handling on +host interrupts when the host sends interrupt in that time frame. +Then kernel eventually forcibly disables the interrupt with +dumping stack and printing a 'nobody cared this irq' message out. + +To prevent this issue, all LPC sub-nodes should enable LCLK +individually so this patch adds clock control logic into the LPC +SNOOP driver. + +Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") +Signed-off-by: Jae Hyun Yoo +Signed-off-by: Vernon Mauery +Signed-off-by: John Wang +Reviewed-by: Joel Stanley +Link: https://lore.kernel.org/r/20201208091748.1920-1-wangzhiqiang.bj@bytedance.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/misc/aspeed-lpc-snoop.c | 30 +++++++++++++++++++++++++++--- + 1 file changed, 27 insertions(+), 3 deletions(-) + +diff --git a/drivers/misc/aspeed-lpc-snoop.c b/drivers/misc/aspeed-lpc-snoop.c +index c10be21a1663d..b4a776bf44bc5 100644 +--- a/drivers/misc/aspeed-lpc-snoop.c ++++ b/drivers/misc/aspeed-lpc-snoop.c +@@ -15,6 +15,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -71,6 +72,7 @@ struct aspeed_lpc_snoop_channel { + struct aspeed_lpc_snoop { + struct regmap *regmap; + int irq; ++ struct clk *clk; + struct aspeed_lpc_snoop_channel chan[NUM_SNOOP_CHANNELS]; + }; + +@@ -286,22 +288,42 @@ static int aspeed_lpc_snoop_probe(struct platform_device *pdev) + return -ENODEV; + } + ++ lpc_snoop->clk = devm_clk_get(dev, NULL); ++ if (IS_ERR(lpc_snoop->clk)) { ++ rc = PTR_ERR(lpc_snoop->clk); ++ if (rc != -EPROBE_DEFER) ++ dev_err(dev, "couldn't get clock\n"); ++ return rc; ++ } ++ rc = clk_prepare_enable(lpc_snoop->clk); ++ if (rc) { ++ dev_err(dev, "couldn't enable clock\n"); ++ return rc; ++ } ++ + rc = aspeed_lpc_snoop_config_irq(lpc_snoop, pdev); + if (rc) +- return rc; ++ goto err; + + rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 0, port); + if (rc) +- return rc; ++ goto err; + + /* Configuration of 2nd snoop channel port is optional */ + if (of_property_read_u32_index(dev->of_node, "snoop-ports", + 1, &port) == 0) { + rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 1, port); +- if (rc) ++ if (rc) { + aspeed_lpc_disable_snoop(lpc_snoop, 0); ++ goto err; ++ } + } + ++ return 0; ++ ++err: ++ clk_disable_unprepare(lpc_snoop->clk); ++ + return rc; + } + +@@ -313,6 +335,8 @@ static int aspeed_lpc_snoop_remove(struct platform_device *pdev) + aspeed_lpc_disable_snoop(lpc_snoop, 0); + aspeed_lpc_disable_snoop(lpc_snoop, 1); + ++ clk_disable_unprepare(lpc_snoop->clk); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-4.19/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch b/queue-4.19/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch new file mode 100644 index 00000000000..cf9a6930321 --- /dev/null +++ b/queue-4.19/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch @@ -0,0 +1,47 @@ +From 5f6df15988d95c06b963391560ac1885714e3a69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 16:40:11 -0800 +Subject: sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set + +From: Randy Dunlap + +[ Upstream commit 80bddf5c93a99e11fc9faf7e4b575d01cecd45d3 ] + +Currently COMPAT on SPARC64 selects COMPAT_BINFMT_ELF unconditionally, +even when BINFMT_ELF is not enabled. This causes a kconfig warning. + +Instead, just select COMPAT_BINFMT_ELF if BINFMT_ELF is enabled. +This builds cleanly with no kconfig warnings. + +WARNING: unmet direct dependencies detected for COMPAT_BINFMT_ELF + Depends on [n]: COMPAT [=y] && BINFMT_ELF [=n] + Selected by [y]: + - COMPAT [=y] && SPARC64 [=y] + +Fixes: 26b4c912185a ("sparc,sparc64: unify Kconfig files") +Signed-off-by: Randy Dunlap +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Sam Ravnborg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index e6f2a38d2e61e..1f1a7583fa905 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -554,7 +554,7 @@ config COMPAT + bool + depends on SPARC64 + default y +- select COMPAT_BINFMT_ELF ++ select COMPAT_BINFMT_ELF if BINFMT_ELF + select HAVE_UID16 + select ARCH_WANT_OLD_COMPAT_IPC + select COMPAT_OLD_SIGACTION +-- +2.27.0 + diff --git a/queue-4.19/spi-atmel-put-allocated-master-before-return.patch b/queue-4.19/spi-atmel-put-allocated-master-before-return.patch new file mode 100644 index 00000000000..8a2baf9c81c --- /dev/null +++ b/queue-4.19/spi-atmel-put-allocated-master-before-return.patch @@ -0,0 +1,39 @@ +From 7ca2c29ac65279cdc0899683909ead967550dbcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 21:00:25 -0800 +Subject: spi: atmel: Put allocated master before return + +From: Pan Bian + +[ Upstream commit 21ea2743f015dbacec1831bdc8afc848db9c2b8c ] + +The allocated master is not released. Goto error handling label rather +than directly return. + +Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring") +Signed-off-by: Pan Bian +Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring") +Reviewed-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20210120050025.25426-1-bianpan2016@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-atmel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 5a9d7e252a77c..2254e36c7f468 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1605,7 +1605,7 @@ static int atmel_spi_probe(struct platform_device *pdev) + if (ret == 0) { + as->use_dma = true; + } else if (ret == -EPROBE_DEFER) { +- return ret; ++ goto out_unmap_regs; + } + } else if (as->caps.has_pdc_support) { + as->use_pdc = true; +-- +2.27.0 + diff --git a/queue-4.19/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch b/queue-4.19/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch new file mode 100644 index 00000000000..0c664729a1e --- /dev/null +++ b/queue-4.19/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch @@ -0,0 +1,41 @@ +From 1971bd7eb640897b1955b3f78aa4b12f362171d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 00:14:20 +0530 +Subject: spi: cadence-quadspi: Abort read if dummy cycles required are too + many + +From: Pratyush Yadav + +[ Upstream commit ceeda328edeeeeac7579e9dbf0610785a3b83d39 ] + +The controller can only support up to 31 dummy cycles. If the command +requires more it falls back to using 31. This command is likely to fail +because the correct number of cycles are not waited upon. Rather than +silently issuing an incorrect command, fail loudly so the caller can get +a chance to find out the command can't be supported by the controller. + +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Pratyush Yadav +Link: https://lore.kernel.org/r/20201222184425.7028-3-p.yadav@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 04cedd3a2bf66..a92f531ad23a3 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -473,7 +473,7 @@ static int cqspi_read_setup(struct spi_nor *nor) + /* Setup dummy clock cycles */ + dummy_clk = nor->read_dummy; + if (dummy_clk > CQSPI_DUMMY_CLKS_MAX) +- dummy_clk = CQSPI_DUMMY_CLKS_MAX; ++ return -EOPNOTSUPP; + + if (dummy_clk / 8) { + reg |= (1 << CQSPI_REG_RD_INSTR_MODE_EN_LSB); +-- +2.27.0 + diff --git a/queue-4.19/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch b/queue-4.19/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch new file mode 100644 index 00000000000..18dac6e2a13 --- /dev/null +++ b/queue-4.19/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch @@ -0,0 +1,87 @@ +From 258c7e70eda0bff2ad326fdfe3b1856326f91e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 18:38:15 +0200 +Subject: spi: pxa2xx: Fix the controller numbering for Wildcat Point + +From: Andy Shevchenko + +[ Upstream commit 54c5d3bfb0cfb7b31259765524567871dee11615 ] + +Wildcat Point has two SPI controllers and added one is actually second one. +Fix the numbering by adding the description of the first one. + +Fixes: caba248db286 ("spi: spi-pxa2xx-pci: Add ID and driver type for WildcatPoint PCH") +Cc: Leif Liddy +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210208163816.22147-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx-pci.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c +index 869f188b02eb3..1736a48bbccec 100644 +--- a/drivers/spi/spi-pxa2xx-pci.c ++++ b/drivers/spi/spi-pxa2xx-pci.c +@@ -21,7 +21,8 @@ enum { + PORT_BSW1, + PORT_BSW2, + PORT_CE4100, +- PORT_LPT, ++ PORT_LPT0, ++ PORT_LPT1, + }; + + struct pxa_spi_info { +@@ -55,8 +56,10 @@ static struct dw_dma_slave bsw1_rx_param = { .src_id = 7 }; + static struct dw_dma_slave bsw2_tx_param = { .dst_id = 8 }; + static struct dw_dma_slave bsw2_rx_param = { .src_id = 9 }; + +-static struct dw_dma_slave lpt_tx_param = { .dst_id = 0 }; +-static struct dw_dma_slave lpt_rx_param = { .src_id = 1 }; ++static struct dw_dma_slave lpt1_tx_param = { .dst_id = 0 }; ++static struct dw_dma_slave lpt1_rx_param = { .src_id = 1 }; ++static struct dw_dma_slave lpt0_tx_param = { .dst_id = 2 }; ++static struct dw_dma_slave lpt0_rx_param = { .src_id = 3 }; + + static bool lpss_dma_filter(struct dma_chan *chan, void *param) + { +@@ -182,12 +185,19 @@ static struct pxa_spi_info spi_info_configs[] = { + .num_chipselect = 1, + .max_clk_rate = 50000000, + }, +- [PORT_LPT] = { ++ [PORT_LPT0] = { + .type = LPSS_LPT_SSP, + .port_id = 0, + .setup = lpss_spi_setup, +- .tx_param = &lpt_tx_param, +- .rx_param = &lpt_rx_param, ++ .tx_param = &lpt0_tx_param, ++ .rx_param = &lpt0_rx_param, ++ }, ++ [PORT_LPT1] = { ++ .type = LPSS_LPT_SSP, ++ .port_id = 1, ++ .setup = lpss_spi_setup, ++ .tx_param = &lpt1_tx_param, ++ .rx_param = &lpt1_rx_param, + }, + }; + +@@ -281,8 +291,9 @@ static const struct pci_device_id pxa2xx_spi_pci_devices[] = { + { PCI_VDEVICE(INTEL, 0x2290), PORT_BSW1 }, + { PCI_VDEVICE(INTEL, 0x22ac), PORT_BSW2 }, + { PCI_VDEVICE(INTEL, 0x2e6a), PORT_CE4100 }, +- { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT }, +- { }, ++ { PCI_VDEVICE(INTEL, 0x9ce5), PORT_LPT0 }, ++ { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT1 }, ++ { } + }; + MODULE_DEVICE_TABLE(pci, pxa2xx_spi_pci_devices); + +-- +2.27.0 + diff --git a/queue-4.19/spi-stm32-properly-handle-0-byte-transfer.patch b/queue-4.19/spi-stm32-properly-handle-0-byte-transfer.patch new file mode 100644 index 00000000000..2dfa9fbddaf --- /dev/null +++ b/queue-4.19/spi-stm32-properly-handle-0-byte-transfer.patch @@ -0,0 +1,39 @@ +From 5f483dedad79f5f89bd3444741bd273f1cb95fc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 19:59:25 +0100 +Subject: spi: stm32: properly handle 0 byte transfer + +From: Alain Volmat + +[ Upstream commit 2269f5a8b1a7b38651d62676b98182828f29d11a ] + +On 0 byte transfer request, return straight from the +xfer function after finalizing the transfer. + +Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller") +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1612551572-495-2-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 8eb2644506dd3..8d692f16d90ac 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -992,6 +992,10 @@ static int stm32_spi_transfer_one(struct spi_master *master, + struct stm32_spi *spi = spi_master_get_devdata(master); + int ret; + ++ /* Don't do anything on 0 bytes transfers */ ++ if (transfer->len == 0) ++ return 0; ++ + spi->tx_buf = transfer->tx_buf; + spi->rx_buf = transfer->rx_buf; + spi->tx_len = spi->tx_buf ? transfer->len : 0; +-- +2.27.0 + diff --git a/queue-4.19/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch b/queue-4.19/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch new file mode 100644 index 00000000000..947cad9431d --- /dev/null +++ b/queue-4.19/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch @@ -0,0 +1,93 @@ +From efc305e1522b23d227d79c184bc35aa12661b610 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jan 2021 22:14:01 +0800 +Subject: staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory + rules + +From: Chen-Yu Tsai + +[ Upstream commit 61834c967a929f6b4b7fcb91f43fa225cc29aa19 ] + +The custom regulatory ruleset in the rtl8723bs driver lists an incorrect +number of rules: one too many. This results in an out-of-bounds access, +as detected by KASAN. This was possible thanks to the newly added support +for KASAN on ARMv7. + +Fix this by filling in the correct number of rules given. + +KASAN report: + +================================================================== +BUG: KASAN: global-out-of-bounds in cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211] +Read of size 4 at addr bf20c254 by task ip/971 + +CPU: 2 PID: 971 Comm: ip Tainted: G C 5.11.0-rc2-00020-gf7fe528a7ebe #1 +Hardware name: Allwinner sun8i Family +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0x9c/0xb4) +[] (dump_stack) from [] (print_address_description.constprop.2+0x1dc/0x2dc) +[] (print_address_description.constprop.2) from [] (kasan_report+0x1a8/0x1c4) +[] (kasan_report) from [] (cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211]) +[] (cfg80211_does_bw_fit_range [cfg80211]) from [] (freq_reg_info_regd.part.6+0x108/0x124 [> +[] (freq_reg_info_regd.part.6 [cfg80211]) from [] (handle_channel_custom.constprop.12+0x48/> +[] (handle_channel_custom.constprop.12 [cfg80211]) from [] (wiphy_apply_custom_regulatory+0> +[] (wiphy_apply_custom_regulatory [cfg80211]) from [] (rtw_regd_init+0x60/0x70 [r8723bs]) +[] (rtw_regd_init [r8723bs]) from [] (rtw_cfg80211_init_wiphy+0x164/0x1e8 [r8723bs]) +[] (rtw_cfg80211_init_wiphy [r8723bs]) from [] (_netdev_open+0xe4/0x28c [r8723bs]) +[] (_netdev_open [r8723bs]) from [] (netdev_open+0x60/0x88 [r8723bs]) +[] (netdev_open [r8723bs]) from [] (__dev_open+0x178/0x220) +[] (__dev_open) from [] (__dev_change_flags+0x258/0x2c4) +[] (__dev_change_flags) from [] (dev_change_flags+0x40/0x80) +[] (dev_change_flags) from [] (do_setlink+0x538/0x1160) +[] (do_setlink) from [] (__rtnl_newlink+0x65c/0xad8) +[] (__rtnl_newlink) from [] (rtnl_newlink+0x4c/0x6c) +[] (rtnl_newlink) from [] (rtnetlink_rcv_msg+0x1f8/0x454) +[] (rtnetlink_rcv_msg) from [] (netlink_rcv_skb+0xc4/0x1e0) +[] (netlink_rcv_skb) from [] (netlink_unicast+0x2c8/0x3c4) +[] (netlink_unicast) from [] (netlink_sendmsg+0x320/0x5f0) +[] (netlink_sendmsg) from [] (____sys_sendmsg+0x320/0x3e0) +[] (____sys_sendmsg) from [] (___sys_sendmsg+0xe8/0x12c) +[] (___sys_sendmsg) from [] (__sys_sendmsg+0xc0/0x120) +[] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x58) +Exception stack(0xc5693fa8 to 0xc5693ff0) +3fa0: 00000074 c7a39800 00000003 b6cee648 00000000 00000000 +3fc0: 00000074 c7a39800 00000001 00000128 78d18349 00000000 b6ceeda0 004f7cb0 +3fe0: 00000128 b6cee5e8 aeca151f aec1d746 + +The buggy address belongs to the variable: + rtw_drv_halt+0xf908/0x6b4 [r8723bs] + +Memory state around the buggy address: + bf20c100: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 + bf20c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +>bf20c200: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 + ^ + bf20c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + bf20c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +================================================================== + +Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20210108141401.31741-1-wens@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c +index aa2f62acc994d..4dd6f3fb59060 100644 +--- a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c ++++ b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c +@@ -39,7 +39,7 @@ + NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM) + + static const struct ieee80211_regdomain rtw_regdom_rd = { +- .n_reg_rules = 3, ++ .n_reg_rules = 2, + .alpha2 = "99", + .reg_rules = { + RTW_2GHZ_CH01_11, +-- +2.27.0 + diff --git a/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch b/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch new file mode 100644 index 00000000000..ca0a86cc0bb --- /dev/null +++ b/queue-4.19/take-mmap-lock-in-cacheflush-syscall.patch @@ -0,0 +1,61 @@ +From 1ef2f917d29933eccf325fccea8fb641240ebb13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 14:59:35 +0800 +Subject: Take mmap lock in cacheflush syscall + +From: Jann Horn + +[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ] + +We need to take the mmap lock around find_vma() and subsequent use of the +VMA. Otherwise, we can race with concurrent operations like munmap(), which +can lead to use-after-free accesses to freed VMAs. + +Fixes: 1000197d8013 ("nios2: System calls handling") +Signed-off-by: Jann Horn +Signed-off-by: Ley Foon Tan +Signed-off-by: Sasha Levin +--- + arch/nios2/kernel/sys_nios2.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c +index cd390ec4f88bf..b1ca856999521 100644 +--- a/arch/nios2/kernel/sys_nios2.c ++++ b/arch/nios2/kernel/sys_nios2.c +@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, + unsigned int op) + { + struct vm_area_struct *vma; ++ struct mm_struct *mm = current->mm; + + if (len == 0) + return 0; +@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, + if (addr + len < addr) + return -EFAULT; + ++ if (mmap_read_lock_killable(mm)) ++ return -EINTR; ++ + /* + * Verify that the specified address region actually belongs + * to this process. + */ +- vma = find_vma(current->mm, addr); +- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) ++ vma = find_vma(mm, addr); ++ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) { ++ mmap_read_unlock(mm); + return -EFAULT; ++ } + + flush_cache_range(vma, addr, addr + len); + ++ mmap_read_unlock(mm); + return 0; + } + +-- +2.27.0 + diff --git a/queue-4.19/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch b/queue-4.19/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch new file mode 100644 index 00000000000..d4bd3d12a29 --- /dev/null +++ b/queue-4.19/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch @@ -0,0 +1,67 @@ +From b063688a93197d06e0f2b21574d521eda8cc534b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 15:22:13 -0800 +Subject: tcp: fix SO_RCVLOWAT related hangs under mem pressure + +From: Eric Dumazet + +[ Upstream commit f969dc5a885736842c3511ecdea240fbb02d25d9 ] + +While commit 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs") +fixed an issue vs too small sk_rcvbuf for given sk_rcvlowat constraint, +it missed to address issue caused by memory pressure. + +1) If we are under memory pressure and socket receive queue is empty. +First incoming packet is allowed to be queued, after commit +76dfa6082032 ("tcp: allow one skb to be received per socket under memory pressure") + +But we do not send EPOLLIN yet, in case tcp_data_ready() sees sk_rcvlowat +is bigger than skb length. + +2) Then, when next packet comes, it is dropped, and we directly +call sk->sk_data_ready(). + +3) If application is using poll(), tcp_poll() will then use +tcp_stream_is_readable() and decide the socket receive queue is +not yet filled, so nothing will happen. + +Even when sender retransmits packets, phases 2) & 3) repeat +and flow is effectively frozen, until memory pressure is off. + +Fix is to consider tcp_under_memory_pressure() to take care +of global memory pressure or memcg pressure. + +Fixes: 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs") +Signed-off-by: Eric Dumazet +Reported-by: Arjun Roy +Suggested-by: Wei Wang +Reviewed-by: Wei Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index afbe1d3991f21..4fe3ab47b4803 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1380,8 +1380,13 @@ static inline int tcp_full_space(const struct sock *sk) + */ + static inline bool tcp_rmem_pressure(const struct sock *sk) + { +- int rcvbuf = READ_ONCE(sk->sk_rcvbuf); +- int threshold = rcvbuf - (rcvbuf >> 3); ++ int rcvbuf, threshold; ++ ++ if (tcp_under_memory_pressure(sk)) ++ return true; ++ ++ rcvbuf = READ_ONCE(sk->sk_rcvbuf); ++ threshold = rcvbuf - (rcvbuf >> 3); + + return atomic_read(&sk->sk_rmem_alloc) > threshold; + } +-- +2.27.0 + diff --git a/queue-4.19/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch b/queue-4.19/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch new file mode 100644 index 00000000000..495c4d151fd --- /dev/null +++ b/queue-4.19/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch @@ -0,0 +1,205 @@ +From 4e463c04fda8a9c455f0e4fcc55a41cbff6c2253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 09:34:05 -0500 +Subject: tracepoint: Do not fail unregistering a probe due to memory failure + +From: Steven Rostedt (VMware) + +[ Upstream commit befe6d946551d65cddbd32b9cb0170b0249fd5ed ] + +The list of tracepoint callbacks is managed by an array that is protected +by RCU. To update this array, a new array is allocated, the updates are +copied over to the new array, and then the list of functions for the +tracepoint is switched over to the new array. After a completion of an RCU +grace period, the old array is freed. + +This process happens for both adding a callback as well as removing one. +But on removing a callback, if the new array fails to be allocated, the +callback is not removed, and may be used after it is freed by the clients +of the tracepoint. + +There's really no reason to fail if the allocation for a new array fails +when removing a function. Instead, the function can simply be replaced by a +stub function that could be cleaned up on the next modification of the +array. That is, instead of calling the function registered to the +tracepoint, it would call a stub function in its place. + +Link: https://lore.kernel.org/r/20201115055256.65625-1-mmullins@mmlx.us +Link: https://lore.kernel.org/r/20201116175107.02db396d@gandalf.local.home +Link: https://lore.kernel.org/r/20201117211836.54acaef2@oasis.local.home +Link: https://lkml.kernel.org/r/20201118093405.7a6d2290@gandalf.local.home + +[ Note, this version does use undefined compiler behavior (assuming that + a stub function with no parameters or return, can be called by a location + that thinks it has parameters but still no return value. Static calls + do the same thing, so this trick is not without precedent. + + There's another solution that uses RCU tricks and is more complex, but + can be an alternative if this solution becomes an issue. + + Link: https://lore.kernel.org/lkml/20210127170721.58bce7cc@gandalf.local.home/ +] + +Cc: Peter Zijlstra +Cc: Josh Poimboeuf +Cc: Mathieu Desnoyers +Cc: Ingo Molnar +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Dmitry Vyukov +Cc: Martin KaFai Lau +Cc: Song Liu +Cc: Yonghong Song +Cc: Andrii Nakryiko +Cc: John Fastabend +Cc: KP Singh +Cc: netdev +Cc: bpf +Cc: Kees Cook +Cc: Florian Weimer +Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints") +Reported-by: syzbot+83aa762ef23b6f0d1991@syzkaller.appspotmail.com +Reported-by: syzbot+d29e58bb557324e55e5e@syzkaller.appspotmail.com +Reported-by: Matt Mullins +Signed-off-by: Steven Rostedt (VMware) +Tested-by: Matt Mullins +Signed-off-by: Sasha Levin +--- + kernel/tracepoint.c | 80 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 64 insertions(+), 16 deletions(-) + +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c +index a3be42304485f..d5ce692319128 100644 +--- a/kernel/tracepoint.c ++++ b/kernel/tracepoint.c +@@ -66,6 +66,12 @@ struct tp_probes { + struct tracepoint_func probes[0]; + }; + ++/* Called in removal of a func but failed to allocate a new tp_funcs */ ++static void tp_stub_func(void) ++{ ++ return; ++} ++ + static inline void *allocate_probes(int count) + { + struct tp_probes *p = kmalloc(count * sizeof(struct tracepoint_func) +@@ -144,6 +150,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func, + { + struct tracepoint_func *old, *new; + int nr_probes = 0; ++ int stub_funcs = 0; + int pos = -1; + + if (WARN_ON(!tp_func->func)) +@@ -160,14 +167,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func, + if (old[nr_probes].func == tp_func->func && + old[nr_probes].data == tp_func->data) + return ERR_PTR(-EEXIST); ++ if (old[nr_probes].func == tp_stub_func) ++ stub_funcs++; + } + } +- /* + 2 : one for new probe, one for NULL func */ +- new = allocate_probes(nr_probes + 2); ++ /* + 2 : one for new probe, one for NULL func - stub functions */ ++ new = allocate_probes(nr_probes + 2 - stub_funcs); + if (new == NULL) + return ERR_PTR(-ENOMEM); + if (old) { +- if (pos < 0) { ++ if (stub_funcs) { ++ /* Need to copy one at a time to remove stubs */ ++ int probes = 0; ++ ++ pos = -1; ++ for (nr_probes = 0; old[nr_probes].func; nr_probes++) { ++ if (old[nr_probes].func == tp_stub_func) ++ continue; ++ if (pos < 0 && old[nr_probes].prio < prio) ++ pos = probes++; ++ new[probes++] = old[nr_probes]; ++ } ++ nr_probes = probes; ++ if (pos < 0) ++ pos = probes; ++ else ++ nr_probes--; /* Account for insertion */ ++ ++ } else if (pos < 0) { + pos = nr_probes; + memcpy(new, old, nr_probes * sizeof(struct tracepoint_func)); + } else { +@@ -201,8 +228,9 @@ static void *func_remove(struct tracepoint_func **funcs, + /* (N -> M), (N > 1, M >= 0) probes */ + if (tp_func->func) { + for (nr_probes = 0; old[nr_probes].func; nr_probes++) { +- if (old[nr_probes].func == tp_func->func && +- old[nr_probes].data == tp_func->data) ++ if ((old[nr_probes].func == tp_func->func && ++ old[nr_probes].data == tp_func->data) || ++ old[nr_probes].func == tp_stub_func) + nr_del++; + } + } +@@ -221,14 +249,32 @@ static void *func_remove(struct tracepoint_func **funcs, + /* N -> M, (N > 1, M > 0) */ + /* + 1 for NULL */ + new = allocate_probes(nr_probes - nr_del + 1); +- if (new == NULL) +- return ERR_PTR(-ENOMEM); +- for (i = 0; old[i].func; i++) +- if (old[i].func != tp_func->func +- || old[i].data != tp_func->data) +- new[j++] = old[i]; +- new[nr_probes - nr_del].func = NULL; +- *funcs = new; ++ if (new) { ++ for (i = 0; old[i].func; i++) ++ if ((old[i].func != tp_func->func ++ || old[i].data != tp_func->data) ++ && old[i].func != tp_stub_func) ++ new[j++] = old[i]; ++ new[nr_probes - nr_del].func = NULL; ++ *funcs = new; ++ } else { ++ /* ++ * Failed to allocate, replace the old function ++ * with calls to tp_stub_func. ++ */ ++ for (i = 0; old[i].func; i++) ++ if (old[i].func == tp_func->func && ++ old[i].data == tp_func->data) { ++ old[i].func = tp_stub_func; ++ /* Set the prio to the next event. */ ++ if (old[i + 1].func) ++ old[i].prio = ++ old[i + 1].prio; ++ else ++ old[i].prio = -1; ++ } ++ *funcs = old; ++ } + } + debug_print_probes(*funcs); + return old; +@@ -284,10 +330,12 @@ static int tracepoint_remove_func(struct tracepoint *tp, + tp_funcs = rcu_dereference_protected(tp->funcs, + lockdep_is_held(&tracepoints_mutex)); + old = func_remove(&tp_funcs, func); +- if (IS_ERR(old)) { +- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM); ++ if (WARN_ON_ONCE(IS_ERR(old))) + return PTR_ERR(old); +- } ++ ++ if (tp_funcs == old) ++ /* Failed allocating new tp_funcs, replaced func with stub */ ++ return 0; + + if (!tp_funcs) { + /* Removed last function */ +-- +2.27.0 + diff --git a/queue-4.19/usb-dwc2-abort-transaction-after-errors-with-unknown.patch b/queue-4.19/usb-dwc2-abort-transaction-after-errors-with-unknown.patch new file mode 100644 index 00000000000..8ac03875b32 --- /dev/null +++ b/queue-4.19/usb-dwc2-abort-transaction-after-errors-with-unknown.patch @@ -0,0 +1,84 @@ +From 1edbb301ff7831172cd56273c12bf4ef34be2fff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 12:20:50 +0100 +Subject: usb: dwc2: Abort transaction after errors with unknown reason + +From: Guenter Roeck + +[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ] + +In some situations, the following error messages are reported. + +dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown +dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021 + +This is sometimes followed by: + +dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length + +and then: + +WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913 + dwc2_assign_and_init_hc+0x98c/0x990 + +The warning suggests that an odd buffer address is to be used for DMA. + +After an error is observed, the receive buffer may be full +(urb->actual_length >= urb->length). However, the urb is still left in +the queue unless three errors were observed in a row. When it is queued +again, the dwc2 hcd code translates this into a 1-block transfer. +If urb->actual_length (ie the total expected receive length) is not +DMA-aligned, the buffer pointer programmed into the chip will be +unaligned. This results in the observed warning. + +To solve the problem, abort input transactions after an error with +unknown cause if the entire packet was already received. This may be +a bit drastic, but we don't really know why the transfer was aborted +even though the entire packet was received. Aborting the transfer in +this situation is less risky than accepting a potentially corrupted +packet. + +With this patch in place, the 'ChHltd set' and 'trimming xfer length' +messages are still observed, but there are no more transfer attempts +with odd buffer addresses. + +Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better") +Cc: Boris ARZUR +Cc: Douglas Anderson +Tested-by: Nicolas Saenz Julienne +Reviewed-by: Douglas Anderson +Signed-off-by: Guenter Roeck +Signed-off-by: Nicolas Saenz Julienne +Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c +index a052d39b4375e..12819e019e13c 100644 +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -1977,6 +1977,18 @@ error: + qtd->error_count++; + dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb, + qtd, DWC2_HC_XFER_XACT_ERR); ++ /* ++ * We can get here after a completed transaction ++ * (urb->actual_length >= urb->length) which was not reported ++ * as completed. If that is the case, and we do not abort ++ * the transfer, a transfer of size 0 will be enqueued ++ * subsequently. If urb->actual_length is not DMA-aligned, ++ * the buffer will then point to an unaligned address, and ++ * the resulting behavior is undefined. Bail out in that ++ * situation. ++ */ ++ if (qtd->urb->actual_length >= qtd->urb->length) ++ qtd->error_count = 3; + dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd); + dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR); + } +-- +2.27.0 + diff --git a/queue-4.19/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch b/queue-4.19/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch new file mode 100644 index 00000000000..0c0bfd49f6e --- /dev/null +++ b/queue-4.19/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch @@ -0,0 +1,63 @@ +From fff7e68637eb62e5fbac6b11655adfb102be8e22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 12:20:49 +0100 +Subject: usb: dwc2: Do not update data length if it is 0 on inbound transfers + +From: Guenter Roeck + +[ Upstream commit 415fa1c7305dedbb345e2cc8ac91769bc1c83f1a ] + +The DWC2 documentation states that transfers with zero data length should +set the number of packets to 1 and the transfer length to 0. This is not +currently the case for inbound transfers: the transfer length is set to +the maximum packet length. This can have adverse effects if the chip +actually does transfer data as it is programmed to do. Follow chip +documentation and keep the transfer length set to 0 in that situation. + +Fixes: 56f5b1cff22a1 ("staging: Core files for the DWC2 driver") +Tested-by: Nicolas Saenz Julienne +Reviewed-by: Douglas Anderson +Signed-off-by: Guenter Roeck +Signed-off-by: Nicolas Saenz Julienne +Link: https://lore.kernel.org/r/20210113112052.17063-2-nsaenzjulienne@suse.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/hcd.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index a5c8329fd4625..56a35e0160392 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1512,19 +1512,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg, + if (num_packets > max_hc_pkt_count) { + num_packets = max_hc_pkt_count; + chan->xfer_len = num_packets * chan->max_packet; ++ } else if (chan->ep_is_in) { ++ /* ++ * Always program an integral # of max packets ++ * for IN transfers. ++ * Note: This assumes that the input buffer is ++ * aligned and sized accordingly. ++ */ ++ chan->xfer_len = num_packets * chan->max_packet; + } + } else { + /* Need 1 packet for transfer length of 0 */ + num_packets = 1; + } + +- if (chan->ep_is_in) +- /* +- * Always program an integral # of max packets for IN +- * transfers +- */ +- chan->xfer_len = num_packets * chan->max_packet; +- + if (chan->ep_type == USB_ENDPOINT_XFER_INT || + chan->ep_type == USB_ENDPOINT_XFER_ISOC) + /* +-- +2.27.0 + diff --git a/queue-4.19/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch b/queue-4.19/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch new file mode 100644 index 00000000000..18a6dffa423 --- /dev/null +++ b/queue-4.19/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch @@ -0,0 +1,48 @@ +From b228fb0f60aadd04e8d49c0c59c2809f97a28f00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 12:20:51 +0100 +Subject: usb: dwc2: Make "trimming xfer length" a debug message + +From: Guenter Roeck + +[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ] + +With some USB network adapters, such as DM96xx, the following message +is seen for each maximum size receive packet. + +dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length + +This happens because the packet size requested by the driver is 1522 +bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to +receive 24*64 = 1536 bytes, and the chip does indeed send more than +1522 bytes of data. Since the event does not indicate an error condition, +the message is just noise. Demote it to debug level. + +Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver") +Tested-by: Nicolas Saenz Julienne +Reviewed-by: Douglas Anderson +Signed-off-by: Guenter Roeck +Signed-off-by: Nicolas Saenz Julienne +Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/hcd_intr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c +index 12819e019e13c..d5f4ec1b73b15 100644 +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -500,7 +500,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg, + &short_read); + + if (urb->actual_length + xfer_length > urb->length) { +- dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__); ++ dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__); + xfer_length = urb->length - urb->actual_length; + } + +-- +2.27.0 + diff --git a/queue-4.19/usb-gadget-u_audio-free-requests-only-after-callback.patch b/queue-4.19/usb-gadget-u_audio-free-requests-only-after-callback.patch new file mode 100644 index 00000000000..56b188b688d --- /dev/null +++ b/queue-4.19/usb-gadget-u_audio-free-requests-only-after-callback.patch @@ -0,0 +1,72 @@ +From 0d840ae84818260aaacd7ad4172a781d143f0abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 09:46:39 +0100 +Subject: usb: gadget: u_audio: Free requests only after callback + +From: Jack Pham + +[ Upstream commit 7de8681be2cde9f6953d3be1fa6ce05f9fe6e637 ] + +As per the kernel doc for usb_ep_dequeue(), it states that "this +routine is asynchronous, that is, it may return before the completion +routine runs". And indeed since v5.0 the dwc3 gadget driver updated +its behavior to place dequeued requests on to a cancelled list to be +given back later after the endpoint is stopped. + +The free_ep() was incorrectly assuming that a request was ready to +be freed after calling dequeue which results in a use-after-free +in dwc3 when it traverses its cancelled list. Fix this by moving +the usb_ep_free_request() call to the callback itself in case the +ep is disabled. + +Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core") +Reported-and-tested-by: Ferry Toth +Reviewed-and-tested-by: Peter Chen +Acked-by: Felipe Balbi +Signed-off-by: Jack Pham +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_audio.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index fb5ed97572e5f..0cb0c638fd131 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req) + struct snd_uac_chip *uac = prm->uac; + + /* i/f shutting down */ +- if (!prm->ep_enabled || req->status == -ESHUTDOWN) ++ if (!prm->ep_enabled) { ++ usb_ep_free_request(ep, req); ++ return; ++ } ++ ++ if (req->status == -ESHUTDOWN) + return; + + /* +@@ -351,8 +356,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + + for (i = 0; i < params->req_number; i++) { + if (prm->ureq[i].req) { +- usb_ep_dequeue(ep, prm->ureq[i].req); +- usb_ep_free_request(ep, prm->ureq[i].req); ++ if (usb_ep_dequeue(ep, prm->ureq[i].req)) ++ usb_ep_free_request(ep, prm->ureq[i].req); ++ /* ++ * If usb_ep_dequeue() cannot successfully dequeue the ++ * request, the request will be freed by the completion ++ * callback. ++ */ ++ + prm->ureq[i].req = NULL; + } + } +-- +2.27.0 + diff --git a/queue-4.19/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch b/queue-4.19/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch new file mode 100644 index 00000000000..4939170a421 --- /dev/null +++ b/queue-4.19/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch @@ -0,0 +1,43 @@ +From ef792e8b43a27d07d5c3a89037d75bffcfd22b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 08:32:40 -0800 +Subject: VMCI: Use set_page_dirty_lock() when unregistering guest memory + +From: Jorgen Hansen + +[ Upstream commit 5a16c535409f8dcb7568e20737309e3027ae3e49 ] + +When the VMCI host support releases guest memory in the case where +the VM was killed, the pinned guest pages aren't locked. Use +set_page_dirty_lock() instead of set_page_dirty(). + +Testing done: Killed VM while having an active VMCI based vSocket +connection and observed warning from ext4. With this fix, no +warning was observed. Ran various vSocket tests without issues. + +Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") +Reviewed-by: Vishnu Dasa +Signed-off-by: Jorgen Hansen +Link: https://lore.kernel.org/r/1611160360-30299-1-git-send-email-jhansen@vmware.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index 5e0d1ac67f73f..36025e1058169 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -645,7 +645,7 @@ static void qp_release_pages(struct page **pages, + + for (i = 0; i < num_pages; i++) { + if (dirty) +- set_page_dirty(pages[i]); ++ set_page_dirty_lock(pages[i]); + + put_page(pages[i]); + pages[i] = NULL; +-- +2.27.0 + diff --git a/queue-4.19/vxlan-move-debug-check-after-netdev-unregister.patch b/queue-4.19/vxlan-move-debug-check-after-netdev-unregister.patch new file mode 100644 index 00000000000..8e7848fc33d --- /dev/null +++ b/queue-4.19/vxlan-move-debug-check-after-netdev-unregister.patch @@ -0,0 +1,106 @@ +From 6b3ee20c6192bb1a8b7c54e51510ec431e352a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Feb 2021 15:45:52 +0000 +Subject: vxlan: move debug check after netdev unregister + +From: Taehee Yoo + +[ Upstream commit 92584ddf550ae72d492858c19d1f9025e07a9350 ] + +The debug check must be done after unregister_netdevice_many() call -- +the hlist_del_rcu() for this is done inside .ndo_stop. + +This is the same with commit 0fda7600c2e1 ("geneve: move debug check after +netdev unregister") + +Test commands: + ip netns del A + ip netns add A + ip netns add B + + ip netns exec B ip link add vxlan0 type vxlan vni 100 local 10.0.0.1 \ + remote 10.0.0.2 dstport 4789 srcport 4789 4789 + ip netns exec B ip link set vxlan0 netns A + ip netns exec A ip link set vxlan0 up + ip netns del B + +Splat looks like: +[ 73.176249][ T7] ------------[ cut here ]------------ +[ 73.178662][ T7] WARNING: CPU: 4 PID: 7 at drivers/net/vxlan.c:4743 vxlan_exit_batch_net+0x52e/0x720 [vxlan] +[ 73.182597][ T7] Modules linked in: vxlan openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 mlx5_core nfp mlxfw ixgbevf tls sch_fq_codel nf_tables nfnetlink ip_tables x_tables unix +[ 73.190113][ T7] CPU: 4 PID: 7 Comm: kworker/u16:0 Not tainted 5.11.0-rc7+ #838 +[ 73.193037][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 73.196986][ T7] Workqueue: netns cleanup_net +[ 73.198946][ T7] RIP: 0010:vxlan_exit_batch_net+0x52e/0x720 [vxlan] +[ 73.201509][ T7] Code: 00 01 00 00 0f 84 39 fd ff ff 48 89 ca 48 c1 ea 03 80 3c 1a 00 0f 85 a6 00 00 00 89 c2 48 83 c2 02 49 8b 14 d4 48 85 d2 74 ce <0f> 0b eb ca e8 b9 51 db dd 84 c0 0f 85 4a fe ff ff 48 c7 c2 80 bc +[ 73.208813][ T7] RSP: 0018:ffff888100907c10 EFLAGS: 00010286 +[ 73.211027][ T7] RAX: 000000000000003c RBX: dffffc0000000000 RCX: ffff88800ec411f0 +[ 73.213702][ T7] RDX: ffff88800a278000 RSI: ffff88800fc78c70 RDI: ffff88800fc78070 +[ 73.216169][ T7] RBP: ffff88800b5cbdc0 R08: fffffbfff424de61 R09: fffffbfff424de61 +[ 73.218463][ T7] R10: ffffffffa126f307 R11: fffffbfff424de60 R12: ffff88800ec41000 +[ 73.220794][ T7] R13: ffff888100907d08 R14: ffff888100907c50 R15: ffff88800fc78c40 +[ 73.223337][ T7] FS: 0000000000000000(0000) GS:ffff888114800000(0000) knlGS:0000000000000000 +[ 73.225814][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 73.227616][ T7] CR2: 0000562b5cb4f4d0 CR3: 0000000105fbe001 CR4: 00000000003706e0 +[ 73.229700][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 73.231820][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 73.233844][ T7] Call Trace: +[ 73.234698][ T7] ? vxlan_err_lookup+0x3c0/0x3c0 [vxlan] +[ 73.235962][ T7] ? ops_exit_list.isra.11+0x93/0x140 +[ 73.237134][ T7] cleanup_net+0x45e/0x8a0 +[ ... ] + +Fixes: 57b61127ab7d ("vxlan: speedup vxlan tunnels dismantle") +Signed-off-by: Taehee Yoo +Link: https://lore.kernel.org/r/20210221154552.11749-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 66fffbd64a33f..49e8c6d42cda4 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3812,7 +3812,6 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head) + struct vxlan_net *vn = net_generic(net, vxlan_net_id); + struct vxlan_dev *vxlan, *next; + struct net_device *dev, *aux; +- unsigned int h; + + for_each_netdev_safe(net, dev, aux) + if (dev->rtnl_link_ops == &vxlan_link_ops) +@@ -3826,14 +3825,13 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head) + unregister_netdevice_queue(vxlan->dev, head); + } + +- for (h = 0; h < PORT_HASH_SIZE; ++h) +- WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h])); + } + + static void __net_exit vxlan_exit_batch_net(struct list_head *net_list) + { + struct net *net; + LIST_HEAD(list); ++ unsigned int h; + + rtnl_lock(); + list_for_each_entry(net, net_list, exit_list) +@@ -3841,6 +3839,13 @@ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list) + + unregister_netdevice_many(&list); + rtnl_unlock(); ++ ++ list_for_each_entry(net, net_list, exit_list) { ++ struct vxlan_net *vn = net_generic(net, vxlan_net_id); ++ ++ for (h = 0; h < PORT_HASH_SIZE; ++h) ++ WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h])); ++ } + } + + static struct pernet_operations vxlan_net_ops = { +-- +2.27.0 + diff --git a/queue-4.19/xen-netback-fix-spurious-event-detection-for-common-.patch b/queue-4.19/xen-netback-fix-spurious-event-detection-for-common-.patch new file mode 100644 index 00000000000..f6db3a56a3d --- /dev/null +++ b/queue-4.19/xen-netback-fix-spurious-event-detection-for-common-.patch @@ -0,0 +1,56 @@ +From 6c19b5d5d7aa5fa51a19081e2c289a17da53a9a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 11:16:12 +0100 +Subject: xen/netback: fix spurious event detection for common event case + +From: Juergen Gross + +[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ] + +In case of a common event for rx and tx queue the event should be +regarded to be spurious if no rx and no tx requests are pending. + +Unfortunately the condition for testing that is wrong causing to +decide a event being spurious if no rx OR no tx requests are +pending. + +Fix that plus using local variables for rx/tx pending indicators in +order to split function calls and if condition. + +Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding") +Signed-off-by: Juergen Gross +Reviewed-by: Jan Beulich +Reviewed-by: Paul Durrant +Reviewed-by: Wei Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/interface.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index c960cb7e3251f..3b5fdb24ef1b9 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -162,13 +162,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id) + { + struct xenvif_queue *queue = dev_id; + int old; ++ bool has_rx, has_tx; + + old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending); + WARN(old, "Interrupt while EOI pending\n"); + +- /* Use bitwise or as we need to call both functions. */ +- if ((!xenvif_handle_tx_interrupt(queue) | +- !xenvif_handle_rx_interrupt(queue))) { ++ has_tx = xenvif_handle_tx_interrupt(queue); ++ has_rx = xenvif_handle_rx_interrupt(queue); ++ ++ if (!has_rx && !has_tx) { + atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending); + xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); + } +-- +2.27.0 +