From: Greg Kroah-Hartman Date: Tue, 14 Jul 2020 14:06:09 +0000 (+0200) Subject: 5.7-stable patches X-Git-Tag: v5.7.9~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5676e23ed33605a953410e6497a1189153f09bef;p=thirdparty%2Fkernel%2Fstable-queue.git 5.7-stable patches added patches: arc-elf-use-right-elf_arch.patch arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch arm64-arch_timer-allow-an-workaround-descriptor-to-disable-compat-vdso.patch arm64-arch_timer-disable-the-compat-vdso-for-cores-affected-by-arm64_workaround_1418040.patch arm64-introduce-a-way-to-disable-the-32bit-vdso.patch blk-mq-consider-non-idle-request-as-inflight-in-blk_mq_rq_inflight.patch btrfs-discard-add-missing-put-when-grabbing-block-group-from-unused-list.patch btrfs-fix-double-put-of-block-group-with-nocow.patch btrfs-fix-fatal-extent_buffer-readahead-vs-releasepage-race.patch btrfs-reset-tree-root-pointer-after-error-in-init_tree_roots.patch cifs-fix-reference-leak-for-tlink.patch dm-use-noio-when-sending-kobject-event.patch dm-writecache-reject-asynchronous-pmem-devices.patch drm-amdgpu-add-tmr-destory-function-for-psp.patch drm-amdgpu-asd-function-needs-to-be-unloaded-in-suspend-phase.patch drm-amdgpu-don-t-do-soft-recovery-if-gpu_recovery-0.patch drm-i915-also-drop-vm.ref-along-error-paths-for-vma-construction.patch drm-i915-drop-vm.ref-for-duplicate-vma-on-construction.patch drm-i915-gt-pin-the-rings-before-marking-active.patch drm-i915-skip-stale-object-handle-for-debugfs-per-file-stats.patch drm-radeon-fix-double-free.patch mmc-meson-gx-limit-segments-to-1-when-dram-access-quirk-is-needed.patch mmc-owl-mmc-get-rid-of-of_match_ptr-macro.patch perf-scripts-python-export-to-postgresql.py-fix-struct.pack-int-argument.patch perf-scripts-python-exported-sql-viewer.py-fix-time-chart-call-tree.patch perf-scripts-python-exported-sql-viewer.py-fix-unexpanded-find-result.patch perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-graph-find-result.patch perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-tree-find-result.patch pinctrl-baytrail-fix-pin-being-driven-low-for-a-while-on-gpiod_get-...-gpiod_out_high.patch s390-mm-fix-huge-pte-soft-dirty-copying.patch s390-setup-init-jump-labels-before-command-line-parsing.patch smb3-fix-access-denied-on-change-notify-request-to-some-servers.patch smb3-fix-unneeded-error-message-on-change-notify.patch --- diff --git a/queue-5.7/arc-elf-use-right-elf_arch.patch b/queue-5.7/arc-elf-use-right-elf_arch.patch new file mode 100644 index 00000000000..302286ee2e3 --- /dev/null +++ b/queue-5.7/arc-elf-use-right-elf_arch.patch @@ -0,0 +1,28 @@ +From b7faf971081a4e56147f082234bfff55135305cb Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Wed, 27 May 2020 14:18:45 -0700 +Subject: ARC: elf: use right ELF_ARCH + +From: Vineet Gupta + +commit b7faf971081a4e56147f082234bfff55135305cb upstream. + +Cc: +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/elf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arc/include/asm/elf.h ++++ b/arch/arc/include/asm/elf.h +@@ -19,7 +19,7 @@ + #define R_ARC_32_PCREL 0x31 + + /*to set parameters in the core dumps */ +-#define ELF_ARCH EM_ARCOMPACT ++#define ELF_ARCH EM_ARC_INUSE + #define ELF_CLASS ELFCLASS32 + + #ifdef CONFIG_CPU_BIG_ENDIAN diff --git a/queue-5.7/arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch b/queue-5.7/arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch new file mode 100644 index 00000000000..9dfaaded91b --- /dev/null +++ b/queue-5.7/arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch @@ -0,0 +1,81 @@ +From 00fdec98d9881bf5173af09aebd353ab3b9ac729 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 19 May 2020 22:28:32 -0700 +Subject: ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE + +From: Vineet Gupta + +commit 00fdec98d9881bf5173af09aebd353ab3b9ac729 upstream. + +Trap handler for syscall tracing reads EFA (Exception Fault Address), +in case strace wants PC of trap instruction (EFA is not part of pt_regs +as of current code). + +However this EFA read is racy as it happens after dropping to pure +kernel mode (re-enabling interrupts). A taken interrupt could +context-switch, trigger a different task's trap, clobbering EFA for this +execution context. + +Fix this by reading EFA early, before re-enabling interrupts. A slight +side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler. +The trap handler is common to both ARCompact and ARCv2 builds too. + +This just came out of code rework/review and no real problem was reported +but is clearly a potential problem specially for strace. + +Cc: +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/entry.S | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -165,7 +165,6 @@ END(EV_Extension) + tracesys: + ; save EFA in case tracer wants the PC of traced task + ; using ERET won't work since next-PC has already committed +- lr r12, [efa] + GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 + st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address + +@@ -208,15 +207,9 @@ tracesys_exit: + ; Breakpoint TRAP + ; --------------------------------------------- + trap_with_param: +- +- ; stop_pc info by gdb needs this info +- lr r0, [efa] ++ mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc + mov r1, sp + +- ; Now that we have read EFA, it is safe to do "fake" rtie +- ; and get out of CPU exception mode +- FAKE_RET_FROM_EXCPN +- + ; Save callee regs in case gdb wants to have a look + ; SP will grow up by size of CALLEE Reg-File + ; NOTE: clobbers r12 +@@ -243,6 +236,10 @@ ENTRY(EV_Trap) + + EXCEPTION_PROLOGUE + ++ lr r12, [efa] ++ ++ FAKE_RET_FROM_EXCPN ++ + ;============ TRAP 1 :breakpoints + ; Check ECR for trap with arg (PROLOGUE ensures r10 has ECR) + bmsk.f 0, r10, 7 +@@ -250,9 +247,6 @@ ENTRY(EV_Trap) + + ;============ TRAP (no param): syscall top level + +- ; First return from Exception to pure K mode (Exception/IRQs renabled) +- FAKE_RET_FROM_EXCPN +- + ; If syscall tracing ongoing, invoke pre-post-hooks + GET_CURR_THR_INFO_FLAGS r10 + btst r10, TIF_SYSCALL_TRACE diff --git a/queue-5.7/arm64-arch_timer-allow-an-workaround-descriptor-to-disable-compat-vdso.patch b/queue-5.7/arm64-arch_timer-allow-an-workaround-descriptor-to-disable-compat-vdso.patch new file mode 100644 index 00000000000..6de5a8b5c09 --- /dev/null +++ b/queue-5.7/arm64-arch_timer-allow-an-workaround-descriptor-to-disable-compat-vdso.patch @@ -0,0 +1,46 @@ +From c1fbec4ac0d701f350a581941d35643d5a9cd184 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 6 Jul 2020 17:38:00 +0100 +Subject: arm64: arch_timer: Allow an workaround descriptor to disable compat vdso + +From: Marc Zyngier + +commit c1fbec4ac0d701f350a581941d35643d5a9cd184 upstream. + +As we are about to disable the vdso for compat tasks in some circumstances, +let's allow a workaround descriptor to express exactly that. + +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200706163802.1836732-3-maz@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/include/asm/arch_timer.h | 1 + + drivers/clocksource/arm_arch_timer.c | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/arch/arm64/include/asm/arch_timer.h ++++ b/arch/arm64/include/asm/arch_timer.h +@@ -58,6 +58,7 @@ struct arch_timer_erratum_workaround { + u64 (*read_cntvct_el0)(void); + int (*set_next_event_phys)(unsigned long, struct clock_event_device *); + int (*set_next_event_virt)(unsigned long, struct clock_event_device *); ++ bool disable_compat_vdso; + }; + + DECLARE_PER_CPU(const struct arch_timer_erratum_workaround *, +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -566,6 +566,9 @@ void arch_timer_enable_workaround(const + if (wa->read_cntvct_el0) { + clocksource_counter.vdso_clock_mode = VDSO_CLOCKMODE_NONE; + vdso_default = VDSO_CLOCKMODE_NONE; ++ } else if (wa->disable_compat_vdso && vdso_default != VDSO_CLOCKMODE_NONE) { ++ vdso_default = VDSO_CLOCKMODE_ARCHTIMER_NOCOMPAT; ++ clocksource_counter.vdso_clock_mode = vdso_default; + } + } + diff --git a/queue-5.7/arm64-arch_timer-disable-the-compat-vdso-for-cores-affected-by-arm64_workaround_1418040.patch b/queue-5.7/arm64-arch_timer-disable-the-compat-vdso-for-cores-affected-by-arm64_workaround_1418040.patch new file mode 100644 index 00000000000..f478584eac7 --- /dev/null +++ b/queue-5.7/arm64-arch_timer-disable-the-compat-vdso-for-cores-affected-by-arm64_workaround_1418040.patch @@ -0,0 +1,44 @@ +From 4b661d6133c5d3a7c9aca0b4ee5a78c7766eff3f Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 6 Jul 2020 17:38:01 +0100 +Subject: arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040 + +From: Marc Zyngier + +commit 4b661d6133c5d3a7c9aca0b4ee5a78c7766eff3f upstream. + +ARM64_WORKAROUND_1418040 requires that AArch32 EL0 accesses to +the virtual counter register are trapped and emulated by the kernel. +This makes the vdso pretty pointless, and in some cases livelock +prone. + +Provide a workaround entry that limits the vdso to 64bit tasks. + +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200706163802.1836732-4-maz@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/arm_arch_timer.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -480,6 +480,14 @@ static const struct arch_timer_erratum_w + .set_next_event_virt = erratum_set_next_event_tval_virt, + }, + #endif ++#ifdef CONFIG_ARM64_ERRATUM_1418040 ++ { ++ .match_type = ate_match_local_cap_id, ++ .id = (void *)ARM64_WORKAROUND_1418040, ++ .desc = "ARM erratum 1418040", ++ .disable_compat_vdso = true, ++ }, ++#endif + }; + + typedef bool (*ate_match_fn_t)(const struct arch_timer_erratum_workaround *, diff --git a/queue-5.7/arm64-introduce-a-way-to-disable-the-32bit-vdso.patch b/queue-5.7/arm64-introduce-a-way-to-disable-the-32bit-vdso.patch new file mode 100644 index 00000000000..5a1965c1934 --- /dev/null +++ b/queue-5.7/arm64-introduce-a-way-to-disable-the-32bit-vdso.patch @@ -0,0 +1,70 @@ +From 97884ca8c2925d14c32188e865069f21378b4b4f Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 6 Jul 2020 17:37:59 +0100 +Subject: arm64: Introduce a way to disable the 32bit vdso + +From: Marc Zyngier + +commit 97884ca8c2925d14c32188e865069f21378b4b4f upstream. + +We have a class of errata (grouped under the ARM64_WORKAROUND_1418040 +banner) that force the trapping of counter access from 32bit EL0. + +We would normally disable the whole vdso for such defect, except that +it would disable it for 64bit userspace as well, which is a shame. + +Instead, add a new vdso_clock_mode, which signals that the vdso +isn't usable for compat tasks. This gets checked in the new +vdso_clocksource_ok() helper, now provided for the 32bit vdso. + +Signed-off-by: Marc Zyngier +Acked-by: Mark Rutland +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200706163802.1836732-2-maz@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/include/asm/vdso/clocksource.h | 7 +++++-- + arch/arm64/include/asm/vdso/compat_gettimeofday.h | 8 +++++++- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/arch/arm64/include/asm/vdso/clocksource.h ++++ b/arch/arm64/include/asm/vdso/clocksource.h +@@ -2,7 +2,10 @@ + #ifndef __ASM_VDSOCLOCKSOURCE_H + #define __ASM_VDSOCLOCKSOURCE_H + +-#define VDSO_ARCH_CLOCKMODES \ +- VDSO_CLOCKMODE_ARCHTIMER ++#define VDSO_ARCH_CLOCKMODES \ ++ /* vdso clocksource for both 32 and 64bit tasks */ \ ++ VDSO_CLOCKMODE_ARCHTIMER, \ ++ /* vdso clocksource for 64bit tasks only */ \ ++ VDSO_CLOCKMODE_ARCHTIMER_NOCOMPAT + + #endif +--- a/arch/arm64/include/asm/vdso/compat_gettimeofday.h ++++ b/arch/arm64/include/asm/vdso/compat_gettimeofday.h +@@ -111,7 +111,7 @@ static __always_inline u64 __arch_get_hw + * update. Return something. Core will do another round and then + * see the mode change and fallback to the syscall. + */ +- if (clock_mode == VDSO_CLOCKMODE_NONE) ++ if (clock_mode != VDSO_CLOCKMODE_ARCHTIMER) + return 0; + + /* +@@ -152,6 +152,12 @@ static __always_inline const struct vdso + return ret; + } + ++static inline bool vdso_clocksource_ok(const struct vdso_data *vd) ++{ ++ return vd->clock_mode == VDSO_CLOCKMODE_ARCHTIMER; ++} ++#define vdso_clocksource_ok vdso_clocksource_ok ++ + #endif /* !__ASSEMBLY__ */ + + #endif /* __ASM_VDSO_GETTIMEOFDAY_H */ diff --git a/queue-5.7/blk-mq-consider-non-idle-request-as-inflight-in-blk_mq_rq_inflight.patch b/queue-5.7/blk-mq-consider-non-idle-request-as-inflight-in-blk_mq_rq_inflight.patch new file mode 100644 index 00000000000..4f1d4d5fa76 --- /dev/null +++ b/queue-5.7/blk-mq-consider-non-idle-request-as-inflight-in-blk_mq_rq_inflight.patch @@ -0,0 +1,52 @@ +From 05a4fed69ff00a8bd83538684cb602a4636b07a7 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Tue, 7 Jul 2020 11:04:33 -0400 +Subject: blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() + +From: Ming Lei + +commit 05a4fed69ff00a8bd83538684cb602a4636b07a7 upstream. + +dm-multipath is the only user of blk_mq_queue_inflight(). When +dm-multipath calls blk_mq_queue_inflight() to check if it has +outstanding IO it can get a false negative. The reason for this is +blk_mq_rq_inflight() doesn't consider requests that are no longer +MQ_RQ_IN_FLIGHT but that are now MQ_RQ_COMPLETE (->complete isn't +called or finished yet) as "inflight". + +This causes request-based dm-multipath's dm_wait_for_completion() to +return before all outstanding dm-multipath requests have actually +completed. This breaks DM multipath's suspend functionality because +blk-mq requests complete after DM's suspend has finished -- which +shouldn't happen. + +Fix this by considering any request not in the MQ_RQ_IDLE state +(so either MQ_RQ_COMPLETE or MQ_RQ_IN_FLIGHT) as "inflight" in +blk_mq_rq_inflight(). + +Fixes: 3c94d83cb3526 ("blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight()") +Signed-off-by: Ming Lei +Signed-off-by: Mike Snitzer +Cc: stable@vger.kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -803,10 +803,10 @@ static bool blk_mq_rq_inflight(struct bl + void *priv, bool reserved) + { + /* +- * If we find a request that is inflight and the queue matches, ++ * If we find a request that isn't idle and the queue matches, + * we know the queue is busy. Return false to stop the iteration. + */ +- if (rq->state == MQ_RQ_IN_FLIGHT && rq->q == hctx->queue) { ++ if (blk_mq_request_started(rq) && rq->q == hctx->queue) { + bool *busy = priv; + + *busy = true; diff --git a/queue-5.7/btrfs-discard-add-missing-put-when-grabbing-block-group-from-unused-list.patch b/queue-5.7/btrfs-discard-add-missing-put-when-grabbing-block-group-from-unused-list.patch new file mode 100644 index 00000000000..74c293db8ed --- /dev/null +++ b/queue-5.7/btrfs-discard-add-missing-put-when-grabbing-block-group-from-unused-list.patch @@ -0,0 +1,104 @@ +From 04e484c5973ed0f9234c97685c3c5e1ebf0d6eb6 Mon Sep 17 00:00:00 2001 +From: Qu Wenruo +Date: Fri, 3 Jul 2020 15:05:50 +0800 +Subject: btrfs: discard: add missing put when grabbing block group from unused list + +From: Qu Wenruo + +commit 04e484c5973ed0f9234c97685c3c5e1ebf0d6eb6 upstream. + +[BUG] +The following small test script can trigger ASSERT() at unmount time: + + mkfs.btrfs -f $dev + mount $dev $mnt + mount -o remount,discard=async $mnt + umount $mnt + +The call trace: + assertion failed: atomic_read(&block_group->count) == 1, in fs/btrfs/block-group.c:3431 + ------------[ cut here ]------------ + kernel BUG at fs/btrfs/ctree.h:3204! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 4 PID: 10389 Comm: umount Tainted: G O 5.8.0-rc3-custom+ #68 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + Call Trace: + btrfs_free_block_groups.cold+0x22/0x55 [btrfs] + close_ctree+0x2cb/0x323 [btrfs] + btrfs_put_super+0x15/0x17 [btrfs] + generic_shutdown_super+0x72/0x110 + kill_anon_super+0x18/0x30 + btrfs_kill_super+0x17/0x30 [btrfs] + deactivate_locked_super+0x3b/0xa0 + deactivate_super+0x40/0x50 + cleanup_mnt+0x135/0x190 + __cleanup_mnt+0x12/0x20 + task_work_run+0x64/0xb0 + __prepare_exit_to_usermode+0x1bc/0x1c0 + __syscall_return_slowpath+0x47/0x230 + do_syscall_64+0x64/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The code: + ASSERT(atomic_read(&block_group->count) == 1); + btrfs_put_block_group(block_group); + +[CAUSE] +Obviously it's some btrfs_get_block_group() call doesn't get its put +call. + +The offending btrfs_get_block_group() happens here: + + void btrfs_mark_bg_unused(struct btrfs_block_group *bg) + { + if (list_empty(&bg->bg_list)) { + btrfs_get_block_group(bg); + list_add_tail(&bg->bg_list, &fs_info->unused_bgs); + } + } + +So every call sites removing the block group from unused_bgs list should +reduce the ref count of that block group. + +However for async discard, it didn't follow the call convention: + + void btrfs_discard_punt_unused_bgs_list(struct btrfs_fs_info *fs_info) + { + list_for_each_entry_safe(block_group, next, &fs_info->unused_bgs, + bg_list) { + list_del_init(&block_group->bg_list); + btrfs_discard_queue_work(&fs_info->discard_ctl, block_group); + } + } + +And in btrfs_discard_queue_work(), it doesn't call +btrfs_put_block_group() either. + +[FIX] +Fix the problem by reducing the reference count when we grab the block +group from unused_bgs list. + +Reported-by: Marcos Paulo de Souza +Fixes: 6e80d4f8c422 ("btrfs: handle empty block_group removal for async discard") +CC: stable@vger.kernel.org # 5.6+ +Tested-by: Marcos Paulo de Souza +Reviewed-by: Anand Jain +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/discard.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/btrfs/discard.c ++++ b/fs/btrfs/discard.c +@@ -619,6 +619,7 @@ void btrfs_discard_punt_unused_bgs_list( + list_for_each_entry_safe(block_group, next, &fs_info->unused_bgs, + bg_list) { + list_del_init(&block_group->bg_list); ++ btrfs_put_block_group(block_group); + btrfs_discard_queue_work(&fs_info->discard_ctl, block_group); + } + spin_unlock(&fs_info->unused_bgs_lock); diff --git a/queue-5.7/btrfs-fix-double-put-of-block-group-with-nocow.patch b/queue-5.7/btrfs-fix-double-put-of-block-group-with-nocow.patch new file mode 100644 index 00000000000..d0b26462de4 --- /dev/null +++ b/queue-5.7/btrfs-fix-double-put-of-block-group-with-nocow.patch @@ -0,0 +1,68 @@ +From 230ed397435e85b54f055c524fcb267ae2ce3bc4 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Mon, 6 Jul 2020 09:14:12 -0400 +Subject: btrfs: fix double put of block group with nocow + +From: Josef Bacik + +commit 230ed397435e85b54f055c524fcb267ae2ce3bc4 upstream. + +While debugging a patch that I wrote I was hitting use-after-free panics +when accessing block groups on unmount. This turned out to be because +in the nocow case if we bail out of doing the nocow for whatever reason +we need to call btrfs_dec_nocow_writers() if we called the inc. This +puts our block group, but a few error cases does + +if (nocow) { + btrfs_dec_nocow_writers(); + goto error; +} + +unfortunately, error is + +error: + if (nocow) + btrfs_dec_nocow_writers(); + +so we get a double put on our block group. Fix this by dropping the +error cases calling of btrfs_dec_nocow_writers(), as it's handled at the +error label now. + +Fixes: 762bf09893b4 ("btrfs: improve error handling in run_delalloc_nocow") +CC: stable@vger.kernel.org # 5.4+ +Reviewed-by: Filipe Manana +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/inode.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1690,12 +1690,8 @@ out_check: + ret = fallback_to_cow(inode, locked_page, cow_start, + found_key.offset - 1, + page_started, nr_written); +- if (ret) { +- if (nocow) +- btrfs_dec_nocow_writers(fs_info, +- disk_bytenr); ++ if (ret) + goto error; +- } + cow_start = (u64)-1; + } + +@@ -1711,9 +1707,6 @@ out_check: + ram_bytes, BTRFS_COMPRESS_NONE, + BTRFS_ORDERED_PREALLOC); + if (IS_ERR(em)) { +- if (nocow) +- btrfs_dec_nocow_writers(fs_info, +- disk_bytenr); + ret = PTR_ERR(em); + goto error; + } diff --git a/queue-5.7/btrfs-fix-fatal-extent_buffer-readahead-vs-releasepage-race.patch b/queue-5.7/btrfs-fix-fatal-extent_buffer-readahead-vs-releasepage-race.patch new file mode 100644 index 00000000000..503f3e104e7 --- /dev/null +++ b/queue-5.7/btrfs-fix-fatal-extent_buffer-readahead-vs-releasepage-race.patch @@ -0,0 +1,206 @@ +From 6bf9cd2eed9aee6d742bb9296c994a91f5316949 Mon Sep 17 00:00:00 2001 +From: Boris Burkov +Date: Wed, 17 Jun 2020 11:35:19 -0700 +Subject: btrfs: fix fatal extent_buffer readahead vs releasepage race + +From: Boris Burkov + +commit 6bf9cd2eed9aee6d742bb9296c994a91f5316949 upstream. + +Under somewhat convoluted conditions, it is possible to attempt to +release an extent_buffer that is under io, which triggers a BUG_ON in +btrfs_release_extent_buffer_pages. + +This relies on a few different factors. First, extent_buffer reads done +as readahead for searching use WAIT_NONE, so they free the local extent +buffer reference while the io is outstanding. However, they should still +be protected by TREE_REF. However, if the system is doing signficant +reclaim, and simultaneously heavily accessing the extent_buffers, it is +possible for releasepage to race with two concurrent readahead attempts +in a way that leaves TREE_REF unset when the readahead extent buffer is +released. + +Essentially, if two tasks race to allocate a new extent_buffer, but the +winner who attempts the first io is rebuffed by a page being locked +(likely by the reclaim itself) then the loser will still go ahead with +issuing the readahead. The loser's call to find_extent_buffer must also +race with the reclaim task reading the extent_buffer's refcount as 1 in +a way that allows the reclaim to re-clear the TREE_REF checked by +find_extent_buffer. + +The following represents an example execution demonstrating the race: + + CPU0 CPU1 CPU2 +reada_for_search reada_for_search + readahead_tree_block readahead_tree_block + find_create_tree_block find_create_tree_block + alloc_extent_buffer alloc_extent_buffer + find_extent_buffer // not found + allocates eb + lock pages + associate pages to eb + insert eb into radix tree + set TREE_REF, refs == 2 + unlock pages + read_extent_buffer_pages // WAIT_NONE + not uptodate (brand new eb) + lock_page + if !trylock_page + goto unlock_exit // not an error + free_extent_buffer + release_extent_buffer + atomic_dec_and_test refs to 1 + find_extent_buffer // found + try_release_extent_buffer + take refs_lock + reads refs == 1; no io + atomic_inc_not_zero refs to 2 + mark_buffer_accessed + check_buffer_tree_ref + // not STALE, won't take refs_lock + refs == 2; TREE_REF set // no action + read_extent_buffer_pages // WAIT_NONE + clear TREE_REF + release_extent_buffer + atomic_dec_and_test refs to 1 + unlock_page + still not uptodate (CPU1 read failed on trylock_page) + locks pages + set io_pages > 0 + submit io + return + free_extent_buffer + release_extent_buffer + dec refs to 0 + delete from radix tree + btrfs_release_extent_buffer_pages + BUG_ON(io_pages > 0)!!! + +We observe this at a very low rate in production and were also able to +reproduce it in a test environment by introducing some spurious delays +and by introducing probabilistic trylock_page failures. + +To fix it, we apply check_tree_ref at a point where it could not +possibly be unset by a competing task: after io_pages has been +incremented. All the codepaths that clear TREE_REF check for io, so they +would not be able to clear it after this point until the io is done. + +Stack trace, for reference: +[1417839.424739] ------------[ cut here ]------------ +[1417839.435328] kernel BUG at fs/btrfs/extent_io.c:4841! +[1417839.447024] invalid opcode: 0000 [#1] SMP +[1417839.502972] RIP: 0010:btrfs_release_extent_buffer_pages+0x20/0x1f0 +[1417839.517008] Code: ed e9 ... +[1417839.558895] RSP: 0018:ffffc90020bcf798 EFLAGS: 00010202 +[1417839.570816] RAX: 0000000000000002 RBX: ffff888102d6def0 RCX: 0000000000000028 +[1417839.586962] RDX: 0000000000000002 RSI: ffff8887f0296482 RDI: ffff888102d6def0 +[1417839.603108] RBP: ffff88885664a000 R08: 0000000000000046 R09: 0000000000000238 +[1417839.619255] R10: 0000000000000028 R11: ffff88885664af68 R12: 0000000000000000 +[1417839.635402] R13: 0000000000000000 R14: ffff88875f573ad0 R15: ffff888797aafd90 +[1417839.651549] FS: 00007f5a844fa700(0000) GS:ffff88885f680000(0000) knlGS:0000000000000000 +[1417839.669810] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[1417839.682887] CR2: 00007f7884541fe0 CR3: 000000049f609002 CR4: 00000000003606e0 +[1417839.699037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[1417839.715187] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[1417839.731320] Call Trace: +[1417839.737103] release_extent_buffer+0x39/0x90 +[1417839.746913] read_block_for_search.isra.38+0x2a3/0x370 +[1417839.758645] btrfs_search_slot+0x260/0x9b0 +[1417839.768054] btrfs_lookup_file_extent+0x4a/0x70 +[1417839.778427] btrfs_get_extent+0x15f/0x830 +[1417839.787665] ? submit_extent_page+0xc4/0x1c0 +[1417839.797474] ? __do_readpage+0x299/0x7a0 +[1417839.806515] __do_readpage+0x33b/0x7a0 +[1417839.815171] ? btrfs_releasepage+0x70/0x70 +[1417839.824597] extent_readpages+0x28f/0x400 +[1417839.833836] read_pages+0x6a/0x1c0 +[1417839.841729] ? startup_64+0x2/0x30 +[1417839.849624] __do_page_cache_readahead+0x13c/0x1a0 +[1417839.860590] filemap_fault+0x6c7/0x990 +[1417839.869252] ? xas_load+0x8/0x80 +[1417839.876756] ? xas_find+0x150/0x190 +[1417839.884839] ? filemap_map_pages+0x295/0x3b0 +[1417839.894652] __do_fault+0x32/0x110 +[1417839.902540] __handle_mm_fault+0xacd/0x1000 +[1417839.912156] handle_mm_fault+0xaa/0x1c0 +[1417839.921004] __do_page_fault+0x242/0x4b0 +[1417839.930044] ? page_fault+0x8/0x30 +[1417839.937933] page_fault+0x1e/0x30 +[1417839.945631] RIP: 0033:0x33c4bae +[1417839.952927] Code: Bad RIP value. +[1417839.960411] RSP: 002b:00007f5a844f7350 EFLAGS: 00010206 +[1417839.972331] RAX: 000000000000006e RBX: 1614b3ff6a50398a RCX: 0000000000000000 +[1417839.988477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 +[1417840.004626] RBP: 00007f5a844f7420 R08: 000000000000006e R09: 00007f5a94aeccb8 +[1417840.020784] R10: 00007f5a844f7350 R11: 0000000000000000 R12: 00007f5a94aecc79 +[1417840.036932] R13: 00007f5a94aecc78 R14: 00007f5a94aecc90 R15: 00007f5a94aecc40 + +CC: stable@vger.kernel.org # 4.4+ +Reviewed-by: Filipe Manana +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent_io.c | 40 ++++++++++++++++++++++++---------------- + 1 file changed, 24 insertions(+), 16 deletions(-) + +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5063,25 +5063,28 @@ struct extent_buffer *alloc_dummy_extent + static void check_buffer_tree_ref(struct extent_buffer *eb) + { + int refs; +- /* the ref bit is tricky. We have to make sure it is set +- * if we have the buffer dirty. Otherwise the +- * code to free a buffer can end up dropping a dirty +- * page ++ /* ++ * The TREE_REF bit is first set when the extent_buffer is added ++ * to the radix tree. It is also reset, if unset, when a new reference ++ * is created by find_extent_buffer. + * +- * Once the ref bit is set, it won't go away while the +- * buffer is dirty or in writeback, and it also won't +- * go away while we have the reference count on the +- * eb bumped. ++ * It is only cleared in two cases: freeing the last non-tree ++ * reference to the extent_buffer when its STALE bit is set or ++ * calling releasepage when the tree reference is the only reference. + * +- * We can't just set the ref bit without bumping the +- * ref on the eb because free_extent_buffer might +- * see the ref bit and try to clear it. If this happens +- * free_extent_buffer might end up dropping our original +- * ref by mistake and freeing the page before we are able +- * to add one more ref. ++ * In both cases, care is taken to ensure that the extent_buffer's ++ * pages are not under io. However, releasepage can be concurrently ++ * called with creating new references, which is prone to race ++ * conditions between the calls to check_buffer_tree_ref in those ++ * codepaths and clearing TREE_REF in try_release_extent_buffer. + * +- * So bump the ref count first, then set the bit. If someone +- * beat us to it, drop the ref we added. ++ * The actual lifetime of the extent_buffer in the radix tree is ++ * adequately protected by the refcount, but the TREE_REF bit and ++ * its corresponding reference are not. To protect against this ++ * class of races, we call check_buffer_tree_ref from the codepaths ++ * which trigger io after they set eb->io_pages. Note that once io is ++ * initiated, TREE_REF can no longer be cleared, so that is the ++ * moment at which any such race is best fixed. + */ + refs = atomic_read(&eb->refs); + if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) +@@ -5532,6 +5535,11 @@ int read_extent_buffer_pages(struct exte + clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags); + eb->read_mirror = 0; + atomic_set(&eb->io_pages, num_reads); ++ /* ++ * It is possible for releasepage to clear the TREE_REF bit before we ++ * set io_pages. See check_buffer_tree_ref for a more detailed comment. ++ */ ++ check_buffer_tree_ref(eb); + for (i = 0; i < num_pages; i++) { + page = eb->pages[i]; + diff --git a/queue-5.7/btrfs-reset-tree-root-pointer-after-error-in-init_tree_roots.patch b/queue-5.7/btrfs-reset-tree-root-pointer-after-error-in-init_tree_roots.patch new file mode 100644 index 00000000000..9a5c16ad837 --- /dev/null +++ b/queue-5.7/btrfs-reset-tree-root-pointer-after-error-in-init_tree_roots.patch @@ -0,0 +1,74 @@ +From 0465337c5599bbe360cdcff452992a1a6b7ed2d4 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Tue, 30 Jun 2020 14:53:02 -0400 +Subject: btrfs: reset tree root pointer after error in init_tree_roots + +From: Josef Bacik + +commit 0465337c5599bbe360cdcff452992a1a6b7ed2d4 upstream. + +Eric reported an issue where mounting -o recovery with a fuzzed fs +resulted in a kernel panic. This is because we tried to free the tree +node, except it was an error from the read. Fix this by properly +resetting the tree_root->node == NULL in this case. The panic was the +following + + BTRFS warning (device loop0): failed to read tree root + BUG: kernel NULL pointer dereference, address: 000000000000001f + RIP: 0010:free_extent_buffer+0xe/0x90 [btrfs] + Call Trace: + free_root_extent_buffers.part.0+0x11/0x30 [btrfs] + free_root_pointers+0x1a/0xa2 [btrfs] + open_ctree+0x1776/0x18a5 [btrfs] + btrfs_mount_root.cold+0x13/0xfa [btrfs] + ? selinux_fs_context_parse_param+0x37/0x80 + legacy_get_tree+0x27/0x40 + vfs_get_tree+0x25/0xb0 + fc_mount+0xe/0x30 + vfs_kern_mount.part.0+0x71/0x90 + btrfs_mount+0x147/0x3e0 [btrfs] + ? cred_has_capability+0x7c/0x120 + ? legacy_get_tree+0x27/0x40 + legacy_get_tree+0x27/0x40 + vfs_get_tree+0x25/0xb0 + do_mount+0x735/0xa40 + __x64_sys_mount+0x8e/0xd0 + do_syscall_64+0x4d/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Nik says: this is problematic only if we fail on the last iteration of +the loop as this results in init_tree_roots returning err value with +tree_root->node = -ERR. Subsequently the caller does: fail_tree_roots +which calls free_root_pointers on the bogus value. + +Reported-by: Eric Sandeen +Fixes: b8522a1e5f42 ("btrfs: Factor out tree roots initialization during mount") +CC: stable@vger.kernel.org # 5.5+ +Reviewed-by: Nikolay Borisov +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add details how the pointer gets dereferenced ] +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/disk-io.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -2583,10 +2583,12 @@ static int __cold init_tree_roots(struct + !extent_buffer_uptodate(tree_root->node)) { + handle_error = true; + +- if (IS_ERR(tree_root->node)) ++ if (IS_ERR(tree_root->node)) { + ret = PTR_ERR(tree_root->node); +- else if (!extent_buffer_uptodate(tree_root->node)) ++ tree_root->node = NULL; ++ } else if (!extent_buffer_uptodate(tree_root->node)) { + ret = -EUCLEAN; ++ } + + btrfs_warn(fs_info, "failed to read tree root"); + continue; diff --git a/queue-5.7/cifs-fix-reference-leak-for-tlink.patch b/queue-5.7/cifs-fix-reference-leak-for-tlink.patch new file mode 100644 index 00000000000..c5c1969b1ae --- /dev/null +++ b/queue-5.7/cifs-fix-reference-leak-for-tlink.patch @@ -0,0 +1,52 @@ +From a77592a70081edb58a95b9da18fd5a2882a25666 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Thu, 9 Jul 2020 20:39:49 +1000 +Subject: cifs: fix reference leak for tlink + +From: Ronnie Sahlberg + +commit a77592a70081edb58a95b9da18fd5a2882a25666 upstream. + +Don't leak a reference to tlink during the NOTIFY ioctl + +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +CC: Stable # v5.6+ +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/ioctl.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/fs/cifs/ioctl.c ++++ b/fs/cifs/ioctl.c +@@ -169,6 +169,7 @@ long cifs_ioctl(struct file *filep, unsi + unsigned int xid; + struct cifsFileInfo *pSMBFile = filep->private_data; + struct cifs_tcon *tcon; ++ struct tcon_link *tlink; + struct cifs_sb_info *cifs_sb; + __u64 ExtAttrBits = 0; + __u64 caps; +@@ -307,13 +308,19 @@ long cifs_ioctl(struct file *filep, unsi + break; + } + cifs_sb = CIFS_SB(inode->i_sb); +- tcon = tlink_tcon(cifs_sb_tlink(cifs_sb)); ++ tlink = cifs_sb_tlink(cifs_sb); ++ if (IS_ERR(tlink)) { ++ rc = PTR_ERR(tlink); ++ break; ++ } ++ tcon = tlink_tcon(tlink); + if (tcon && tcon->ses->server->ops->notify) { + rc = tcon->ses->server->ops->notify(xid, + filep, (void __user *)arg); + cifs_dbg(FYI, "ioctl notify rc %d\n", rc); + } else + rc = -EOPNOTSUPP; ++ cifs_put_tlink(tlink); + break; + default: + cifs_dbg(FYI, "unsupported ioctl\n"); diff --git a/queue-5.7/dm-use-noio-when-sending-kobject-event.patch b/queue-5.7/dm-use-noio-when-sending-kobject-event.patch new file mode 100644 index 00000000000..d1916533947 --- /dev/null +++ b/queue-5.7/dm-use-noio-when-sending-kobject-event.patch @@ -0,0 +1,67 @@ +From 6958c1c640af8c3f40fa8a2eee3b5b905d95b677 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Wed, 8 Jul 2020 12:25:20 -0400 +Subject: dm: use noio when sending kobject event + +From: Mikulas Patocka + +commit 6958c1c640af8c3f40fa8a2eee3b5b905d95b677 upstream. + +kobject_uevent may allocate memory and it may be called while there are dm +devices suspended. The allocation may recurse into a suspended device, +causing a deadlock. We must set the noio flag when sending a uevent. + +The observed deadlock was reported here: +https://www.redhat.com/archives/dm-devel/2020-March/msg00025.html + +Reported-by: Khazhismel Kumykov +Reported-by: Tahsin Erdogan +Reported-by: Gabriel Krisman Bertazi +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2894,17 +2895,25 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fas + int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, + unsigned cookie) + { ++ int r; ++ unsigned noio_flag; + char udev_cookie[DM_COOKIE_LENGTH]; + char *envp[] = { udev_cookie, NULL }; + ++ noio_flag = memalloc_noio_save(); ++ + if (!cookie) +- return kobject_uevent(&disk_to_dev(md->disk)->kobj, action); ++ r = kobject_uevent(&disk_to_dev(md->disk)->kobj, action); + else { + snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u", + DM_COOKIE_ENV_VAR_NAME, cookie); +- return kobject_uevent_env(&disk_to_dev(md->disk)->kobj, +- action, envp); ++ r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, ++ action, envp); + } ++ ++ memalloc_noio_restore(noio_flag); ++ ++ return r; + } + + uint32_t dm_next_uevent_seq(struct mapped_device *md) diff --git a/queue-5.7/dm-writecache-reject-asynchronous-pmem-devices.patch b/queue-5.7/dm-writecache-reject-asynchronous-pmem-devices.patch new file mode 100644 index 00000000000..f222ab750b5 --- /dev/null +++ b/queue-5.7/dm-writecache-reject-asynchronous-pmem-devices.patch @@ -0,0 +1,39 @@ +From a46624580376a3a0beb218d94cbc7f258696e29f Mon Sep 17 00:00:00 2001 +From: Michal Suchanek +Date: Tue, 30 Jun 2020 17:49:24 +0200 +Subject: dm writecache: reject asynchronous pmem devices + +From: Michal Suchanek + +commit a46624580376a3a0beb218d94cbc7f258696e29f upstream. + +DM writecache does not handle asynchronous pmem. Reject it when +supplied as cache. + +Link: https://lore.kernel.org/linux-nvdimm/87lfk5hahc.fsf@linux.ibm.com/ +Fixes: 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") +Signed-off-by: Michal Suchanek +Acked-by: Mikulas Patocka +Cc: stable@vger.kernel.org # 5.3+ +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-writecache.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -2232,6 +2232,12 @@ invalid_optional: + } + + if (WC_MODE_PMEM(wc)) { ++ if (!dax_synchronous(wc->ssd_dev->dax_dev)) { ++ r = -EOPNOTSUPP; ++ ti->error = "Asynchronous persistent memory not supported as pmem cache"; ++ goto bad; ++ } ++ + r = persistent_memory_claim(wc); + if (r) { + ti->error = "Unable to map persistent memory for cache"; diff --git a/queue-5.7/drm-amdgpu-add-tmr-destory-function-for-psp.patch b/queue-5.7/drm-amdgpu-add-tmr-destory-function-for-psp.patch new file mode 100644 index 00000000000..6c067dff1d3 --- /dev/null +++ b/queue-5.7/drm-amdgpu-add-tmr-destory-function-for-psp.patch @@ -0,0 +1,113 @@ +From c564b8601ae917086751d90f464d5f19d731ece7 Mon Sep 17 00:00:00 2001 +From: Huang Rui +Date: Tue, 30 Jun 2020 12:32:57 +0800 +Subject: drm/amdgpu: add TMR destory function for psp + +From: Huang Rui + +commit c564b8601ae917086751d90f464d5f19d731ece7 upstream. + +TMR is required to be destoried with GFX_CMD_ID_DESTROY_TMR while the +system goes to suspend. Otherwise, PSP may return the failure state +(0xFFFF007) on Gfx-2-PSP command GFX_CMD_ID_SETUP_TMR after do multiple +times suspend/resume. + +Signed-off-by: Huang Rui +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 57 +++++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -370,6 +370,52 @@ static int psp_tmr_load(struct psp_conte + return ret; + } + ++static void psp_prep_tmr_unload_cmd_buf(struct psp_context *psp, ++ struct psp_gfx_cmd_resp *cmd) ++{ ++ if (amdgpu_sriov_vf(psp->adev)) ++ cmd->cmd_id = GFX_CMD_ID_DESTROY_VMR; ++ else ++ cmd->cmd_id = GFX_CMD_ID_DESTROY_TMR; ++} ++ ++static int psp_tmr_unload(struct psp_context *psp) ++{ ++ int ret; ++ struct psp_gfx_cmd_resp *cmd; ++ ++ cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ psp_prep_tmr_unload_cmd_buf(psp, cmd); ++ DRM_INFO("free PSP TMR buffer\n"); ++ ++ ret = psp_cmd_submit_buf(psp, NULL, cmd, ++ psp->fence_buf_mc_addr); ++ ++ kfree(cmd); ++ ++ return ret; ++} ++ ++static int psp_tmr_terminate(struct psp_context *psp) ++{ ++ int ret; ++ void *tmr_buf; ++ void **pptr; ++ ++ ret = psp_tmr_unload(psp); ++ if (ret) ++ return ret; ++ ++ /* free TMR memory buffer */ ++ pptr = amdgpu_sriov_vf(psp->adev) ? &tmr_buf : NULL; ++ amdgpu_bo_free_kernel(&psp->tmr_bo, &psp->tmr_mc_addr, pptr); ++ ++ return 0; ++} ++ + static void psp_prep_asd_load_cmd_buf(struct psp_gfx_cmd_resp *cmd, + uint64_t asd_mc, uint32_t size) + { +@@ -1575,8 +1621,6 @@ static int psp_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + struct psp_context *psp = &adev->psp; +- void *tmr_buf; +- void **pptr; + + if (psp->adev->psp.ta_fw) { + psp_ras_terminate(psp); +@@ -1586,10 +1630,9 @@ static int psp_hw_fini(void *handle) + + psp_asd_unload(psp); + ++ psp_tmr_terminate(psp); + psp_ring_destroy(psp, PSP_RING_TYPE__KM); + +- pptr = amdgpu_sriov_vf(psp->adev) ? &tmr_buf : NULL; +- amdgpu_bo_free_kernel(&psp->tmr_bo, &psp->tmr_mc_addr, pptr); + amdgpu_bo_free_kernel(&psp->fw_pri_bo, + &psp->fw_pri_mc_addr, &psp->fw_pri_buf); + amdgpu_bo_free_kernel(&psp->fence_buf_bo, +@@ -1636,6 +1679,12 @@ static int psp_suspend(void *handle) + } + } + ++ ret = psp_tmr_terminate(psp); ++ if (ret) { ++ DRM_ERROR("Falied to terminate tmr\n"); ++ return ret; ++ } ++ + ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); + if (ret) { + DRM_ERROR("PSP ring stop failed\n"); diff --git a/queue-5.7/drm-amdgpu-asd-function-needs-to-be-unloaded-in-suspend-phase.patch b/queue-5.7/drm-amdgpu-asd-function-needs-to-be-unloaded-in-suspend-phase.patch new file mode 100644 index 00000000000..f07fe93c16c --- /dev/null +++ b/queue-5.7/drm-amdgpu-asd-function-needs-to-be-unloaded-in-suspend-phase.patch @@ -0,0 +1,36 @@ +From 20303ec5d2165ee6344190274bc59118921f71d9 Mon Sep 17 00:00:00 2001 +From: Huang Rui +Date: Tue, 30 Jun 2020 10:43:21 +0800 +Subject: drm/amdgpu: asd function needs to be unloaded in suspend phase + +From: Huang Rui + +commit 20303ec5d2165ee6344190274bc59118921f71d9 upstream. + +Unload ASD function in suspend phase. + +Signed-off-by: Huang Rui +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1685,6 +1685,12 @@ static int psp_suspend(void *handle) + return ret; + } + ++ ret = psp_asd_unload(psp); ++ if (ret) { ++ DRM_ERROR("Failed to unload asd\n"); ++ return ret; ++ } ++ + ret = psp_ring_stop(psp, PSP_RING_TYPE__KM); + if (ret) { + DRM_ERROR("PSP ring stop failed\n"); diff --git a/queue-5.7/drm-amdgpu-don-t-do-soft-recovery-if-gpu_recovery-0.patch b/queue-5.7/drm-amdgpu-don-t-do-soft-recovery-if-gpu_recovery-0.patch new file mode 100644 index 00000000000..f4e27068458 --- /dev/null +++ b/queue-5.7/drm-amdgpu-don-t-do-soft-recovery-if-gpu_recovery-0.patch @@ -0,0 +1,37 @@ +From f4892c327a8e5df7ce16cab40897daf90baf6bec Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Ol=C5=A1=C3=A1k?= +Date: Mon, 6 Jul 2020 18:23:17 -0400 +Subject: drm/amdgpu: don't do soft recovery if gpu_recovery=0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Olšák + +commit f4892c327a8e5df7ce16cab40897daf90baf6bec upstream. + +It's impossible to debug shader hangs with soft recovery. + +Signed-off-by: Marek Olšák +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -36,7 +36,8 @@ static void amdgpu_job_timedout(struct d + + memset(&ti, 0, sizeof(struct amdgpu_task_info)); + +- if (amdgpu_ring_soft_recovery(ring, job->vmid, s_job->s_fence->parent)) { ++ if (amdgpu_gpu_recovery && ++ amdgpu_ring_soft_recovery(ring, job->vmid, s_job->s_fence->parent)) { + DRM_ERROR("ring %s timeout, but soft recovered\n", + s_job->sched->name); + return; diff --git a/queue-5.7/drm-i915-also-drop-vm.ref-along-error-paths-for-vma-construction.patch b/queue-5.7/drm-i915-also-drop-vm.ref-along-error-paths-for-vma-construction.patch new file mode 100644 index 00000000000..d40301a17c7 --- /dev/null +++ b/queue-5.7/drm-i915-also-drop-vm.ref-along-error-paths-for-vma-construction.patch @@ -0,0 +1,79 @@ +From cf1976b11372cac3b57fbae1831f66a4486355d3 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 2 Jul 2020 22:10:15 +0100 +Subject: drm/i915: Also drop vm.ref along error paths for vma construction + +From: Chris Wilson + +commit cf1976b11372cac3b57fbae1831f66a4486355d3 upstream. + +Not only do we need to release the vm.ref we acquired for the vma on the +duplicate insert branch, but also for the normal error paths, so roll +them all into one. + +Reported-by: Andi Shyti +Suggested-by: Andi Shyti +Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") +Signed-off-by: Chris Wilson +Cc: Andi Shyti +Cc: # v5.5+ +Reviewed-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20200702211015.29604-1-chris@chris-wilson.co.uk +(cherry picked from commit 03fca66b7a36b52da8915341eee388267f6d5b73) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_vma.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -104,6 +104,7 @@ vma_create(struct drm_i915_gem_object *o + struct i915_address_space *vm, + const struct i915_ggtt_view *view) + { ++ struct i915_vma *pos = ERR_PTR(-E2BIG); + struct i915_vma *vma; + struct rb_node *rb, **p; + +@@ -184,7 +185,6 @@ vma_create(struct drm_i915_gem_object *o + rb = NULL; + p = &obj->vma.tree.rb_node; + while (*p) { +- struct i915_vma *pos; + long cmp; + + rb = *p; +@@ -196,17 +196,12 @@ vma_create(struct drm_i915_gem_object *o + * and dispose of ours. + */ + cmp = i915_vma_compare(pos, vm, view); +- if (cmp == 0) { +- spin_unlock(&obj->vma.lock); +- i915_vm_put(vm); +- i915_vma_free(vma); +- return pos; +- } +- + if (cmp < 0) + p = &rb->rb_right; +- else ++ else if (cmp > 0) + p = &rb->rb_left; ++ else ++ goto err_unlock; + } + rb_link_node(&vma->obj_node, rb, p); + rb_insert_color(&vma->obj_node, &obj->vma.tree); +@@ -229,8 +224,9 @@ vma_create(struct drm_i915_gem_object *o + err_unlock: + spin_unlock(&obj->vma.lock); + err_vma: ++ i915_vm_put(vm); + i915_vma_free(vma); +- return ERR_PTR(-E2BIG); ++ return pos; + } + + static struct i915_vma * diff --git a/queue-5.7/drm-i915-drop-vm.ref-for-duplicate-vma-on-construction.patch b/queue-5.7/drm-i915-drop-vm.ref-for-duplicate-vma-on-construction.patch new file mode 100644 index 00000000000..6f5d8873fb6 --- /dev/null +++ b/queue-5.7/drm-i915-drop-vm.ref-for-duplicate-vma-on-construction.patch @@ -0,0 +1,39 @@ +From 42723673a193d5f8e30dba6ea9826d42262a502b Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 2 Jul 2020 09:32:03 +0100 +Subject: drm/i915: Drop vm.ref for duplicate vma on construction + +From: Chris Wilson + +commit 42723673a193d5f8e30dba6ea9826d42262a502b upstream. + +As we allow for parallel threads to create the same vma instance +concurrently, and we only filter out the duplicates upon reacquiring the +spinlock for the rbtree, we have to free the loser of the constructors' +race. When freeing, we should also drop any resource references acquired +for the redundant vma. + +Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: # v5.5+ +Reviewed-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20200702083225.20044-1-chris@chris-wilson.co.uk +(cherry picked from commit 2377427cdd2b7514eb4c40241cf5c4dec63c1bec) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_vma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_vma.c ++++ b/drivers/gpu/drm/i915/i915_vma.c +@@ -198,6 +198,7 @@ vma_create(struct drm_i915_gem_object *o + cmp = i915_vma_compare(pos, vm, view); + if (cmp == 0) { + spin_unlock(&obj->vma.lock); ++ i915_vm_put(vm); + i915_vma_free(vma); + return pos; + } diff --git a/queue-5.7/drm-i915-gt-pin-the-rings-before-marking-active.patch b/queue-5.7/drm-i915-gt-pin-the-rings-before-marking-active.patch new file mode 100644 index 00000000000..c51e0ae998c --- /dev/null +++ b/queue-5.7/drm-i915-gt-pin-the-rings-before-marking-active.patch @@ -0,0 +1,63 @@ +From 5a383d443b29a140094430f3ad1d02fa1acc2b80 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 6 Jul 2020 18:01:38 +0100 +Subject: drm/i915/gt: Pin the rings before marking active + +From: Chris Wilson + +commit 5a383d443b29a140094430f3ad1d02fa1acc2b80 upstream. + +On eviction, we acquire the vm->mutex and then wait on the vma->active. +Therefore when binding and pinning the vma, we must follow the same +sequence, lock/pin the vma then mark it active. Otherwise, we mark the +vma as active, then wait for the vm->mutex, and meanwhile the evictor +holding the mutex waits upon us to complete our activity. + +Fixes: 8ccfc20a7d56 ("drm/i915/gt: Mark ring->vma as active while pinned") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: # v5.6+ +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20200706170138.8993-1-chris@chris-wilson.co.uk +(cherry picked from commit 8567774e87e23a57155e5102f81208729b992ae6) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gt/intel_context.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_context.c ++++ b/drivers/gpu/drm/i915/gt/intel_context.c +@@ -201,25 +201,25 @@ static int __ring_active(struct intel_ri + { + int err; + +- err = i915_active_acquire(&ring->vma->active); ++ err = intel_ring_pin(ring); + if (err) + return err; + +- err = intel_ring_pin(ring); ++ err = i915_active_acquire(&ring->vma->active); + if (err) +- goto err_active; ++ goto err_pin; + + return 0; + +-err_active: +- i915_active_release(&ring->vma->active); ++err_pin: ++ intel_ring_unpin(ring); + return err; + } + + static void __ring_retire(struct intel_ring *ring) + { +- intel_ring_unpin(ring); + i915_active_release(&ring->vma->active); ++ intel_ring_unpin(ring); + } + + __i915_active_call diff --git a/queue-5.7/drm-i915-skip-stale-object-handle-for-debugfs-per-file-stats.patch b/queue-5.7/drm-i915-skip-stale-object-handle-for-debugfs-per-file-stats.patch new file mode 100644 index 00000000000..9f74b224848 --- /dev/null +++ b/queue-5.7/drm-i915-skip-stale-object-handle-for-debugfs-per-file-stats.patch @@ -0,0 +1,68 @@ +From 7dfbf8a07cf8c936b0d6cc810df6ae7923954d5b Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 30 Jun 2020 16:27:24 +0100 +Subject: drm/i915: Skip stale object handle for debugfs per-file-stats + +From: Chris Wilson + +commit 7dfbf8a07cf8c936b0d6cc810df6ae7923954d5b upstream. + +As we close a handle GEM object, we update the drm_file's idr with an +error^W NULL pointer to indicate the in-progress closure, and finally +removing it. If we read the idr directly, we may then see an invalid +object pointer, and in our debugfs per_file_stats() we therefore need +to protect against the entry being invalid. + +[ 1016.651637] RIP: 0010:per_file_stats+0xe/0x16e +[ 1016.651646] Code: d2 41 0f b6 8e 69 8c 00 00 48 89 df 48 c7 c6 7b 74 8c be 31 c0 e8 0c 89 cf ff eb d2 0f 1f 44 00 00 55 48 89 e5 41 +57 41 56 53 <8b> 06 85 c0 0f 84 4d 01 00 00 49 89 d6 48 89 f3 3d ff ff ff 7f 73 +[ 1016.651651] RSP: 0018:ffffad3a01337ba0 EFLAGS: 00010293 +[ 1016.651656] RAX: 0000000000000018 RBX: ffff96fe040d65e0 RCX: 0000000000000002 +[ 1016.651660] RDX: ffffad3a01337c50 RSI: 0000000000000000 RDI: 00000000000001e8 +[ 1016.651663] RBP: ffffad3a01337bb8 R08: 0000000000000000 R09: 00000000000001c0 +[ 1016.651667] R10: 0000000000000000 R11: ffffffffbdbe5fce R12: 0000000000000000 +[ 1016.651671] R13: ffffffffbdbe5fce R14: ffffad3a01337c50 R15: 0000000000000001 +[ 1016.651676] FS: 00007a597e2d7480(0000) GS:ffff96ff3bb00000(0000) knlGS:0000000000000000 +[ 1016.651680] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1016.651683] CR2: 0000000000000000 CR3: 0000000171fc2001 CR4: 00000000003606e0 +[ 1016.651687] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 1016.651690] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 1016.651693] Call Trace: +[ 1016.651693] Call Trace: +[ 1016.651703] idr_for_each+0x8a/0xe8 +[ 1016.651711] i915_gem_object_info+0x2a3/0x3eb +[ 1016.651720] seq_read+0x162/0x3ca +[ 1016.651727] full_proxy_read+0x5b/0x8d +[ 1016.651733] __vfs_read+0x45/0x1bb +[ 1016.651741] vfs_read+0xc9/0x15e +[ 1016.651746] ksys_read+0x7e/0xde +[ 1016.651752] do_syscall_64+0x54/0x68 +[ 1016.651758] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Reported-by: Guenter Roeck +Fixes: a8c15954d64a ("drm/i915: Protect debugfs per_file_stats with RCU lock") +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Guenter Roeck +Cc: stable@vger.kernel.org +Reviewed-by: Mika Kuoppala +Link: https://patchwork.freedesktop.org/patch/msgid/20200630152724.3734-1-chris@chris-wilson.co.uk +(cherry picked from commit c1b9fd3d310177b31621d5e661f06885869cae12) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_debugfs.c ++++ b/drivers/gpu/drm/i915/i915_debugfs.c +@@ -229,7 +229,7 @@ static int per_file_stats(int id, void * + struct file_stats *stats = data; + struct i915_vma *vma; + +- if (!kref_get_unless_zero(&obj->base.refcount)) ++ if (IS_ERR_OR_NULL(obj) || !kref_get_unless_zero(&obj->base.refcount)) + return 0; + + stats->count++; diff --git a/queue-5.7/drm-radeon-fix-double-free.patch b/queue-5.7/drm-radeon-fix-double-free.patch new file mode 100644 index 00000000000..168a3a63ebf --- /dev/null +++ b/queue-5.7/drm-radeon-fix-double-free.patch @@ -0,0 +1,81 @@ +From 41855a898650803e24b284173354cc3e44d07725 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Mon, 6 Jul 2020 05:28:57 -0700 +Subject: drm/radeon: fix double free + +From: Tom Rix + +commit 41855a898650803e24b284173354cc3e44d07725 upstream. + +clang static analysis flags this error + +drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc] + kfree(rdev->pm.dpm.ps[i].ps_priv); + ^~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc] + kfree(rdev->pm.dpm.ps); + ^~~~~~~~~~~~~~~~~~~~~~ + +problem is reported in ci_dpm_fini, with these code blocks. + + for (i = 0; i < rdev->pm.dpm.num_ps; i++) { + kfree(rdev->pm.dpm.ps[i].ps_priv); + } + kfree(rdev->pm.dpm.ps); + +The first free happens in ci_parse_power_table where it cleans up locally +on a failure. ci_dpm_fini also does a cleanup. + + ret = ci_parse_power_table(rdev); + if (ret) { + ci_dpm_fini(rdev); + return ret; + } + +So remove the cleanup in ci_parse_power_table and +move the num_ps calculation to inside the loop so ci_dpm_fini +will know how many array elements to free. + +Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)") + +Signed-off-by: Tom Rix +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ci_dpm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/ci_dpm.c ++++ b/drivers/gpu/drm/radeon/ci_dpm.c +@@ -5577,6 +5577,7 @@ static int ci_parse_power_table(struct r + if (!rdev->pm.dpm.ps) + return -ENOMEM; + power_state_offset = (u8 *)state_array->states; ++ rdev->pm.dpm.num_ps = 0; + for (i = 0; i < state_array->ucNumEntries; i++) { + u8 *idx; + power_state = (union pplib_power_state *)power_state_offset; +@@ -5586,10 +5587,8 @@ static int ci_parse_power_table(struct r + if (!rdev->pm.power_state[i].clock_info) + return -EINVAL; + ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(rdev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + rdev->pm.dpm.ps[i].ps_priv = ps; + ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], + non_clock_info, +@@ -5611,8 +5610,8 @@ static int ci_parse_power_table(struct r + k++; + } + power_state_offset += 2 + power_state->v2.ucNumDPMLevels; ++ rdev->pm.dpm.num_ps = i + 1; + } +- rdev->pm.dpm.num_ps = state_array->ucNumEntries; + + /* fill in the vce power states */ + for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) { diff --git a/queue-5.7/mmc-meson-gx-limit-segments-to-1-when-dram-access-quirk-is-needed.patch b/queue-5.7/mmc-meson-gx-limit-segments-to-1-when-dram-access-quirk-is-needed.patch new file mode 100644 index 00000000000..3ab45403ed7 --- /dev/null +++ b/queue-5.7/mmc-meson-gx-limit-segments-to-1-when-dram-access-quirk-is-needed.patch @@ -0,0 +1,51 @@ +From 27a5e7d36d383970affae801d77141deafd536a8 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Mon, 8 Jun 2020 10:44:58 +0200 +Subject: mmc: meson-gx: limit segments to 1 when dram-access-quirk is needed + +From: Neil Armstrong + +commit 27a5e7d36d383970affae801d77141deafd536a8 upstream. + +The actual max_segs computation leads to failure while using the broadcom +sdio brcmfmac/bcmsdh driver, since the driver tries to make usage of +scatter gather. + +But with the dram-access-quirk we use a 1,5K SRAM bounce buffer, and the +max_segs current value of 3 leads to max transfers to 4,5k, which doesn't +work. + +This patch sets max_segs to 1 to better describe the hardware limitation, +and fix the SDIO functionality with the brcmfmac/bcmsdh driver on Amlogic +G12A/G12B SoCs on boards like SEI510 or Khadas VIM3. + +Reported-by: Art Nikpal +Reported-by: Christian Hewitt +Fixes: acdc8e71d9bb ("mmc: meson-gx: add dram-access-quirk") +Signed-off-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200608084458.32014-1-narmstrong@baylibre.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/meson-gx-mmc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/meson-gx-mmc.c ++++ b/drivers/mmc/host/meson-gx-mmc.c +@@ -1143,9 +1143,11 @@ static int meson_mmc_probe(struct platfo + + mmc->caps |= MMC_CAP_CMD23; + if (host->dram_access_quirk) { ++ /* Limit segments to 1 due to low available sram memory */ ++ mmc->max_segs = 1; + /* Limit to the available sram memory */ +- mmc->max_segs = SD_EMMC_SRAM_DATA_BUF_LEN / mmc->max_blk_size; +- mmc->max_blk_count = mmc->max_segs; ++ mmc->max_blk_count = SD_EMMC_SRAM_DATA_BUF_LEN / ++ mmc->max_blk_size; + } else { + mmc->max_blk_count = CMD_CFG_LENGTH_MASK; + mmc->max_segs = SD_EMMC_DESC_BUF_LEN / diff --git a/queue-5.7/mmc-owl-mmc-get-rid-of-of_match_ptr-macro.patch b/queue-5.7/mmc-owl-mmc-get-rid-of-of_match_ptr-macro.patch new file mode 100644 index 00000000000..3fa01863d15 --- /dev/null +++ b/queue-5.7/mmc-owl-mmc-get-rid-of-of_match_ptr-macro.patch @@ -0,0 +1,38 @@ +From f8884711f78fa946041cf04492e218c377479a9c Mon Sep 17 00:00:00 2001 +From: Manivannan Sadhasivam +Date: Sun, 21 Jun 2020 08:23:30 +0530 +Subject: mmc: owl-mmc: Get rid of of_match_ptr() macro + +From: Manivannan Sadhasivam + +commit f8884711f78fa946041cf04492e218c377479a9c upstream. + +Remove the 'of_match_ptr()' macro to fix the warning when CONFIG_OF is +not selected. + +drivers/mmc/host/owl-mmc.c:677:34: warning: unused variable 'owl_mmc_of_match' +[-Wunused-const-variable] + +Reported-by: kernel test robot +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20200621025330.10561-1-mani@kernel.org +Fixes: ff65ffe46d28 ("mmc: Add Actions Semi Owl SoCs SD/MMC driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/owl-mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/owl-mmc.c ++++ b/drivers/mmc/host/owl-mmc.c +@@ -689,7 +689,7 @@ MODULE_DEVICE_TABLE(of, owl_mmc_of_match + static struct platform_driver owl_mmc_driver = { + .driver = { + .name = "owl_mmc", +- .of_match_table = of_match_ptr(owl_mmc_of_match), ++ .of_match_table = owl_mmc_of_match, + }, + .probe = owl_mmc_probe, + .remove = owl_mmc_remove, diff --git a/queue-5.7/perf-scripts-python-export-to-postgresql.py-fix-struct.pack-int-argument.patch b/queue-5.7/perf-scripts-python-export-to-postgresql.py-fix-struct.pack-int-argument.patch new file mode 100644 index 00000000000..9370cf68830 --- /dev/null +++ b/queue-5.7/perf-scripts-python-export-to-postgresql.py-fix-struct.pack-int-argument.patch @@ -0,0 +1,68 @@ +From 640432e6bed08e9d5d2ba26856ba3f55008b07e3 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 29 Jun 2020 12:19:50 +0300 +Subject: perf scripts python: export-to-postgresql.py: Fix struct.pack() int argument + +From: Adrian Hunter + +commit 640432e6bed08e9d5d2ba26856ba3f55008b07e3 upstream. + +Python 3.8 is requiring that arguments being packed as integers are also +integers. Add int() accordingly. + + Before: + + $ perf record -e intel_pt//u uname + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-postgresql.py perf_data_db branches calls + 2020-06-25 16:09:10.547256 Creating database... + 2020-06-25 16:09:10.733185 Writing to intermediate files... + Traceback (most recent call last): + File "/home/ahunter/libexec/perf-core/scripts/python/export-to-postgresql.py", line 1106, in synth_data + cbr(id, raw_buf) + File "/home/ahunter/libexec/perf-core/scripts/python/export-to-postgresql.py", line 1058, in cbr + value = struct.pack("!hiqiiiiii", 4, 8, id, 4, cbr, 4, MHz, 4, percent) + struct.error: required argument is not an integer + Fatal Python error: problem in Python trace event handler + Python runtime state: initialized + + Current thread 0x00007f35d3695780 (most recent call first): + + Aborted (core dumped) + + After: + + $ dropdb perf_data_db + $ rm -rf perf_data_db-perf-data + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-postgresql.py perf_data_db branches calls + 2020-06-25 16:09:40.990267 Creating database... + 2020-06-25 16:09:41.207009 Writing to intermediate files... + 2020-06-25 16:09:41.270915 Copying to database... + 2020-06-25 16:09:41.382030 Removing intermediate files... + 2020-06-25 16:09:41.384630 Adding primary keys + 2020-06-25 16:09:41.541894 Adding foreign keys + 2020-06-25 16:09:41.677044 Dropping unused tables + 2020-06-25 16:09:41.703761 Done + +Fixes: aba44287a224 ("perf scripts python: export-to-postgresql.py: Export Intel PT power and ptwrite events") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Cc: stable@vger.kernel.org +Link: http://lore.kernel.org/lkml/20200629091955.17090-2-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/scripts/python/export-to-postgresql.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/scripts/python/export-to-postgresql.py ++++ b/tools/perf/scripts/python/export-to-postgresql.py +@@ -1055,7 +1055,7 @@ def cbr(id, raw_buf): + cbr = data[0] + MHz = (data[4] + 500) / 1000 + percent = ((cbr * 1000 / data[2]) + 5) / 10 +- value = struct.pack("!hiqiiiiii", 4, 8, id, 4, cbr, 4, MHz, 4, percent) ++ value = struct.pack("!hiqiiiiii", 4, 8, id, 4, cbr, 4, int(MHz), 4, int(percent)) + cbr_file.write(value) + + def mwait(id, raw_buf): diff --git a/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-time-chart-call-tree.patch b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-time-chart-call-tree.patch new file mode 100644 index 00000000000..def1cadab8f --- /dev/null +++ b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-time-chart-call-tree.patch @@ -0,0 +1,75 @@ +From f18d5cf86cdb58eb50cafb5a5e20943ec7a61b1f Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 29 Jun 2020 12:19:55 +0300 +Subject: perf scripts python: exported-sql-viewer.py: Fix time chart call tree + +From: Adrian Hunter + +commit f18d5cf86cdb58eb50cafb5a5e20943ec7a61b1f upstream. + +Using Python version 3.8.2 and PySide2 version 5.14.0, time chart call tree +would not expand the tree to the result. Fix by using setExpanded(). + +Example: + + $ perf record -e intel_pt//u uname + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.034 MB perf.data ] + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls + 2020-06-26 15:32:14.928997 Creating database ... + 2020-06-26 15:32:14.933971 Writing records... + 2020-06-26 15:32:15.535251 Adding indexes + 2020-06-26 15:32:15.542993 Dropping unused tables + 2020-06-26 15:32:15.549716 Done + $ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db + + Select: Charts -> Time chart by CPU + Move mouse over middle of chart + Right-click and select Show Call Tree + +Before: displays Call Tree but not expanded to selected time +After: displays Call Tree expanded to selected time + +Fixes: e69d5df75d74d ("perf scripts python: exported-sql-viewer.py: Add ability for Call tree to open at a specified task and time") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Cc: stable@vger.kernel.org +Link: http://lore.kernel.org/lkml/20200629091955.17090-7-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/scripts/python/exported-sql-viewer.py | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/tools/perf/scripts/python/exported-sql-viewer.py ++++ b/tools/perf/scripts/python/exported-sql-viewer.py +@@ -1130,6 +1130,7 @@ class CallTreeWindow(TreeWindowBase): + child = self.model.index(row, 0, parent) + if child.internalPointer().dbid == dbid: + found = True ++ self.view.setExpanded(parent, True) + self.view.setCurrentIndex(child) + parent = child + break +@@ -1142,6 +1143,7 @@ class CallTreeWindow(TreeWindowBase): + return + last_child = None + for row in xrange(n): ++ self.view.setExpanded(parent, True) + child = self.model.index(row, 0, parent) + child_call_time = child.internalPointer().call_time + if child_call_time < time: +@@ -1154,9 +1156,11 @@ class CallTreeWindow(TreeWindowBase): + if not last_child: + if not found: + child = self.model.index(0, 0, parent) ++ self.view.setExpanded(parent, True) + self.view.setCurrentIndex(child) + return + found = True ++ self.view.setExpanded(parent, True) + self.view.setCurrentIndex(last_child) + parent = last_child + diff --git a/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-unexpanded-find-result.patch b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-unexpanded-find-result.patch new file mode 100644 index 00000000000..164b1a9dd47 --- /dev/null +++ b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-unexpanded-find-result.patch @@ -0,0 +1,57 @@ +From 3a3cf7c570a486b07d9a6e68a77548aea6a8421f Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 29 Jun 2020 12:19:52 +0300 +Subject: perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result + +From: Adrian Hunter + +commit 3a3cf7c570a486b07d9a6e68a77548aea6a8421f upstream. + +Using Python version 3.8.2 and PySide2 version 5.14.0, ctrl-F ('Find') +would not expand the tree to the result. Fix by using setExpanded(). + +Example: + + $ perf record -e intel_pt//u uname + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.034 MB perf.data ] + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls + 2020-06-26 15:32:14.928997 Creating database ... + 2020-06-26 15:32:14.933971 Writing records... + 2020-06-26 15:32:15.535251 Adding indexes + 2020-06-26 15:32:15.542993 Dropping unused tables + 2020-06-26 15:32:15.549716 Done + $ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db + + Select: Reports -> Context-Sensitive Call Graph or Reports -> Call Tree + Press: Ctrl-F + Enter: main + Press: Enter + +Before: line showing 'main' does not display + +After: tree is expanded to line showing 'main' + +Fixes: ebd70c7dc2f5f ("perf scripts python: exported-sql-viewer.py: Add ability to find symbols in the call-graph") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Cc: stable@vger.kernel.org +Link: http://lore.kernel.org/lkml/20200629091955.17090-4-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/scripts/python/exported-sql-viewer.py | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/perf/scripts/python/exported-sql-viewer.py ++++ b/tools/perf/scripts/python/exported-sql-viewer.py +@@ -1052,6 +1052,7 @@ class TreeWindowBase(QMdiSubWindow): + child = self.model.index(row, 0, parent) + if child.internalPointer().dbid == dbid: + found = True ++ self.view.setExpanded(parent, True) + self.view.setCurrentIndex(child) + parent = child + break diff --git a/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-graph-find-result.patch b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-graph-find-result.patch new file mode 100644 index 00000000000..b3e62ace812 --- /dev/null +++ b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-graph-find-result.patch @@ -0,0 +1,58 @@ +From 7ff520b0a71dd2db695b52ad117d81b7eaf6ff9d Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 29 Jun 2020 12:19:53 +0300 +Subject: perf scripts python: exported-sql-viewer.py: Fix zero id in call graph 'Find' result + +From: Adrian Hunter + +commit 7ff520b0a71dd2db695b52ad117d81b7eaf6ff9d upstream. + +Using ctrl-F ('Find') would not find 'unknown' because it matches id zero. +Fix by excluding id zero from selection. + +Example: + + $ perf record -e intel_pt//u uname + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.034 MB perf.data ] + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls + 2020-06-26 15:32:14.928997 Creating database ... + 2020-06-26 15:32:14.933971 Writing records... + 2020-06-26 15:32:15.535251 Adding indexes + 2020-06-26 15:32:15.542993 Dropping unused tables + 2020-06-26 15:32:15.549716 Done + $ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db + + Select: Reports -> Context-Sensitive Call Graph + Press: Ctrl-F + Enter: unknown + Press: Enter + +Before: gets stuck +After: tree is expanded to line showing 'unknown' + +Fixes: 254c0d820b86d ("perf scripts python: exported-sql-viewer.py: Factor out CallGraphModelBase") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Cc: stable@vger.kernel.org +Link: http://lore.kernel.org/lkml/20200629091955.17090-5-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/scripts/python/exported-sql-viewer.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/scripts/python/exported-sql-viewer.py ++++ b/tools/perf/scripts/python/exported-sql-viewer.py +@@ -768,7 +768,8 @@ class CallGraphModel(CallGraphModelBase) + " FROM calls" + " INNER JOIN call_paths ON calls.call_path_id = call_paths.id" + " INNER JOIN symbols ON call_paths.symbol_id = symbols.id" +- " WHERE symbols.name" + match + ++ " WHERE calls.id <> 0" ++ " AND symbols.name" + match + + " GROUP BY comm_id, thread_id, call_path_id" + " ORDER BY comm_id, thread_id, call_path_id") + diff --git a/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-tree-find-result.patch b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-tree-find-result.patch new file mode 100644 index 00000000000..0c6008f7480 --- /dev/null +++ b/queue-5.7/perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-tree-find-result.patch @@ -0,0 +1,58 @@ +From 031c8d5edb1ddeb6d398f7942ce2a01a1a51ada9 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 29 Jun 2020 12:19:54 +0300 +Subject: perf scripts python: exported-sql-viewer.py: Fix zero id in call tree 'Find' result + +From: Adrian Hunter + +commit 031c8d5edb1ddeb6d398f7942ce2a01a1a51ada9 upstream. + +Using ctrl-F ('Find') would not find 'unknown' because it matches id +zero. Fix by excluding id zero from selection. + +Example: + + $ perf record -e intel_pt//u uname + Linux + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.034 MB perf.data ] + $ perf script --itrace=bep -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py perf.data.db branches calls + 2020-06-26 15:32:14.928997 Creating database ... + 2020-06-26 15:32:14.933971 Writing records... + 2020-06-26 15:32:15.535251 Adding indexes + 2020-06-26 15:32:15.542993 Dropping unused tables + 2020-06-26 15:32:15.549716 Done + $ python3 ~/libexec/perf-core/scripts/python/exported-sql-viewer.py perf.data.db + + Select: Reports -> Call Tree + Press: Ctrl-F + Enter: unknown + Press: Enter + +Before: displays 'unknown' not found +After: tree is expanded to line showing 'unknown' + +Fixes: ae8b887c00d3f ("perf scripts python: exported-sql-viewer.py: Add call tree") +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Cc: stable@vger.kernel.org +Link: http://lore.kernel.org/lkml/20200629091955.17090-6-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/scripts/python/exported-sql-viewer.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/scripts/python/exported-sql-viewer.py ++++ b/tools/perf/scripts/python/exported-sql-viewer.py +@@ -964,7 +964,8 @@ class CallTreeModel(CallGraphModelBase): + " FROM calls" + " INNER JOIN call_paths ON calls.call_path_id = call_paths.id" + " INNER JOIN symbols ON call_paths.symbol_id = symbols.id" +- " WHERE symbols.name" + match + ++ " WHERE calls.id <> 0" ++ " AND symbols.name" + match + + " ORDER BY comm_id, thread_id, call_time, calls.id") + + def FindPath(self, query): diff --git a/queue-5.7/pinctrl-baytrail-fix-pin-being-driven-low-for-a-while-on-gpiod_get-...-gpiod_out_high.patch b/queue-5.7/pinctrl-baytrail-fix-pin-being-driven-low-for-a-while-on-gpiod_get-...-gpiod_out_high.patch new file mode 100644 index 00000000000..26c49e78822 --- /dev/null +++ b/queue-5.7/pinctrl-baytrail-fix-pin-being-driven-low-for-a-while-on-gpiod_get-...-gpiod_out_high.patch @@ -0,0 +1,167 @@ +From 45c11a927606c612e4898a9484867b71318699f6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 6 Jun 2020 11:31:50 +0200 +Subject: pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) + +From: Hans de Goede + +commit 45c11a927606c612e4898a9484867b71318699f6 upstream. + +The pins on the Bay Trail SoC have separate input-buffer and output-buffer +enable bits and a read of the level bit of the value register will always +return the value from the input-buffer. + +The BIOS of a device may configure a pin in output-only mode, only enabling +the output buffer, and write 1 to the level bit to drive the pin high. +This 1 written to the level bit will be stored inside the data-latch of the +output buffer. + +But a subsequent read of the value register will return 0 for the level bit +because the input-buffer is disabled. This causes a read-modify-write as +done by byt_gpio_set_direction() to write 0 to the level bit, driving the +pin low! + +Before this commit byt_gpio_direction_output() relied on +pinctrl_gpio_direction_output() to set the direction, followed by a call +to byt_gpio_set() to apply the selected value. This causes the pin to +go low between the pinctrl_gpio_direction_output() and byt_gpio_set() +calls. + +Change byt_gpio_direction_output() to directly make the register +modifications itself instead. Replacing the 2 subsequent writes to the +value register with a single write. + +Note that the pinctrl code does not keep track internally of the direction, +so not going through pinctrl_gpio_direction_output() is not an issue. + +This issue was noticed on a Trekstor SurfTab Twin 10.1. When the panel is +already on at boot (no external monitor connected), then the i915 driver +does a gpiod_get(..., GPIOD_OUT_HIGH) for the panel-enable GPIO. The +temporarily going low of that GPIO was causing the panel to reset itself +after which it would not show an image until it was turned off and back on +again (until a full modeset was done on it). This commit fixes this. + +This commit also updates the byt_gpio_direction_input() to use direct +register accesses instead of going through pinctrl_gpio_direction_input(), +to keep it consistent with byt_gpio_direction_output(). + +Note for backporting, this commit depends on: +commit e2b74419e5cc ("pinctrl: baytrail: Replace WARN with dev_info_once +when setting direct-irq pin to output") + +Cc: stable@vger.kernel.org +Fixes: 86e3ef812fe3 ("pinctrl: baytrail: Update gpio chip operations") +Signed-off-by: Hans de Goede +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 67 ++++++++++++++++++++++++------- + 1 file changed, 53 insertions(+), 14 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -800,6 +800,21 @@ static void byt_gpio_disable_free(struct + pm_runtime_put(vg->dev); + } + ++static void byt_gpio_direct_irq_check(struct intel_pinctrl *vg, ++ unsigned int offset) ++{ ++ void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG); ++ ++ /* ++ * Before making any direction modifications, do a check if gpio is set ++ * for direct IRQ. On Bay Trail, setting GPIO to output does not make ++ * sense, so let's at least inform the caller before they shoot ++ * themselves in the foot. ++ */ ++ if (readl(conf_reg) & BYT_DIRECT_IRQ_EN) ++ dev_info_once(vg->dev, "Potential Error: Setting GPIO with direct_irq_en to output"); ++} ++ + static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, + struct pinctrl_gpio_range *range, + unsigned int offset, +@@ -807,7 +822,6 @@ static int byt_gpio_set_direction(struct + { + struct intel_pinctrl *vg = pinctrl_dev_get_drvdata(pctl_dev); + void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG); +- void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG); + unsigned long flags; + u32 value; + +@@ -817,14 +831,8 @@ static int byt_gpio_set_direction(struct + value &= ~BYT_DIR_MASK; + if (input) + value |= BYT_OUTPUT_EN; +- else if (readl(conf_reg) & BYT_DIRECT_IRQ_EN) +- /* +- * Before making any direction modifications, do a check if gpio +- * is set for direct IRQ. On baytrail, setting GPIO to output +- * does not make sense, so let's at least inform the caller before +- * they shoot themselves in the foot. +- */ +- dev_info_once(vg->dev, "Potential Error: Setting GPIO with direct_irq_en to output"); ++ else ++ byt_gpio_direct_irq_check(vg, offset); + + writel(value, val_reg); + +@@ -1165,19 +1173,50 @@ static int byt_gpio_get_direction(struct + + static int byt_gpio_direction_input(struct gpio_chip *chip, unsigned int offset) + { +- return pinctrl_gpio_direction_input(chip->base + offset); ++ struct intel_pinctrl *vg = gpiochip_get_data(chip); ++ void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG); ++ unsigned long flags; ++ u32 reg; ++ ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ ++ reg = readl(val_reg); ++ reg &= ~BYT_DIR_MASK; ++ reg |= BYT_OUTPUT_EN; ++ writel(reg, val_reg); ++ ++ raw_spin_unlock_irqrestore(&byt_lock, flags); ++ return 0; + } + ++/* ++ * Note despite the temptation this MUST NOT be converted into a call to ++ * pinctrl_gpio_direction_output() + byt_gpio_set() that does not work this ++ * MUST be done as a single BYT_VAL_REG register write. ++ * See the commit message of the commit adding this comment for details. ++ */ + static int byt_gpio_direction_output(struct gpio_chip *chip, + unsigned int offset, int value) + { +- int ret = pinctrl_gpio_direction_output(chip->base + offset); ++ struct intel_pinctrl *vg = gpiochip_get_data(chip); ++ void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG); ++ unsigned long flags; ++ u32 reg; + +- if (ret) +- return ret; ++ raw_spin_lock_irqsave(&byt_lock, flags); ++ ++ byt_gpio_direct_irq_check(vg, offset); ++ ++ reg = readl(val_reg); ++ reg &= ~BYT_DIR_MASK; ++ if (value) ++ reg |= BYT_LEVEL; ++ else ++ reg &= ~BYT_LEVEL; + +- byt_gpio_set(chip, offset, value); ++ writel(reg, val_reg); + ++ raw_spin_unlock_irqrestore(&byt_lock, flags); + return 0; + } + diff --git a/queue-5.7/s390-mm-fix-huge-pte-soft-dirty-copying.patch b/queue-5.7/s390-mm-fix-huge-pte-soft-dirty-copying.patch new file mode 100644 index 00000000000..2a5c99d130f --- /dev/null +++ b/queue-5.7/s390-mm-fix-huge-pte-soft-dirty-copying.patch @@ -0,0 +1,35 @@ +From 528a9539348a0234375dfaa1ca5dbbb2f8f8e8d2 Mon Sep 17 00:00:00 2001 +From: Janosch Frank +Date: Tue, 7 Jul 2020 15:38:54 +0200 +Subject: s390/mm: fix huge pte soft dirty copying + +From: Janosch Frank + +commit 528a9539348a0234375dfaa1ca5dbbb2f8f8e8d2 upstream. + +If the pmd is soft dirty we must mark the pte as soft dirty (and not dirty). +This fixes some cases for guest migration with huge page backings. + +Cc: # 4.8 +Fixes: bc29b7ac1d9f ("s390/mm: clean up pte/pmd encoding") +Reviewed-by: Christian Borntraeger +Reviewed-by: Gerald Schaefer +Signed-off-by: Janosch Frank +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/mm/hugetlbpage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/mm/hugetlbpage.c ++++ b/arch/s390/mm/hugetlbpage.c +@@ -117,7 +117,7 @@ static inline pte_t __rste_to_pte(unsign + _PAGE_YOUNG); + #ifdef CONFIG_MEM_SOFT_DIRTY + pte_val(pte) |= move_set_bit(rste, _SEGMENT_ENTRY_SOFT_DIRTY, +- _PAGE_DIRTY); ++ _PAGE_SOFT_DIRTY); + #endif + pte_val(pte) |= move_set_bit(rste, _SEGMENT_ENTRY_NOEXEC, + _PAGE_NOEXEC); diff --git a/queue-5.7/s390-setup-init-jump-labels-before-command-line-parsing.patch b/queue-5.7/s390-setup-init-jump-labels-before-command-line-parsing.patch new file mode 100644 index 00000000000..f392a4090bd --- /dev/null +++ b/queue-5.7/s390-setup-init-jump-labels-before-command-line-parsing.patch @@ -0,0 +1,42 @@ +From 95e61b1b5d6394b53d147c0fcbe2ae70fbe09446 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Thu, 18 Jun 2020 17:17:19 +0200 +Subject: s390/setup: init jump labels before command line parsing + +From: Vasily Gorbik + +commit 95e61b1b5d6394b53d147c0fcbe2ae70fbe09446 upstream. + +Command line parameters might set static keys. This is true for s390 at +least since commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 +and init_on_free=1 boot options"). To avoid the following WARN: + +static_key_enable_cpuslocked(): static key 'init_on_alloc+0x0/0x40' used +before call to jump_label_init() + +call jump_label_init() just before parse_early_param(). +jump_label_init() is safe to call multiple times (x86 does that), doesn't +do any memory allocations and hence should be safe to call that early. + +Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") +Cc: # 5.3: d6df52e9996d: s390/maccess: add no DAT mode to kernel_write +Cc: # 5.3 +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -1107,6 +1107,7 @@ void __init setup_arch(char **cmdline_p) + if (IS_ENABLED(CONFIG_EXPOLINE_AUTO)) + nospec_auto_detect(); + ++ jump_label_init(); + parse_early_param(); + #ifdef CONFIG_CRASH_DUMP + /* Deactivate elfcorehdr= kernel parameter */ diff --git a/queue-5.7/series b/queue-5.7/series index 9a9f45dcaff..4d46179e817 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -131,3 +131,36 @@ module-do-not-expose-section-addresses-to-non-cap_syslog.patch kprobes-do-not-expose-probe-addresses-to-non-cap_syslog.patch bpf-check-correct-cred-for-cap_syslog-in-bpf_dump_raw_ok.patch revert-ath9k-fix-general-protection-fault-in-ath9k_hif_usb_rx_cb.patch +btrfs-fix-fatal-extent_buffer-readahead-vs-releasepage-race.patch +btrfs-reset-tree-root-pointer-after-error-in-init_tree_roots.patch +btrfs-discard-add-missing-put-when-grabbing-block-group-from-unused-list.patch +btrfs-fix-double-put-of-block-group-with-nocow.patch +drm-radeon-fix-double-free.patch +drm-i915-gt-pin-the-rings-before-marking-active.patch +drm-i915-skip-stale-object-handle-for-debugfs-per-file-stats.patch +drm-amdgpu-don-t-do-soft-recovery-if-gpu_recovery-0.patch +drm-amdgpu-add-tmr-destory-function-for-psp.patch +drm-amdgpu-asd-function-needs-to-be-unloaded-in-suspend-phase.patch +drm-i915-drop-vm.ref-for-duplicate-vma-on-construction.patch +drm-i915-also-drop-vm.ref-along-error-paths-for-vma-construction.patch +cifs-fix-reference-leak-for-tlink.patch +smb3-fix-access-denied-on-change-notify-request-to-some-servers.patch +smb3-fix-unneeded-error-message-on-change-notify.patch +dm-use-noio-when-sending-kobject-event.patch +mmc-meson-gx-limit-segments-to-1-when-dram-access-quirk-is-needed.patch +mmc-owl-mmc-get-rid-of-of_match_ptr-macro.patch +pinctrl-baytrail-fix-pin-being-driven-low-for-a-while-on-gpiod_get-...-gpiod_out_high.patch +arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch +arc-elf-use-right-elf_arch.patch +s390-setup-init-jump-labels-before-command-line-parsing.patch +s390-mm-fix-huge-pte-soft-dirty-copying.patch +arm64-introduce-a-way-to-disable-the-32bit-vdso.patch +arm64-arch_timer-allow-an-workaround-descriptor-to-disable-compat-vdso.patch +arm64-arch_timer-disable-the-compat-vdso-for-cores-affected-by-arm64_workaround_1418040.patch +blk-mq-consider-non-idle-request-as-inflight-in-blk_mq_rq_inflight.patch +dm-writecache-reject-asynchronous-pmem-devices.patch +perf-scripts-python-export-to-postgresql.py-fix-struct.pack-int-argument.patch +perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-graph-find-result.patch +perf-scripts-python-exported-sql-viewer.py-fix-zero-id-in-call-tree-find-result.patch +perf-scripts-python-exported-sql-viewer.py-fix-unexpanded-find-result.patch +perf-scripts-python-exported-sql-viewer.py-fix-time-chart-call-tree.patch diff --git a/queue-5.7/smb3-fix-access-denied-on-change-notify-request-to-some-servers.patch b/queue-5.7/smb3-fix-access-denied-on-change-notify-request-to-some-servers.patch new file mode 100644 index 00000000000..43d8f00b920 --- /dev/null +++ b/queue-5.7/smb3-fix-access-denied-on-change-notify-request-to-some-servers.patch @@ -0,0 +1,34 @@ +From 4ef9b4f1a76ea2370fbfe20e80fef141ab92b65e Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Tue, 7 Jul 2020 18:08:46 -0500 +Subject: smb3: fix access denied on change notify request to some servers + +From: Steve French + +commit 4ef9b4f1a76ea2370fbfe20e80fef141ab92b65e upstream. + +read permission, not just read attributes permission, is required +on the directory. + +See MS-SMB2 (protocol specification) section 3.3.5.19. + +Signed-off-by: Steve French +CC: Stable # v5.6+ +Reviewed-by: Pavel Shilovsky +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -2119,7 +2119,7 @@ smb3_notify(const unsigned int xid, stru + + tcon = cifs_sb_master_tcon(cifs_sb); + oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; ++ oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; + oparms.disposition = FILE_OPEN; + oparms.create_options = cifs_create_options(cifs_sb, 0); + oparms.fid = &fid; diff --git a/queue-5.7/smb3-fix-unneeded-error-message-on-change-notify.patch b/queue-5.7/smb3-fix-unneeded-error-message-on-change-notify.patch new file mode 100644 index 00000000000..316c392646a --- /dev/null +++ b/queue-5.7/smb3-fix-unneeded-error-message-on-change-notify.patch @@ -0,0 +1,38 @@ +From 8668115cf2db40e22e7be02652a3673d8d30c9f0 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Tue, 7 Jul 2020 23:43:39 -0500 +Subject: smb3: fix unneeded error message on change notify + +From: Steve French + +commit 8668115cf2db40e22e7be02652a3673d8d30c9f0 upstream. + +We should not be logging a warning repeatedly on change notify. + +CC: Stable # v5.6+ +Signed-off-by: Steve French +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2misc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -354,9 +354,13 @@ smb2_get_data_area_len(int *off, int *le + ((struct smb2_ioctl_rsp *)shdr)->OutputCount); + break; + case SMB2_CHANGE_NOTIFY: ++ *off = le16_to_cpu( ++ ((struct smb2_change_notify_rsp *)shdr)->OutputBufferOffset); ++ *len = le32_to_cpu( ++ ((struct smb2_change_notify_rsp *)shdr)->OutputBufferLength); ++ break; + default: +- /* BB FIXME for unimplemented cases above */ +- cifs_dbg(VFS, "no length check for command\n"); ++ cifs_dbg(VFS, "no length check for command %d\n", le16_to_cpu(shdr->Command)); + break; + } +