From: Sasha Levin Date: Mon, 23 Nov 2020 03:05:55 +0000 (-0500) Subject: Fixes for 5.9 X-Git-Tag: v4.4.246~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59f2050cbf6297136118894208c3f6ef5ee897b5;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.9 Signed-off-by: Sasha Levin --- diff --git a/queue-5.9/afs-fix-speculative-status-fetch-going-out-of-order-.patch b/queue-5.9/afs-fix-speculative-status-fetch-going-out-of-order-.patch new file mode 100644 index 00000000000..1a5a8d53e5f --- /dev/null +++ b/queue-5.9/afs-fix-speculative-status-fetch-going-out-of-order-.patch @@ -0,0 +1,113 @@ +From 56a608c84ca59a5a66106fee30d80ea9622bef5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Nov 2020 13:13:45 +0000 +Subject: afs: Fix speculative status fetch going out of order wrt to + modifications + +From: David Howells + +[ Upstream commit a9e5c87ca7443d09fb530fffa4d96ce1c76dbe4d ] + +When doing a lookup in a directory, the afs filesystem uses a bulk +status fetch to speculatively retrieve the statuses of up to 48 other +vnodes found in the same directory and it will then either update extant +inodes or create new ones - effectively doing 'lookup ahead'. + +To avoid the possibility of deadlocking itself, however, the filesystem +doesn't lock all of those inodes; rather just the directory inode is +locked (by the VFS). + +When the operation completes, afs_inode_init_from_status() or +afs_apply_status() is called, depending on whether the inode already +exists, to commit the new status. + +A case exists, however, where the speculative status fetch operation may +straddle a modification operation on one of those vnodes. What can then +happen is that the speculative bulk status RPC retrieves the old status, +and whilst that is happening, the modification happens - which returns +an updated status, then the modification status is committed, then we +attempt to commit the speculative status. + +This results in something like the following being seen in dmesg: + + kAFS: vnode modified {100058:861} 8->9 YFS.InlineBulkStatus + +showing that for vnode 861 on volume 100058, we saw YFS.InlineBulkStatus +say that the vnode had data version 8 when we'd already recorded version +9 due to a local modification. This was causing the cache to be +invalidated for that vnode when it shouldn't have been. If it happens +on a data file, this might lead to local changes being lost. + +Fix this by ignoring speculative status updates if the data version +doesn't match the expected value. + +Note that it is possible to get a DV regression if a volume gets +restored from a backup - but we should get a callback break in such a +case that should trigger a recheck anyway. It might be worth checking +the volume creation time in the volsync info and, if a change is +observed in that (as would happen on a restore), invalidate all caches +associated with the volume. + +Fixes: 5cf9dd55a0ec ("afs: Prospectively look up extra files when doing a single lookup") +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 1 + + fs/afs/inode.c | 8 ++++++++ + fs/afs/internal.h | 1 + + 3 files changed, 10 insertions(+) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 1bb5b9d7f0a2c..9068d5578a26f 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -823,6 +823,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry, + vp->cb_break_before = afs_calc_vnode_cb_break(vnode); + vp->vnode = vnode; + vp->put_vnode = true; ++ vp->speculative = true; /* vnode not locked */ + } + } + } +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 0fe8844b4bee2..b0d7b892090da 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -294,6 +294,13 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v + op->flags &= ~AFS_OPERATION_DIR_CONFLICT; + } + } else if (vp->scb.have_status) { ++ if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version && ++ vp->speculative) ++ /* Ignore the result of a speculative bulk status fetch ++ * if it splits around a modification op, thereby ++ * appearing to regress the data version. ++ */ ++ goto out; + afs_apply_status(op, vp); + if (vp->scb.have_cb) + afs_apply_callback(op, vp); +@@ -305,6 +312,7 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v + } + } + ++out: + write_sequnlock(&vnode->cb_lock); + + if (vp->scb.have_status) +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 17336cbb8419f..932f501888e73 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -754,6 +754,7 @@ struct afs_vnode_param { + bool update_ctime:1; /* Need to update the ctime */ + bool set_size:1; /* Must update i_size */ + bool op_unlinked:1; /* True if file was unlinked by op */ ++ bool speculative:1; /* T if speculative status fetch (no vnode lock) */ + }; + + /* +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch b/queue-5.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch new file mode 100644 index 00000000000..87e69e0dec6 --- /dev/null +++ b/queue-5.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch @@ -0,0 +1,43 @@ +From 8103c28cf214eab52511254c153a692820bed728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:13:20 -0300 +Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX + +From: Fabio Estevam + +[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ] + +The SPI chip selects are represented as: + +cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>; + +, which means that they are used in GPIO function instead of native +SPI mode. + +Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of +the native CSPI_SSI function. + +Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx50-evk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts +index a25da415cb02e..907339bc81e54 100644 +--- a/arch/arm/boot/dts/imx50-evk.dts ++++ b/arch/arm/boot/dts/imx50-evk.dts +@@ -59,7 +59,7 @@ + MX50_PAD_CSPI_MISO__CSPI_MISO 0x00 + MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00 + MX50_PAD_CSPI_SS0__GPIO4_11 0xc4 +- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4 ++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84 + >; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-imx6q-prti6q-fix-phy-address.patch b/queue-5.9/arm-dts-imx6q-prti6q-fix-phy-address.patch new file mode 100644 index 00000000000..ced9c951939 --- /dev/null +++ b/queue-5.9/arm-dts-imx6q-prti6q-fix-phy-address.patch @@ -0,0 +1,56 @@ +From c94bf8c2c5142023afb25c2520851d63ae94079f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 09:18:16 +0200 +Subject: ARM: dts: imx6q-prti6q: fix PHY address + +From: Oleksij Rempel + +[ Upstream commit e402599e5e5e0b2758d7766fd9f6d7953d4ccd85 ] + +Due to bug in the bootloader, the PHY has floating address and may +randomly change on each PHY reset. To avoid it, the updated bootloader +with the following patch[0] should be used: + +| ARM: protonic: disable on-die termination to fix PHY bootstrapping +| +| If on-die termination is enabled, the RXC pin of iMX6 will be pulled +| high. Since we already have an 10K pull-down on board, the RXC level on +| PHY reset will be ~800mV, which is mostly interpreted as 1. On some +| reboots we get 0 instead and kernel can't detect the PHY properly. +| +| Since the default 0x020e07ac value is 0, it is sufficient to remove this +| entry from the affected imxcfg files. +| +| Since we get stable 0 on pin PHYADDR[2], the PHY address is changed from +| 4 to 0. + +With latest bootloader update, the PHY address will be fixed to "0". + +[0] https://git.pengutronix.de/cgit/barebox/commit/?id=93f7dcf631edfcda19e7757b28d66017ea274b81 + +Fixes: 0d446a505592 ("ARM: dts: add Protonic PRTI6Q board") +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-prti6q.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6q-prti6q.dts b/arch/arm/boot/dts/imx6q-prti6q.dts +index de6cbaab8b499..671bb3a6665d8 100644 +--- a/arch/arm/boot/dts/imx6q-prti6q.dts ++++ b/arch/arm/boot/dts/imx6q-prti6q.dts +@@ -213,8 +213,8 @@ + #size-cells = <0>; + + /* Microchip KSZ9031RNX PHY */ +- rgmii_phy: ethernet-phy@4 { +- reg = <4>; ++ rgmii_phy: ethernet-phy@0 { ++ reg = <0>; + interrupts-extended = <&gpio1 28 IRQ_TYPE_LEVEL_LOW>; + reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-assert-us = <10000>; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch b/queue-5.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch new file mode 100644 index 00000000000..93dcd23994f --- /dev/null +++ b/queue-5.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch @@ -0,0 +1,39 @@ +From 80269c2a63a6710c9cbe19e369e497043d42c951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Oct 2020 23:11:20 +0300 +Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy + +From: Sergey Matyukevich + +[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ] + +Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the +KSZ9031 PHY") fixed micrel phy driver adding proper support for phy +modes. Adapt imx6q-udoo board phy settings : explicitly set required +delay configuration using "rgmii-id". + +Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo") +Signed-off-by: Sergey Matyukevich +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +index 828dd20cd27d2..d07d8f83456d2 100644 +--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +@@ -98,7 +98,7 @@ + &fec { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-stm32-define-vio-regulator-supply-on-dhcom.patch b/queue-5.9/arm-dts-stm32-define-vio-regulator-supply-on-dhcom.patch new file mode 100644 index 00000000000..f102fb95e00 --- /dev/null +++ b/queue-5.9/arm-dts-stm32-define-vio-regulator-supply-on-dhcom.patch @@ -0,0 +1,40 @@ +From 11ed64b7c551b096fd90f5a26d8426d1524e70fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 20:46:17 +0100 +Subject: ARM: dts: stm32: Define VIO regulator supply on DHCOM + +From: Marek Vasut + +[ Upstream commit 1f3d7fc279b1a299bb8b1b225d80309a2062ab8a ] + +The VIO regulator is supplied by PMIC Buck3, describe this in the DT. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index a87ebc4843963..6c3920cd5419b 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -68,6 +68,7 @@ + gpio = <&gpiog 3 GPIO_ACTIVE_LOW>; + regulator-always-on; + regulator-boot-on; ++ vin-supply = <&vdd>; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-stm32-enable-thermal-sensor-support-on-stm32.patch b/queue-5.9/arm-dts-stm32-enable-thermal-sensor-support-on-stm32.patch new file mode 100644 index 00000000000..a3955c22ef4 --- /dev/null +++ b/queue-5.9/arm-dts-stm32-enable-thermal-sensor-support-on-stm32.patch @@ -0,0 +1,42 @@ +From e6408b83f23ad71c597cfd43bdc0e5223fa01346 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 01:25:35 +0200 +Subject: ARM: dts: stm32: Enable thermal sensor support on stm32mp15xx-dhcor + +From: Marek Vasut + +[ Upstream commit e5ace7f62695656ef8a66ad5a4c3edd055894876 ] + +Enable STM32 Digital Thermal Sensor driver for stm32mp15xx-dhcor SoMs. + +Fixes: 94cafe1b6482 ("ARM: dts: stm32: Add Avenger96 devicetree support based on STM32MP157A") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Manivannan Sadhasivam +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +index 04fbb324a541f..803eb8bc9c85c 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +@@ -21,6 +21,10 @@ + }; + }; + ++&dts { ++ status = "okay"; ++}; ++ + &i2c4 { + pinctrl-names = "default"; + pinctrl-0 = <&i2c4_pins_a>; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-stm32-fix-led5-on-stm32mp1-dhcom-pdk2.patch b/queue-5.9/arm-dts-stm32-fix-led5-on-stm32mp1-dhcom-pdk2.patch new file mode 100644 index 00000000000..4702f7ba652 --- /dev/null +++ b/queue-5.9/arm-dts-stm32-fix-led5-on-stm32mp1-dhcom-pdk2.patch @@ -0,0 +1,43 @@ +From 3013b006f9998bca7aead34799969cbb88a9854e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 21:46:17 +0100 +Subject: ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2 + +From: Marek Vasut + +[ Upstream commit 7e5f3155dcbb4d724386b30cc232002d9b9d81f5 ] + +On the prototype DHCOM, the LED5 was connected to pin PG2 of the +STM32MP15xx, however on the production SoM this was changed to pin +PC6. Update the connection in the DT. + +Fixes: 81d5fc719798 ("ARM: dts: stm32: Add GPIO LEDs for STM32MP1 DHCOM PDK2") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index 7cddeb1a545a3..13f52b79454e1 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -82,7 +82,7 @@ + + led-0 { + label = "green:led5"; +- gpios = <&gpiog 2 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpioc 6 GPIO_ACTIVE_HIGH>; + default-state = "off"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-stm32-fix-ta3-gpio-c-key-on-stm32mp1-dhcom-p.patch b/queue-5.9/arm-dts-stm32-fix-ta3-gpio-c-key-on-stm32mp1-dhcom-p.patch new file mode 100644 index 00000000000..c2199552cb3 --- /dev/null +++ b/queue-5.9/arm-dts-stm32-fix-ta3-gpio-c-key-on-stm32mp1-dhcom-p.patch @@ -0,0 +1,67 @@ +From 76dc2697b180366d29fd2e35dae4f8110bad2a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 21:35:38 +0200 +Subject: ARM: dts: stm32: Fix TA3-GPIO-C key on STM32MP1 DHCOM PDK2 + +From: Marek Vasut + +[ Upstream commit 52d9edbe6efc5042cf57fae6a25d07572ddf398b ] + +On the prototype DHCOM, the TA3-GPIO-C button was connected to pin PI11 of +the STM32MP15xx, however on the production SoM this was changed to pin PG0 +to free up the IRQ line 11 for LAN8710i PHY IRQ. Update the connection in +the DT. Since the IRQ line 0 is used for PMIC as well and cannot be shared +with the button, make the button polled. + +Fixes: 87cabf9405cb ("ARM: dts: stm32: Add GPIO keys for STM32MP1 DHCOM PDK2") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index e4e3c92eb30d3..7cddeb1a545a3 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -46,6 +46,16 @@ + linux,code = ; + gpios = <&gpiof 3 GPIO_ACTIVE_LOW>; + }; ++ ++ /* ++ * The EXTi IRQ line 0 is shared with PMIC, ++ * so mark this as polled GPIO key. ++ */ ++ button-2 { ++ label = "TA3-GPIO-C"; ++ linux,code = ; ++ gpios = <&gpiog 0 GPIO_ACTIVE_LOW>; ++ }; + }; + + gpio-keys { +@@ -59,13 +69,6 @@ + wakeup-source; + }; + +- button-2 { +- label = "TA3-GPIO-C"; +- linux,code = ; +- gpios = <&gpioi 11 GPIO_ACTIVE_LOW>; +- wakeup-source; +- }; +- + button-3 { + label = "TA4-GPIO-D"; + linux,code = ; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-stm32-keep-vdda-ldo1-always-on-on-dhcom.patch b/queue-5.9/arm-dts-stm32-keep-vdda-ldo1-always-on-on-dhcom.patch new file mode 100644 index 00000000000..8172b45cb12 --- /dev/null +++ b/queue-5.9/arm-dts-stm32-keep-vdda-ldo1-always-on-on-dhcom.patch @@ -0,0 +1,42 @@ +From d74ca7a546b3ac40043a743bbdb75587d57199bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 20:46:52 +0100 +Subject: ARM: dts: stm32: Keep VDDA LDO1 always on on DHCOM + +From: Marek Vasut + +[ Upstream commit f4c7fa39415da6db1fa0bc26162ac23a0fbae8bb ] + +The VDDA LDO1 PMIC output supplies the analog VDDA input of the +STM32MP1 on DHCOM, keep it always on, otherwise there could be +leakage through the SoC. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index 6c3920cd5419b..e4804afc90e2f 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -203,6 +203,7 @@ + + vdda: ldo1 { + regulator-name = "vdda"; ++ regulator-always-on; + regulator-min-microvolt = <2900000>; + regulator-max-microvolt = <2900000>; + interrupts = ; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch b/queue-5.9/arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch new file mode 100644 index 00000000000..b60bde21a1a --- /dev/null +++ b/queue-5.9/arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch @@ -0,0 +1,44 @@ +From bae1b33eb909aaac01fc8957828e85d11fe7dd85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:07 +0800 +Subject: ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on + Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit e76724153f5b4539802cc21b2c6131058668a1c6 ] + +The Ethernet PHY on the A31 Hummingbird has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: c220aec2bb79 ("ARM: dts: sun6i: Add Merrii A31 Hummingbird support") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-2-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun6i-a31-hummingbird.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts +index 049e6ab3cf56c..73de34ae37fdc 100644 +--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts ++++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts +@@ -154,7 +154,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch b/queue-5.9/arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch new file mode 100644 index 00000000000..79f81f20bad --- /dev/null +++ b/queue-5.9/arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch @@ -0,0 +1,44 @@ +From 859f19abd7ff5a13a79af6dbb0f0816c57ec816c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:09 +0800 +Subject: ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on + Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit f94f78bd93f567c022f594589dbeecdf59931365 ] + +The Ethernet PHY on the Bananapi M1+ has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 04c85ecad32a ("ARM: dts: sun7i: Add dts file for Bananapi M1 Plus board") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-4-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts +index 32d5d45a35c03..8945dbb114a2a 100644 +--- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts ++++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts +@@ -130,7 +130,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_gmac_3v3>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch b/queue-5.9/arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch new file mode 100644 index 00000000000..12e4c03f5b7 --- /dev/null +++ b/queue-5.9/arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch @@ -0,0 +1,47 @@ +From b37541c1676ee8ba6fd45b87c95fd714a553ae7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:08 +0800 +Subject: ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen-Yu Tsai + +[ Upstream commit 353c3de1303fc93032164402c0eb8550ecd6f154 ] + +The Ethernet PHY on the Cubietruck has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 67073d97672d ("ARM: dts: sun7i: cubietruck: Enable the GMAC") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Emilio López +Reviewed-by: Emilio López +Link: https://lore.kernel.org/r/20201024162515.30032-3-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-cubietruck.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts +index 8c8dee6ea461a..9109ca0919ade 100644 +--- a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts ++++ b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts +@@ -151,7 +151,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch b/queue-5.9/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch new file mode 100644 index 00000000000..bd9283d3184 --- /dev/null +++ b/queue-5.9/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch @@ -0,0 +1,58 @@ +From 096edadadf7e81b34ca106e57d6d0fe6c5f77791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:11 +0800 +Subject: ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit 57dbe558457bf4042169bc1f334e3b53a8480a1c ] + +The Ethernet PHY on the Bananapi M3 and Cubietruck Plus have the RX +and TX delays enabled on the PHY, using pull-ups on the RXDLY and +TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 039359948a4b ("ARM: dts: sun8i: a83t: Enable Ethernet on two boards") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-6-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +- + arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts +index 9d34eabba1213..431f70234d364 100644 +--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts ++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts +@@ -131,7 +131,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_sw>; + phy-handle = <&rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + allwinner,rx-delay-ps = <700>; + allwinner,tx-delay-ps = <700>; + status = "okay"; +diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +index d9be511f054f0..d8326a5c681d4 100644 +--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts ++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +@@ -183,7 +183,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_dldo4>; + phy-handle = <&rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch b/queue-5.9/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch new file mode 100644 index 00000000000..edbf4f1a0bd --- /dev/null +++ b/queue-5.9/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch @@ -0,0 +1,46 @@ +From cfbd4fdb01d08c074df98323890de1525d8bdfd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:10 +0800 +Subject: ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on + Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit e080ab31a0aa126b0a7e4f67f2b01b371b852c88 ] + +The Ethernet PHY on the Orange Pi Plus 2E has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)") +Fixes: 7a78ef92cdc5 ("ARM: sun8i: h3: Enable EMAC with external PHY on Orange Pi Plus 2E") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Jernej Skrabec +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-5-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts +index 6dbf7b2e0c13c..b6ca45d18e511 100644 +--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts ++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts +@@ -67,7 +67,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch b/queue-5.9/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch new file mode 100644 index 00000000000..b9c3f2dd442 --- /dev/null +++ b/queue-5.9/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch @@ -0,0 +1,37 @@ +From c0978125f28d90d63bf0b3b19eae4f97b47589ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 09:19:49 +0100 +Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit b3eec3212e66ece33f69be0de98d54e67834e798 ] + +Ethernet PHY on BananaPi M2 Ultra provides RX and TX delays. Fix +ethernet node to reflect that fact. + +Fixes: c36fd5a48bd2 ("ARM: dts: sun8i: r40: bananapi-m2-ultra: Enable GMAC ethernet controller") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201025081949.783443-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +index ea15073f0c79c..7db89500f399c 100644 +--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts ++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +@@ -129,7 +129,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_dc1sw>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch b/queue-5.9/arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch new file mode 100644 index 00000000000..d8d81e04cb5 --- /dev/null +++ b/queue-5.9/arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch @@ -0,0 +1,59 @@ +From f25f57fc1de88f8f7e23394620323372f09d06c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:12 +0800 +Subject: ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit b1064037e8ecf09d587b7b4966eebe0c362908e5 ] + +The Ethernet PHY on the Cubieboard 4 and A80 Optimus have the RX +and TX delays enabled on the PHY, using pull-ups on the RXDLY and +TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 98048143b7f8 ("ARM: dts: sun9i: cubieboard4: Enable GMAC") +Fixes: bc9bd03a44f9 ("ARM: dts: sun9i: a80-optimus: Enable GMAC") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-7-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 2 +- + arch/arm/boot/dts/sun9i-a80-optimus.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +index d3b337b043a15..484b93df20cb6 100644 +--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts ++++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +@@ -129,7 +129,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_cldo1>; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts +index bbc6335e56314..5c3580d712e40 100644 +--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts ++++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts +@@ -124,7 +124,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_cldo1>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch b/queue-5.9/arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch new file mode 100644 index 00000000000..aab32d08fea --- /dev/null +++ b/queue-5.9/arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch @@ -0,0 +1,47 @@ +From 706f240de05c3658056715eda27eac1c598edb51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:13 +0800 +Subject: ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on + Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit 3914160ffc0bf762d6d605d4b27036b7b89367ea ] + +The Ethernet PHY on the Bananapi M2+ has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 8c7ba536e709 ("ARM: sun8i: bananapi-m2-plus: Enable dwmac-sun8i") +Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)") +Fixes: aa8fee415f46 ("ARM: dts: sun8i: h3: Split out non-SoC-specific parts of Bananapi M2 Plus") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Jernej Skrabec +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-8-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi +index 39263e74fbb53..8e5cb3b3fd686 100644 +--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi ++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi +@@ -126,7 +126,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm-dts-vf610-zii-dev-rev-b-fix-mdio-over-clocking.patch b/queue-5.9/arm-dts-vf610-zii-dev-rev-b-fix-mdio-over-clocking.patch new file mode 100644 index 00000000000..f84c14c7eaa --- /dev/null +++ b/queue-5.9/arm-dts-vf610-zii-dev-rev-b-fix-mdio-over-clocking.patch @@ -0,0 +1,42 @@ +From 5c7c5c7877f8838b1cbc3fe5446f7676d35a3fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 01:55:28 +0100 +Subject: ARM: dts: vf610-zii-dev-rev-b: Fix MDIO over clocking + +From: Andrew Lunn + +[ Upstream commit f8b5a33707c9a19ec905d2826be0acd151997a09 ] + +The ZII devel B board has two generations of Marvell Switches. The +mv88e6352 supports an MDIO clock of 12MHz. However the older 88e6185 +does not like 12MHz, and often fails to probe. + +Reduce the clock speed to 5MHz, which seems to work reliably. + +Cc: Chris Healy +Fixes: b955387667ec ("ARM: dts: ZII: update MDIO speed and preamble") +Signed-off-by: Andrew Lunn +Reviewed-by: Chris Healy +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/vf610-zii-dev-rev-b.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts +index e500911ce0a59..6f1e0f0d4f0ae 100644 +--- a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts ++++ b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts +@@ -406,6 +406,9 @@ + }; + }; + ++&mdio1 { ++ clock-frequency = <5000000>; ++}; + + &iomuxc { + pinctrl_gpio_e6185_eeprom_sel: pinctrl-gpio-e6185-eeprom-spi0 { +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch b/queue-5.9/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch new file mode 100644 index 00000000000..f7c18de1f2a --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch @@ -0,0 +1,46 @@ +From 043394efe2d466c65fbd9403748bf0e36354bbd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:15 +0800 +Subject: arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on + PHY + +From: Chen-Yu Tsai + +[ Upstream commit 1a9a8910b2153cd3c4f3f2f8defcb853ead3b1fd ] + +The Ethernet PHY on the Bananapi M64 has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: e7295499903d ("arm64: allwinner: bananapi-m64: Enable dwmac-sun8i") +Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Corentin Labbe +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-10-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts +index 883f217efb812..5dd81e9239a7a 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts +@@ -105,7 +105,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <&ext_rgmii_phy>; + phy-supply = <®_dc1sw>; + status = "okay"; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch b/queue-5.9/arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch new file mode 100644 index 00000000000..bdbfad541d2 --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch @@ -0,0 +1,37 @@ +From e2e5784b154fe72ab3f8173fcf0acb0565ee4770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 20:58:39 +0200 +Subject: arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit d7cdff444579e6659459b2fe04340ebb27628d5e ] + +RX/TX delay on OrangePi Win board is set on PHY. Reflect that in +ethernet node. + +Fixes: 93d6a27cfcc0 ("arm64: dts: allwinner: a64: Orange Pi Win: Add Ethernet node") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201022185839.2779245-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +index fde9c7a99b17e..cc1723a16cf75 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +@@ -120,7 +120,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <&ext_rgmii_phy>; + phy-supply = <®_gmac_3v3>; + status = "okay"; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch b/queue-5.9/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch new file mode 100644 index 00000000000..9577b50e72f --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch @@ -0,0 +1,42 @@ +From ca4ac98ffdd8ec08b85bda46e049b7c40fbb86e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 23:13:01 +0200 +Subject: arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit 927f42fcc1b4f7d04a2ac5cf02f25612aa8923a4 ] + +According to board schematic, PHY provides both, RX and TX delays. +However, according to "fix" Realtek provided for this board, only TX +delay should be provided by PHY. +Tests show that both variants work but TX only PHY delay works +slightly better. + +Update ethernet node to reflect the fact that PHY provides TX delay. + +Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201022211301.3548422-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts +index b26181cf9095a..b54099b654c8a 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts +@@ -13,7 +13,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-txid"; + phy-handle = <&ext_rgmii_phy>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch b/queue-5.9/arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch new file mode 100644 index 00000000000..4f4f88f02f7 --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch @@ -0,0 +1,50 @@ +From 77bef90500440461668855f37cb790f82dbf14c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Oct 2020 19:24:09 +0200 +Subject: arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Péron + +[ Upstream commit 97a38c1c213b162aa577299de698f39c18ba696b ] + +Before the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the software overwrite for RX/TX delays of the RTL8211e +were not working properly and the Beelink GS1 had both RX/TX delay of RGMII +interface set using pull-up on the TXDLY and RXDLY pins. + +Now that these delays are working properly they overwrite the HW +config and set this to 'rgmii' meaning no delay on both RX/TX. +This makes the ethernet of this board not working anymore. + +Set the phy-mode to 'rgmii-id' meaning RGMII with RX/TX delays +in the device-tree to keep the correct configuration. + +Fixes: 089bee8dd119 ("arm64: dts: allwinner: h6: Introduce Beelink GS1 board") +Signed-off-by: Clément Péron +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20201018172409.1754775-1-peron.clem@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +index 3f7ceeb1a767a..7c9dbde645b52 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +@@ -97,7 +97,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&ext_rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <&ext_rgmii_phy>; + phy-supply = <®_aldo2>; + status = "okay"; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-h5-libretech-all-h5-cc-enable-rg.patch b/queue-5.9/arm64-dts-allwinner-h5-libretech-all-h5-cc-enable-rg.patch new file mode 100644 index 00000000000..d348ffd386a --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-h5-libretech-all-h5-cc-enable-rg.patch @@ -0,0 +1,44 @@ +From 4994fe5fcbccbd2a3fd34afd40b503692b259967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:14 +0800 +Subject: arm64: dts: allwinner: h5: libretech-all-h5-cc: Enable RGMII RX/TX + delay on PHY + +From: Chen-Yu Tsai + +[ Upstream commit 2bd8570d20c88909b8be3251727a26476b02652c ] + +The Ethernet PHY on the Libre Computer ALL-H5-CC has the RX and TX +delays enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 60d0426d7603 ("arm64: dts: allwinner: h5: Add Libre Computer ALL-H5-CC H5 board") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-9-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts +index df1b9263ad0e2..6e30a564c87f6 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts +@@ -36,7 +36,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + /delete-property/ allwinner,leds-active-low; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch b/queue-5.9/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch new file mode 100644 index 00000000000..b11704d8f00 --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch @@ -0,0 +1,37 @@ +From 2ed9c7520005d08bebd12d224f256fe89a2927bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 20:48:58 +0200 +Subject: arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit b34bf9f6a623ddb82600a5ed5c644224122395e1 ] + +RX and TX delay are provided by ethernet PHY. Reflect that in ethernet +node. + +Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201023184858.3272918-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts +index 7d7aad18f078b..8bf2db9dcbda0 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts +@@ -123,7 +123,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch b/queue-5.9/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch new file mode 100644 index 00000000000..95e9b7e4e71 --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch @@ -0,0 +1,38 @@ +From b116a6100d55d6e03599c05840bf6eac4f8639af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 12:58:17 +0100 +Subject: arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node + +From: Nenad Peric + +[ Upstream commit 107954afc5df667da438644aa4982606663f9b17 ] + +RX and TX delay are provided by ethernet PHY. Reflect that in ethernet +node. + +Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes") +Signed-off-by: Nenad Peric +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201028115817.68113-1-nperic@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts +index cb44bfa5981fd..33ab44072e6d7 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts +@@ -124,7 +124,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch b/queue-5.9/arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch new file mode 100644 index 00000000000..40d9d3b58d9 --- /dev/null +++ b/queue-5.9/arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch @@ -0,0 +1,39 @@ +From 7100138e27abae2e7691577a194a8ff7550c9667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 06:34:49 +0000 +Subject: arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay + +From: Corentin Labbe + +[ Upstream commit 419c65f5000a6c25597ea52488528d75b287cbd0 ] + +Since commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"), +the network is unusable on PineH64 model A. + +This is due to phy-mode incorrectly set to rgmii instead of rgmii-id. + +Fixes: 729e1ffcf47e ("arm64: allwinner: h6: add support for the Ethernet on Pine H64") +Signed-off-by: Corentin Labbe +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201019063449.33316-1-clabbe@baylibre.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts +index af85b2074867f..961732c52aa0e 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts +@@ -100,7 +100,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&ext_rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <&ext_rgmii_phy>; + phy-supply = <®_gmac_3v3>; + allwinner,rx-delay-ps = <200>; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-fsl-fix-endianness-issue-of-rcpm.patch b/queue-5.9/arm64-dts-fsl-fix-endianness-issue-of-rcpm.patch new file mode 100644 index 00000000000..bd9212a508c --- /dev/null +++ b/queue-5.9/arm64-dts-fsl-fix-endianness-issue-of-rcpm.patch @@ -0,0 +1,68 @@ +From 0138e7d4df1f9f0bff6881fee210daf417dc9dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 09:30:21 +0800 +Subject: arm64: dts: fsl: fix endianness issue of rcpm +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Biwen Li + +[ Upstream commit d92454287ee25d78f1caac3734a1864f8a5a5275 ] + +Add little-endian property to RCPM node (for ls1028a,ls1088a,ls208xa), +otherwise RCPM driver will program hardware with incorrect setting, +causing system (such as LS1028ARDB) failed to be waked by wakeup source. + +Fixes: 791c88ca5713 (“arm64: dts: ls1028a: Add ftm_alarm0 DT node”) +Fixes: f4fe3a8665495 (“arm64: dts: layerscape: add ftm_alarm0 node”) +Signed-off-by: Biwen Li +Signed-off-by: Ran Wang +Acked-by: Li Yang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 1 + + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 1 + + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 0efeb8fa773e7..651bfe1040ba3 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -1012,6 +1012,7 @@ + compatible = "fsl,ls1028a-rcpm", "fsl,qoriq-rcpm-2.1+"; + reg = <0x0 0x1e34040 0x0 0x1c>; + #fsl,rcpm-wakeup-cells = <7>; ++ little-endian; + }; + + ftm_alarm0: timer@2800000 { +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index 169f4742ae3b2..2ef812dd29ebc 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -787,6 +787,7 @@ + compatible = "fsl,ls1088a-rcpm", "fsl,qoriq-rcpm-2.1+"; + reg = <0x0 0x1e34040 0x0 0x18>; + #fsl,rcpm-wakeup-cells = <6>; ++ little-endian; + }; + + ftm_alarm0: timer@2800000 { +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index 41102dacc2e10..141b3d23b1552 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -769,6 +769,7 @@ + compatible = "fsl,ls208xa-rcpm", "fsl,qoriq-rcpm-2.1+"; + reg = <0x0 0x1e34040 0x0 0x18>; + #fsl,rcpm-wakeup-cells = <6>; ++ little-endian; + }; + + ftm_alarm0: timer@2800000 { +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-imx8mm-beacon-som-fix-choppy-bt-audio.patch b/queue-5.9/arm64-dts-imx8mm-beacon-som-fix-choppy-bt-audio.patch new file mode 100644 index 00000000000..3700faf11a4 --- /dev/null +++ b/queue-5.9/arm64-dts-imx8mm-beacon-som-fix-choppy-bt-audio.patch @@ -0,0 +1,40 @@ +From e8904f8a0a987fe9700873262ba074ffd77ce4da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 08:02:37 -0500 +Subject: arm64: dts: imx8mm-beacon-som: Fix Choppy BT audio + +From: Adam Ford + +[ Upstream commit 587258edd94c305077923ec458e04c032fca83e6 ] + +When streaming bluetooth audio, the sound is choppy due to the +fact that the default baud rate of the HCI interface is too slow +to handle 16-bit stereo at 48KHz. + +The Bluetooth chip is capable of up to 4M baud on the serial port, +so this patch sets the max-speed to 4000000 in order to properly +stream audio over the Bluetooth. + +Fixes: 593816fa2f35 ("arm64: dts: imx: Add Beacon i.MX8m-Mini development kit") +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +index 94911b1707ef2..09d757b3e3ce6 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +@@ -210,6 +210,7 @@ + host-wakeup-gpios = <&gpio2 8 GPIO_ACTIVE_HIGH>; + device-wakeup-gpios = <&gpio2 7 GPIO_ACTIVE_HIGH>; + clocks = <&osc_32k>; ++ max-speed = <4000000>; + clock-names = "extclk"; + }; + }; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch b/queue-5.9/arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch new file mode 100644 index 00000000000..125a92f6fc5 --- /dev/null +++ b/queue-5.9/arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch @@ -0,0 +1,38 @@ +From fe91ca81eda1b1ef29ff7b8733fd72ad6e91461c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:06:12 +0100 +Subject: arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point + +From: Lucas Stach + +[ Upstream commit d19d2152ca055baf20339cfacbf039c2cfb8d936 ] + +The datasheet for both the industrial and consumer variant of the +SoC lists a typical voltage of 0.95V for the 1.6GHz CPU operating +point. + +Fixes: e85c9d0faa75 (arm64: dts: imx8mm: Add cpufreq properties) +Signed-off-by: Lucas Stach +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 76f040e4be5e9..7cc2a810831ab 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -129,7 +129,7 @@ + + opp-1600000000 { + opp-hz = /bits/ 64 <1600000000>; +- opp-microvolt = <900000>; ++ opp-microvolt = <950000>; + opp-supported-hw = <0xc>, <0x7>; + clock-latency-ns = <150000>; + opp-suspend; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch b/queue-5.9/arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch new file mode 100644 index 00000000000..1ff0760f5cb --- /dev/null +++ b/queue-5.9/arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch @@ -0,0 +1,73 @@ +From 169337e339c02f668f1282577b19f98d0b285ad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 13:33:00 -0500 +Subject: arm64: dts imx8mn: Remove non-existent USB OTG2 + +From: Adam Ford + +[ Upstream commit cf5abb0132193767c07c83e06f91b777d22ba495 ] + +According to the i.MX8MN TRM, there is only one OTG port. The +address for OTG2 is reserved on Nano. + +This patch removes the non-existent OTG2, usbphynop2, and the usbmisc2 +nodes. + +Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support") +Signed-off-by: Adam Ford +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 30 ----------------------- + 1 file changed, 30 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index 9385dd7d1a2f7..b05f60503d45a 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -789,28 +789,6 @@ + #index-cells = <1>; + reg = <0x32e40200 0x200>; + }; +- +- usbotg2: usb@32e50000 { +- compatible = "fsl,imx8mn-usb", "fsl,imx7d-usb"; +- reg = <0x32e50000 0x200>; +- interrupts = ; +- clocks = <&clk IMX8MN_CLK_USB1_CTRL_ROOT>; +- clock-names = "usb1_ctrl_root_clk"; +- assigned-clocks = <&clk IMX8MN_CLK_USB_BUS>, +- <&clk IMX8MN_CLK_USB_CORE_REF>; +- assigned-clock-parents = <&clk IMX8MN_SYS_PLL2_500M>, +- <&clk IMX8MN_SYS_PLL1_100M>; +- fsl,usbphy = <&usbphynop2>; +- fsl,usbmisc = <&usbmisc2 0>; +- status = "disabled"; +- }; +- +- usbmisc2: usbmisc@32e50200 { +- compatible = "fsl,imx8mn-usbmisc", "fsl,imx7d-usbmisc"; +- #index-cells = <1>; +- reg = <0x32e50200 0x200>; +- }; +- + }; + + dma_apbh: dma-controller@33000000 { +@@ -875,12 +853,4 @@ + assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>; + clock-names = "main_clk"; + }; +- +- usbphynop2: usbphynop2 { +- compatible = "usb-nop-xceiv"; +- clocks = <&clk IMX8MN_CLK_USB_PHY_REF>; +- assigned-clocks = <&clk IMX8MN_CLK_USB_PHY_REF>; +- assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>; +- clock-names = "main_clk"; +- }; + }; +-- +2.27.0 + diff --git a/queue-5.9/asoc-intel-kbl_rt5663_rt5514_max98927-do-not-try-to-.patch b/queue-5.9/asoc-intel-kbl_rt5663_rt5514_max98927-do-not-try-to-.patch new file mode 100644 index 00000000000..68697d5f007 --- /dev/null +++ b/queue-5.9/asoc-intel-kbl_rt5663_rt5514_max98927-do-not-try-to-.patch @@ -0,0 +1,56 @@ +From 6e43053bea3d406b6e265a2d10a6046034e3d7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 12:54:34 -0800 +Subject: ASOC: Intel: kbl_rt5663_rt5514_max98927: Do not try to disable + disabled clock + +From: Guenter Roeck + +[ Upstream commit 879ee8b6f2bae0cc4a25536f8841db1dbc969523 ] + +In kabylake_set_bias_level(), enabling mclk may fail if the clock has +already been enabled by the firmware. Attempts to disable that clock +later will fail with a warning backtrace. + +mclk already disabled +WARNING: CPU: 2 PID: 108 at drivers/clk/clk.c:952 clk_core_disable+0x1b6/0x1cf +... +Call Trace: + clk_disable+0x2d/0x3a + kabylake_set_bias_level+0x72/0xfd [snd_soc_kbl_rt5663_rt5514_max98927] + snd_soc_card_set_bias_level+0x2b/0x6f + snd_soc_dapm_set_bias_level+0xe1/0x209 + dapm_pre_sequence_async+0x63/0x96 + async_run_entry_fn+0x3d/0xd1 + process_one_work+0x2a9/0x526 +... + +Only disable the clock if it has been enabled. + +Fixes: 15747a802075 ("ASoC: eve: implement set_bias_level function for rt5514") +Cc: Brent Lu +Cc: Curtis Malainey +Signed-off-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201111205434.207610-1-linux@roeck-us.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 922cd0176e1ff..f95546c184aae 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -700,6 +700,8 @@ static int kabylake_set_bias_level(struct snd_soc_card *card, + switch (level) { + case SND_SOC_BIAS_PREPARE: + if (dapm->bias_level == SND_SOC_BIAS_ON) { ++ if (!__clk_is_enabled(priv->mclk)) ++ return 0; + dev_dbg(card->dev, "Disable mclk"); + clk_disable_unprepare(priv->mclk); + } else { +-- +2.27.0 + diff --git a/queue-5.9/asoc-intel-kmb-fix-s24_le-configuration.patch b/queue-5.9/asoc-intel-kmb-fix-s24_le-configuration.patch new file mode 100644 index 00000000000..1ca3468b787 --- /dev/null +++ b/queue-5.9/asoc-intel-kmb-fix-s24_le-configuration.patch @@ -0,0 +1,44 @@ +From 45bdd47d54589152e68c72b2c1b6797faa94652b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 14:19:01 +0800 +Subject: ASoC: Intel: KMB: Fix S24_LE configuration + +From: Michael Sit Wei Hong + +[ Upstream commit 1bd7b0fc0165694897b7d2fb39751a07b98f6bf1 ] + +S24_LE is 24 bit audio in 32 bit container configuration +Fixing the configuration to match the data arrangement of +this audio format. + +Fixes: c5477e966728 ("ASoC: Intel: Add KeemBay platform driver") + +Signed-off-by: Michael Sit Wei Hong +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20201116061905.32431-2-michael.wei.hong.sit@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/keembay/kmb_platform.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/keembay/kmb_platform.c b/sound/soc/intel/keembay/kmb_platform.c +index 16f9fc4c663d1..49079da5c4065 100644 +--- a/sound/soc/intel/keembay/kmb_platform.c ++++ b/sound/soc/intel/keembay/kmb_platform.c +@@ -455,9 +455,9 @@ static int kmb_dai_hw_params(struct snd_pcm_substream *substream, + kmb_i2s->xfer_resolution = 0x02; + break; + case SNDRV_PCM_FORMAT_S24_LE: +- config->data_width = 24; +- kmb_i2s->ccr = 0x08; +- kmb_i2s->xfer_resolution = 0x04; ++ config->data_width = 32; ++ kmb_i2s->ccr = 0x14; ++ kmb_i2s->xfer_resolution = 0x05; + break; + case SNDRV_PCM_FORMAT_S32_LE: + config->data_width = 32; +-- +2.27.0 + diff --git a/queue-5.9/asoc-qcom-lpass-platform-fix-memory-leak.patch b/queue-5.9/asoc-qcom-lpass-platform-fix-memory-leak.patch new file mode 100644 index 00000000000..623a8c7b790 --- /dev/null +++ b/queue-5.9/asoc-qcom-lpass-platform-fix-memory-leak.patch @@ -0,0 +1,50 @@ +From 4de35e57db287539e5af71a86dffcbace52ba8ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 10:26:50 +0530 +Subject: ASoC: qcom: lpass-platform: Fix memory leak + +From: Srinivasa Rao Mandadapu + +[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ] + +lpass_pcm_data is not freed in error paths. Free it in +error paths to avoid memory leak. + +Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage") +Signed-off-by: Pavel Machek +Signed-off-by: V Sujith Kumar Reddy +Signed-off-by: Srinivasa Rao Mandadapu +Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-platform.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c +index e62ac7e650785..a1cabcd267b8b 100644 +--- a/sound/soc/qcom/lpass-platform.c ++++ b/sound/soc/qcom/lpass-platform.c +@@ -73,8 +73,10 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component, + else + dma_ch = 0; + +- if (dma_ch < 0) ++ if (dma_ch < 0) { ++ kfree(data); + return dma_ch; ++ } + + drvdata->substream[dma_ch] = substream; + +@@ -95,6 +97,7 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component, + ret = snd_pcm_hw_constraint_integer(runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + if (ret < 0) { ++ kfree(data); + dev_err(soc_runtime->dev, "setting constraints failed: %d\n", + ret); + return -EINVAL; +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch b/queue-5.9/bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch new file mode 100644 index 00000000000..52953c227cf --- /dev/null +++ b/queue-5.9/bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch @@ -0,0 +1,162 @@ +From de66736db60beac6bdf3d3872bd9d294d94b6934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 14:28:46 -0800 +Subject: bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to + self + +From: John Fastabend + +[ Upstream commit 6fa9201a898983da731fca068bb4b5c941537588 ] + +If a socket redirects to itself and it is under memory pressure it is +possible to get a socket stuck so that recv() returns EAGAIN and the +socket can not advance for some time. This happens because when +redirecting a skb to the same socket we received the skb on we first +check if it is OK to enqueue the skb on the receiving socket by checking +memory limits. But, if the skb is itself the object holding the memory +needed to enqueue the skb we will keep retrying from kernel side +and always fail with EAGAIN. Then userspace will get a recv() EAGAIN +error if there are no skbs in the psock ingress queue. This will continue +until either some skbs get kfree'd causing the memory pressure to +reduce far enough that we can enqueue the pending packet or the +socket is destroyed. In some cases its possible to get a socket +stuck for a noticeable amount of time if the socket is only receiving +skbs from sk_skb verdict programs. To reproduce I make the socket +memory limits ridiculously low so sockets are always under memory +pressure. More often though if under memory pressure it looks like +a spurious EAGAIN error on user space side causing userspace to retry +and typically enough has moved on the memory side that it works. + +To fix skip memory checks and skb_orphan if receiving on the same +sock as already assigned. + +For SK_PASS cases this is easy, its always the same socket so we +can just omit the orphan/set_owner pair. + +For backlog cases we need to check skb->sk and decide if the orphan +and set_owner pair are needed. + +Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/160556572660.73229.12566203819812939627.stgit@john-XPS-13-9370 +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 72 +++++++++++++++++++++++++++++++++++------------- + 1 file changed, 53 insertions(+), 19 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 4ac112cc490c5..97f4c11a2ea7a 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -399,38 +399,38 @@ out: + } + EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter); + +-static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) ++static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk, ++ struct sk_buff *skb) + { +- struct sock *sk = psock->sk; +- int copied = 0, num_sge; + struct sk_msg *msg; + + if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) +- return -EAGAIN; ++ return NULL; ++ ++ if (!sk_rmem_schedule(sk, skb, skb->truesize)) ++ return NULL; + + msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC); + if (unlikely(!msg)) +- return -EAGAIN; +- if (!sk_rmem_schedule(sk, skb, skb->truesize)) { +- kfree(msg); +- return -EAGAIN; +- } ++ return NULL; + + sk_msg_init(msg); +- num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len); ++ return msg; ++} ++ ++static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, ++ struct sk_psock *psock, ++ struct sock *sk, ++ struct sk_msg *msg) ++{ ++ int num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len); ++ int copied; ++ + if (unlikely(num_sge < 0)) { + kfree(msg); + return num_sge; + } + +- /* This will transition ownership of the data from the socket where +- * the BPF program was run initiating the redirect to the socket +- * we will eventually receive this data on. The data will be released +- * from skb_consume found in __tcp_bpf_recvmsg() after its been copied +- * into user buffers. +- */ +- skb_set_owner_r(skb, sk); +- + copied = skb->len; + msg->sg.start = 0; + msg->sg.size = copied; +@@ -442,6 +442,40 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) + return copied; + } + ++static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) ++{ ++ struct sock *sk = psock->sk; ++ struct sk_msg *msg; ++ ++ msg = sk_psock_create_ingress_msg(sk, skb); ++ if (!msg) ++ return -EAGAIN; ++ ++ /* This will transition ownership of the data from the socket where ++ * the BPF program was run initiating the redirect to the socket ++ * we will eventually receive this data on. The data will be released ++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied ++ * into user buffers. ++ */ ++ skb_set_owner_r(skb, sk); ++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg); ++} ++ ++/* Puts an skb on the ingress queue of the socket already assigned to the ++ * skb. In this case we do not need to check memory limits or skb_set_owner_r ++ * because the skb is already accounted for here. ++ */ ++static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb) ++{ ++ struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC); ++ struct sock *sk = psock->sk; ++ ++ if (unlikely(!msg)) ++ return -EAGAIN; ++ sk_msg_init(msg); ++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg); ++} ++ + static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb, + u32 off, u32 len, bool ingress) + { +@@ -784,7 +818,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock, + * retrying later from workqueue. + */ + if (skb_queue_empty(&psock->ingress_skb)) { +- err = sk_psock_skb_ingress(psock, skb); ++ err = sk_psock_skb_ingress_self(psock, skb); + } + if (err < 0) { + skb_queue_tail(&psock->ingress_skb, skb); +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch b/queue-5.9/bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch new file mode 100644 index 00000000000..f702e9999c8 --- /dev/null +++ b/queue-5.9/bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch @@ -0,0 +1,90 @@ +From ca1bbccc1141db77c29ce3d5d030bffb202c828c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 14:28:06 -0800 +Subject: bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect + +From: John Fastabend + +[ Upstream commit 36cd0e696a832a00247fca522034703566ac8885 ] + +Fix sockmap sk_skb programs so that they observe sk_rcvbuf limits. This +allows users to tune SO_RCVBUF and sockmap will honor them. + +We can refactor the if(charge) case out in later patches. But, keep this +fix to the point. + +Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path") +Suggested-by: Jakub Sitnicki +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/160556568657.73229.8404601585878439060.stgit@john-XPS-13-9370 +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 20 ++++++++++++++++---- + net/ipv4/tcp_bpf.c | 3 ++- + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 30ddca6db6c6b..f41b06e60ad90 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -170,10 +170,12 @@ static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i, + struct scatterlist *sge = sk_msg_elem(msg, i); + u32 len = sge->length; + +- if (charge) +- sk_mem_uncharge(sk, len); +- if (!msg->skb) ++ /* When the skb owns the memory we free it from consume_skb path. */ ++ if (!msg->skb) { ++ if (charge) ++ sk_mem_uncharge(sk, len); + put_page(sg_page(sge)); ++ } + memset(sge, 0, sizeof(*sge)); + return len; + } +@@ -403,6 +405,9 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) + int copied = 0, num_sge; + struct sk_msg *msg; + ++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) ++ return -EAGAIN; ++ + msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC); + if (unlikely(!msg)) + return -EAGAIN; +@@ -418,7 +423,14 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) + return num_sge; + } + +- sk_mem_charge(sk, skb->len); ++ /* This will transition ownership of the data from the socket where ++ * the BPF program was run initiating the redirect to the socket ++ * we will eventually receive this data on. The data will be released ++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied ++ * into user buffers. ++ */ ++ skb_set_owner_r(skb, sk); ++ + copied = skb->len; + msg->sg.start = 0; + msg->sg.size = copied; +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index d85ba32dc6e7a..24e1be45d4cd7 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -45,7 +45,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock, + if (likely(!peek)) { + sge->offset += copy; + sge->length -= copy; +- sk_mem_uncharge(sk, copy); ++ if (!msg_rx->skb) ++ sk_mem_uncharge(sk, copy); + msg_rx->sg.size -= copy; + + if (!sge->length) { +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch b/queue-5.9/bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch new file mode 100644 index 00000000000..9ab3b1d8712 --- /dev/null +++ b/queue-5.9/bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch @@ -0,0 +1,92 @@ +From 7b99f67ff83bf7afd92ecdcec44cadc53c527e55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 14:27:46 -0800 +Subject: bpf, sockmap: Fix partial copy_page_to_iter so progress can still be + made + +From: John Fastabend + +[ Upstream commit c9c89dcd872ea33327673fcb97398993a1f22736 ] + +If copy_page_to_iter() fails or even partially completes, but with fewer +bytes copied than expected we currently reset sg.start and return EFAULT. +This proves problematic if we already copied data into the user buffer +before we return an error. Because we leave the copied data in the user +buffer and fail to unwind the scatterlist so kernel side believes data +has been copied and user side believes data has _not_ been received. + +Expected behavior should be to return number of bytes copied and then +on the next read we need to return the error assuming its still there. This +can happen if we have a copy length spanning multiple scatterlist elements +and one or more complete before the error is hit. + +The error is rare enough though that my normal testing with server side +programs, such as nginx, httpd, envoy, etc., I have never seen this. The +only reliable way to reproduce that I've found is to stream movies over +my browser for a day or so and wait for it to hang. Not very scientific, +but with a few extra WARN_ON()s in the code the bug was obvious. + +When we review the errors from copy_page_to_iter() it seems we are hitting +a page fault from copy_page_to_iter_iovec() where the code checks +fault_in_pages_writeable(buf, copy) where buf is the user buffer. It +also seems typical server applications don't hit this case. + +The other way to try and reproduce this is run the sockmap selftest tool +test_sockmap with data verification enabled, but it doesn't reproduce the +fault. Perhaps we can trigger this case artificially somehow from the +test tools. I haven't sorted out a way to do that yet though. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/160556566659.73229.15694973114605301063.stgit@john-XPS-13-9370 +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_bpf.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 7aa68f4aae6c3..d85ba32dc6e7a 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -15,8 +15,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock, + { + struct iov_iter *iter = &msg->msg_iter; + int peek = flags & MSG_PEEK; +- int i, ret, copied = 0; + struct sk_msg *msg_rx; ++ int i, copied = 0; + + msg_rx = list_first_entry_or_null(&psock->ingress_msg, + struct sk_msg, list); +@@ -37,11 +37,9 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock, + page = sg_page(sge); + if (copied + copy > len) + copy = len - copied; +- ret = copy_page_to_iter(page, sge->offset, copy, iter); +- if (ret != copy) { +- msg_rx->sg.start = i; +- return -EFAULT; +- } ++ copy = copy_page_to_iter(page, sge->offset, copy, iter); ++ if (!copy) ++ return copied ? copied : -EFAULT; + + copied += copy; + if (likely(!peek)) { +@@ -56,6 +54,11 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock, + put_page(page); + } + } else { ++ /* Lets not optimize peek case if copy_page_to_iter ++ * didn't copy the entire length lets just break. ++ */ ++ if (copy != sge->length) ++ return copied; + sk_msg_iter_var_next(i); + } + +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch b/queue-5.9/bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch new file mode 100644 index 00000000000..0d7c194b446 --- /dev/null +++ b/queue-5.9/bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch @@ -0,0 +1,72 @@ +From 1699f9d7542306045797e4c7de90cf7b7f704e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 11:36:37 -0700 +Subject: bpf, sockmap: On receive programs try to fast track SK_PASS ingress + +From: John Fastabend + +[ Upstream commit 9ecbfb06a078c4911fb444203e8e41d93d22f886 ] + +When we receive an skb and the ingress skb verdict program returns +SK_PASS we currently set the ingress flag and put it on the workqueue +so it can be turned into a sk_msg and put on the sk_msg ingress queue. +Then finally telling userspace with data_ready hook. + +Here we observe that if the workqueue is empty then we can try to +convert into a sk_msg type and call data_ready directly without +bouncing through a workqueue. Its a common pattern to have a recv +verdict program for visibility that always returns SK_PASS. In this +case unless there is an ENOMEM error or we overrun the socket we +can avoid the workqueue completely only using it when we fall back +to error cases caused by memory pressure. + +By doing this we eliminate another case where data may be dropped +if errors occur on memory limits in workqueue. + +Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path") +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/160226859704.5692.12929678876744977669.stgit@john-Precision-5820-Tower +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index aa78784292a7e..eaf9c90389517 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -764,6 +764,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock, + { + struct tcp_skb_cb *tcp; + struct sock *sk_other; ++ int err = -EIO; + + switch (verdict) { + case __SK_PASS: +@@ -775,8 +776,20 @@ static void sk_psock_verdict_apply(struct sk_psock *psock, + + tcp = TCP_SKB_CB(skb); + tcp->bpf.flags |= BPF_F_INGRESS; +- skb_queue_tail(&psock->ingress_skb, skb); +- schedule_work(&psock->work); ++ ++ /* If the queue is empty then we can submit directly ++ * into the msg queue. If its not empty we have to ++ * queue work otherwise we may get OOO data. Otherwise, ++ * if sk_psock_skb_ingress errors will be handled by ++ * retrying later from workqueue. ++ */ ++ if (skb_queue_empty(&psock->ingress_skb)) { ++ err = sk_psock_skb_ingress(psock, skb); ++ } ++ if (err < 0) { ++ skb_queue_tail(&psock->ingress_skb, skb); ++ schedule_work(&psock->work); ++ } + break; + case __SK_REDIRECT: + sk_psock_skb_redirect(skb); +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch b/queue-5.9/bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch new file mode 100644 index 00000000000..9b4086a5fe0 --- /dev/null +++ b/queue-5.9/bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch @@ -0,0 +1,66 @@ +From 89fe6e35827c7d691523d81cefe853799000166b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 11:36:16 -0700 +Subject: bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits + +From: John Fastabend + +[ Upstream commit cfea28f890cf292d5fe90680db64b68086ef25ba ] + +For sk_skb case where skb_verdict program returns SK_PASS to continue to +pass packet up the stack, the memory limits were already checked before +enqueuing in skb_queue_tail from TCP side. So, lets remove the extra checks +here. The theory is if the TCP stack believes we have memory to receive +the packet then lets trust the stack and not double check the limits. + +In fact the accounting here can cause a drop if sk_rmem_alloc has increased +after the stack accepted this packet, but before the duplicate check here. +And worse if this happens because TCP stack already believes the data has +been received there is no retransmit. + +Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path") +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/160226857664.5692.668205469388498375.stgit@john-Precision-5820-Tower +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index f41b06e60ad90..aa78784292a7e 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -762,6 +762,7 @@ EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read); + static void sk_psock_verdict_apply(struct sk_psock *psock, + struct sk_buff *skb, int verdict) + { ++ struct tcp_skb_cb *tcp; + struct sock *sk_other; + + switch (verdict) { +@@ -771,16 +772,12 @@ static void sk_psock_verdict_apply(struct sk_psock *psock, + !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { + goto out_free; + } +- if (atomic_read(&sk_other->sk_rmem_alloc) <= +- sk_other->sk_rcvbuf) { +- struct tcp_skb_cb *tcp = TCP_SKB_CB(skb); + +- tcp->bpf.flags |= BPF_F_INGRESS; +- skb_queue_tail(&psock->ingress_skb, skb); +- schedule_work(&psock->work); +- break; +- } +- goto out_free; ++ tcp = TCP_SKB_CB(skb); ++ tcp->bpf.flags |= BPF_F_INGRESS; ++ skb_queue_tail(&psock->ingress_skb, skb); ++ schedule_work(&psock->work); ++ break; + case __SK_REDIRECT: + sk_psock_skb_redirect(skb); + break; +-- +2.27.0 + diff --git a/queue-5.9/bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch b/queue-5.9/bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch new file mode 100644 index 00000000000..30eb3e2ec20 --- /dev/null +++ b/queue-5.9/bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch @@ -0,0 +1,38 @@ +From 30e26cd192452c5c5e771d23dd8eae2e61d2a586 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 14:28:26 -0800 +Subject: bpf, sockmap: Use truesize with sk_rmem_schedule() + +From: John Fastabend + +[ Upstream commit 70796fb751f1d34cc650e640572a174faf009cd4 ] + +We use skb->size with sk_rmem_scheduled() which is not correct. Instead +use truesize to align with socket and tcp stack usage of sk_rmem_schedule. + +Suggested-by: Daniel Borkman +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/160556570616.73229.17003722112077507863.stgit@john-XPS-13-9370 +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index eaf9c90389517..4ac112cc490c5 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -411,7 +411,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) + msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC); + if (unlikely(!msg)) + return -EAGAIN; +- if (!sk_rmem_schedule(sk, skb, skb->len)) { ++ if (!sk_rmem_schedule(sk, skb, skb->truesize)) { + kfree(msg); + return -EAGAIN; + } +-- +2.27.0 + diff --git a/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch b/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch new file mode 100644 index 00000000000..7e8c1193abe --- /dev/null +++ b/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch @@ -0,0 +1,69 @@ +From 1f966b4a4c5f286fb0c990395f15d07d48464c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 03:09:05 +0530 +Subject: can: af_can: prevent potential access of uninitialized member in + can_rcv() + +From: Anant Thazhemadam + +[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ] + +In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this +uninitialized cfd->len is accessed nonetheless by pr_warn_once(). + +Fix this uninitialized variable access by checking cfd->len's validity +condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's +condition is checked, and appropriately modify the log messages that +are generated as well. +In case either of the required conditions fail, the skb is freed and +NET_RX_DROP is returned, same as before. + +Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once") +Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com +Tested-by: Anant Thazhemadam +Signed-off-by: Anant Thazhemadam +Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/af_can.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 5c06404bdf3e7..c7106daadd0c7 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -677,16 +677,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, + { + struct canfd_frame *cfd = (struct canfd_frame *)skb->data; + +- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU || +- cfd->len > CAN_MAX_DLEN)) { +- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n", ++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n", ++ dev->type, skb->len); ++ goto free_skb; ++ } ++ ++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ ++ if (unlikely(cfd->len > CAN_MAX_DLEN)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n", + dev->type, skb->len, cfd->len); +- kfree_skb(skb); +- return NET_RX_DROP; ++ goto free_skb; + } + + can_receive(skb, dev); + return NET_RX_SUCCESS; ++ ++free_skb: ++ kfree_skb(skb); ++ return NET_RX_DROP; + } + + static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, +-- +2.27.0 + diff --git a/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch-9610 b/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch-9610 new file mode 100644 index 00000000000..5bf1cb434f1 --- /dev/null +++ b/queue-5.9/can-af_can-prevent-potential-access-of-uninitialized.patch-9610 @@ -0,0 +1,69 @@ +From b6617b3cf1bf2ecb600ee3b0e079437779ccecba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 03:09:06 +0530 +Subject: can: af_can: prevent potential access of uninitialized member in + canfd_rcv() + +From: Anant Thazhemadam + +[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ] + +In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this +uninitialized cfd->len is accessed nonetheless by pr_warn_once(). + +Fix this uninitialized variable access by checking cfd->len's validity +condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's +condition is checked, and appropriately modify the log messages that +are generated as well. +In case either of the required conditions fail, the skb is freed and +NET_RX_DROP is returned, same as before. + +Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") +Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com +Tested-by: Anant Thazhemadam +Signed-off-by: Anant Thazhemadam +Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/af_can.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index c7106daadd0c7..0e71e0164ab3b 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -703,16 +703,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, + { + struct canfd_frame *cfd = (struct canfd_frame *)skb->data; + +- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU || +- cfd->len > CANFD_MAX_DLEN)) { +- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n", ++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", ++ dev->type, skb->len); ++ goto free_skb; ++ } ++ ++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ ++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n", + dev->type, skb->len, cfd->len); +- kfree_skb(skb); +- return NET_RX_DROP; ++ goto free_skb; + } + + can_receive(skb, dev); + return NET_RX_SUCCESS; ++ ++free_skb: ++ kfree_skb(skb); ++ return NET_RX_DROP; + } + + /* af_can protocol functions */ +-- +2.27.0 + diff --git a/queue-5.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch b/queue-5.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch new file mode 100644 index 00000000000..68492a3e6df --- /dev/null +++ b/queue-5.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch @@ -0,0 +1,41 @@ +From 12d4419cece87cac2a1bb0bee9b7348a628d486f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 21:51:47 +0000 +Subject: can: dev: can_restart(): post buffer from the right context + +From: Alejandro Concepcion Rodriguez + +[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ] + +netif_rx() is meant to be called from interrupt contexts. can_restart() may be +called by can_restart_work(), which is called from a worqueue, so it may run in +process context. Use netif_rx_ni() instead. + +Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") +Co-developed-by: Loris Fauster +Signed-off-by: Loris Fauster +Signed-off-by: Alejandro Concepcion Rodriguez +Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu +[mkl: use netif_rx_ni() instead of netif_rx_any_context()] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index d5e52ffc7ed25..4bc9aa6c34787 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -566,7 +566,7 @@ static void can_restart(struct net_device *dev) + + cf->can_id |= CAN_ERR_RESTARTED; + +- netif_rx(skb); ++ netif_rx_ni(skb); + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +-- +2.27.0 + diff --git a/queue-5.9/can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch b/queue-5.9/can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch new file mode 100644 index 00000000000..f5e93a9f044 --- /dev/null +++ b/queue-5.9/can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch @@ -0,0 +1,59 @@ +From 67e28c76c59301b8b3ab428fcd85a23c806a9ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:30:00 +0800 +Subject: can: flexcan: fix failure handling of pm_runtime_get_sync() + +From: Zhang Qilong + +[ Upstream commit b7ee5bc3e1006433601a058a6a7c24c5272635f4 ] + +pm_runtime_get_sync() will increment pm usage at first and it will resume the +device later. If runtime of the device has error or device is in inaccessible +state(or other error state), resume operation will fail. If we do not call put +operation to decrease the reference, it will result in reference leak in the +two functions flexcan_get_berr_counter() and flexcan_open(). + +Moreover, this device cannot enter the idle state and always stay busy or other +non-idle state later. So we should fix it through adding +pm_runtime_put_noidle(). + +Fixes: ca10989632d88 ("can: flexcan: implement can Runtime PM") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201108083000.2599705-1-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index a330d6c56242e..20a56f389c20c 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -614,8 +614,10 @@ static int flexcan_get_berr_counter(const struct net_device *dev, + int err; + + err = pm_runtime_get_sync(priv->dev); +- if (err < 0) ++ if (err < 0) { ++ pm_runtime_put_noidle(priv->dev); + return err; ++ } + + err = __flexcan_get_berr_counter(dev, bec); + +@@ -1310,8 +1312,10 @@ static int flexcan_open(struct net_device *dev) + int err; + + err = pm_runtime_get_sync(priv->dev); +- if (err < 0) ++ if (err < 0) { ++ pm_runtime_put_noidle(priv->dev); + return err; ++ } + + err = open_candev(dev); + if (err) +-- +2.27.0 + diff --git a/queue-5.9/can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch b/queue-5.9/can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch new file mode 100644 index 00000000000..fe7c807b95f --- /dev/null +++ b/queue-5.9/can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch @@ -0,0 +1,107 @@ +From a96c73679da53d5207961e3020827d8903f96b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 16:01:48 +0100 +Subject: can: flexcan: flexcan_chip_start(): fix erroneous + flexcan_transceiver_enable() during bus-off recovery + +From: Marc Kleine-Budde + +[ Upstream commit cd9f13c59461351d7a5fd07924264fb49b287359 ] + +If the CAN controller goes into bus off, the do_set_mode() callback with +CAN_MODE_START can be used to recover the controller, which then calls +flexcan_chip_start(). If configured, this is done automatically by the +framework or manually by the user. + +In flexcan_chip_start() there is an explicit call to +flexcan_transceiver_enable(), which does a regulator_enable() on the +transceiver regulator. This results in a net usage counter increase, as there +is no corresponding flexcan_transceiver_disable() in the bus off code path. +This further leads to the transceiver stuck enabled, even if the CAN interface +is shut down. + +To fix this problem the +flexcan_transceiver_enable()/flexcan_transceiver_disable() are moved out of +flexcan_chip_start()/flexcan_chip_stop() into flexcan_open()/flexcan_close(). + +Fixes: e955cead0311 ("CAN: Add Flexcan CAN controller driver") +Link: https://lore.kernel.org/r/20201118150148.2664024-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 20a56f389c20c..4cbe8889f546f 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1229,14 +1229,10 @@ static int flexcan_chip_start(struct net_device *dev) + priv->write(reg_mecr, ®s->mecr); + } + +- err = flexcan_transceiver_enable(priv); +- if (err) +- goto out_chip_disable; +- + /* synchronize with the can bus */ + err = flexcan_chip_unfreeze(priv); + if (err) +- goto out_transceiver_disable; ++ goto out_chip_disable; + + priv->can.state = CAN_STATE_ERROR_ACTIVE; + +@@ -1254,8 +1250,6 @@ static int flexcan_chip_start(struct net_device *dev) + + return 0; + +- out_transceiver_disable: +- flexcan_transceiver_disable(priv); + out_chip_disable: + flexcan_chip_disable(priv); + return err; +@@ -1285,7 +1279,6 @@ static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error) + priv->write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL, + ®s->ctrl); + +- flexcan_transceiver_disable(priv); + priv->can.state = CAN_STATE_STOPPED; + + return 0; +@@ -1321,10 +1314,14 @@ static int flexcan_open(struct net_device *dev) + if (err) + goto out_runtime_put; + +- err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev); ++ err = flexcan_transceiver_enable(priv); + if (err) + goto out_close; + ++ err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev); ++ if (err) ++ goto out_transceiver_disable; ++ + priv->mb_size = sizeof(struct flexcan_mb) + CAN_MAX_DLEN; + priv->mb_count = (sizeof(priv->regs->mb[0]) / priv->mb_size) + + (sizeof(priv->regs->mb[1]) / priv->mb_size); +@@ -1373,6 +1370,8 @@ static int flexcan_open(struct net_device *dev) + can_rx_offload_del(&priv->offload); + out_free_irq: + free_irq(dev->irq, dev); ++ out_transceiver_disable: ++ flexcan_transceiver_disable(priv); + out_close: + close_candev(dev); + out_runtime_put: +@@ -1391,6 +1390,7 @@ static int flexcan_close(struct net_device *dev) + + can_rx_offload_del(&priv->offload); + free_irq(dev->irq, dev); ++ flexcan_transceiver_disable(priv); + + close_candev(dev); + pm_runtime_put(priv->dev); +-- +2.27.0 + diff --git a/queue-5.9/can-kvaser_pciefd-fix-kcan-bittiming-limits.patch b/queue-5.9/can-kvaser_pciefd-fix-kcan-bittiming-limits.patch new file mode 100644 index 00000000000..f8fa76df994 --- /dev/null +++ b/queue-5.9/can-kvaser_pciefd-fix-kcan-bittiming-limits.patch @@ -0,0 +1,42 @@ +From be42b3494b190434636e62899abdc9fdffd84c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 17:30:22 +0100 +Subject: can: kvaser_pciefd: Fix KCAN bittiming limits + +From: Jimmy Assarsson + +[ Upstream commit 470e14c00c63752466ac44de392f584dfdddd82e ] + +Use correct bittiming limits for the KCAN CAN controller. + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20201115163027.16851-1-jimmyassarsson@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 6f766918211a4..72acd1ba162d2 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -287,12 +287,12 @@ struct kvaser_pciefd_tx_packet { + static const struct can_bittiming_const kvaser_pciefd_bittiming_const = { + .name = KVASER_PCIEFD_DRV_NAME, + .tseg1_min = 1, +- .tseg1_max = 255, ++ .tseg1_max = 512, + .tseg2_min = 1, + .tseg2_max = 32, + .sjw_max = 16, + .brp_min = 1, +- .brp_max = 4096, ++ .brp_max = 8192, + .brp_inc = 1, + }; + +-- +2.27.0 + diff --git a/queue-5.9/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch b/queue-5.9/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch new file mode 100644 index 00000000000..1d044e46d59 --- /dev/null +++ b/queue-5.9/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch @@ -0,0 +1,36 @@ +From 73eac15d4748a437b9fcfd5faef21a5ca1ff7838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 17:30:23 +0100 +Subject: can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits + +From: Jimmy Assarsson + +[ Upstream commit d003868d7f8579838ed58b6429af91844039b6f8 ] + +Use correct bittiming limits for the KCAN CAN controller. + +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20201115163027.16851-2-jimmyassarsson@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 7ab87a7587545..218fadc911558 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = { + .tseg2_max = 32, + .sjw_max = 16, + .brp_min = 1, +- .brp_max = 4096, ++ .brp_max = 8192, + .brp_inc = 1, + }; + +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-fix-freeing-of-can-device-from-peripherial.patch b/queue-5.9/can-m_can-fix-freeing-of-can-device-from-peripherial.patch new file mode 100644 index 00000000000..ac4d6a47ab2 --- /dev/null +++ b/queue-5.9/can-m_can-fix-freeing-of-can-device-from-peripherial.patch @@ -0,0 +1,179 @@ +From d93e756335ec2f66ccec2887ea3f91d89dc232fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 12:38:29 -0600 +Subject: can: m_can: Fix freeing of can device from peripherials + +From: Dan Murphy + +[ Upstream commit 85816aba460ceebed0047381395615891df68c8f ] + +Fix leaking netdev device from peripherial devices. The call to allocate the +netdev device is made from and managed by the peripherial. + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Reported-by: Marc Kleine-Budde +Signed-off-by: Dan Murphy +Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 --- + drivers/net/can/m_can/m_can_platform.c | 23 +++++++++++++++-------- + drivers/net/can/m_can/tcan4x5x.c | 26 ++++++++++++++++++-------- + 3 files changed, 33 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index f2c87b76e5692..645101d19989b 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1856,7 +1856,6 @@ pm_runtime_fail: + if (ret) { + if (m_can_dev->pm_clock_support) + pm_runtime_disable(m_can_dev->dev); +- free_candev(m_can_dev->net); + } + + return ret; +@@ -1914,8 +1913,6 @@ void m_can_class_unregister(struct m_can_classdev *m_can_dev) + unregister_candev(m_can_dev->net); + + m_can_clk_stop(m_can_dev); +- +- free_candev(m_can_dev->net); + } + EXPORT_SYMBOL_GPL(m_can_class_unregister); + +diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c +index e6d0cb9ee02f0..161cb9be018c0 100644 +--- a/drivers/net/can/m_can/m_can_platform.c ++++ b/drivers/net/can/m_can/m_can_platform.c +@@ -67,32 +67,36 @@ static int m_can_plat_probe(struct platform_device *pdev) + return -ENOMEM; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; ++ if (!priv) { ++ ret = -ENOMEM; ++ goto probe_fail; ++ } + + mcan_class->device_data = priv; + +- m_can_class_get_clocks(mcan_class); ++ ret = m_can_class_get_clocks(mcan_class); ++ if (ret) ++ goto probe_fail; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "m_can"); + addr = devm_ioremap_resource(&pdev->dev, res); + irq = platform_get_irq_byname(pdev, "int0"); + if (IS_ERR(addr) || irq < 0) { + ret = -EINVAL; +- goto failed_ret; ++ goto probe_fail; + } + + /* message ram could be shared */ + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram"); + if (!res) { + ret = -ENODEV; +- goto failed_ret; ++ goto probe_fail; + } + + mram_addr = devm_ioremap(&pdev->dev, res->start, resource_size(res)); + if (!mram_addr) { + ret = -ENOMEM; +- goto failed_ret; ++ goto probe_fail; + } + + priv->base = addr; +@@ -111,9 +115,10 @@ static int m_can_plat_probe(struct platform_device *pdev) + + m_can_init_ram(mcan_class); + +- ret = m_can_class_register(mcan_class); ++ return m_can_class_register(mcan_class); + +-failed_ret: ++probe_fail: ++ m_can_class_free_dev(mcan_class->net); + return ret; + } + +@@ -134,6 +139,8 @@ static int m_can_plat_remove(struct platform_device *pdev) + + m_can_class_unregister(mcan_class); + ++ m_can_class_free_dev(mcan_class->net); ++ + platform_set_drvdata(pdev, NULL); + + return 0; +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index 4fdb7121403ab..e5d7d85e0b6d1 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -440,14 +440,18 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + return -ENOMEM; + + priv = devm_kzalloc(&spi->dev, sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; ++ if (!priv) { ++ ret = -ENOMEM; ++ goto out_m_can_class_free_dev; ++ } + + priv->power = devm_regulator_get_optional(&spi->dev, "vsup"); +- if (PTR_ERR(priv->power) == -EPROBE_DEFER) +- return -EPROBE_DEFER; +- else ++ if (PTR_ERR(priv->power) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto out_m_can_class_free_dev; ++ } else { + priv->power = NULL; ++ } + + mcan_class->device_data = priv; + +@@ -460,8 +464,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + } + + /* Sanity check */ +- if (freq < 20000000 || freq > TCAN4X5X_EXT_CLK_DEF) +- return -ERANGE; ++ if (freq < 20000000 || freq > TCAN4X5X_EXT_CLK_DEF) { ++ ret = -ERANGE; ++ goto out_m_can_class_free_dev; ++ } + + priv->reg_offset = TCAN4X5X_MCAN_OFFSET; + priv->mram_start = TCAN4X5X_MRAM_START; +@@ -518,8 +524,10 @@ out_clk: + clk_disable_unprepare(mcan_class->cclk); + clk_disable_unprepare(mcan_class->hclk); + } +- ++ out_m_can_class_free_dev: ++ m_can_class_free_dev(mcan_class->net); + dev_err(&spi->dev, "Probe failed, err=%d\n", ret); ++ + return ret; + } + +@@ -531,6 +539,8 @@ static int tcan4x5x_can_remove(struct spi_device *spi) + + tcan4x5x_power_enable(priv->power, 0); + ++ m_can_class_free_dev(priv->mcan_dev->net); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-m_can_class_free_dev-introduce-new-functio.patch b/queue-5.9/can-m_can-m_can_class_free_dev-introduce-new-functio.patch new file mode 100644 index 00000000000..54229305882 --- /dev/null +++ b/queue-5.9/can-m_can-m_can_class_free_dev-introduce-new-functio.patch @@ -0,0 +1,55 @@ +From 388044d776565260e4146cc128da8bbd239a5798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 12:38:29 -0600 +Subject: can: m_can: m_can_class_free_dev(): introduce new function + +From: Dan Murphy + +[ Upstream commit a8c22f5b0c689a29f45ef4a110d09fd391debcbc ] + +This patch creates a common function that peripherials can call to free the +netdev device when failures occur. + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Reported-by: Marc Kleine-Budde +Signed-off-by: Dan Murphy +Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 6 ++++++ + drivers/net/can/m_can/m_can.h | 1 + + 2 files changed, 7 insertions(+) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 63887e23d89c0..f2c87b76e5692 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1812,6 +1812,12 @@ out: + } + EXPORT_SYMBOL_GPL(m_can_class_allocate_dev); + ++void m_can_class_free_dev(struct net_device *net) ++{ ++ free_candev(net); ++} ++EXPORT_SYMBOL_GPL(m_can_class_free_dev); ++ + int m_can_class_register(struct m_can_classdev *m_can_dev) + { + int ret; +diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h +index 49f42b50627a1..b2699a7c99973 100644 +--- a/drivers/net/can/m_can/m_can.h ++++ b/drivers/net/can/m_can/m_can.h +@@ -99,6 +99,7 @@ struct m_can_classdev { + }; + + struct m_can_classdev *m_can_class_allocate_dev(struct device *dev); ++void m_can_class_free_dev(struct net_device *net); + int m_can_class_register(struct m_can_classdev *cdev); + void m_can_class_unregister(struct m_can_classdev *cdev); + int m_can_class_get_clocks(struct m_can_classdev *cdev); +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-m_can_handle_state_change-fix-state-change.patch b/queue-5.9/can-m_can-m_can_handle_state_change-fix-state-change.patch new file mode 100644 index 00000000000..ef9956cf224 --- /dev/null +++ b/queue-5.9/can-m_can-m_can_handle_state_change-fix-state-change.patch @@ -0,0 +1,51 @@ +From a91f09d3aac3b6e6fb5e5972a04aa439c56b2088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2020 10:23:30 +0800 +Subject: can: m_can: m_can_handle_state_change(): fix state change + +From: Wu Bo + +[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ] + +m_can_handle_state_change() is called with the new_state as an argument. + +In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the +following code indicate that a CAN_STATE_ERROR_WARNING is handled. + +This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING. + +Signed-off-by: Wu Bo +Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com +Cc: Dan Murphy +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 02c5795b73936..63887e23d89c0 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -665,7 +665,7 @@ static int m_can_handle_state_change(struct net_device *dev, + unsigned int ecr; + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cdev->can.can_stats.error_warning++; + cdev->can.state = CAN_STATE_ERROR_WARNING; +@@ -694,7 +694,7 @@ static int m_can_handle_state_change(struct net_device *dev, + __m_can_get_berr_counter(dev, &bec); + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] = (bec.txerr > bec.rxerr) ? +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-m_can_stop-set-device-to-software-init-mod.patch b/queue-5.9/can-m_can-m_can_stop-set-device-to-software-init-mod.patch new file mode 100644 index 00000000000..4ca14efe1bc --- /dev/null +++ b/queue-5.9/can-m_can-m_can_stop-set-device-to-software-init-mod.patch @@ -0,0 +1,43 @@ +From f197875fbe528311cd6d1ada635600d66038c00c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 11:24:42 +0530 +Subject: can: m_can: m_can_stop(): set device to software init mode before + closing + +From: Faiz Abbas + +[ Upstream commit a584e9bc1b7e88f24f8504886eafbe6c73d8a97c ] + +There might be some requests pending in the buffer when the interface close +sequence occurs. In some devices, these pending requests might lead to the +module not shutting down properly when m_can_clk_stop() is called. + +Therefore, move the device to init state before potentially powering it down. + +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Signed-off-by: Faiz Abbas +Acked-by: Dan Murphy +Link: https://lore.kernel.org/r/20200825055442.16994-1-faiz_abbas@ti.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 645101d19989b..e7264043f79a2 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1414,6 +1414,9 @@ static void m_can_stop(struct net_device *dev) + /* disable all interrupts */ + m_can_disable_all_interrupts(cdev); + ++ /* Set init mode to disengage from the network */ ++ m_can_config_endisable(cdev, true); ++ + /* set the state as STOPPED */ + cdev->can.state = CAN_STATE_STOPPED; + } +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-process-interrupt-only-when-not-runtime-su.patch b/queue-5.9/can-m_can-process-interrupt-only-when-not-runtime-su.patch new file mode 100644 index 00000000000..99117c9cc32 --- /dev/null +++ b/queue-5.9/can-m_can-process-interrupt-only-when-not-runtime-su.patch @@ -0,0 +1,40 @@ +From d8606cb3ca6a3e14a49c255c17c2e1c95b019436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 16:47:15 +0300 +Subject: can: m_can: process interrupt only when not runtime suspended + +From: Jarkko Nikula + +[ Upstream commit a1f634463aaf2c94dfa13001dbdea011303124cc ] + +Avoid processing bogus interrupt statuses when the HW is runtime suspended and +the M_CAN_IR register read may get all bits 1's. Handler can be called if the +interrupt request is shared with other peripherals or at the end of free_irq(). + +Therefore check the runtime suspended status before processing. + +Fixes: cdf8259d6573 ("can: m_can: Add PM Support") +Signed-off-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20200915134715.696303-1-jarkko.nikula@linux.intel.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index e7264043f79a2..f3fc37e96b087 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -956,6 +956,8 @@ static irqreturn_t m_can_isr(int irq, void *dev_id) + struct net_device_stats *stats = &dev->stats; + u32 ir; + ++ if (pm_runtime_suspended(cdev->dev)) ++ return IRQ_NONE; + ir = m_can_read(cdev, M_CAN_IR); + if (!ir) + return IRQ_NONE; +-- +2.27.0 + diff --git a/queue-5.9/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch b/queue-5.9/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch new file mode 100644 index 00000000000..eeddb7115d8 --- /dev/null +++ b/queue-5.9/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch @@ -0,0 +1,51 @@ +From 006ea22478caf5634ad416d38f720a8b04a4c8db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 21:16:55 +0200 +Subject: can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to + can_put_echo_skb() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marc Kleine-Budde + +[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ] + +The driver has to first fill the skb with data and then handle it to +can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before +sending the skb out via USB. + +Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") +Cc: Remigiusz Kołłątaj +Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/mcba_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 21faa2ec46327..8f785c199e220 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -326,8 +326,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + if (!ctx) + return NETDEV_TX_BUSY; + +- can_put_echo_skb(skb, priv->netdev, ctx->ndx); +- + if (cf->can_id & CAN_EFF_FLAG) { + /* SIDH | SIDL | EIDH | EIDL + * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0 +@@ -357,6 +355,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + if (cf->can_id & CAN_RTR_FLAG) + usb_msg.dlc |= MCBA_DLC_RTR_MASK; + ++ can_put_echo_skb(skb, priv->netdev, ctx->ndx); ++ + err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx); + if (err) + goto xmit_failed; +-- +2.27.0 + diff --git a/queue-5.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch b/queue-5.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch new file mode 100644 index 00000000000..869393f6149 --- /dev/null +++ b/queue-5.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch @@ -0,0 +1,48 @@ +From 060e98ffbac4b4cd3692c2dacaa36bbc87399b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 11:24:27 +0000 +Subject: can: peak_usb: fix potential integer overflow on shift of a int + +From: Colin Ian King + +[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ] + +The left shift of int 32 bit integer constant 1 is evaluated using 32 bit +arithmetic and then assigned to a signed 64 bit variable. In the case where +time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow. +Avoid this by shifting using the BIT_ULL macro instead. + +Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index c2764799f9efb..204ccb27d6d9a 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -156,7 +156,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time) + if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { + /* case when event time (tsw) wraps */ + if (ts < time_ref->ts_dev_1) +- delta_ts = 1 << time_ref->adapter->ts_used_bits; ++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits); + + /* Otherwise, sync time counter (ts_dev_2) has wrapped: + * handle case when event time (tsn) hasn't. +@@ -168,7 +168,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time) + * tsn ts + */ + } else if (time_ref->ts_dev_1 < ts) { +- delta_ts = -(1 << time_ref->adapter->ts_used_bits); ++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits); + } + + /* add delay between last sync and event timestamps */ +-- +2.27.0 + diff --git a/queue-5.9/can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch b/queue-5.9/can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch new file mode 100644 index 00000000000..a66344b1efe --- /dev/null +++ b/queue-5.9/can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch @@ -0,0 +1,42 @@ +From 70ecd5af13f8b11bd65ee76c8528727dd2f4a597 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Apr 2020 16:10:13 +0200 +Subject: can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI + +From: Enric Balletbo i Serra + +[ Upstream commit 3fcce133f0d9a50d3a23f8e2bc950197b4e03900 ] + +regmap is a library function that gets selected by drivers that need it. No +driver modules should depend on it. Instead depends on SPI and select +REGMAP_SPI. Depending on REGMAP_SPI makes this driver only build if another +driver already selected REGMAP_SPI, as the symbol can't be selected through the +menu kernel configuration. + +Signed-off-by: Enric Balletbo i Serra +Link: http://lore.kernel.org/r/20200413141013.506613-1-enric.balletbo@collabora.com +Reviewed-by: Dan Murphy +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig +index d9216147ca93f..3acedb766c48c 100644 +--- a/drivers/net/can/m_can/Kconfig ++++ b/drivers/net/can/m_can/Kconfig +@@ -16,7 +16,8 @@ config CAN_M_CAN_PLATFORM + + config CAN_M_CAN_TCAN4X5X + depends on CAN_M_CAN +- depends on REGMAP_SPI ++ depends on SPI ++ select REGMAP_SPI + tristate "TCAN4X5X M_CAN device" + help + Say Y here if you want support for Texas Instruments TCAN4x5x +-- +2.27.0 + diff --git a/queue-5.9/can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch b/queue-5.9/can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch new file mode 100644 index 00000000000..fa60aca11e4 --- /dev/null +++ b/queue-5.9/can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch @@ -0,0 +1,40 @@ +From 54c815db8ce6ef3587dd316513402288065823f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2020 11:30:34 +0100 +Subject: can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for + devm_regmap_init() + +From: Marc Kleine-Budde + +[ Upstream commit 1ff203badbbf1738027c8395d5b40b0d462b6e4d ] + +This patch adds the missing error checking when initializing the regmap +interface fails. + +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Cc: Dan Murphy +Link: http://lore.kernel.org/r/20201019154233.1262589-7-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/tcan4x5x.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index eacd428e07e9f..f058bd9104e99 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -487,6 +487,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + + priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus, + &spi->dev, &tcan4x5x_regmap); ++ if (IS_ERR(priv->regmap)) { ++ ret = PTR_ERR(priv->regmap); ++ goto out_clk; ++ } + + ret = tcan4x5x_power_enable(priv->power, 1); + if (ret) +-- +2.27.0 + diff --git a/queue-5.9/can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch b/queue-5.9/can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch new file mode 100644 index 00000000000..929df9121fc --- /dev/null +++ b/queue-5.9/can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch @@ -0,0 +1,42 @@ +From f8d781721c77b1667b1fc5397e4063311d914332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 22:23:49 +0200 +Subject: can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration + +From: Marc Kleine-Budde + +[ Upstream commit c81d0b6ca665477c761f227807010762630b089f ] + +Change the order in tcan4x5x_can_remove() to be the exact inverse of +tcan4x5x_can_probe(). First m_can_class_unregister(), then power down the +device. + +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Cc: Dan Murphy +Link: http://lore.kernel.org/r/20201019154233.1262589-10-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/tcan4x5x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index f058bd9104e99..4fdb7121403ab 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -527,10 +527,10 @@ static int tcan4x5x_can_remove(struct spi_device *spi) + { + struct tcan4x5x_priv *priv = spi_get_drvdata(spi); + +- tcan4x5x_power_enable(priv->power, 0); +- + m_can_class_unregister(priv->mcan_dev); + ++ tcan4x5x_power_enable(priv->power, 0); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.9/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch b/queue-5.9/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch new file mode 100644 index 00000000000..e9b9b40b2f4 --- /dev/null +++ b/queue-5.9/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch @@ -0,0 +1,74 @@ +From d531c1b512f218fc987d69a3d0c44d96dd88913e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 19:17:08 +0800 +Subject: can: ti_hecc: Fix memleak in ti_hecc_probe + +From: Zhang Qilong + +[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ] + +In the error handling, we should goto the probe_exit_candev +to free ndev to prevent memory leak. + +Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/ti_hecc.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c +index 228ecd45ca6c1..0e8b5df7e9830 100644 +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -887,7 +887,8 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->base)) { + dev_err(&pdev->dev, "hecc ioremap failed\n"); +- return PTR_ERR(priv->base); ++ err = PTR_ERR(priv->base); ++ goto probe_exit_candev; + } + + /* handle hecc-ram memory */ +@@ -900,7 +901,8 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->hecc_ram)) { + dev_err(&pdev->dev, "hecc-ram ioremap failed\n"); +- return PTR_ERR(priv->hecc_ram); ++ err = PTR_ERR(priv->hecc_ram); ++ goto probe_exit_candev; + } + + /* handle mbx memory */ +@@ -913,13 +915,14 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->mbx = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->mbx)) { + dev_err(&pdev->dev, "mbx ioremap failed\n"); +- return PTR_ERR(priv->mbx); ++ err = PTR_ERR(priv->mbx); ++ goto probe_exit_candev; + } + + irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); + if (!irq) { + dev_err(&pdev->dev, "No irq resource\n"); +- goto probe_exit; ++ goto probe_exit_candev; + } + + priv->ndev = ndev; +@@ -983,7 +986,7 @@ probe_exit_release_clk: + clk_put(priv->clk); + probe_exit_candev: + free_candev(ndev); +-probe_exit: ++ + return err; + } + +-- +2.27.0 + diff --git a/queue-5.9/counter-ti-eqep-fix-regmap-max_register.patch b/queue-5.9/counter-ti-eqep-fix-regmap-max_register.patch new file mode 100644 index 00000000000..d3e212492da --- /dev/null +++ b/queue-5.9/counter-ti-eqep-fix-regmap-max_register.patch @@ -0,0 +1,48 @@ +From 7b9d74ae0d63c125aec93c90ca14fe4ffc6a605f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 11:51:22 -0500 +Subject: counter/ti-eqep: Fix regmap max_register + +From: David Lechner + +[ Upstream commit 271b339236e1c0e6448bc1cafeaedcb529324bf0 ] + +The values given were the offset of the register after the last +register instead of the actual last register in each range. Fix +by using the correct last register of each range. + +Fixes: f213729f6796 ("counter: new TI eQEP driver") +Signed-off-by: David Lechner +Acked-by: William Breathitt Gray +Link: https://lore.kernel.org/r/20201025165122.607866-1-david@lechnology.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/counter/ti-eqep.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/counter/ti-eqep.c b/drivers/counter/ti-eqep.c +index 1ff07faef27f3..5d6470968d2cd 100644 +--- a/drivers/counter/ti-eqep.c ++++ b/drivers/counter/ti-eqep.c +@@ -368,7 +368,7 @@ static const struct regmap_config ti_eqep_regmap32_config = { + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, +- .max_register = 0x24, ++ .max_register = QUPRD, + }; + + static const struct regmap_config ti_eqep_regmap16_config = { +@@ -376,7 +376,7 @@ static const struct regmap_config ti_eqep_regmap16_config = { + .reg_bits = 16, + .val_bits = 16, + .reg_stride = 2, +- .max_register = 0x1e, ++ .max_register = QCPRDLAT, + }; + + static int ti_eqep_probe(struct platform_device *pdev) +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-fix-error-codes-in-channel_register.patch b/queue-5.9/dmaengine-fix-error-codes-in-channel_register.patch new file mode 100644 index 00000000000..bdec63f7772 --- /dev/null +++ b/queue-5.9/dmaengine-fix-error-codes-in-channel_register.patch @@ -0,0 +1,75 @@ +From e8a9751677cea00c55b8ebe0007c5e2e5d1097e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 13:16:31 +0300 +Subject: dmaengine: fix error codes in channel_register() + +From: Dan Carpenter + +[ Upstream commit 7e4be1290a38b3dd4a77cdf4565c9ffe7e620013 ] + +The error codes were not set on some of these error paths. + +Also the error handling was more confusing than it needed to be so I +cleaned it up and shuffled it around a bit. + +Fixes: d2fb0a043838 ("dmaengine: break out channel registration") +Signed-off-by: Dan Carpenter +Reviewed-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20201113101631.GE168908@mwanda +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmaengine.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c +index a53e71d2bbd4c..a2146d1f42da7 100644 +--- a/drivers/dma/dmaengine.c ++++ b/drivers/dma/dmaengine.c +@@ -1055,16 +1055,15 @@ static int get_dma_id(struct dma_device *device) + static int __dma_async_device_channel_register(struct dma_device *device, + struct dma_chan *chan) + { +- int rc = 0; ++ int rc; + + chan->local = alloc_percpu(typeof(*chan->local)); + if (!chan->local) +- goto err_out; ++ return -ENOMEM; + chan->dev = kzalloc(sizeof(*chan->dev), GFP_KERNEL); + if (!chan->dev) { +- free_percpu(chan->local); +- chan->local = NULL; +- goto err_out; ++ rc = -ENOMEM; ++ goto err_free_local; + } + + /* +@@ -1077,7 +1076,8 @@ static int __dma_async_device_channel_register(struct dma_device *device, + if (chan->chan_id < 0) { + pr_err("%s: unable to alloc ida for chan: %d\n", + __func__, chan->chan_id); +- goto err_out; ++ rc = chan->chan_id; ++ goto err_free_dev; + } + + chan->dev->device.class = &dma_devclass; +@@ -1098,9 +1098,10 @@ static int __dma_async_device_channel_register(struct dma_device *device, + mutex_lock(&device->chan_mutex); + ida_free(&device->chan_ida, chan->chan_id); + mutex_unlock(&device->chan_mutex); +- err_out: +- free_percpu(chan->local); ++ err_free_dev: + kfree(chan->dev); ++ err_free_local: ++ free_percpu(chan->local); + return rc; + } + +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-idxd-fix-mapping-of-portal-size.patch b/queue-5.9/dmaengine-idxd-fix-mapping-of-portal-size.patch new file mode 100644 index 00000000000..e6f06b7a81c --- /dev/null +++ b/queue-5.9/dmaengine-idxd-fix-mapping-of-portal-size.patch @@ -0,0 +1,66 @@ +From 27f1f22d8e125c6677fd84f8cc2c5bda878fc943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 15:23:46 -0700 +Subject: dmaengine: idxd: fix mapping of portal size + +From: Dave Jiang + +[ Upstream commit 8326be9f1c0bb498baf134878a8deb8a952e0135 ] + +Portal size is 4k. Current code is mapping all 4 portals in a single chunk. +Restrict the mapped portal size to a single portal to ensure that submission +only goes to the intended portal address. + +Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/160513342642.510187.16450549281618747065.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 2 +- + drivers/dma/idxd/registers.h | 2 +- + drivers/dma/idxd/submit.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index c2beece445215..66e947627f569 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -271,7 +271,7 @@ int idxd_wq_map_portal(struct idxd_wq *wq) + resource_size_t start; + + start = pci_resource_start(pdev, IDXD_WQ_BAR); +- start = start + wq->id * IDXD_PORTAL_SIZE; ++ start += idxd_get_wq_portal_full_offset(wq->id, IDXD_PORTAL_LIMITED); + + wq->dportal = devm_ioremap(dev, start, IDXD_PORTAL_SIZE); + if (!wq->dportal) +diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h +index aef5a902829ee..54390334c243a 100644 +--- a/drivers/dma/idxd/registers.h ++++ b/drivers/dma/idxd/registers.h +@@ -8,7 +8,7 @@ + + #define IDXD_MMIO_BAR 0 + #define IDXD_WQ_BAR 2 +-#define IDXD_PORTAL_SIZE 0x4000 ++#define IDXD_PORTAL_SIZE PAGE_SIZE + + /* MMIO Device BAR0 Registers */ + #define IDXD_VER_OFFSET 0x00 +diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c +index 156a1ee233aa5..417048e3c42aa 100644 +--- a/drivers/dma/idxd/submit.c ++++ b/drivers/dma/idxd/submit.c +@@ -74,7 +74,7 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc) + if (idxd->state != IDXD_DEV_ENABLED) + return -EIO; + +- portal = wq->dportal + idxd_get_wq_portal_offset(IDXD_PORTAL_UNLIMITED); ++ portal = wq->dportal; + /* + * The wmb() flushes writes to coherent DMA data before possibly + * triggering a DMA read. The wmb() is necessary even on UP because +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-idxd-fix-wq-config-registers-offset-progra.patch b/queue-5.9/dmaengine-idxd-fix-wq-config-registers-offset-progra.patch new file mode 100644 index 00000000000..998d97f0c36 --- /dev/null +++ b/queue-5.9/dmaengine-idxd-fix-wq-config-registers-offset-progra.patch @@ -0,0 +1,192 @@ +From 0ef16712429320c69408e5e7de3b57774d4112df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 14:34:09 -0700 +Subject: dmaengine: idxd: fix wq config registers offset programming + +From: Dave Jiang + +[ Upstream commit 484f910e93b48c1d8890d8330a87e34ae61f4782 ] + +DSA spec v1.1 [1] updated to include a stride size register for WQ +configuration that will specify how much space is reserved for the WQ +configuration register set. This change is expected to be in the final +gen1 DSA hardware. Fix the driver to use WQCFG_OFFSET() for all WQ +offset calculation and fixup WQCFG_OFFSET() to use the new calculated +wq size. + +[1]: https://software.intel.com/content/www/us/en/develop/download/intel-data-streaming-accelerator-preliminary-architecture-specification.html + +Fixes: bfe1d56091c1 ("dmaengine: idxd: Init and probe for Intel data accelerators") +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/160383444959.48058.14249265538404901781.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 29 ++++++++++++++--------------- + drivers/dma/idxd/idxd.h | 3 ++- + drivers/dma/idxd/init.c | 5 +++++ + drivers/dma/idxd/registers.h | 23 ++++++++++++++++++++++- + 4 files changed, 43 insertions(+), 17 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index b75d699160bfa..c2beece445215 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -295,7 +295,7 @@ void idxd_wq_disable_cleanup(struct idxd_wq *wq) + int i, wq_offset; + + lockdep_assert_held(&idxd->dev_lock); +- memset(&wq->wqcfg, 0, sizeof(wq->wqcfg)); ++ memset(wq->wqcfg, 0, idxd->wqcfg_size); + wq->type = IDXD_WQT_NONE; + wq->size = 0; + wq->group = NULL; +@@ -304,8 +304,8 @@ void idxd_wq_disable_cleanup(struct idxd_wq *wq) + clear_bit(WQ_FLAG_DEDICATED, &wq->flags); + memset(wq->name, 0, WQ_NAME_SIZE); + +- for (i = 0; i < 8; i++) { +- wq_offset = idxd->wqcfg_offset + wq->id * 32 + i * sizeof(u32); ++ for (i = 0; i < WQCFG_STRIDES(idxd); i++) { ++ wq_offset = WQCFG_OFFSET(idxd, wq->id, i); + iowrite32(0, idxd->reg_base + wq_offset); + dev_dbg(dev, "WQ[%d][%d][%#x]: %#x\n", + wq->id, i, wq_offset, +@@ -535,10 +535,10 @@ static int idxd_wq_config_write(struct idxd_wq *wq) + if (!wq->group) + return 0; + +- memset(&wq->wqcfg, 0, sizeof(union wqcfg)); ++ memset(wq->wqcfg, 0, idxd->wqcfg_size); + + /* byte 0-3 */ +- wq->wqcfg.wq_size = wq->size; ++ wq->wqcfg->wq_size = wq->size; + + if (wq->size == 0) { + dev_warn(dev, "Incorrect work queue size: 0\n"); +@@ -546,22 +546,21 @@ static int idxd_wq_config_write(struct idxd_wq *wq) + } + + /* bytes 4-7 */ +- wq->wqcfg.wq_thresh = wq->threshold; ++ wq->wqcfg->wq_thresh = wq->threshold; + + /* byte 8-11 */ +- wq->wqcfg.priv = !!(wq->type == IDXD_WQT_KERNEL); +- wq->wqcfg.mode = 1; +- +- wq->wqcfg.priority = wq->priority; ++ wq->wqcfg->priv = !!(wq->type == IDXD_WQT_KERNEL); ++ wq->wqcfg->mode = 1; ++ wq->wqcfg->priority = wq->priority; + + /* bytes 12-15 */ +- wq->wqcfg.max_xfer_shift = idxd->hw.gen_cap.max_xfer_shift; +- wq->wqcfg.max_batch_shift = idxd->hw.gen_cap.max_batch_shift; ++ wq->wqcfg->max_xfer_shift = idxd->hw.gen_cap.max_xfer_shift; ++ wq->wqcfg->max_batch_shift = idxd->hw.gen_cap.max_batch_shift; + + dev_dbg(dev, "WQ %d CFGs\n", wq->id); +- for (i = 0; i < 8; i++) { +- wq_offset = idxd->wqcfg_offset + wq->id * 32 + i * sizeof(u32); +- iowrite32(wq->wqcfg.bits[i], idxd->reg_base + wq_offset); ++ for (i = 0; i < WQCFG_STRIDES(idxd); i++) { ++ wq_offset = WQCFG_OFFSET(idxd, wq->id, i); ++ iowrite32(wq->wqcfg->bits[i], idxd->reg_base + wq_offset); + dev_dbg(dev, "WQ[%d][%d][%#x]: %#x\n", + wq->id, i, wq_offset, + ioread32(idxd->reg_base + wq_offset)); +diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h +index e62b4799d1896..a3e5b83c80ef7 100644 +--- a/drivers/dma/idxd/idxd.h ++++ b/drivers/dma/idxd/idxd.h +@@ -103,7 +103,7 @@ struct idxd_wq { + u32 priority; + enum idxd_wq_state state; + unsigned long flags; +- union wqcfg wqcfg; ++ union wqcfg *wqcfg; + u32 vec_ptr; /* interrupt steering */ + struct dsa_hw_desc **hw_descs; + int num_descs; +@@ -180,6 +180,7 @@ struct idxd_device { + int max_wq_size; + int token_limit; + int nr_tokens; /* non-reserved tokens */ ++ unsigned int wqcfg_size; + + union sw_err_reg sw_err; + wait_queue_head_t cmd_waitq; +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index c7c61974f20f6..4bf9ed369bb7b 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -176,6 +176,9 @@ static int idxd_setup_internals(struct idxd_device *idxd) + wq->idxd = idxd; + mutex_init(&wq->wq_lock); + wq->idxd_cdev.minor = -1; ++ wq->wqcfg = devm_kzalloc(dev, idxd->wqcfg_size, GFP_KERNEL); ++ if (!wq->wqcfg) ++ return -ENOMEM; + } + + for (i = 0; i < idxd->max_engines; i++) { +@@ -249,6 +252,8 @@ static void idxd_read_caps(struct idxd_device *idxd) + dev_dbg(dev, "total workqueue size: %u\n", idxd->max_wq_size); + idxd->max_wqs = idxd->hw.wq_cap.num_wqs; + dev_dbg(dev, "max workqueues: %u\n", idxd->max_wqs); ++ idxd->wqcfg_size = 1 << (idxd->hw.wq_cap.wqcfg_size + IDXD_WQCFG_MIN); ++ dev_dbg(dev, "wqcfg size: %u\n", idxd->wqcfg_size); + + /* reading operation capabilities */ + for (i = 0; i < 4; i++) { +diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h +index a39e7ae6b3d93..aef5a902829ee 100644 +--- a/drivers/dma/idxd/registers.h ++++ b/drivers/dma/idxd/registers.h +@@ -43,7 +43,8 @@ union wq_cap_reg { + struct { + u64 total_wq_size:16; + u64 num_wqs:8; +- u64 rsvd:24; ++ u64 wqcfg_size:4; ++ u64 rsvd:20; + u64 shared_mode:1; + u64 dedicated_mode:1; + u64 rsvd2:1; +@@ -55,6 +56,7 @@ union wq_cap_reg { + u64 bits; + } __packed; + #define IDXD_WQCAP_OFFSET 0x20 ++#define IDXD_WQCFG_MIN 5 + + union group_cap_reg { + struct { +@@ -333,4 +335,23 @@ union wqcfg { + }; + u32 bits[8]; + } __packed; ++ ++/* ++ * This macro calculates the offset into the WQCFG register ++ * idxd - struct idxd * ++ * n - wq id ++ * ofs - the index of the 32b dword for the config register ++ * ++ * The WQCFG register block is divided into groups per each wq. The n index ++ * allows us to move to the register group that's for that particular wq. ++ * Each register is 32bits. The ofs gives us the number of register to access. ++ */ ++#define WQCFG_OFFSET(_idxd_dev, n, ofs) \ ++({\ ++ typeof(_idxd_dev) __idxd_dev = (_idxd_dev); \ ++ (__idxd_dev)->wqcfg_offset + (n) * (__idxd_dev)->wqcfg_size + sizeof(u32) * (ofs); \ ++}) ++ ++#define WQCFG_STRIDES(_idxd_dev) ((_idxd_dev)->wqcfg_size / sizeof(u32)) ++ + #endif +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-ti-omap-dma-block-pm-if-sdma-is-busy-to-fi.patch b/queue-5.9/dmaengine-ti-omap-dma-block-pm-if-sdma-is-busy-to-fi.patch new file mode 100644 index 00000000000..959589e0687 --- /dev/null +++ b/queue-5.9/dmaengine-ti-omap-dma-block-pm-if-sdma-is-busy-to-fi.patch @@ -0,0 +1,96 @@ +From 219c75eb66fbd8ba62563d3c0a51ab383c6717ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 17:40:13 +0200 +Subject: dmaengine: ti: omap-dma: Block PM if SDMA is busy to fix audio + +From: Tony Lindgren + +[ Upstream commit 29a25b9246f7f24203d30d59424cbe22bd905dfc ] + +We now use cpu_pm for saving and restoring device context for deeper SoC +idle states. But for omap3, we must also block idle if SDMA is busy. + +If we don't block idle when SDMA is busy, we eventually end up saving and +restoring SDMA register state on PER domain idle while SDMA is active and +that causes at least audio playback to fail. + +Fixes: 4c74ecf79227 ("dmaengine: ti: omap-dma: Add device tree match data and use it for cpu_pm") +Reported-by: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Tested-by: Peter Ujfalusi +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20201109154013.11950-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/omap-dma.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c +index 918301e175525..3339f0952074a 100644 +--- a/drivers/dma/ti/omap-dma.c ++++ b/drivers/dma/ti/omap-dma.c +@@ -1522,29 +1522,38 @@ static void omap_dma_free(struct omap_dmadev *od) + } + } + ++/* Currently used by omap2 & 3 to block deeper SoC idle states */ ++static bool omap_dma_busy(struct omap_dmadev *od) ++{ ++ struct omap_chan *c; ++ int lch = -1; ++ ++ while (1) { ++ lch = find_next_bit(od->lch_bitmap, od->lch_count, lch + 1); ++ if (lch >= od->lch_count) ++ break; ++ c = od->lch_map[lch]; ++ if (!c) ++ continue; ++ if (omap_dma_chan_read(c, CCR) & CCR_ENABLE) ++ return true; ++ } ++ ++ return false; ++} ++ + /* Currently only used for omap2. For omap1, also a check for lcd_dma is needed */ + static int omap_dma_busy_notifier(struct notifier_block *nb, + unsigned long cmd, void *v) + { + struct omap_dmadev *od; +- struct omap_chan *c; +- int lch = -1; + + od = container_of(nb, struct omap_dmadev, nb); + + switch (cmd) { + case CPU_CLUSTER_PM_ENTER: +- while (1) { +- lch = find_next_bit(od->lch_bitmap, od->lch_count, +- lch + 1); +- if (lch >= od->lch_count) +- break; +- c = od->lch_map[lch]; +- if (!c) +- continue; +- if (omap_dma_chan_read(c, CCR) & CCR_ENABLE) +- return NOTIFY_BAD; +- } ++ if (omap_dma_busy(od)) ++ return NOTIFY_BAD; + break; + case CPU_CLUSTER_PM_ENTER_FAILED: + case CPU_CLUSTER_PM_EXIT: +@@ -1595,6 +1604,8 @@ static int omap_dma_context_notifier(struct notifier_block *nb, + + switch (cmd) { + case CPU_CLUSTER_PM_ENTER: ++ if (omap_dma_busy(od)) ++ return NOTIFY_BAD; + omap_dma_context_save(od); + break; + case CPU_CLUSTER_PM_ENTER_FAILED: +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-xilinx_dma-fix-sg-capability-check-for-mcd.patch b/queue-5.9/dmaengine-xilinx_dma-fix-sg-capability-check-for-mcd.patch new file mode 100644 index 00000000000..a28a080cc0b --- /dev/null +++ b/queue-5.9/dmaengine-xilinx_dma-fix-sg-capability-check-for-mcd.patch @@ -0,0 +1,45 @@ +From f1a0dbdbe1ae942b4756126aa8ed51f899a7098f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 12:30:06 +0530 +Subject: dmaengine: xilinx_dma: Fix SG capability check for MCDMA + +From: Matthew Murrian + +[ Upstream commit 96d5d884f78306206d745d856aad322becd100c3 ] + +The SG capability is inherently present with Multichannel DMA operation. +The register used to check for this capability with other DMA driver types +is not defined for MCDMA. + +Fixes: 6ccd692bfb7f ("dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support") +Signed-off-by: Matthew Murrian +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1604473206-32573-4-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index f0662f6672ff9..0fc432567b857 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2875,10 +2875,11 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev, + chan->stop_transfer = xilinx_dma_stop_transfer; + } + +- /* check if SG is enabled (only for AXIDMA and CDMA) */ ++ /* check if SG is enabled (only for AXIDMA, AXIMCDMA, and CDMA) */ + if (xdev->dma_config->dmatype != XDMA_TYPE_VDMA) { +- if (dma_ctrl_read(chan, XILINX_DMA_REG_DMASR) & +- XILINX_DMA_DMASR_SG_MASK) ++ if (xdev->dma_config->dmatype == XDMA_TYPE_AXIMCDMA || ++ dma_ctrl_read(chan, XILINX_DMA_REG_DMASR) & ++ XILINX_DMA_DMASR_SG_MASK) + chan->has_sg = true; + dev_dbg(chan->dev, "ch %d: SG %s\n", chan->id, + chan->has_sg ? "enabled" : "disabled"); +-- +2.27.0 + diff --git a/queue-5.9/dmaengine-xilinx_dma-fix-usage-of-xilinx_aximcdma_tx.patch b/queue-5.9/dmaengine-xilinx_dma-fix-usage-of-xilinx_aximcdma_tx.patch new file mode 100644 index 00000000000..76b43e3de79 --- /dev/null +++ b/queue-5.9/dmaengine-xilinx_dma-fix-usage-of-xilinx_aximcdma_tx.patch @@ -0,0 +1,120 @@ +From d37399298bdff962aabca35932e09379e6cb2be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 12:30:05 +0530 +Subject: dmaengine: xilinx_dma: Fix usage of xilinx_aximcdma_tx_segment + +From: Matthew Murrian + +[ Upstream commit c8ae7932997d0cc92d016829138074c7520248e5 ] + +Several code sections incorrectly use struct xilinx_axidma_tx_segment +instead of struct xilinx_aximcdma_tx_segment when operating as +Multichannel DMA. As their structures are similar, this just works. + +Fixes: 6ccd692bfb7f ("dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support") +Signed-off-by: Matthew Murrian +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1604473206-32573-3-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 29 ++++++++++++++++++++++++----- + 1 file changed, 24 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 5429497d3560b..f0662f6672ff9 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -948,8 +948,10 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan, + { + struct xilinx_cdma_tx_segment *cdma_seg; + struct xilinx_axidma_tx_segment *axidma_seg; ++ struct xilinx_aximcdma_tx_segment *aximcdma_seg; + struct xilinx_cdma_desc_hw *cdma_hw; + struct xilinx_axidma_desc_hw *axidma_hw; ++ struct xilinx_aximcdma_desc_hw *aximcdma_hw; + struct list_head *entry; + u32 residue = 0; + +@@ -961,13 +963,23 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan, + cdma_hw = &cdma_seg->hw; + residue += (cdma_hw->control - cdma_hw->status) & + chan->xdev->max_buffer_len; +- } else { ++ } else if (chan->xdev->dma_config->dmatype == ++ XDMA_TYPE_AXIDMA) { + axidma_seg = list_entry(entry, + struct xilinx_axidma_tx_segment, + node); + axidma_hw = &axidma_seg->hw; + residue += (axidma_hw->control - axidma_hw->status) & + chan->xdev->max_buffer_len; ++ } else { ++ aximcdma_seg = ++ list_entry(entry, ++ struct xilinx_aximcdma_tx_segment, ++ node); ++ aximcdma_hw = &aximcdma_seg->hw; ++ residue += ++ (aximcdma_hw->control - aximcdma_hw->status) & ++ chan->xdev->max_buffer_len; + } + } + +@@ -1135,7 +1147,7 @@ static int xilinx_dma_alloc_chan_resources(struct dma_chan *dchan) + upper_32_bits(chan->seg_p + sizeof(*chan->seg_mv) * + ((i + 1) % XILINX_DMA_NUM_DESCS)); + chan->seg_mv[i].phys = chan->seg_p + +- sizeof(*chan->seg_v) * i; ++ sizeof(*chan->seg_mv) * i; + list_add_tail(&chan->seg_mv[i].node, + &chan->free_seg_list); + } +@@ -1560,7 +1572,7 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan) + static void xilinx_mcdma_start_transfer(struct xilinx_dma_chan *chan) + { + struct xilinx_dma_tx_descriptor *head_desc, *tail_desc; +- struct xilinx_axidma_tx_segment *tail_segment; ++ struct xilinx_aximcdma_tx_segment *tail_segment; + u32 reg; + + /* +@@ -1582,7 +1594,7 @@ static void xilinx_mcdma_start_transfer(struct xilinx_dma_chan *chan) + tail_desc = list_last_entry(&chan->pending_list, + struct xilinx_dma_tx_descriptor, node); + tail_segment = list_last_entry(&tail_desc->segments, +- struct xilinx_axidma_tx_segment, node); ++ struct xilinx_aximcdma_tx_segment, node); + + reg = dma_ctrl_read(chan, XILINX_MCDMA_CHAN_CR_OFFSET(chan->tdest)); + +@@ -1864,6 +1876,7 @@ static void append_desc_queue(struct xilinx_dma_chan *chan, + struct xilinx_vdma_tx_segment *tail_segment; + struct xilinx_dma_tx_descriptor *tail_desc; + struct xilinx_axidma_tx_segment *axidma_tail_segment; ++ struct xilinx_aximcdma_tx_segment *aximcdma_tail_segment; + struct xilinx_cdma_tx_segment *cdma_tail_segment; + + if (list_empty(&chan->pending_list)) +@@ -1885,11 +1898,17 @@ static void append_desc_queue(struct xilinx_dma_chan *chan, + struct xilinx_cdma_tx_segment, + node); + cdma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys; +- } else { ++ } else if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) { + axidma_tail_segment = list_last_entry(&tail_desc->segments, + struct xilinx_axidma_tx_segment, + node); + axidma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys; ++ } else { ++ aximcdma_tail_segment = ++ list_last_entry(&tail_desc->segments, ++ struct xilinx_aximcdma_tx_segment, ++ node); ++ aximcdma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys; + } + + /* +-- +2.27.0 + diff --git a/queue-5.9/drm-bridge-dw-hdmi-avoid-resetting-force-in-the-dete.patch b/queue-5.9/drm-bridge-dw-hdmi-avoid-resetting-force-in-the-dete.patch new file mode 100644 index 00000000000..d5279ebdb6e --- /dev/null +++ b/queue-5.9/drm-bridge-dw-hdmi-avoid-resetting-force-in-the-dete.patch @@ -0,0 +1,62 @@ +From ff84b4ca993f16965a929401586ca16633227510 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 19:17:47 +1100 +Subject: drm: bridge: dw-hdmi: Avoid resetting force in the detect function + +From: Jonathan Liu + +[ Upstream commit bc551d776b691022f49b5bb5379bd58f7c4eb76a ] + +It has been observed that resetting force in the detect function can +result in the PHY being powered down in response to hot-plug detect +being asserted, even when the HDMI connector is forced on. + +Enabling debug messages and adding a call to dump_stack() in +dw_hdmi_phy_power_off() shows the following in dmesg: +[ 160.637413] dwhdmi-rockchip ff940000.hdmi: EVENT=plugin +[ 160.637433] dwhdmi-rockchip ff940000.hdmi: PHY powered down in 0 iterations + +Call trace: +dw_hdmi_phy_power_off +dw_hdmi_phy_disable +dw_hdmi_update_power +dw_hdmi_detect +dw_hdmi_connector_detect +drm_helper_probe_detect_ctx +drm_helper_hpd_irq_event +dw_hdmi_irq +irq_thread_fn +irq_thread +kthread +ret_from_fork + +Fixes: 381f05a7a842 ("drm: bridge/dw_hdmi: add connector mode forcing") +Signed-off-by: Jonathan Liu +Reviewed-by: Sam Ravnborg +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20201031081747.372599-1-net147@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 748df1cacd2b7..0c79a9ba48bb6 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -2327,12 +2327,6 @@ static enum drm_connector_status dw_hdmi_detect(struct dw_hdmi *hdmi) + { + enum drm_connector_status result; + +- mutex_lock(&hdmi->mutex); +- hdmi->force = DRM_FORCE_UNSPECIFIED; +- dw_hdmi_update_power(hdmi); +- dw_hdmi_update_phy_mask(hdmi); +- mutex_unlock(&hdmi->mutex); +- + result = hdmi->phy.ops->read_hpd(hdmi, hdmi->phy.data); + + mutex_lock(&hdmi->mutex); +-- +2.27.0 + diff --git a/queue-5.9/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch b/queue-5.9/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch new file mode 100644 index 00000000000..68f408faddd --- /dev/null +++ b/queue-5.9/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch @@ -0,0 +1,38 @@ +From 66010159a606a4a3e6301dab6afb17c8b67a3cd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 09:09:29 +0800 +Subject: drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() + +From: Xiongfeng Wang + +[ Upstream commit 6654b57866b98230a270953dd34f67de17ab1708 ] + +Fix to return a negative error code from the error handling case instead +of 0 in function sun8i_dw_hdmi_bind(). + +Fixes: b7c7436a5ff0 ("drm/sun4i: Implement A83T HDMI driver") +Reported-by: Hulk Robot +Signed-off-by: Xiongfeng Wang +Reviewed-by: Jernej Skrabec +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/1605488969-5211-1-git-send-email-wangxiongfeng2@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index d4c08043dd81d..92add2cef2e7d 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -208,6 +208,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master, + phy_node = of_parse_phandle(dev->of_node, "phys", 0); + if (!phy_node) { + dev_err(dev, "Can't found PHY phandle\n"); ++ ret = -EINVAL; + goto err_disable_clk_tmds; + } + +-- +2.27.0 + diff --git a/queue-5.9/efi-arm-set-hsctlr-thumb2-bit-correctly-for-hvc-call.patch b/queue-5.9/efi-arm-set-hsctlr-thumb2-bit-correctly-for-hvc-call.patch new file mode 100644 index 00000000000..f03ed9b7d68 --- /dev/null +++ b/queue-5.9/efi-arm-set-hsctlr-thumb2-bit-correctly-for-hvc-call.patch @@ -0,0 +1,49 @@ +From 8c69b01dfc92bd40ca837c340351f5e91900662c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Oct 2020 17:28:27 +0200 +Subject: efi/arm: set HSCTLR Thumb2 bit correctly for HVC calls from HYP + +From: Ard Biesheuvel + +[ Upstream commit fbc81ec5b85d43a4b22e49ec0e643fa7dec2ea40 ] + +Commit + + db227c19e68db353 ("ARM: 8985/1: efi/decompressor: deal with HYP mode boot gracefully") + +updated the EFI entry code to permit firmware to invoke the EFI stub +loader in HYP mode, with the MMU either enabled or disabled, neither +of which is permitted by the EFI spec, but which does happen in the +field. + +In the MMU on case, we remain in HYP mode as configured by the firmware, +and rely on the fact that any HVC instruction issued in this mode will +be dispatched via the SVC slot in the HYP vector table. However, this +slot will point to a Thumb2 symbol if the kernel is built in Thumb2 +mode, and so we have to configure HSCTLR to ensure that the exception +handlers are invoked in Thumb2 mode as well. + +Fixes: db227c19e68db353 ("ARM: 8985/1: efi/decompressor: deal with HYP mode boot gracefully") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/head.S | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index 434a16982e344..19499d636bc88 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -1476,6 +1476,9 @@ ENTRY(efi_enter_kernel) + @ issued from HYP mode take us to the correct handler code. We + @ will disable the MMU before jumping to the kernel proper. + @ ++ ARM( bic r1, r1, #(1 << 30) ) @ clear HSCTLR.TE ++ THUMB( orr r1, r1, #(1 << 30) ) @ set HSCTLR.TE ++ mcr p15, 4, r1, c1, c0, 0 + adr r0, __hyp_reentry_vectors + mcr p15, 4, r0, c12, c0, 0 @ set HYP vector base (HVBAR) + isb +-- +2.27.0 + diff --git a/queue-5.9/efi-x86-free-efi_pgd-with-free_pages.patch b/queue-5.9/efi-x86-free-efi_pgd-with-free_pages.patch new file mode 100644 index 00000000000..69a881f81a3 --- /dev/null +++ b/queue-5.9/efi-x86-free-efi_pgd-with-free_pages.patch @@ -0,0 +1,83 @@ +From 3a5eedf54c083302ff55ae54cb4d69ec8288eedb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 11:39:19 -0500 +Subject: efi/x86: Free efi_pgd with free_pages() + +From: Arvind Sankar + +[ Upstream commit c2fe61d8be491ff8188edaf22e838f819999146b ] + +Commit + + d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD") + +changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in +the error path it should be freed using free_pages() rather than +free_page(). + +Commit + + 06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()") + +fixed one instance of this, but missed another. + +Move the freeing out-of-line to avoid code duplication and fix this bug. + +Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD") +Link: https://lore.kernel.org/r/20201110163919.1134431-1-nivedita@alum.mit.edu +Signed-off-by: Arvind Sankar +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/x86/platform/efi/efi_64.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index 6af4da1149bac..5ce50adb6fd0c 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -77,28 +77,30 @@ int __init efi_alloc_page_tables(void) + gfp_mask = GFP_KERNEL | __GFP_ZERO; + efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER); + if (!efi_pgd) +- return -ENOMEM; ++ goto fail; + + pgd = efi_pgd + pgd_index(EFI_VA_END); + p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END); +- if (!p4d) { +- free_page((unsigned long)efi_pgd); +- return -ENOMEM; +- } ++ if (!p4d) ++ goto free_pgd; + + pud = pud_alloc(&init_mm, p4d, EFI_VA_END); +- if (!pud) { +- if (pgtable_l5_enabled()) +- free_page((unsigned long) pgd_page_vaddr(*pgd)); +- free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER); +- return -ENOMEM; +- } ++ if (!pud) ++ goto free_p4d; + + efi_mm.pgd = efi_pgd; + mm_init_cpumask(&efi_mm); + init_new_context(NULL, &efi_mm); + + return 0; ++ ++free_p4d: ++ if (pgtable_l5_enabled()) ++ free_page((unsigned long)pgd_page_vaddr(*pgd)); ++free_pgd: ++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER); ++fail: ++ return -ENOMEM; + } + + /* +-- +2.27.0 + diff --git a/queue-5.9/fail_function-remove-a-redundant-mutex-unlock.patch b/queue-5.9/fail_function-remove-a-redundant-mutex-unlock.patch new file mode 100644 index 00000000000..67e29d381fa --- /dev/null +++ b/queue-5.9/fail_function-remove-a-redundant-mutex-unlock.patch @@ -0,0 +1,51 @@ +From aa9f02869d4b43ff33f51d7e65da20cdfa028eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 22:49:31 +0900 +Subject: fail_function: Remove a redundant mutex unlock + +From: Luo Meng + +[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ] + +Fix a mutex_unlock() issue where before copy_from_user() is +not called mutex_locked. + +Fixes: 4b1a29a7f542 ("error-injection: Support fault injection framework") +Reported-by: Hulk Robot +Signed-off-by: Luo Meng +Signed-off-by: Masami Hiramatsu +Signed-off-by: Alexei Starovoitov +Acked-by: Masami Hiramatsu +Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + kernel/fail_function.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/fail_function.c b/kernel/fail_function.c +index 63b349168da72..b0b1ad93fa957 100644 +--- a/kernel/fail_function.c ++++ b/kernel/fail_function.c +@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer, + + if (copy_from_user(buf, buffer, count)) { + ret = -EFAULT; +- goto out; ++ goto out_free; + } + buf[count] = '\0'; + sym = strstrip(buf); +@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer, + ret = count; + } + out: +- kfree(buf); + mutex_unlock(&fei_lock); ++out_free: ++ kfree(buf); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.9/hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch b/queue-5.9/hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch new file mode 100644 index 00000000000..2f81feed6c2 --- /dev/null +++ b/queue-5.9/hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch @@ -0,0 +1,100 @@ +From 7a9ec483ca173d4baebfcd6b9e73197dc796751b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 22:20:56 +0100 +Subject: HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver + +From: Hans de Goede + +[ Upstream commit b4c00e7976636f33a4f67eab436a11666c8afd60 ] + +Some users are pairing the Dinovo keyboards with the MX5000 or MX5500 +receivers, instead of with the Dinovo receivers. The receivers are +mostly the same (and the air protocol obviously is compatible) but +currently the Dinovo receivers are handled by hid-lg.c while the +MX5x00 receivers are handled by logitech-dj.c. + +When using a Dinovo keyboard, with its builtin touchpad, through +logitech-dj.c then the touchpad stops working because when asking the +receiver for paired devices, we get only 1 paired device with +a device_type of REPORT_TYPE_KEYBOARD. And since we don't see a paired +mouse, we have nowhere to send mouse-events to, so we drop them. + +Extend the existing fix for the Dinovo Edge for this to also cover the +Dinovo Mini keyboard and also add a mapping to logitech-hidpp for the +Media key on the Dinovo Mini, so that that keeps working too. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424 +Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver") +Signed-off-by: Hans de Goede +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 1 + + drivers/hid/hid-logitech-hidpp.c | 25 +++++++++++++++++++++++++ + 2 files changed, 26 insertions(+) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 1cafb65428b04..389f953c1f12c 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -875,6 +875,7 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev, + */ + static const u16 kbd_builtin_touchpad_ids[] = { + 0xb309, /* Dinovo Edge */ ++ 0xb30c, /* Dinovo Mini */ + }; + + static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev, +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 730036650f7df..a2991622702ae 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -93,6 +93,8 @@ MODULE_PARM_DESC(disable_tap_to_click, + #define HIDPP_CAPABILITY_BATTERY_LEVEL_STATUS BIT(3) + #define HIDPP_CAPABILITY_BATTERY_VOLTAGE BIT(4) + ++#define lg_map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c)) ++ + /* + * There are two hidpp protocols in use, the first version hidpp10 is known + * as register access protocol or RAP, the second version hidpp20 is known as +@@ -2950,6 +2952,26 @@ static int g920_get_config(struct hidpp_device *hidpp, + return g920_ff_set_autocenter(hidpp, data); + } + ++/* -------------------------------------------------------------------------- */ ++/* Logitech Dinovo Mini keyboard with builtin touchpad */ ++/* -------------------------------------------------------------------------- */ ++#define DINOVO_MINI_PRODUCT_ID 0xb30c ++ ++static int lg_dinovo_input_mapping(struct hid_device *hdev, struct hid_input *hi, ++ struct hid_field *field, struct hid_usage *usage, ++ unsigned long **bit, int *max) ++{ ++ if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR) ++ return 0; ++ ++ switch (usage->hid & HID_USAGE) { ++ case 0x00d: lg_map_key_clear(KEY_MEDIA); break; ++ default: ++ return 0; ++ } ++ return 1; ++} ++ + /* -------------------------------------------------------------------------- */ + /* HID++1.0 devices which use HID++ reports for their wheels */ + /* -------------------------------------------------------------------------- */ +@@ -3185,6 +3207,9 @@ static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi, + field->application != HID_GD_MOUSE) + return m560_input_mapping(hdev, hi, field, usage, bit, max); + ++ if (hdev->product == DINOVO_MINI_PRODUCT_ID) ++ return lg_dinovo_input_mapping(hdev, hi, field, usage, bit, max); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.9/hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch b/queue-5.9/hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch new file mode 100644 index 00000000000..85130daae59 --- /dev/null +++ b/queue-5.9/hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch @@ -0,0 +1,87 @@ +From 8ef2ca5fb27caf4bdb8d3ed82bb5831a4d540a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 14:36:56 +0100 +Subject: HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin + trackpad + +From: Hans de Goede + +[ Upstream commit ee5e58418a854755201eb4952b1230d873a457d5 ] + +Some quad/bluetooth keyboards, such as the Dinovo Edge (Y-RAY81) have a +builtin touchpad. In this case when asking the receiver for paired devices, +we get only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. + +This means that we do not instantiate a second dj_hiddev for the mouse +(as we normally would) and thus there is no place for us to forward the +mouse input reports to, causing the touchpad part of the keyboard to not +work. + +There is no way for us to detect these keyboards, so this commit adds +an array with device-ids for such keyboards and when a keyboard is on +this list it adds STD_MOUSE to the reports_supported bitmap for the +dj_hiddev created for the keyboard fixing the touchpad not working. + +Using a list of device-ids for this is not ideal, but there are only +very few such keyboards so this should be fine. Besides the Dinovo Edge, +other known wireless Logitech keyboards with a builtin touchpad are: + +* Dinovo Mini (TODO add its device-id to the list) +* K400 (uses a unifying receiver so is not affected) +* K600 (uses a unifying receiver so is not affected) + +Cc: stable@vger.kernel.org +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424 +Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver") +Signed-off-by: Hans de Goede +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 38ee25a813b9e..1cafb65428b04 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -866,11 +866,23 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev, + schedule_work(&djrcv_dev->work); + } + ++/* ++ * Some quad/bluetooth keyboards have a builtin touchpad in this case we see ++ * only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. For the ++ * touchpad to work we must also forward mouse input reports to the dj_hiddev ++ * created for the keyboard (instead of forwarding them to a second paired ++ * device with a device_type of REPORT_TYPE_MOUSE as we normally would). ++ */ ++static const u16 kbd_builtin_touchpad_ids[] = { ++ 0xb309, /* Dinovo Edge */ ++}; ++ + static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev, + struct hidpp_event *hidpp_report, + struct dj_workitem *workitem) + { + struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev); ++ int i, id; + + workitem->type = WORKITEM_TYPE_PAIRED; + workitem->device_type = hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] & +@@ -882,6 +894,13 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev, + workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA | + POWER_KEYS | MEDIA_CENTER | + HIDPP; ++ id = (workitem->quad_id_msb << 8) | workitem->quad_id_lsb; ++ for (i = 0; i < ARRAY_SIZE(kbd_builtin_touchpad_ids); i++) { ++ if (id == kbd_builtin_touchpad_ids[i]) { ++ workitem->reports_supported |= STD_MOUSE; ++ break; ++ } ++ } + break; + case REPORT_TYPE_MOUSE: + workitem->reports_supported |= STD_MOUSE | HIDPP; +-- +2.27.0 + diff --git a/queue-5.9/hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch b/queue-5.9/hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch new file mode 100644 index 00000000000..1e1aa1035a6 --- /dev/null +++ b/queue-5.9/hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch @@ -0,0 +1,37 @@ +From 668fe9f23c9f4f26b2f174f6beb7c89fdfd1e593 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 06:56:12 -0700 +Subject: HID: logitech-hidpp: Add PID for MX Anywhere 2 + +From: Harry Cutts + +[ Upstream commit b59f38dbfd5d19eb7e03d8b639f0c0d385ba8cc5 ] + +It seems that the PID 0x4072 was missing from the list Logitech gave me +for this mouse, as I found one with it in the wild (with which I tested +this patch). + +Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice") +Signed-off-by: Harry Cutts +Acked-by: Peter Hutterer +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index b8b53dc95e86b..730036650f7df 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3947,6 +3947,7 @@ static const struct hid_device_id hidpp_devices[] = { + LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, + { /* Mouse Logitech MX Anywhere 2 */ + LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, ++ { LDJ_DEVICE(0x4072), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, + { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, + { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, + { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 }, +-- +2.27.0 + diff --git a/queue-5.9/hid-mcp2221-fix-gpio-output-handling.patch b/queue-5.9/hid-mcp2221-fix-gpio-output-handling.patch new file mode 100644 index 00000000000..9aea0014043 --- /dev/null +++ b/queue-5.9/hid-mcp2221-fix-gpio-output-handling.patch @@ -0,0 +1,157 @@ +From f777e8428dc6cb7a4655504fa73f4dd5d76d64e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 23:02:23 +0100 +Subject: HID: mcp2221: Fix GPIO output handling + +From: Lars Povlsen + +[ Upstream commit 567b8e9fed8add9e20885be38ecd73bb0e07406b ] + +The mcp2221 driver GPIO output handling has has several issues. + +* A wrong value is used for the GPIO direction. + +* Wrong offsets are calculated for some GPIO set value/set direction + operations, when offset is larger than 0. + +This has been fixed by introducing proper manifest constants for the +direction encoding, and using 'offsetof' when calculating GPIO +register offsets. + +The updated driver has been tested with the Sparx5 pcb134/pcb135 +board, which has the mcp2221 device with several (output) GPIO's. + +Fixes: 328de1c519c5c092 ("HID: mcp2221: add GPIO functionality support") +Reviewed-by: Rishi Gupta +Signed-off-by: Lars Povlsen +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-mcp2221.c | 48 +++++++++++++++++++++++++++++++-------- + 1 file changed, 39 insertions(+), 9 deletions(-) + +diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c +index 0d27ccb55dd93..4211b9839209b 100644 +--- a/drivers/hid/hid-mcp2221.c ++++ b/drivers/hid/hid-mcp2221.c +@@ -49,6 +49,36 @@ enum { + MCP2221_ALT_F_NOT_GPIOD = 0xEF, + }; + ++/* MCP GPIO direction encoding */ ++enum { ++ MCP2221_DIR_OUT = 0x00, ++ MCP2221_DIR_IN = 0x01, ++}; ++ ++#define MCP_NGPIO 4 ++ ++/* MCP GPIO set command layout */ ++struct mcp_set_gpio { ++ u8 cmd; ++ u8 dummy; ++ struct { ++ u8 change_value; ++ u8 value; ++ u8 change_direction; ++ u8 direction; ++ } gpio[MCP_NGPIO]; ++} __packed; ++ ++/* MCP GPIO get command layout */ ++struct mcp_get_gpio { ++ u8 cmd; ++ u8 dummy; ++ struct { ++ u8 direction; ++ u8 value; ++ } gpio[MCP_NGPIO]; ++} __packed; ++ + /* + * There is no way to distinguish responses. Therefore next command + * is sent only after response to previous has been received. Mutex +@@ -542,7 +572,7 @@ static int mcp_gpio_get(struct gpio_chip *gc, + + mcp->txbuf[0] = MCP2221_GPIO_GET; + +- mcp->gp_idx = (offset + 1) * 2; ++ mcp->gp_idx = offsetof(struct mcp_get_gpio, gpio[offset].value); + + mutex_lock(&mcp->lock); + ret = mcp_send_data_req_status(mcp, mcp->txbuf, 1); +@@ -559,7 +589,7 @@ static void mcp_gpio_set(struct gpio_chip *gc, + memset(mcp->txbuf, 0, 18); + mcp->txbuf[0] = MCP2221_GPIO_SET; + +- mcp->gp_idx = ((offset + 1) * 4) - 1; ++ mcp->gp_idx = offsetof(struct mcp_set_gpio, gpio[offset].value); + + mcp->txbuf[mcp->gp_idx - 1] = 1; + mcp->txbuf[mcp->gp_idx] = !!value; +@@ -575,7 +605,7 @@ static int mcp_gpio_dir_set(struct mcp2221 *mcp, + memset(mcp->txbuf, 0, 18); + mcp->txbuf[0] = MCP2221_GPIO_SET; + +- mcp->gp_idx = (offset + 1) * 5; ++ mcp->gp_idx = offsetof(struct mcp_set_gpio, gpio[offset].direction); + + mcp->txbuf[mcp->gp_idx - 1] = 1; + mcp->txbuf[mcp->gp_idx] = val; +@@ -590,7 +620,7 @@ static int mcp_gpio_direction_input(struct gpio_chip *gc, + struct mcp2221 *mcp = gpiochip_get_data(gc); + + mutex_lock(&mcp->lock); +- ret = mcp_gpio_dir_set(mcp, offset, 0); ++ ret = mcp_gpio_dir_set(mcp, offset, MCP2221_DIR_IN); + mutex_unlock(&mcp->lock); + + return ret; +@@ -603,7 +633,7 @@ static int mcp_gpio_direction_output(struct gpio_chip *gc, + struct mcp2221 *mcp = gpiochip_get_data(gc); + + mutex_lock(&mcp->lock); +- ret = mcp_gpio_dir_set(mcp, offset, 1); ++ ret = mcp_gpio_dir_set(mcp, offset, MCP2221_DIR_OUT); + mutex_unlock(&mcp->lock); + + /* Can't configure as output, bailout early */ +@@ -623,7 +653,7 @@ static int mcp_gpio_get_direction(struct gpio_chip *gc, + + mcp->txbuf[0] = MCP2221_GPIO_GET; + +- mcp->gp_idx = (offset + 1) * 2; ++ mcp->gp_idx = offsetof(struct mcp_get_gpio, gpio[offset].direction); + + mutex_lock(&mcp->lock); + ret = mcp_send_data_req_status(mcp, mcp->txbuf, 1); +@@ -632,7 +662,7 @@ static int mcp_gpio_get_direction(struct gpio_chip *gc, + if (ret) + return ret; + +- if (mcp->gpio_dir) ++ if (mcp->gpio_dir == MCP2221_DIR_IN) + return GPIO_LINE_DIRECTION_IN; + + return GPIO_LINE_DIRECTION_OUT; +@@ -758,7 +788,7 @@ static int mcp2221_raw_event(struct hid_device *hdev, + mcp->status = -ENOENT; + } else { + mcp->status = !!data[mcp->gp_idx]; +- mcp->gpio_dir = !!data[mcp->gp_idx + 1]; ++ mcp->gpio_dir = data[mcp->gp_idx + 1]; + } + break; + default: +@@ -860,7 +890,7 @@ static int mcp2221_probe(struct hid_device *hdev, + mcp->gc->get_direction = mcp_gpio_get_direction; + mcp->gc->set = mcp_gpio_set; + mcp->gc->get = mcp_gpio_get; +- mcp->gc->ngpio = 4; ++ mcp->gc->ngpio = MCP_NGPIO; + mcp->gc->base = -1; + mcp->gc->can_sleep = 1; + mcp->gc->parent = &hdev->dev; +-- +2.27.0 + diff --git a/queue-5.9/ib-hfi1-fix-error-return-code-in-hfi1_init_dd.patch b/queue-5.9/ib-hfi1-fix-error-return-code-in-hfi1_init_dd.patch new file mode 100644 index 00000000000..3286f204b96 --- /dev/null +++ b/queue-5.9/ib-hfi1-fix-error-return-code-in-hfi1_init_dd.patch @@ -0,0 +1,40 @@ +From 0f72d90ecb671a249a7535f5a8499aad3e0162af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 14:42:27 +0800 +Subject: IB/hfi1: Fix error return code in hfi1_init_dd() + +From: Zhang Changzhong + +[ Upstream commit dabbd6abcdbeb1358a53ec28a244429320eb0e3a ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 4730f4a6c6b2 ("IB/hfi1: Activate the dummy netdev") +Link: https://lore.kernel.org/r/1605249747-17942-1-git-send-email-zhangchangzhong@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Acked-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/chip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 7eaf995382168..c87b94ea29397 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -15245,7 +15245,8 @@ int hfi1_init_dd(struct hfi1_devdata *dd) + & CCE_REVISION_SW_MASK); + + /* alloc netdev data */ +- if (hfi1_netdev_alloc(dd)) ++ ret = hfi1_netdev_alloc(dd); ++ if (ret) + goto bail_cleanup; + + ret = set_up_context_variables(dd); +-- +2.27.0 + diff --git a/queue-5.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch b/queue-5.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch new file mode 100644 index 00000000000..f3076a498e6 --- /dev/null +++ b/queue-5.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch @@ -0,0 +1,38 @@ +From 961e934c29002c6766cff2ba0499e664a68e8b81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 17:10:09 -0700 +Subject: Input: adxl34x - clean up a data type in adxl34x_probe() + +From: Dan Carpenter + +[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ] + +The "revid" is used to store negative error codes so it should be an int +type. + +Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") +Signed-off-by: Dan Carpenter +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/adxl34x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c +index 5fe92d4ba3f0c..4cc4e8ff42b33 100644 +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, + struct input_dev *input_dev; + const struct adxl34x_platform_data *pdata; + int err, range, i; +- unsigned char revid; ++ int revid; + + if (!irq) { + dev_err(dev, "no IRQ?\n"); +-- +2.27.0 + diff --git a/queue-5.9/input-elan_i2c-fix-firmware-update-on-newer-ics.patch b/queue-5.9/input-elan_i2c-fix-firmware-update-on-newer-ics.patch new file mode 100644 index 00000000000..ae108405a98 --- /dev/null +++ b/queue-5.9/input-elan_i2c-fix-firmware-update-on-newer-ics.patch @@ -0,0 +1,114 @@ +From cacf45da5059bad3faf5e47084395f0b875792f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 20:06:24 -0800 +Subject: Input: elan_i2c - fix firmware update on newer ICs + +From: jingle.wu + +[ Upstream commit ae3d6083acf60116d4f409677452399547ed2009 ] + +The argument to iap page type command depends on the firmware page size. + +Fixes: bfd9b92bc8f9 ("Input: elan_i2c - handle firmware updated on newer ICs") +Signed-off-by: Jingle Wu +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c.h | 2 +- + drivers/input/mouse/elan_i2c_core.c | 3 ++- + drivers/input/mouse/elan_i2c_i2c.c | 10 +++++----- + drivers/input/mouse/elan_i2c_smbus.c | 2 +- + 4 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h +index c75b00c45d750..36e3cd9086716 100644 +--- a/drivers/input/mouse/elan_i2c.h ++++ b/drivers/input/mouse/elan_i2c.h +@@ -78,7 +78,7 @@ struct elan_transport_ops { + int (*iap_reset)(struct i2c_client *client); + + int (*prepare_fw_update)(struct i2c_client *client, u16 ic_type, +- u8 iap_version); ++ u8 iap_version, u16 fw_page_size); + int (*write_fw_block)(struct i2c_client *client, u16 fw_page_size, + const u8 *page, u16 checksum, int idx); + int (*finish_fw_update)(struct i2c_client *client, +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index c599e21a84784..61ed3f5ca2199 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -497,7 +497,8 @@ static int __elan_update_firmware(struct elan_tp_data *data, + u16 sw_checksum = 0, fw_checksum = 0; + + error = data->ops->prepare_fw_update(client, data->ic_type, +- data->iap_version); ++ data->iap_version, ++ data->fw_page_size); + if (error) + return error; + +diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c +index 5a496d4ffa491..13dc097eb6c65 100644 +--- a/drivers/input/mouse/elan_i2c_i2c.c ++++ b/drivers/input/mouse/elan_i2c_i2c.c +@@ -517,7 +517,7 @@ static int elan_i2c_set_flash_key(struct i2c_client *client) + return 0; + } + +-static int elan_read_write_iap_type(struct i2c_client *client) ++static int elan_read_write_iap_type(struct i2c_client *client, u16 fw_page_size) + { + int error; + u16 constant; +@@ -526,7 +526,7 @@ static int elan_read_write_iap_type(struct i2c_client *client) + + do { + error = elan_i2c_write_cmd(client, ETP_I2C_IAP_TYPE_CMD, +- ETP_I2C_IAP_TYPE_REG); ++ fw_page_size / 2); + if (error) { + dev_err(&client->dev, + "cannot write iap type: %d\n", error); +@@ -543,7 +543,7 @@ static int elan_read_write_iap_type(struct i2c_client *client) + constant = le16_to_cpup((__le16 *)val); + dev_dbg(&client->dev, "iap type reg: 0x%04x\n", constant); + +- if (constant == ETP_I2C_IAP_TYPE_REG) ++ if (constant == fw_page_size / 2) + return 0; + + } while (--retry > 0); +@@ -553,7 +553,7 @@ static int elan_read_write_iap_type(struct i2c_client *client) + } + + static int elan_i2c_prepare_fw_update(struct i2c_client *client, u16 ic_type, +- u8 iap_version) ++ u8 iap_version, u16 fw_page_size) + { + struct device *dev = &client->dev; + int error; +@@ -594,7 +594,7 @@ static int elan_i2c_prepare_fw_update(struct i2c_client *client, u16 ic_type, + } + + if (ic_type >= 0x0D && iap_version >= 1) { +- error = elan_read_write_iap_type(client); ++ error = elan_read_write_iap_type(client, fw_page_size); + if (error) + return error; + } +diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c +index 8ff823751f3ba..1820f1cfc1dc4 100644 +--- a/drivers/input/mouse/elan_i2c_smbus.c ++++ b/drivers/input/mouse/elan_i2c_smbus.c +@@ -340,7 +340,7 @@ static int elan_smbus_set_flash_key(struct i2c_client *client) + } + + static int elan_smbus_prepare_fw_update(struct i2c_client *client, u16 ic_type, +- u8 iap_version) ++ u8 iap_version, u16 fw_page_size) + { + struct device *dev = &client->dev; + int len; +-- +2.27.0 + diff --git a/queue-5.9/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch b/queue-5.9/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch new file mode 100644 index 00000000000..6736ffffcc9 --- /dev/null +++ b/queue-5.9/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch @@ -0,0 +1,49 @@ +From eb518f5719574c2406358a270f46352f7ef091e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 17:48:52 -0800 +Subject: Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER + +From: Necip Fazil Yildiran + +[ Upstream commit 676650d007e06fddcf3fe38238251d71bd179641 ] + +When TOUCHSCREEN_ADC is enabled and IIO_BUFFER is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for IIO_BUFFER_CB + Depends on [n]: IIO [=y] && IIO_BUFFER [=n] + Selected by [y]: + - TOUCHSCREEN_ADC [=y] && !UML && INPUT [=y] && INPUT_TOUCHSCREEN [=y] && IIO [=y] + +The reason is that TOUCHSCREEN_ADC selects IIO_BUFFER_CB without depending +on or selecting IIO_BUFFER while IIO_BUFFER_CB depends on IIO_BUFFER. This +can also fail building the kernel. + +Honor the kconfig dependency to remove unmet direct dependency warnings +and avoid any potential build failures. + +Fixes: aa132ffb6b0a ("input: touchscreen: resistive-adc-touch: add generic resistive ADC touchscreen") +Signed-off-by: Necip Fazil Yildiran +Acked-by: Jonathan Cameron +Link: https://lore.kernel.org/r/20201102221504.541279-1-fazilyildiran@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig +index 35c867b2d9a77..e6e043388a972 100644 +--- a/drivers/input/touchscreen/Kconfig ++++ b/drivers/input/touchscreen/Kconfig +@@ -96,6 +96,7 @@ config TOUCHSCREEN_AD7879_SPI + config TOUCHSCREEN_ADC + tristate "Generic ADC based resistive touchscreen" + depends on IIO ++ select IIO_BUFFER + select IIO_BUFFER_CB + help + Say Y here if you want to use the generic ADC +-- +2.27.0 + diff --git a/queue-5.9/iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch b/queue-5.9/iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch new file mode 100644 index 00000000000..afac3bdd453 --- /dev/null +++ b/queue-5.9/iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch @@ -0,0 +1,86 @@ +From f2fd1a6a762f19669251ce83c3320e87bbdbf894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 15:19:08 +0800 +Subject: iommu/vt-d: Avoid panic if iommu init fails in tboot system + +From: Zhenzhong Duan + +[ Upstream commit 4d213e76a359e540ca786ee937da7f35faa8e5f8 ] + +"intel_iommu=off" command line is used to disable iommu but iommu is force +enabled in a tboot system for security reason. + +However for better performance on high speed network device, a new option +"intel_iommu=tboot_noforce" is introduced to disable the force on. + +By default kernel should panic if iommu init fail in tboot for security +reason, but it's unnecessory if we use "intel_iommu=tboot_noforce,off". + +Fix the code setting force_on and move intel_iommu_tboot_noforce +from tboot code to intel iommu code. + +Fixes: 7304e8f28bb2 ("iommu/vt-d: Correctly disable Intel IOMMU force on") +Signed-off-by: Zhenzhong Duan +Tested-by: Lukasz Hawrylko +Acked-by: Lu Baolu +Link: https://lore.kernel.org/r/20201110071908.3133-1-zhenzhong.duan@gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/tboot.c | 3 --- + drivers/iommu/intel/iommu.c | 5 +++-- + include/linux/intel-iommu.h | 1 - + 3 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c +index 992fb1415c0f1..420be871d9d45 100644 +--- a/arch/x86/kernel/tboot.c ++++ b/arch/x86/kernel/tboot.c +@@ -514,9 +514,6 @@ int tboot_force_iommu(void) + if (!tboot_enabled()) + return 0; + +- if (intel_iommu_tboot_noforce) +- return 1; +- + if (no_iommu || swiotlb || dmar_disabled) + pr_warn("Forcing Intel-IOMMU to enabled\n"); + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index e58be1fe7585e..f67b7e6ddf1bc 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -179,7 +179,7 @@ static int rwbf_quirk; + * (used when kernel is launched w/ TXT) + */ + static int force_on = 0; +-int intel_iommu_tboot_noforce; ++static int intel_iommu_tboot_noforce; + static int no_platform_optin; + + #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry)) +@@ -4846,7 +4846,8 @@ int __init intel_iommu_init(void) + * Intel IOMMU is required for a TXT/tboot launch or platform + * opt in, so enforce that. + */ +- force_on = tboot_force_iommu() || platform_optin_force_iommu(); ++ force_on = (!intel_iommu_tboot_noforce && tboot_force_iommu()) || ++ platform_optin_force_iommu(); + + if (iommu_init_mempool()) { + if (force_on) +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 6a3ddaabf3f50..bdf80d7a70fb3 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -791,7 +791,6 @@ extern int iommu_calculate_agaw(struct intel_iommu *iommu); + extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu); + extern int dmar_disabled; + extern int intel_iommu_enabled; +-extern int intel_iommu_tboot_noforce; + extern int intel_iommu_gfx_mapped; + #else + static inline int iommu_calculate_agaw(struct intel_iommu *iommu) +-- +2.27.0 + diff --git a/queue-5.9/iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch b/queue-5.9/iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch new file mode 100644 index 00000000000..915fb99edf8 --- /dev/null +++ b/queue-5.9/iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch @@ -0,0 +1,61 @@ +From bcc1af5edf8bf3d8c9870c2267dc44c791545d2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 19:12:11 +0300 +Subject: iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header + +From: Andy Shevchenko + +[ Upstream commit c7eb900f5f45eeab1ea1bed997a2a12d8b5907bc ] + +Static analyzer is not happy about intel_iommu_gfx_mapped declaration: + +.../drivers/iommu/intel/iommu.c:364:5: warning: symbol 'intel_iommu_gfx_mapped' was not declared. Should it be static? + +Move its declaration to Intel IOMMU header file. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Lu Baolu +Link: https://lore.kernel.org/r/20200828161212.71294-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + include/drm/intel-gtt.h | 5 +---- + include/linux/intel-iommu.h | 1 + + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/include/drm/intel-gtt.h b/include/drm/intel-gtt.h +index 71d81923e6b06..abfefaaf897a0 100644 +--- a/include/drm/intel-gtt.h ++++ b/include/drm/intel-gtt.h +@@ -5,6 +5,7 @@ + #define _DRM_INTEL_GTT_H + + #include ++#include + #include + + void intel_gtt_get(u64 *gtt_total, +@@ -33,8 +34,4 @@ void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries); + /* flag for GFDT type */ + #define AGP_USER_CACHED_MEMORY_GFDT (1 << 3) + +-#ifdef CONFIG_INTEL_IOMMU +-extern int intel_iommu_gfx_mapped; +-#endif +- + #endif +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index b1ed2f25f7c0d..6a3ddaabf3f50 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -792,6 +792,7 @@ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu); + extern int dmar_disabled; + extern int intel_iommu_enabled; + extern int intel_iommu_tboot_noforce; ++extern int intel_iommu_gfx_mapped; + #else + static inline int iommu_calculate_agaw(struct intel_iommu *iommu) + { +-- +2.27.0 + diff --git a/queue-5.9/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch b/queue-5.9/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch new file mode 100644 index 00000000000..1135dea8bef --- /dev/null +++ b/queue-5.9/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch @@ -0,0 +1,70 @@ +From 7e414dc6c2e30a4a2aa774793cba015a3c2ce4b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 16:16:40 -0800 +Subject: ip_tunnels: Set tunnel option flag when tunnel metadata is present + +From: Yi-Hung Wei + +[ Upstream commit 9c2e14b48119b39446031d29d994044ae958d8fc ] + +Currently, we may set the tunnel option flag when the size of metadata +is zero. For example, we set TUNNEL_GENEVE_OPT in the receive function +no matter the geneve option is present or not. As this may result in +issues on the tunnel flags consumers, this patch fixes the issue. + +Related discussion: +* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u + +Fixes: 256c87c17c53 ("net: check tunnel option type in tunnel flags") +Signed-off-by: Yi-Hung Wei +Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 3 +-- + include/net/ip_tunnels.h | 7 ++++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 974a244f45ba0..67c86ebfa7da2 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -225,8 +225,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + if (ip_tunnel_collect_metadata() || gs->collect_md) { + __be16 flags; + +- flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT | +- (gnvh->oam ? TUNNEL_OAM : 0) | ++ flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) | + (gnvh->critical ? TUNNEL_CRIT_OPT : 0); + + tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags, +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 02ccd32542d0a..61620677b0347 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -478,9 +478,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info, + const void *from, int len, + __be16 flags) + { +- memcpy(ip_tunnel_info_opts(info), from, len); + info->options_len = len; +- info->key.tun_flags |= flags; ++ if (len > 0) { ++ memcpy(ip_tunnel_info_opts(info), from, len); ++ info->key.tun_flags |= flags; ++ } + } + + static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate) +@@ -526,7 +528,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info, + __be16 flags) + { + info->options_len = 0; +- info->key.tun_flags |= flags; + } + + #endif /* CONFIG_INET */ +-- +2.27.0 + diff --git a/queue-5.9/kunit-tool-unmark-test_data-as-binary-blobs.patch b/queue-5.9/kunit-tool-unmark-test_data-as-binary-blobs.patch new file mode 100644 index 00000000000..ba27c68699c --- /dev/null +++ b/queue-5.9/kunit-tool-unmark-test_data-as-binary-blobs.patch @@ -0,0 +1,32 @@ +From 4bb2dfc7ec18658462c665b7009849c8c1727767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 15:24:40 -0800 +Subject: kunit: tool: unmark test_data as binary blobs + +From: Brendan Higgins + +[ Upstream commit c335b4f1f65012713832d988ec06512c7bda5c04 ] + +The tools/testing/kunit/test_data/ directory was marked as binary +because some of the test_data files cause checkpatch warnings. Fix this +by dropping the .gitattributes file. + +Fixes: afc63da64f1e ("kunit: kunit_parser: make parser more robust") +Signed-off-by: Brendan Higgins +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/kunit/.gitattributes | 1 - + 1 file changed, 1 deletion(-) + delete mode 100644 tools/testing/kunit/.gitattributes + +diff --git a/tools/testing/kunit/.gitattributes b/tools/testing/kunit/.gitattributes +deleted file mode 100644 +index 5b7da1fc3b8f1..0000000000000 +--- a/tools/testing/kunit/.gitattributes ++++ /dev/null +@@ -1 +0,0 @@ +-test_data/* binary +-- +2.27.0 + diff --git a/queue-5.9/lib-strncpy_from_user.c-mask-out-bytes-after-nul-ter.patch b/queue-5.9/lib-strncpy_from_user.c-mask-out-bytes-after-nul-ter.patch new file mode 100644 index 00000000000..8c69eada743 --- /dev/null +++ b/queue-5.9/lib-strncpy_from_user.c-mask-out-bytes-after-nul-ter.patch @@ -0,0 +1,101 @@ +From 1da4ee1acefea5461f3a2ec362ac774e273a180f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 12:05:45 -0800 +Subject: lib/strncpy_from_user.c: Mask out bytes after NUL terminator. + +From: Daniel Xu + +[ Upstream commit 6fa6d28051e9fcaa1570e69648ea13a353a5d218 ] + +do_strncpy_from_user() may copy some extra bytes after the NUL +terminator into the destination buffer. This usually does not matter for +normal string operations. However, when BPF programs key BPF maps with +strings, this matters a lot. + +A BPF program may read strings from user memory by calling the +bpf_probe_read_user_str() helper which eventually calls +do_strncpy_from_user(). The program can then key a map with the +destination buffer. BPF map keys are fixed-width and string-agnostic, +meaning that map keys are treated as a set of bytes. + +The issue is when do_strncpy_from_user() overcopies bytes after the NUL +terminator, it can result in seemingly identical strings occupying +multiple slots in a BPF map. This behavior is subtle and totally +unexpected by the user. + +This commit masks out the bytes following the NUL while preserving +long-sized stride in the fast path. + +Fixes: 6ae08ae3dea2 ("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers") +Signed-off-by: Daniel Xu +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/21efc982b3e9f2f7b0379eed642294caaa0c27a7.1605642949.git.dxu@dxuuu.xyz +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 10 ++++++++++ + lib/strncpy_from_user.c | 19 +++++++++++++++++-- + 2 files changed, 27 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index a8d4f253ed778..f236927ed2110 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -173,6 +173,16 @@ bpf_probe_read_user_str_common(void *dst, u32 size, + { + int ret; + ++ /* ++ * NB: We rely on strncpy_from_user() not copying junk past the NUL ++ * terminator into `dst`. ++ * ++ * strncpy_from_user() does long-sized strides in the fast path. If the ++ * strncpy does not mask out the bytes after the NUL in `unsafe_ptr`, ++ * then there could be junk after the NUL in `dst`. If user takes `dst` ++ * and keys a hash map with it, then semantically identical strings can ++ * occupy multiple entries in the map. ++ */ + ret = strncpy_from_user_nofault(dst, unsafe_ptr, size); + if (unlikely(ret < 0)) + memset(dst, 0, size); +diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c +index 34696a348864f..2eaed320a4db7 100644 +--- a/lib/strncpy_from_user.c ++++ b/lib/strncpy_from_user.c +@@ -34,17 +34,32 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, + goto byte_at_a_time; + + while (max >= sizeof(unsigned long)) { +- unsigned long c, data; ++ unsigned long c, data, mask; + + /* Fall back to byte-at-a-time if we get a page fault */ + unsafe_get_user(c, (unsigned long __user *)(src+res), byte_at_a_time); + +- *(unsigned long *)(dst+res) = c; ++ /* ++ * Note that we mask out the bytes following the NUL. This is ++ * important to do because string oblivious code may read past ++ * the NUL. For those routines, we don't want to give them ++ * potentially random bytes after the NUL in `src`. ++ * ++ * One example of such code is BPF map keys. BPF treats map keys ++ * as an opaque set of bytes. Without the post-NUL mask, any BPF ++ * maps keyed by strings returned from strncpy_from_user() may ++ * have multiple entries for semantically identical strings. ++ */ + if (has_zero(c, &data, &constants)) { + data = prep_zero_mask(c, data, &constants); + data = create_zero_mask(data); ++ mask = zero_bytemask(data); ++ *(unsigned long *)(dst+res) = c & mask; + return res + find_zero(data); + } ++ ++ *(unsigned long *)(dst+res) = c; ++ + res += sizeof(unsigned long); + max -= sizeof(unsigned long); + } +-- +2.27.0 + diff --git a/queue-5.9/libbpf-fix-versioned_sym_count-number-parsing.patch b/queue-5.9/libbpf-fix-versioned_sym_count-number-parsing.patch new file mode 100644 index 00000000000..b2c427127c9 --- /dev/null +++ b/queue-5.9/libbpf-fix-versioned_sym_count-number-parsing.patch @@ -0,0 +1,57 @@ +From 68ecced425590b8cfeeb1793aa529ca4c31c263f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 22:13:50 +0100 +Subject: libbpf: Fix VERSIONED_SYM_COUNT number parsing + +From: Jiri Olsa + +[ Upstream commit 1fd6cee127e2ddff36d648573d7566aafb0d0b77 ] + +We remove "other info" from "readelf -s --wide" output when +parsing GLOBAL_SYM_COUNT variable, which was added in [1]. +But we don't do that for VERSIONED_SYM_COUNT and it's failing +the check_abi target on powerpc Fedora 33. + +The extra "other info" wasn't problem for VERSIONED_SYM_COUNT +parsing until commit [2] added awk in the pipe, which assumes +that the last column is symbol, but it can be "other info". + +Adding "other info" removal for VERSIONED_SYM_COUNT the same +way as we did for GLOBAL_SYM_COUNT parsing. + +[1] aa915931ac3e ("libbpf: Fix readelf output parsing for Fedora") +[2] 746f534a4809 ("tools/libbpf: Avoid counting local symbols in ABI check") + +Fixes: 746f534a4809 ("tools/libbpf: Avoid counting local symbols in ABI check") +Signed-off-by: Jiri Olsa +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20201118211350.1493421-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 9ae8f4ef0aac2..8bf2c406b0e05 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -152,6 +152,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \ + sort -u | wc -l) + VERSIONED_SYM_COUNT = $(shell readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ ++ sed 's/\[.*\]//' | \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | sort -u | wc -l) + +@@ -220,6 +221,7 @@ check_abi: $(OUTPUT)libbpf.so + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \ + sort -u > $(OUTPUT)libbpf_global_syms.tmp; \ + readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ ++ sed 's/\[.*\]//' | \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | \ + sort -u > $(OUTPUT)libbpf_versioned_syms.tmp; \ +-- +2.27.0 + diff --git a/queue-5.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch b/queue-5.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch new file mode 100644 index 00000000000..87295fb8983 --- /dev/null +++ b/queue-5.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch @@ -0,0 +1,57 @@ +From 5b21aa08eaf66be89d99850d76ab47838bc9b533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 22:17:19 -0800 +Subject: libfs: fix error cast of negative value in simple_attr_write() + +From: Yicong Yang + +[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ] + +The attr->set() receive a value of u64, but simple_strtoll() is used for +doing the conversion. It will lead to the error cast if user inputs a +negative value. + +Use kstrtoull() instead of simple_strtoll() to convert a string got from +the user to an unsigned value. The former will return '-EINVAL' if it +gets a negetive value, but the latter can't handle the situation +correctly. Make 'val' unsigned long long as what kstrtoull() takes, +this will eliminate the compile warning on no 64-bit architectures. + +Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines") +Signed-off-by: Yicong Yang +Signed-off-by: Andrew Morton +Cc: Al Viro +Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index e0d42e977d9af..7bf691979a584 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -957,7 +957,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos) + { + struct simple_attr *attr; +- u64 val; ++ unsigned long long val; + size_t size; + ssize_t ret; + +@@ -975,7 +975,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + goto out; + + attr->set_buf[size] = '\0'; +- val = simple_strtoll(attr->set_buf, NULL, 0); ++ ret = kstrtoull(attr->set_buf, 0, &val); ++ if (ret) ++ goto out; + ret = attr->set(attr->data, val); + if (ret == 0) + ret = len; /* on success, claim we got the whole input */ +-- +2.27.0 + diff --git a/queue-5.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch b/queue-5.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch new file mode 100644 index 00000000000..8ddcec146fd --- /dev/null +++ b/queue-5.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch @@ -0,0 +1,51 @@ +From ea5572642598408cf0d7460df6c940247df7bb69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:18:56 +0800 +Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu + +From: Zhang Qilong + +[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ] + +If the clk_register fails, we should free h before +function returns to prevent memleak. + +Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/alchemy/common/clock.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c +index a95a894aceaf1..f0c8303371047 100644 +--- a/arch/mips/alchemy/common/clock.c ++++ b/arch/mips/alchemy/common/clock.c +@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + { + struct clk_init_data id; + struct clk_hw *h; ++ struct clk *clk; + + h = kzalloc(sizeof(*h), GFP_KERNEL); + if (!h) +@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + id.ops = &alchemy_clkops_cpu; + h->init = &id; + +- return clk_register(NULL, h); ++ clk = clk_register(NULL, h); ++ if (IS_ERR(clk)) { ++ pr_err("failed to register clock\n"); ++ kfree(h); ++ } ++ ++ return clk; + } + + /* AUXPLLs ************************************************************/ +-- +2.27.0 + diff --git a/queue-5.9/mips-export-has_transparent_hugepage-for-modules.patch b/queue-5.9/mips-export-has_transparent_hugepage-for-modules.patch new file mode 100644 index 00000000000..3e53736cae3 --- /dev/null +++ b/queue-5.9/mips-export-has_transparent_hugepage-for-modules.patch @@ -0,0 +1,47 @@ +From bbf94c8cabc7644f19bde069d669807f0c625139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 12:44:40 -0700 +Subject: MIPS: export has_transparent_hugepage() for modules + +From: Randy Dunlap + +[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ] + +MIPS should export its local version of "has_transparent_hugepage" +so that loadable modules (dax) can use it. + +Fixes this build error: +ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined! + +Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Dan Williams +Cc: Vishal Verma +Cc: Dave Jiang +Cc: linux-nvdimm@lists.01.org +Cc: Hugh Dickins +Cc: Andrew Morton +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlb-r4k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c +index 38e2894d5fa32..1b939abbe4caa 100644 +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -438,6 +438,7 @@ int has_transparent_hugepage(void) + } + return mask == PM_HUGE_MASK; + } ++EXPORT_SYMBOL(has_transparent_hugepage); + + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch b/queue-5.9/net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch new file mode 100644 index 00000000000..da1c2b14624 --- /dev/null +++ b/queue-5.9/net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch @@ -0,0 +1,39 @@ +From 11ca803b93de36cc09c0c49fbea11ce2f497b5da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 11:35:52 +0200 +Subject: net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled + +From: Eli Cohen + +[ Upstream commit 5b8631c7b21ca8bc039f0bc030048973b039e0d2 ] + +Avoid calling mlx5_esw_modify_vport_rate() if qos is not enabled and +avoid unnecessary syndrome messages from firmware. + +Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support") +Signed-off-by: Eli Cohen +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 5ad2308a2a6bd..d4ee0a9c03dbf 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1142,6 +1142,10 @@ int mlx5_esw_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num, + struct mlx5_vport *vport; + + vport = mlx5_eswitch_get_vport(esw, vport_num); ++ ++ if (!vport->qos.enabled) ++ return -EOPNOTSUPP; ++ + MLX5_SET(scheduling_context, ctx, max_average_bw, rate_mbps); + + return mlx5_modify_scheduling_element_cmd(esw->dev, +-- +2.27.0 + diff --git a/queue-5.9/perf-lock-correct-field-name-flags.patch b/queue-5.9/perf-lock-correct-field-name-flags.patch new file mode 100644 index 00000000000..4e06f2b64f4 --- /dev/null +++ b/queue-5.9/perf-lock-correct-field-name-flags.patch @@ -0,0 +1,43 @@ +From bec5543a7f7b47d4d4cba6d56e2b978d720c10f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 17:42:28 +0800 +Subject: perf lock: Correct field name "flags" + +From: Leo Yan + +[ Upstream commit e24a87b54ef3e39261f1d859b7f78416349dfb14 ] + +The tracepoint "lock:lock_acquire" contains field "flags" but not +"flag". Current code wrongly retrieves value from field "flag" and it +always gets zero for the value, thus "perf lock" doesn't report the +correct result. + +This patch replaces the field name "flag" with "flags", so can read out +the correct flags for locking. + +Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence") +Signed-off-by: Leo Yan +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20201104094229.17509-1-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-lock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c +index f0a1dbacb46c7..5cecc1ad78e1f 100644 +--- a/tools/perf/builtin-lock.c ++++ b/tools/perf/builtin-lock.c +@@ -406,7 +406,7 @@ static int report_lock_acquire_event(struct evsel *evsel, + struct lock_seq_stat *seq; + const char *name = evsel__strval(evsel, sample, "name"); + u64 tmp = evsel__intval(evsel, sample, "lockdep_addr"); +- int flag = evsel__intval(evsel, sample, "flag"); ++ int flag = evsel__intval(evsel, sample, "flags"); + + memcpy(&addr, &tmp, sizeof(void *)); + +-- +2.27.0 + diff --git a/queue-5.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch b/queue-5.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch new file mode 100644 index 00000000000..4bf7262ef6b --- /dev/null +++ b/queue-5.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch @@ -0,0 +1,54 @@ +From 574db974aacbf776ecdadcfef3a86c23cd3f7fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 17:42:29 +0800 +Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero + +From: Leo Yan + +[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ] + +When execute command "perf lock report", it hits failure and outputs log +as follows: + + perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed. + Aborted + +This is an imbalance issue. The locking sequence structure +"lock_seq_stat" contains the reader counter and it is used to check if +the locking sequence is balance or not between acquiring and releasing. + +If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero, +the "read_count" will be reset to zero when allocate a new structure at +the next time; thus it causes the wrong counting for reader and finally +results in imbalance issue. + +To fix this issue, if detects "read_count" is not zero (means still have +read user in the locking sequence), goto the "end" tag to skip freeing +structure "lock_seq_stat". + +Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence") +Signed-off-by: Leo Yan +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-lock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c +index 5cecc1ad78e1f..a2f1e53f37a7a 100644 +--- a/tools/perf/builtin-lock.c ++++ b/tools/perf/builtin-lock.c +@@ -621,7 +621,7 @@ static int report_lock_release_event(struct evsel *evsel, + case SEQ_STATE_READ_ACQUIRED: + seq->read_count--; + BUG_ON(seq->read_count < 0); +- if (!seq->read_count) { ++ if (seq->read_count) { + ls->nr_release++; + goto end; + } +-- +2.27.0 + diff --git a/queue-5.9/rcu-don-t-invoke-try_invoke_on_locked_down_task-with.patch b/queue-5.9/rcu-don-t-invoke-try_invoke_on_locked_down_task-with.patch new file mode 100644 index 00000000000..051ec26cf32 --- /dev/null +++ b/queue-5.9/rcu-don-t-invoke-try_invoke_on_locked_down_task-with.patch @@ -0,0 +1,108 @@ +From 140f39b7b50f14fcee9adb139c1529da59fa779e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 15:11:55 -0700 +Subject: rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled + +From: Paul E. McKenney + +[ Upstream commit c583bcb8f5edd48c1798798e341f78afb9bf4f6f ] + +The try_invoke_on_locked_down_task() function requires that +interrupts be enabled, but it is called with interrupts disabled from +rcu_print_task_stall(), resulting in an "IRQs not enabled as expected" +diagnostic. This commit therefore updates rcu_print_task_stall() +to accumulate a list of the first few tasks while holding the current +leaf rcu_node structure's ->lock, then releases that lock and only then +uses try_invoke_on_locked_down_task() to attempt to obtain per-task +detailed information. Of course, as soon as ->lock is released, the +task might exit, so the get_task_struct() function is used to prevent +the task structure from going away in the meantime. + +Link: https://lore.kernel.org/lkml/000000000000903d5805ab908fc4@google.com/ +Fixes: 5bef8da66a9c ("rcu: Add per-task state to RCU CPU stall warnings") +Reported-by: syzbot+cb3b69ae80afd6535b0e@syzkaller.appspotmail.com +Reported-by: syzbot+f04854e1c5c9e913cc27@syzkaller.appspotmail.com +Tested-by: Sebastian Andrzej Siewior +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_stall.h | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h +index b5d3b4794db48..e3c0f6fb5806d 100644 +--- a/kernel/rcu/tree_stall.h ++++ b/kernel/rcu/tree_stall.h +@@ -249,13 +249,16 @@ static bool check_slow_task(struct task_struct *t, void *arg) + + /* + * Scan the current list of tasks blocked within RCU read-side critical +- * sections, printing out the tid of each. ++ * sections, printing out the tid of each of the first few of them. + */ +-static int rcu_print_task_stall(struct rcu_node *rnp) ++static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags) ++ __releases(rnp->lock) + { ++ int i = 0; + int ndetected = 0; + struct rcu_stall_chk_rdr rscr; + struct task_struct *t; ++ struct task_struct *ts[8]; + + if (!rcu_preempt_blocked_readers_cgp(rnp)) + return 0; +@@ -264,6 +267,14 @@ static int rcu_print_task_stall(struct rcu_node *rnp) + t = list_entry(rnp->gp_tasks->prev, + struct task_struct, rcu_node_entry); + list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry) { ++ get_task_struct(t); ++ ts[i++] = t; ++ if (i >= ARRAY_SIZE(ts)) ++ break; ++ } ++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags); ++ for (i--; i; i--) { ++ t = ts[i]; + if (!try_invoke_on_locked_down_task(t, check_slow_task, &rscr)) + pr_cont(" P%d", t->pid); + else +@@ -273,6 +284,7 @@ static int rcu_print_task_stall(struct rcu_node *rnp) + ".q"[rscr.rs.b.need_qs], + ".e"[rscr.rs.b.exp_hint], + ".l"[rscr.on_blkd_list]); ++ put_task_struct(t); + ndetected++; + } + pr_cont("\n"); +@@ -293,8 +305,9 @@ static void rcu_print_detail_task_stall_rnp(struct rcu_node *rnp) + * Because preemptible RCU does not exist, we never have to check for + * tasks blocked within RCU read-side critical sections. + */ +-static int rcu_print_task_stall(struct rcu_node *rnp) ++static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags) + { ++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + return 0; + } + #endif /* #else #ifdef CONFIG_PREEMPT_RCU */ +@@ -472,7 +485,6 @@ static void print_other_cpu_stall(unsigned long gp_seq, unsigned long gps) + pr_err("INFO: %s detected stalls on CPUs/tasks:\n", rcu_state.name); + rcu_for_each_leaf_node(rnp) { + raw_spin_lock_irqsave_rcu_node(rnp, flags); +- ndetected += rcu_print_task_stall(rnp); + if (rnp->qsmask != 0) { + for_each_leaf_node_possible_cpu(rnp, cpu) + if (rnp->qsmask & leaf_node_cpu_bit(rnp, cpu)) { +@@ -480,7 +492,7 @@ static void print_other_cpu_stall(unsigned long gp_seq, unsigned long gps) + ndetected++; + } + } +- raw_spin_unlock_irqrestore_rcu_node(rnp, flags); ++ ndetected += rcu_print_task_stall(rnp, flags); // Releases rnp->lock. + } + + for_each_possible_cpu(cpu) +-- +2.27.0 + diff --git a/queue-5.9/rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch b/queue-5.9/rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch new file mode 100644 index 00000000000..6a7728daff8 --- /dev/null +++ b/queue-5.9/rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch @@ -0,0 +1,38 @@ +From b5400655e58819f791d8c47f626ec5e60856e606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 11:22:02 +0800 +Subject: RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device() + +From: Qinglang Miao + +[ Upstream commit d035c3f6cdb8e5d5a17adcbb79d7453417a6077d ] + +Fix missing kfree in pvrdma_register_device() when failure from +ib_device_set_netdev(). + +Fixes: 4b38da75e089 ("RDMA/drivers: Convert easy drivers to use ib_device_set_netdev()") +Link: https://lore.kernel.org/r/20201111032202.17925-1-miaoqinglang@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +index 780fd2dfc07eb..10e67283b9db7 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +@@ -266,7 +266,7 @@ static int pvrdma_register_device(struct pvrdma_dev *dev) + } + ret = ib_device_set_netdev(&dev->ib_dev, dev->netdev, 1); + if (ret) +- return ret; ++ goto err_srq_free; + spin_lock_init(&dev->srq_tbl_lock); + rdma_set_device_sysfs_group(&dev->ib_dev, &pvrdma_attr_group); + +-- +2.27.0 + diff --git a/queue-5.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch b/queue-5.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch new file mode 100644 index 00000000000..019872024d1 --- /dev/null +++ b/queue-5.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch @@ -0,0 +1,71 @@ +From 11728843b0b99ad09d88e34aba1366ef8f97f8a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 08:50:09 -0600 +Subject: regulator: ti-abb: Fix array out of bound read access on the first + transition + +From: Nishanth Menon + +[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ] + +At the start of driver initialization, we do not know what bias +setting the bootloader has configured the system for and we only know +for certain the very first time we do a transition. + +However, since the initial value of the comparison index is -EINVAL, +this negative value results in an array out of bound access on the +very first transition. + +Since we don't know what the setting is, we just set the bias +configuration as there is nothing to compare against. This prevents +the array out of bound access. + +NOTE: Even though we could use a more relaxed check of "< 0" the only +valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+. + +Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver") +Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/ +Reported-by: Naresh Kamboju +Reviewed-by: Arnd Bergmann +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/ti-abb-regulator.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c +index af9abcd9c1665..16501ce0f56f4 100644 +--- a/drivers/regulator/ti-abb-regulator.c ++++ b/drivers/regulator/ti-abb-regulator.c +@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + return ret; + } + +- /* If data is exactly the same, then just update index, no change */ + info = &abb->info[sel]; ++ /* ++ * When Linux kernel is starting up, we are'nt sure of the ++ * Bias configuration that bootloader has configured. ++ * So, we get to know the actual setting the first time ++ * we are asked to transition. ++ */ ++ if (abb->current_info_idx == -EINVAL) ++ goto just_set_abb; ++ ++ /* If data is exactly the same, then just update index, no change */ + oinfo = &abb->info[abb->current_info_idx]; + if (!memcmp(info, oinfo, sizeof(*info))) { + dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__, +@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + goto out; + } + ++just_set_abb: + ret = ti_abb_set_opp(rdev, abb, info); + + out: +-- +2.27.0 + diff --git a/queue-5.9/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch b/queue-5.9/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch new file mode 100644 index 00000000000..753f9291bd5 --- /dev/null +++ b/queue-5.9/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch @@ -0,0 +1,48 @@ +From bb3bd774f1fd524a624f004ae414d8158e3e509f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:06 +0800 +Subject: Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to + active high" + +From: Chen-Yu Tsai + +[ Upstream commit 8d80e2f00a42ef10b54e1b2d9e97314f8fd046c0 ] + +This reverts commit 75ee680cbd2e4d0156b94f9fec50076361ab12f2. + +Turns out the activity and link LEDs on the RJ45 port are active low, +just like on the Orange Pi PC. + +Revert the commit that says otherwise. + +Fixes: 75ee680cbd2e ("arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high") +Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Jernej Skrabec +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-1-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts +index 71fb732089397..babf4cf1b2f68 100644 +--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts ++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts +@@ -53,11 +53,6 @@ + }; + }; + +-&emac { +- /* LEDs changed to active high on the plus */ +- /delete-property/ allwinner,leds-active-low; +-}; +- + &mmc1 { + vmmc-supply = <®_vcc3v3>; + bus-width = <4>; +-- +2.27.0 + diff --git a/queue-5.9/rfkill-fix-use-after-free-in-rfkill_resume.patch b/queue-5.9/rfkill-fix-use-after-free-in-rfkill_resume.patch new file mode 100644 index 00000000000..111aed850ea --- /dev/null +++ b/queue-5.9/rfkill-fix-use-after-free-in-rfkill_resume.patch @@ -0,0 +1,75 @@ +From 72f6cf4d91ef6114cff2f30627883d0fdf4a7c09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 16:49:08 +0800 +Subject: rfkill: Fix use-after-free in rfkill_resume() + +From: Claire Chang + +[ Upstream commit 94e2bd0b259ed39a755fdded47e6734acf1ce464 ] + +If a device is getting removed or reprobed during resume, use-after-free +might happen. For example, h5_btrtl_resume() schedules a work queue for +device reprobing, which of course requires removal first. + +If the removal happens in parallel with the device_resume() and wins the +race to acquire device_lock(), removal may remove the device from the PM +lists and all, but device_resume() is already running and will continue +when the lock can be acquired, thus calling rfkill_resume(). + +During this, if rfkill_set_block() is then called after the corresponding +*_unregister() and kfree() are called, there will be an use-after-free +in hci_rfkill_set_block(): + +BUG: KASAN: use-after-free in hci_rfkill_set_block+0x58/0xc0 [bluetooth] +... +Call trace: + dump_backtrace+0x0/0x154 + show_stack+0x20/0x2c + dump_stack+0xbc/0x12c + print_address_description+0x88/0x4b0 + __kasan_report+0x144/0x168 + kasan_report+0x10/0x18 + check_memory_region+0x19c/0x1ac + __kasan_check_write+0x18/0x24 + hci_rfkill_set_block+0x58/0xc0 [bluetooth] + rfkill_set_block+0x9c/0x120 + rfkill_resume+0x34/0x70 + dpm_run_callback+0xf0/0x1f4 + device_resume+0x210/0x22c + +Fix this by checking rfkill->registered in rfkill_resume(). device_del() +in rfkill_unregister() requires device_lock() and the whole rfkill_resume() +is also protected by the same lock via device_resume(), we can make sure +either the rfkill->registered is false before rfkill_resume() starts or the +rfkill device won't be unregistered before rfkill_resume() returns. + +As async_resume() holds a reference to the device, at this level there can +be no use-after-free; only in the user that doesn't expect this scenario. + +Fixes: 8589086f4efd ("Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume") +Signed-off-by: Claire Chang +Link: https://lore.kernel.org/r/20201110084908.219088-1-tientzu@chromium.org +[edit commit message for clarity and add more info provided later] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/rfkill/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 971c73c7d34cb..97101c55763d7 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -876,6 +876,9 @@ static int rfkill_resume(struct device *dev) + + rfkill->suspended = false; + ++ if (!rfkill->registered) ++ return 0; ++ + if (!rfkill->persistent) { + cur = !!(rfkill->state & RFKILL_BLOCK_SW); + rfkill_set_block(rfkill, cur); +-- +2.27.0 + diff --git a/queue-5.9/rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch b/queue-5.9/rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch new file mode 100644 index 00000000000..1c07aa07c0e --- /dev/null +++ b/queue-5.9/rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch @@ -0,0 +1,85 @@ +From 211799cbb4d9b4c22b12333a5189aab3f9e69267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 19:19:32 +0100 +Subject: RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs + +From: Christoph Hellwig + +[ Upstream commit b1e678bf290db5a76f1b6a9f7c381310e03440d6 ] + +dma_virt_ops requires that all pages have a kernel virtual address. +Introduce a INFINIBAND_VIRT_DMA Kconfig symbol that depends on !HIGHMEM +and make all three drivers depend on the new symbol. + +Also remove the ARCH_DMA_ADDR_T_64BIT dependency, which has been obsolete +since commit 4965a68780c5 ("arch: define the ARCH_DMA_ADDR_T_64BIT config +symbol in lib/Kconfig") + +Fixes: 551199aca1c3 ("lib/dma-virt: Add dma_virt_ops") +Link: https://lore.kernel.org/r/20201106181941.1878556-2-hch@lst.de +Signed-off-by: Christoph Hellwig +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/Kconfig | 3 +++ + drivers/infiniband/sw/rdmavt/Kconfig | 3 ++- + drivers/infiniband/sw/rxe/Kconfig | 2 +- + drivers/infiniband/sw/siw/Kconfig | 1 + + 4 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig +index 91b023341b779..58d1c91ffe51e 100644 +--- a/drivers/infiniband/Kconfig ++++ b/drivers/infiniband/Kconfig +@@ -72,6 +72,9 @@ config INFINIBAND_ADDR_TRANS_CONFIGFS + This allows the user to config the default GID type that the CM + uses for each device, when initiaing new connections. + ++config INFINIBAND_VIRT_DMA ++ def_bool !HIGHMEM ++ + if INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS + source "drivers/infiniband/hw/mthca/Kconfig" + source "drivers/infiniband/hw/qib/Kconfig" +diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig +index 9ef5f5ce1ff6b..c8e268082952b 100644 +--- a/drivers/infiniband/sw/rdmavt/Kconfig ++++ b/drivers/infiniband/sw/rdmavt/Kconfig +@@ -1,7 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0-only + config INFINIBAND_RDMAVT + tristate "RDMA verbs transport library" +- depends on X86_64 && ARCH_DMA_ADDR_T_64BIT ++ depends on INFINIBAND_VIRT_DMA ++ depends on X86_64 + depends on PCI + select DMA_VIRT_OPS + help +diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig +index a0c6c7dfc1814..8810bfa680495 100644 +--- a/drivers/infiniband/sw/rxe/Kconfig ++++ b/drivers/infiniband/sw/rxe/Kconfig +@@ -2,7 +2,7 @@ + config RDMA_RXE + tristate "Software RDMA over Ethernet (RoCE) driver" + depends on INET && PCI && INFINIBAND +- depends on !64BIT || ARCH_DMA_ADDR_T_64BIT ++ depends on INFINIBAND_VIRT_DMA + select NET_UDP_TUNNEL + select CRYPTO_CRC32 + select DMA_VIRT_OPS +diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig +index b622fc62f2cd6..3450ba5081df5 100644 +--- a/drivers/infiniband/sw/siw/Kconfig ++++ b/drivers/infiniband/sw/siw/Kconfig +@@ -1,6 +1,7 @@ + config RDMA_SIW + tristate "Software RDMA over TCP/IP (iWARP) driver" + depends on INET && INFINIBAND && LIBCRC32C ++ depends on INFINIBAND_VIRT_DMA + select DMA_VIRT_OPS + help + This driver implements the iWARP RDMA transport over +-- +2.27.0 + diff --git a/queue-5.9/sched-fair-fix-overutilized-update-in-enqueue_task_f.patch b/queue-5.9/sched-fair-fix-overutilized-update-in-enqueue_task_f.patch new file mode 100644 index 00000000000..cf39892040a --- /dev/null +++ b/queue-5.9/sched-fair-fix-overutilized-update-in-enqueue_task_f.patch @@ -0,0 +1,52 @@ +From f6cdb95dde5ba6b04d7c89a121d1f041c4806baa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 11:12:01 +0000 +Subject: sched/fair: Fix overutilized update in enqueue_task_fair() + +From: Quentin Perret + +[ Upstream commit 8e1ac4299a6e8726de42310d9c1379f188140c71 ] + +enqueue_task_fair() attempts to skip the overutilized update for new +tasks as their util_avg is not accurate yet. However, the flag we check +to do so is overwritten earlier on in the function, which makes the +condition pretty much a nop. + +Fix this by saving the flag early on. + +Fixes: 2802bf3cd936 ("sched/fair: Add over-utilization/tipping point indicator") +Reported-by: Rick Yiu +Signed-off-by: Quentin Perret +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Reviewed-by: Valentin Schneider +Link: https://lkml.kernel.org/r/20201112111201.2081902-1-qperret@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 48a6d442b4443..c0c4d9ad7da8e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5473,6 +5473,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) + struct cfs_rq *cfs_rq; + struct sched_entity *se = &p->se; + int idle_h_nr_running = task_has_idle_policy(p); ++ int task_new = !(flags & ENQUEUE_WAKEUP); + + /* + * The code below (indirectly) updates schedutil which looks at +@@ -5545,7 +5546,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) + * into account, but that is not straightforward to implement, + * and the following generally works well enough in practice. + */ +- if (flags & ENQUEUE_WAKEUP) ++ if (!task_new) + update_overutilized_status(rq); + + enqueue_throttle: +-- +2.27.0 + diff --git a/queue-5.9/sched-fix-data-race-in-wakeup.patch b/queue-5.9/sched-fix-data-race-in-wakeup.patch new file mode 100644 index 00000000000..d034f0bf367 --- /dev/null +++ b/queue-5.9/sched-fix-data-race-in-wakeup.patch @@ -0,0 +1,101 @@ +From 2788b51d1a5854d26f961fdc117054cdc2c25149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 09:08:41 +0100 +Subject: sched: Fix data-race in wakeup + +From: Peter Zijlstra + +[ Upstream commit f97bb5272d9e95d400d6c8643ebb146b3e3e7842 ] + +Mel reported that on some ARM64 platforms loadavg goes bananas and +Will tracked it down to the following race: + + CPU0 CPU1 + + schedule() + prev->sched_contributes_to_load = X; + deactivate_task(prev); + + try_to_wake_up() + if (p->on_rq &&) // false + if (smp_load_acquire(&p->on_cpu) && // true + ttwu_queue_wakelist()) + p->sched_remote_wakeup = Y; + + smp_store_release(prev->on_cpu, 0); + +where both p->sched_contributes_to_load and p->sched_remote_wakeup are +in the same word, and thus the stores X and Y race (and can clobber +one another's data). + +Whereas prior to commit c6e7bd7afaeb ("sched/core: Optimize ttwu() +spinning on p->on_cpu") the p->on_cpu handoff serialized access to +p->sched_remote_wakeup (just as it still does with +p->sched_contributes_to_load) that commit broke that by calling +ttwu_queue_wakelist() with p->on_cpu != 0. + +However, due to + + p->XXX = X ttwu() + schedule() if (p->on_rq && ...) // false + smp_mb__after_spinlock() if (smp_load_acquire(&p->on_cpu) && + deactivate_task() ttwu_queue_wakelist()) + p->on_rq = 0; p->sched_remote_wakeup = Y; + +We can be sure any 'current' store is complete and 'current' is +guaranteed asleep. Therefore we can move p->sched_remote_wakeup into +the current flags word. + +Note: while the observed failure was loadavg accounting gone wrong due +to ttwu() cobbering p->sched_contributes_to_load, the reverse problem +is also possible where schedule() clobbers p->sched_remote_wakeup, +this could result in enqueue_entity() wrecking ->vruntime and causing +scheduling artifacts. + +Fixes: c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") +Reported-by: Mel Gorman +Debugged-by: Will Deacon +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201117083016.GK3121392@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 8bf2295ebee48..12aa57de8eea0 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -770,7 +770,6 @@ struct task_struct { + unsigned sched_reset_on_fork:1; + unsigned sched_contributes_to_load:1; + unsigned sched_migrated:1; +- unsigned sched_remote_wakeup:1; + #ifdef CONFIG_PSI + unsigned sched_psi_wake_requeue:1; + #endif +@@ -780,6 +779,21 @@ struct task_struct { + + /* Unserialized, strictly 'current' */ + ++ /* ++ * This field must not be in the scheduler word above due to wakelist ++ * queueing no longer being serialized by p->on_cpu. However: ++ * ++ * p->XXX = X; ttwu() ++ * schedule() if (p->on_rq && ..) // false ++ * smp_mb__after_spinlock(); if (smp_load_acquire(&p->on_cpu) && //true ++ * deactivate_task() ttwu_queue_wakelist()) ++ * p->on_rq = 0; p->sched_remote_wakeup = Y; ++ * ++ * guarantees all stores of 'current' are visible before ++ * ->sched_remote_wakeup gets used, so it can be in this word. ++ */ ++ unsigned sched_remote_wakeup:1; ++ + /* Bit to tell LSMs we're in execve(): */ + unsigned in_execve:1; + unsigned in_iowait:1; +-- +2.27.0 + diff --git a/queue-5.9/sched-fix-rq-nr_iowait-ordering.patch b/queue-5.9/sched-fix-rq-nr_iowait-ordering.patch new file mode 100644 index 00000000000..9b35c9a7dcd --- /dev/null +++ b/queue-5.9/sched-fix-rq-nr_iowait-ordering.patch @@ -0,0 +1,76 @@ +From 09b67eb0d38ebc9677ac048d34527fb3bfb9c7f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 13:50:42 +0200 +Subject: sched: Fix rq->nr_iowait ordering + +From: Peter Zijlstra + +[ Upstream commit ec618b84f6e15281cc3660664d34cd0dd2f2579e ] + + schedule() ttwu() + deactivate_task(); if (p->on_rq && ...) // false + atomic_dec(&task_rq(p)->nr_iowait); + if (prev->in_iowait) + atomic_inc(&rq->nr_iowait); + +Allows nr_iowait to be decremented before it gets incremented, +resulting in more dodgy IO-wait numbers than usual. + +Note that because we can now do ttwu_queue_wakelist() before +p->on_cpu==0, we lose the natural ordering and have to further delay +the decrement. + +Fixes: c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") +Reported-by: Tejun Heo +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Mel Gorman +Link: https://lkml.kernel.org/r/20201117093829.GD3121429@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index b1e0da56abcac..c4da7e17b9061 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2505,7 +2505,12 @@ ttwu_do_activate(struct rq *rq, struct task_struct *p, int wake_flags, + #ifdef CONFIG_SMP + if (wake_flags & WF_MIGRATED) + en_flags |= ENQUEUE_MIGRATED; ++ else + #endif ++ if (p->in_iowait) { ++ delayacct_blkio_end(p); ++ atomic_dec(&task_rq(p)->nr_iowait); ++ } + + activate_task(rq, p, en_flags); + ttwu_do_wakeup(rq, p, wake_flags, rf); +@@ -2892,11 +2897,6 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags) + if (READ_ONCE(p->on_rq) && ttwu_runnable(p, wake_flags)) + goto unlock; + +- if (p->in_iowait) { +- delayacct_blkio_end(p); +- atomic_dec(&task_rq(p)->nr_iowait); +- } +- + #ifdef CONFIG_SMP + /* + * Ensure we load p->on_cpu _after_ p->on_rq, otherwise it would be +@@ -2967,6 +2967,11 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags) + + cpu = select_task_rq(p, p->wake_cpu, SD_BALANCE_WAKE, wake_flags); + if (task_cpu(p) != cpu) { ++ if (p->in_iowait) { ++ delayacct_blkio_end(p); ++ atomic_dec(&task_rq(p)->nr_iowait); ++ } ++ + wake_flags |= WF_MIGRATED; + psi_ttwu_dequeue(p); + set_task_cpu(p, cpu); +-- +2.27.0 + diff --git a/queue-5.9/selftests-bpf-fix-error-return-code-in-run_getsockop.patch b/queue-5.9/selftests-bpf-fix-error-return-code-in-run_getsockop.patch new file mode 100644 index 00000000000..2faa55c69d7 --- /dev/null +++ b/queue-5.9/selftests-bpf-fix-error-return-code-in-run_getsockop.patch @@ -0,0 +1,39 @@ +From 7dc7ac8d74260d11361c056ea4369015a05536d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 18:16:33 +0800 +Subject: selftests/bpf: Fix error return code in run_getsockopt_test() + +From: Wang Hai + +[ Upstream commit 2acc3c1bc8e98bc66b1badec42e9ea205b4fcdaa ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 65b4414a05eb ("selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20201116101633.64627-1-wanghai38@huawei.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sockopt_multi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c +index 29188d6f5c8de..51fac975b3163 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c ++++ b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c +@@ -138,7 +138,8 @@ static int run_getsockopt_test(struct bpf_object *obj, int cg_parent, + */ + + buf = 0x40; +- if (setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1) < 0) { ++ err = setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1); ++ if (err < 0) { + log_err("Failed to call setsockopt(IP_TOS)"); + goto detach; + } +-- +2.27.0 + diff --git a/queue-5.9/selftests-seccomp-powerpc-fix-typo-in-macro-variable.patch b/queue-5.9/selftests-seccomp-powerpc-fix-typo-in-macro-variable.patch new file mode 100644 index 00000000000..e2fba51394c --- /dev/null +++ b/queue-5.9/selftests-seccomp-powerpc-fix-typo-in-macro-variable.patch @@ -0,0 +1,40 @@ +From 22ea7f2159f173865f575b6f7aa767aab076b13b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 11:33:02 -0800 +Subject: selftests/seccomp: powerpc: Fix typo in macro variable name + +From: Kees Cook + +[ Upstream commit f5098e34dd4c774c3040e417960f1637e5daade8 ] + +A typo sneaked into the powerpc selftest. Fix the name so it builds again. + +Fixes: 46138329faea ("selftests/seccomp: powerpc: Fix seccomp return value testing") +Acked-by: Michael Ellerman +Link: https://lore.kernel.org/lkml/87y2ix2895.fsf@mpe.ellerman.id.au +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/seccomp/seccomp_bpf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 9a9eb02539fb4..6a27b12e9b3c2 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -1710,10 +1710,10 @@ TEST_F(TRACE_poke, getpid_runs_normally) + * and the code is stored as a positive value. \ + */ \ + if (_result < 0) { \ +- SYSCALL_RET(_regs) = -result; \ ++ SYSCALL_RET(_regs) = -_result; \ + (_regs).ccr |= 0x10000000; \ + } else { \ +- SYSCALL_RET(_regs) = result; \ ++ SYSCALL_RET(_regs) = _result; \ + (_regs).ccr &= ~0x10000000; \ + } \ + } while (0) +-- +2.27.0 + diff --git a/queue-5.9/selftests-seccomp-sh-fix-register-names.patch b/queue-5.9/selftests-seccomp-sh-fix-register-names.patch new file mode 100644 index 00000000000..39545ef21b8 --- /dev/null +++ b/queue-5.9/selftests-seccomp-sh-fix-register-names.patch @@ -0,0 +1,40 @@ +From 148689581947bc298bb7c0c23dbbfcedc258b2ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 11:54:43 -0800 +Subject: selftests/seccomp: sh: Fix register names + +From: Kees Cook + +[ Upstream commit 4c222f31fb1db4d590503a181a6268ced9252379 ] + +It looks like the seccomp selftests was never actually built for sh. +This fixes it, though I don't have an environment to do a runtime test +of it yet. + +Fixes: 0bb605c2c7f2b4b3 ("sh: Add SECCOMP_FILTER") +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/lkml/a36d7b48-6598-1642-e403-0c77a86f416d@physik.fu-berlin.de +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/seccomp/seccomp_bpf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 6a27b12e9b3c2..687ca8afe0e83 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -1738,8 +1738,8 @@ TEST_F(TRACE_poke, getpid_runs_normally) + #define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2] + #elif defined(__sh__) + # define ARCH_REGS struct pt_regs +-# define SYSCALL_NUM(_regs) (_regs).gpr[3] +-# define SYSCALL_RET(_regs) (_regs).gpr[0] ++# define SYSCALL_NUM(_regs) (_regs).regs[3] ++# define SYSCALL_RET(_regs) (_regs).regs[0] + #else + # error "Do not know how to find your architecture's registers and syscalls" + #endif +-- +2.27.0 + diff --git a/queue-5.9/series b/queue-5.9/series index fd0e8427444..e6fdb2f7d1e 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -72,3 +72,117 @@ arm64-add-midr-value-for-kryo2xx-gold-silver-cpu-cor.patch arm64-kpti-add-kryo2xx-gold-silver-cpu-cores-to-kpti.patch arm64-cpu_errata-apply-erratum-845719-to-kryo2xx-sil.patch usb-dwc2-avoid-leaving-the-error_debugfs-label-unuse.patch +arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch +arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch +arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch +arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch +arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch +arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch +revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch +arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch +arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch +arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch +arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch +arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch +arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch +arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch +arm64-dts-allwinner-h5-libretech-all-h5-cc-enable-rg.patch +arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch +input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch +mips-export-has_transparent_hugepage-for-modules.patch +dmaengine-idxd-fix-wq-config-registers-offset-progra.patch +arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch +arm64-dts-fsl-fix-endianness-issue-of-rcpm.patch +arm64-dts-imx8mm-beacon-som-fix-choppy-bt-audio.patch +arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch +arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch +arm-dts-vf610-zii-dev-rev-b-fix-mdio-over-clocking.patch +arm-dts-imx6q-prti6q-fix-phy-address.patch +swiotlb-using-size_max-needs-limits.h-included.patch +tee-amdtee-fix-memory-leak-due-to-reset-of-global-sh.patch +tee-amdtee-synchronize-access-to-shm-list.patch +dmaengine-xilinx_dma-fix-usage-of-xilinx_aximcdma_tx.patch +dmaengine-xilinx_dma-fix-sg-capability-check-for-mcd.patch +arm-dts-stm32-fix-ta3-gpio-c-key-on-stm32mp1-dhcom-p.patch +arm-dts-stm32-fix-led5-on-stm32mp1-dhcom-pdk2.patch +arm-dts-stm32-define-vio-regulator-supply-on-dhcom.patch +arm-dts-stm32-enable-thermal-sensor-support-on-stm32.patch +arm-dts-stm32-keep-vdda-ldo1-always-on-on-dhcom.patch +arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch +arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch +dmaengine-ti-omap-dma-block-pm-if-sdma-is-busy-to-fi.patch +kunit-tool-unmark-test_data-as-binary-blobs.patch +rcu-don-t-invoke-try_invoke_on_locked_down_task-with.patch +spi-fix-client-driver-breakages-when-using-gpio-desc.patch +input-resistive-adc-touch-fix-kconfig-dependency-on-.patch +input-elan_i2c-fix-firmware-update-on-newer-ics.patch +rfkill-fix-use-after-free-in-rfkill_resume.patch +rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch +rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch +perf-lock-correct-field-name-flags.patch +perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch +sunrpc-fix-oops-in-the-rpc_xdr_buf-event-class.patch +drm-bridge-dw-hdmi-avoid-resetting-force-in-the-dete.patch +tools-bpftool-add-missing-close-before-bpftool-net-a.patch +ib-hfi1-fix-error-return-code-in-hfi1_init_dd.patch +ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch +can-af_can-prevent-potential-access-of-uninitialized.patch +can-af_can-prevent-potential-access-of-uninitialized.patch-9610 +can-dev-can_restart-post-buffer-from-the-right-conte.patch +can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch +can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch +can-peak_usb-fix-potential-integer-overflow-on-shift.patch +can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch +can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch +can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch +can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch +can-m_can-m_can_handle_state_change-fix-state-change.patch +can-m_can-m_can_class_free_dev-introduce-new-functio.patch +can-m_can-fix-freeing-of-can-device-from-peripherial.patch +can-m_can-m_can_stop-set-device-to-software-init-mod.patch +dmaengine-idxd-fix-mapping-of-portal-size.patch +asoc-intel-kmb-fix-s24_le-configuration.patch +asoc-qcom-lpass-platform-fix-memory-leak.patch +spi-cadence-quadspi-fix-error-return-code-in-cqspi_p.patch +selftests-bpf-fix-error-return-code-in-run_getsockop.patch +mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch +drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch +net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch +bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch +bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch +can-kvaser_pciefd-fix-kcan-bittiming-limits.patch +can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch +dmaengine-fix-error-codes-in-channel_register.patch +iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch +iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch +can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch +can-m_can-process-interrupt-only-when-not-runtime-su.patch +xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch +xfs-strengthen-rmap-record-flags-checking.patch +xfs-directory-scrub-should-check-the-null-bestfree-e.patch +xfs-ensure-inobt-record-walks-always-make-forward-pr.patch +xfs-return-corresponding-errcode-if-xfs_initialize_p.patch +asoc-intel-kbl_rt5663_rt5514_max98927-do-not-try-to-.patch +regulator-ti-abb-fix-array-out-of-bound-read-access-.patch +libbpf-fix-versioned_sym_count-number-parsing.patch +lib-strncpy_from_user.c-mask-out-bytes-after-nul-ter.patch +fail_function-remove-a-redundant-mutex-unlock.patch +xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch +selftests-seccomp-powerpc-fix-typo-in-macro-variable.patch +selftests-seccomp-sh-fix-register-names.patch +bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch +bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch +bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch +bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch +efi-arm-set-hsctlr-thumb2-bit-correctly-for-hvc-call.patch +counter-ti-eqep-fix-regmap-max_register.patch +efi-x86-free-efi_pgd-with-free_pages.patch +sched-fair-fix-overutilized-update-in-enqueue_task_f.patch +sched-fix-data-race-in-wakeup.patch +sched-fix-rq-nr_iowait-ordering.patch +libfs-fix-error-cast-of-negative-value-in-simple_att.patch +afs-fix-speculative-status-fetch-going-out-of-order-.patch +hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch +hid-mcp2221-fix-gpio-output-handling.patch +hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch +hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch diff --git a/queue-5.9/spi-cadence-quadspi-fix-error-return-code-in-cqspi_p.patch b/queue-5.9/spi-cadence-quadspi-fix-error-return-code-in-cqspi_p.patch new file mode 100644 index 00000000000..f3183b88aef --- /dev/null +++ b/queue-5.9/spi-cadence-quadspi-fix-error-return-code-in-cqspi_p.patch @@ -0,0 +1,46 @@ +From 63968bb532f1e2f3a3a8ec82fdc50bc4bc069404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 22:18:36 +0800 +Subject: spi: cadence-quadspi: Fix error return code in cqspi_probe + +From: Zhihao Cheng + +[ Upstream commit ac9978fcad3c5abc43cdd225441ce9459c36e16b ] + +Fix to return the error code from +devm_reset_control_get_optional_exclusive() instaed of 0 +in cqspi_probe(). + +Fixes: 31fb632b5d43ca ("spi: Move cadence-quadspi driver to drivers/spi/") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20201116141836.2970579-1-chengzhihao1@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index c6795c684b16a..9f8cae7a35bb6 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1263,12 +1263,14 @@ static int cqspi_probe(struct platform_device *pdev) + /* Obtain QSPI reset control */ + rstc = devm_reset_control_get_optional_exclusive(dev, "qspi"); + if (IS_ERR(rstc)) { ++ ret = PTR_ERR(rstc); + dev_err(dev, "Cannot get QSPI reset.\n"); + goto probe_reset_failed; + } + + rstc_ocp = devm_reset_control_get_optional_exclusive(dev, "qspi-ocp"); + if (IS_ERR(rstc_ocp)) { ++ ret = PTR_ERR(rstc_ocp); + dev_err(dev, "Cannot get QSPI OCP reset.\n"); + goto probe_reset_failed; + } +-- +2.27.0 + diff --git a/queue-5.9/spi-fix-client-driver-breakages-when-using-gpio-desc.patch b/queue-5.9/spi-fix-client-driver-breakages-when-using-gpio-desc.patch new file mode 100644 index 00000000000..3a324838965 --- /dev/null +++ b/queue-5.9/spi-fix-client-driver-breakages-when-using-gpio-desc.patch @@ -0,0 +1,109 @@ +From 6b7e10eb3b86fe03c7c7232a1bb0e8c485932756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 10:07:06 -0500 +Subject: spi: fix client driver breakages when using GPIO descriptors + +From: Sven Van Asbroeck + +[ Upstream commit 766c6b63aa044e84b045803b40b14754d69a2a1d ] + +Commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs") +introduced the optional use of GPIO descriptors for chip selects. + +A side-effect of this change: when a SPI bus uses GPIO descriptors, +all its client devices have SPI_CS_HIGH set in spi->mode. This flag is +required for the SPI bus to operate correctly. + +This unfortunately breaks many client drivers, which use the following +pattern to configure their underlying SPI bus: + +static int client_device_probe(struct spi_device *spi) +{ + ... + spi->mode = SPI_MODE_0; + spi->bits_per_word = 8; + err = spi_setup(spi); + .. +} + +In short, many client drivers overwrite the SPI_CS_HIGH bit in +spi->mode, and break the underlying SPI bus driver. + +This is especially true for Freescale/NXP imx ecspi, where large +numbers of spi client drivers now no longer work. + +Proposed fix: +------------- +When using gpio descriptors, depend on gpiolib to handle CS polarity. +Existing quirks in gpiolib ensure that this is handled correctly. + +Existing gpiolib behaviour will force the polarity of any chip-select +gpiod to active-high (if 'spi-active-high' devicetree prop present) or +active-low (if 'spi-active-high' absent). Irrespective of whether +the gpio is marked GPIO_ACTIVE_[HIGH|LOW] in the devicetree. + +Loose ends: +----------- +If this fix is applied: +- is commit 138c9c32f090 + ("spi: spidev: Fix CS polarity if GPIO descriptors are used") + still necessary / correct ? + +Fixes: f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs") +Signed-off-by: Sven Van Asbroeck +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/20201106150706.29089-1-TheSven73@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 23 ++++++----------------- + 1 file changed, 6 insertions(+), 17 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 0cab239d8e7fc..7566482c052c8 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -812,18 +812,16 @@ static void spi_set_cs(struct spi_device *spi, bool enable) + enable = !enable; + + if (spi->cs_gpiod || gpio_is_valid(spi->cs_gpio)) { +- /* +- * Honour the SPI_NO_CS flag and invert the enable line, as +- * active low is default for SPI. Execution paths that handle +- * polarity inversion in gpiolib (such as device tree) will +- * enforce active high using the SPI_CS_HIGH resulting in a +- * double inversion through the code above. +- */ + if (!(spi->mode & SPI_NO_CS)) { + if (spi->cs_gpiod) ++ /* polarity handled by gpiolib */ + gpiod_set_value_cansleep(spi->cs_gpiod, +- !enable); ++ enable1); + else ++ /* ++ * invert the enable line, as active low is ++ * default for SPI. ++ */ + gpio_set_value_cansleep(spi->cs_gpio, !enable); + } + /* Some SPI masters need both GPIO CS & slave_select */ +@@ -1992,15 +1990,6 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, + } + spi->chip_select = value; + +- /* +- * For descriptors associated with the device, polarity inversion is +- * handled in the gpiolib, so all gpio chip selects are "active high" +- * in the logical sense, the gpiolib will invert the line if need be. +- */ +- if ((ctlr->use_gpio_descriptors) && ctlr->cs_gpiods && +- ctlr->cs_gpiods[spi->chip_select]) +- spi->mode |= SPI_CS_HIGH; +- + /* Device speed */ + if (!of_property_read_u32(nc, "spi-max-frequency", &value)) + spi->max_speed_hz = value; +-- +2.27.0 + diff --git a/queue-5.9/sunrpc-fix-oops-in-the-rpc_xdr_buf-event-class.patch b/queue-5.9/sunrpc-fix-oops-in-the-rpc_xdr_buf-event-class.patch new file mode 100644 index 00000000000..6b8045b1d1e --- /dev/null +++ b/queue-5.9/sunrpc-fix-oops-in-the-rpc_xdr_buf-event-class.patch @@ -0,0 +1,38 @@ +From 33455eb9f989c450178d0bf4000761b29aaaa5f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 15:17:32 -0500 +Subject: SUNRPC: Fix oops in the rpc_xdr_buf event class + +From: Scott Mayhew + +[ Upstream commit c3213d260a23e263ef85ba21ac68c9e7578020b5 ] + +Backchannel rpc tasks don't have task->tk_client set, so it's necessary +to check it for NULL before dereferencing. + +Fixes: c509f15a5801 ("SUNRPC: Split the xdr_buf event class") +Signed-off-by: Scott Mayhew +Reviewed-by: Chuck Lever +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + include/trace/events/sunrpc.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index ca2f27b9f919d..1652cc32aebcd 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -68,7 +68,8 @@ DECLARE_EVENT_CLASS(rpc_xdr_buf_class, + + TP_fast_assign( + __entry->task_id = task->tk_pid; +- __entry->client_id = task->tk_client->cl_clid; ++ __entry->client_id = task->tk_client ? ++ task->tk_client->cl_clid : -1; + __entry->head_base = xdr->head[0].iov_base; + __entry->head_len = xdr->head[0].iov_len; + __entry->tail_base = xdr->tail[0].iov_base; +-- +2.27.0 + diff --git a/queue-5.9/swiotlb-using-size_max-needs-limits.h-included.patch b/queue-5.9/swiotlb-using-size_max-needs-limits.h-included.patch new file mode 100644 index 00000000000..d1fef119c07 --- /dev/null +++ b/queue-5.9/swiotlb-using-size_max-needs-limits.h-included.patch @@ -0,0 +1,57 @@ +From 3646b6ad43facac61294c24540d1f582ba2cea7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 12:43:27 +1100 +Subject: swiotlb: using SIZE_MAX needs limits.h included + +From: Stephen Rothwell + +[ Upstream commit f51778db088b2407ec177f2f4da0f6290602aa3f ] + +After merging the drm-misc tree, linux-next build (arm +multi_v7_defconfig) failed like this: + +In file included from drivers/gpu/drm/nouveau/nouveau_ttm.c:26: +include/linux/swiotlb.h: In function 'swiotlb_max_mapping_size': +include/linux/swiotlb.h:99:9: error: 'SIZE_MAX' undeclared (first use in this function) + 99 | return SIZE_MAX; + | ^~~~~~~~ +include/linux/swiotlb.h:7:1: note: 'SIZE_MAX' is defined in header ''; did you forget to '#include '? + 6 | #include + +++ |+#include + 7 | #include +include/linux/swiotlb.h:99:9: note: each undeclared identifier is reported only once for each function it appears in + 99 | return SIZE_MAX; + | ^~~~~~~~ + +Caused by commit + + abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()") + +but only exposed by commit "drm/nouveu: fix swiotlb include" + +Fix it by including linux/limits.h as appropriate. + +Fixes: abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()") +Signed-off-by: Stephen Rothwell +Link: https://lore.kernel.org/r/20201102124327.2f82b2a7@canb.auug.org.au +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + include/linux/swiotlb.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h +index 046bb94bd4d61..fa5122c6711e6 100644 +--- a/include/linux/swiotlb.h ++++ b/include/linux/swiotlb.h +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + struct device; + struct page; +-- +2.27.0 + diff --git a/queue-5.9/tee-amdtee-fix-memory-leak-due-to-reset-of-global-sh.patch b/queue-5.9/tee-amdtee-fix-memory-leak-due-to-reset-of-global-sh.patch new file mode 100644 index 00000000000..c041fa845da --- /dev/null +++ b/queue-5.9/tee-amdtee-fix-memory-leak-due-to-reset-of-global-sh.patch @@ -0,0 +1,136 @@ +From 5f2b492026d16eed9a7920cefc9642767d5ecd6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 11:56:09 +0530 +Subject: tee: amdtee: fix memory leak due to reset of global shm list + +From: Rijo Thomas + +[ Upstream commit ff1f855804cdbbb6db7b9b6df6cab783d1a40d66 ] + +The driver maintains a list of shared memory buffers along with their +mapped buffer id's in a global linked list. These buffers need to be +unmapped after use by the user-space client. + +The global shared memory list is initialized to zero entries in the +function amdtee_open(). This clearing of list entries can be a source +for memory leak on secure side if the global linked list previously +held some mapped buffer entries allocated from another TEE context. + +Fix potential memory leak issue by moving global shared memory list +to AMD-TEE driver context data structure. + +Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") +Reviewed-by: Devaraj Rangasamy +Signed-off-by: Rijo Thomas +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/amdtee/amdtee_private.h | 7 +++---- + drivers/tee/amdtee/core.c | 18 +++++++++++------- + 2 files changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h +index d7f798c3394bc..97df16a17285a 100644 +--- a/drivers/tee/amdtee/amdtee_private.h ++++ b/drivers/tee/amdtee/amdtee_private.h +@@ -64,9 +64,12 @@ struct amdtee_session { + /** + * struct amdtee_context_data - AMD-TEE driver context data + * @sess_list: Keeps track of sessions opened in current TEE context ++ * @shm_list: Keeps track of buffers allocated and mapped in current TEE ++ * context + */ + struct amdtee_context_data { + struct list_head sess_list; ++ struct list_head shm_list; + }; + + struct amdtee_driver_data { +@@ -89,10 +92,6 @@ struct amdtee_shm_data { + u32 buf_id; + }; + +-struct amdtee_shm_context { +- struct list_head shmdata_list; +-}; +- + #define LOWER_TWO_BYTE_MASK 0x0000FFFF + + /** +diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c +index 27b4cd77d0db6..ce61c68ec58cb 100644 +--- a/drivers/tee/amdtee/core.c ++++ b/drivers/tee/amdtee/core.c +@@ -20,7 +20,6 @@ + + static struct amdtee_driver_data *drv_data; + static DEFINE_MUTEX(session_list_mutex); +-static struct amdtee_shm_context shmctx; + + static void amdtee_get_version(struct tee_device *teedev, + struct tee_ioctl_version_data *vers) +@@ -42,7 +41,7 @@ static int amdtee_open(struct tee_context *ctx) + return -ENOMEM; + + INIT_LIST_HEAD(&ctxdata->sess_list); +- INIT_LIST_HEAD(&shmctx.shmdata_list); ++ INIT_LIST_HEAD(&ctxdata->shm_list); + + ctx->data = ctxdata; + return 0; +@@ -152,10 +151,11 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata, + + u32 get_buffer_id(struct tee_shm *shm) + { +- u32 buf_id = 0; ++ struct amdtee_context_data *ctxdata = shm->ctx->data; + struct amdtee_shm_data *shmdata; ++ u32 buf_id = 0; + +- list_for_each_entry(shmdata, &shmctx.shmdata_list, shm_node) ++ list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node) + if (shmdata->kaddr == shm->kaddr) { + buf_id = shmdata->buf_id; + break; +@@ -333,8 +333,9 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) + + int amdtee_map_shmem(struct tee_shm *shm) + { +- struct shmem_desc shmem; ++ struct amdtee_context_data *ctxdata; + struct amdtee_shm_data *shmnode; ++ struct shmem_desc shmem; + int rc, count; + u32 buf_id; + +@@ -362,7 +363,8 @@ int amdtee_map_shmem(struct tee_shm *shm) + + shmnode->kaddr = shm->kaddr; + shmnode->buf_id = buf_id; +- list_add(&shmnode->shm_node, &shmctx.shmdata_list); ++ ctxdata = shm->ctx->data; ++ list_add(&shmnode->shm_node, &ctxdata->shm_list); + + pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr); + +@@ -371,6 +373,7 @@ int amdtee_map_shmem(struct tee_shm *shm) + + void amdtee_unmap_shmem(struct tee_shm *shm) + { ++ struct amdtee_context_data *ctxdata; + struct amdtee_shm_data *shmnode; + u32 buf_id; + +@@ -381,7 +384,8 @@ void amdtee_unmap_shmem(struct tee_shm *shm) + /* Unmap the shared memory from TEE */ + handle_unmap_shmem(buf_id); + +- list_for_each_entry(shmnode, &shmctx.shmdata_list, shm_node) ++ ctxdata = shm->ctx->data; ++ list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node) + if (buf_id == shmnode->buf_id) { + list_del(&shmnode->shm_node); + kfree(shmnode); +-- +2.27.0 + diff --git a/queue-5.9/tee-amdtee-synchronize-access-to-shm-list.patch b/queue-5.9/tee-amdtee-synchronize-access-to-shm-list.patch new file mode 100644 index 00000000000..98415374602 --- /dev/null +++ b/queue-5.9/tee-amdtee-synchronize-access-to-shm-list.patch @@ -0,0 +1,97 @@ +From e8b774f799bca211256bf0f34a76e0ca7014ba6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 11:56:10 +0530 +Subject: tee: amdtee: synchronize access to shm list + +From: Rijo Thomas + +[ Upstream commit be353be27874f40837327d9a39e3ad2149ab66d3 ] + +Synchronize access to shm or shared memory buffer list to prevent +race conditions due to concurrent updates to shared shm list by +multiple threads. + +Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") +Reviewed-by: Devaraj Rangasamy +Signed-off-by: Rijo Thomas +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/amdtee/amdtee_private.h | 1 + + drivers/tee/amdtee/core.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h +index 97df16a17285a..337c8d82f74eb 100644 +--- a/drivers/tee/amdtee/amdtee_private.h ++++ b/drivers/tee/amdtee/amdtee_private.h +@@ -70,6 +70,7 @@ struct amdtee_session { + struct amdtee_context_data { + struct list_head sess_list; + struct list_head shm_list; ++ struct mutex shm_mutex; /* synchronizes access to @shm_list */ + }; + + struct amdtee_driver_data { +diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c +index ce61c68ec58cb..8a6a8f30bb427 100644 +--- a/drivers/tee/amdtee/core.c ++++ b/drivers/tee/amdtee/core.c +@@ -42,6 +42,7 @@ static int amdtee_open(struct tee_context *ctx) + + INIT_LIST_HEAD(&ctxdata->sess_list); + INIT_LIST_HEAD(&ctxdata->shm_list); ++ mutex_init(&ctxdata->shm_mutex); + + ctx->data = ctxdata; + return 0; +@@ -85,6 +86,7 @@ static void amdtee_release(struct tee_context *ctx) + list_del(&sess->list_node); + release_session(sess); + } ++ mutex_destroy(&ctxdata->shm_mutex); + kfree(ctxdata); + + ctx->data = NULL; +@@ -155,11 +157,13 @@ u32 get_buffer_id(struct tee_shm *shm) + struct amdtee_shm_data *shmdata; + u32 buf_id = 0; + ++ mutex_lock(&ctxdata->shm_mutex); + list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node) + if (shmdata->kaddr == shm->kaddr) { + buf_id = shmdata->buf_id; + break; + } ++ mutex_unlock(&ctxdata->shm_mutex); + + return buf_id; + } +@@ -364,7 +368,9 @@ int amdtee_map_shmem(struct tee_shm *shm) + shmnode->kaddr = shm->kaddr; + shmnode->buf_id = buf_id; + ctxdata = shm->ctx->data; ++ mutex_lock(&ctxdata->shm_mutex); + list_add(&shmnode->shm_node, &ctxdata->shm_list); ++ mutex_unlock(&ctxdata->shm_mutex); + + pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr); + +@@ -385,12 +391,14 @@ void amdtee_unmap_shmem(struct tee_shm *shm) + handle_unmap_shmem(buf_id); + + ctxdata = shm->ctx->data; ++ mutex_lock(&ctxdata->shm_mutex); + list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node) + if (buf_id == shmnode->buf_id) { + list_del(&shmnode->shm_node); + kfree(shmnode); + break; + } ++ mutex_unlock(&ctxdata->shm_mutex); + } + + int amdtee_invoke_func(struct tee_context *ctx, +-- +2.27.0 + diff --git a/queue-5.9/tools-bpftool-add-missing-close-before-bpftool-net-a.patch b/queue-5.9/tools-bpftool-add-missing-close-before-bpftool-net-a.patch new file mode 100644 index 00000000000..7ac863cec17 --- /dev/null +++ b/queue-5.9/tools-bpftool-add-missing-close-before-bpftool-net-a.patch @@ -0,0 +1,73 @@ +From fd09047b911dd19a4b4a0e12a1ccc9f10b0bf9e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 19:51:52 +0800 +Subject: tools, bpftool: Add missing close before bpftool net attach exit + +From: Wang Hai + +[ Upstream commit 50431b45685b600fc2851a3f2b53e24643efe6d3 ] + +progfd is created by prog_parse_fd() in do_attach() and before the latter +returns in case of success, the file descriptor should be closed. + +Fixes: 04949ccc273e ("tools: bpftool: add net attach command to attach XDP on interface") +Signed-off-by: Wang Hai +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20201113115152.53178-1-wanghai38@huawei.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/net.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c +index 56c3a2bae3ef2..029c8188a2f90 100644 +--- a/tools/bpf/bpftool/net.c ++++ b/tools/bpf/bpftool/net.c +@@ -313,8 +313,8 @@ static int do_attach(int argc, char **argv) + + ifindex = net_parse_dev(&argc, &argv); + if (ifindex < 1) { +- close(progfd); +- return -EINVAL; ++ err = -EINVAL; ++ goto cleanup; + } + + if (argc) { +@@ -322,8 +322,8 @@ static int do_attach(int argc, char **argv) + overwrite = true; + } else { + p_err("expected 'overwrite', got: '%s'?", *argv); +- close(progfd); +- return -EINVAL; ++ err = -EINVAL; ++ goto cleanup; + } + } + +@@ -331,17 +331,17 @@ static int do_attach(int argc, char **argv) + if (is_prefix("xdp", attach_type_strings[attach_type])) + err = do_attach_detach_xdp(progfd, attach_type, ifindex, + overwrite); +- +- if (err < 0) { ++ if (err) { + p_err("interface %s attach failed: %s", + attach_type_strings[attach_type], strerror(-err)); +- return err; ++ goto cleanup; + } + + if (json_output) + jsonw_null(json_wtr); +- +- return 0; ++cleanup: ++ close(progfd); ++ return err; + } + + static int do_detach(int argc, char **argv) +-- +2.27.0 + diff --git a/queue-5.9/xfs-directory-scrub-should-check-the-null-bestfree-e.patch b/queue-5.9/xfs-directory-scrub-should-check-the-null-bestfree-e.patch new file mode 100644 index 00000000000..f39aa97b21e --- /dev/null +++ b/queue-5.9/xfs-directory-scrub-should-check-the-null-bestfree-e.patch @@ -0,0 +1,63 @@ +From cc6afaa477150d6a5dab0c6cc38bfdfa564eba51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:42 -0800 +Subject: xfs: directory scrub should check the null bestfree entries too + +From: Darrick J. Wong + +[ Upstream commit 6b48e5b8a20f653b7d64ccf99a498f2523bff752 ] + +Teach the directory scrubber to check all the bestfree entries, +including the null ones. We want to be able to detect the case where +the entry is null but there actually /is/ a directory data block. + +Found by fuzzing lbests[0] = ones in xfs/391. + +Fixes: df481968f33b ("xfs: scrub directory freespace") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/dir.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c +index 7c432997edade..b045e95c2ea73 100644 +--- a/fs/xfs/scrub/dir.c ++++ b/fs/xfs/scrub/dir.c +@@ -558,14 +558,27 @@ xchk_directory_leaf1_bestfree( + /* Check all the bestfree entries. */ + for (i = 0; i < bestcount; i++, bestp++) { + best = be16_to_cpu(*bestp); +- if (best == NULLDATAOFF) +- continue; + error = xfs_dir3_data_read(sc->tp, sc->ip, +- i * args->geo->fsbcount, 0, &dbp); ++ xfs_dir2_db_to_da(args->geo, i), ++ XFS_DABUF_MAP_HOLE_OK, ++ &dbp); + if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, lblk, + &error)) + break; +- xchk_directory_check_freesp(sc, lblk, dbp, best); ++ ++ if (!dbp) { ++ if (best != NULLDATAOFF) { ++ xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, ++ lblk); ++ break; ++ } ++ continue; ++ } ++ ++ if (best == NULLDATAOFF) ++ xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk); ++ else ++ xchk_directory_check_freesp(sc, lblk, dbp, best); + xfs_trans_brelse(sc->tp, dbp); + if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) + break; +-- +2.27.0 + diff --git a/queue-5.9/xfs-ensure-inobt-record-walks-always-make-forward-pr.patch b/queue-5.9/xfs-ensure-inobt-record-walks-always-make-forward-pr.patch new file mode 100644 index 00000000000..15ac05adf1d --- /dev/null +++ b/queue-5.9/xfs-ensure-inobt-record-walks-always-make-forward-pr.patch @@ -0,0 +1,139 @@ +From e3311a05f52d28e96ad40a54e317739f4a6b9020 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 09:59:22 -0800 +Subject: xfs: ensure inobt record walks always make forward progress + +From: Darrick J. Wong + +[ Upstream commit 27c14b5daa82861220d6fa6e27b51f05f21ffaa7 ] + +The aim of the inode btree record iterator function is to call a +callback on every record in the btree. To avoid having to tear down and +recreate the inode btree cursor around every callback, it caches a +certain number of records in a memory buffer. After each batch of +callback invocations, we have to perform a btree lookup to find the +next record after where we left off. + +However, if the keys of the inode btree are corrupt, the lookup might +put us in the wrong part of the inode btree, causing the walk function +to loop forever. Therefore, we add extra cursor tracking to make sure +that we never go backwards neither when performing the lookup nor when +jumping to the next inobt record. This also fixes an off by one error +where upon resume the lookup should have been for the inode /after/ the +point at which we stopped. + +Found by fuzzing xfs/460 with keys[2].startino = ones causing bulkstat +and quotacheck to hang. + +Fixes: a211432c27ff ("xfs: create simplified inode walk function") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_iwalk.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +diff --git a/fs/xfs/xfs_iwalk.c b/fs/xfs/xfs_iwalk.c +index 233dcc8784db0..2a45138831e33 100644 +--- a/fs/xfs/xfs_iwalk.c ++++ b/fs/xfs/xfs_iwalk.c +@@ -55,6 +55,9 @@ struct xfs_iwalk_ag { + /* Where do we start the traversal? */ + xfs_ino_t startino; + ++ /* What was the last inode number we saw when iterating the inobt? */ ++ xfs_ino_t lastino; ++ + /* Array of inobt records we cache. */ + struct xfs_inobt_rec_incore *recs; + +@@ -301,6 +304,9 @@ xfs_iwalk_ag_start( + if (XFS_IS_CORRUPT(mp, *has_more != 1)) + return -EFSCORRUPTED; + ++ iwag->lastino = XFS_AGINO_TO_INO(mp, agno, ++ irec->ir_startino + XFS_INODES_PER_CHUNK - 1); ++ + /* + * If the LE lookup yielded an inobt record before the cursor position, + * skip it and see if there's another one after it. +@@ -347,15 +353,17 @@ xfs_iwalk_run_callbacks( + struct xfs_mount *mp = iwag->mp; + struct xfs_trans *tp = iwag->tp; + struct xfs_inobt_rec_incore *irec; +- xfs_agino_t restart; ++ xfs_agino_t next_agino; + int error; + ++ next_agino = XFS_INO_TO_AGINO(mp, iwag->lastino) + 1; ++ + ASSERT(iwag->nr_recs > 0); + + /* Delete cursor but remember the last record we cached... */ + xfs_iwalk_del_inobt(tp, curpp, agi_bpp, 0); + irec = &iwag->recs[iwag->nr_recs - 1]; +- restart = irec->ir_startino + XFS_INODES_PER_CHUNK - 1; ++ ASSERT(next_agino == irec->ir_startino + XFS_INODES_PER_CHUNK); + + error = xfs_iwalk_ag_recs(iwag); + if (error) +@@ -372,7 +380,7 @@ xfs_iwalk_run_callbacks( + if (error) + return error; + +- return xfs_inobt_lookup(*curpp, restart, XFS_LOOKUP_GE, has_more); ++ return xfs_inobt_lookup(*curpp, next_agino, XFS_LOOKUP_GE, has_more); + } + + /* Walk all inodes in a single AG, from @iwag->startino to the end of the AG. */ +@@ -396,6 +404,7 @@ xfs_iwalk_ag( + + while (!error && has_more) { + struct xfs_inobt_rec_incore *irec; ++ xfs_ino_t rec_fsino; + + cond_resched(); + if (xfs_pwork_want_abort(&iwag->pwork)) +@@ -407,6 +416,15 @@ xfs_iwalk_ag( + if (error || !has_more) + break; + ++ /* Make sure that we always move forward. */ ++ rec_fsino = XFS_AGINO_TO_INO(mp, agno, irec->ir_startino); ++ if (iwag->lastino != NULLFSINO && ++ XFS_IS_CORRUPT(mp, iwag->lastino >= rec_fsino)) { ++ error = -EFSCORRUPTED; ++ goto out; ++ } ++ iwag->lastino = rec_fsino + XFS_INODES_PER_CHUNK - 1; ++ + /* No allocated inodes in this chunk; skip it. */ + if (iwag->skip_empty && irec->ir_freecount == irec->ir_count) { + error = xfs_btree_increment(cur, 0, &has_more); +@@ -535,6 +553,7 @@ xfs_iwalk( + .trim_start = 1, + .skip_empty = 1, + .pwork = XFS_PWORK_SINGLE_THREADED, ++ .lastino = NULLFSINO, + }; + xfs_agnumber_t agno = XFS_INO_TO_AGNO(mp, startino); + int error; +@@ -623,6 +642,7 @@ xfs_iwalk_threaded( + iwag->data = data; + iwag->startino = startino; + iwag->sz_recs = xfs_iwalk_prefetch(inode_records); ++ iwag->lastino = NULLFSINO; + xfs_pwork_queue(&pctl, &iwag->pwork); + startino = XFS_AGINO_TO_INO(mp, agno + 1, 0); + if (flags & XFS_INOBT_WALK_SAME_AG) +@@ -696,6 +716,7 @@ xfs_inobt_walk( + .startino = startino, + .sz_recs = xfs_inobt_walk_prefetch(inobt_records), + .pwork = XFS_PWORK_SINGLE_THREADED, ++ .lastino = NULLFSINO, + }; + xfs_agnumber_t agno = XFS_INO_TO_AGNO(mp, startino); + int error; +-- +2.27.0 + diff --git a/queue-5.9/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch b/queue-5.9/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch new file mode 100644 index 00000000000..475eafbec44 --- /dev/null +++ b/queue-5.9/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch @@ -0,0 +1,92 @@ +From 59d873f78dc4a0c7ca5385925843ff186c9ff579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:41 -0800 +Subject: xfs: fix the minrecs logic when dealing with inode root child blocks + +From: Darrick J. Wong + +[ Upstream commit e95b6c3ef1311dd7b20467d932a24b6d0fd88395 ] + +The comment and logic in xchk_btree_check_minrecs for dealing with +inode-rooted btrees isn't quite correct. While the direct children of +the inode root are allowed to have fewer records than what would +normally be allowed for a regular ondisk btree block, this is only true +if there is only one child block and the number of records don't fit in +the inode root. + +Fixes: 08a3a692ef58 ("xfs: btree scrub should check minrecs") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/btree.c | 45 ++++++++++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 18 deletions(-) + +diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c +index f52a7b8256f96..debf392e05156 100644 +--- a/fs/xfs/scrub/btree.c ++++ b/fs/xfs/scrub/btree.c +@@ -452,32 +452,41 @@ xchk_btree_check_minrecs( + int level, + struct xfs_btree_block *block) + { +- unsigned int numrecs; +- int ok_level; +- +- numrecs = be16_to_cpu(block->bb_numrecs); ++ struct xfs_btree_cur *cur = bs->cur; ++ unsigned int root_level = cur->bc_nlevels - 1; ++ unsigned int numrecs = be16_to_cpu(block->bb_numrecs); + + /* More records than minrecs means the block is ok. */ +- if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level)) ++ if (numrecs >= cur->bc_ops->get_minrecs(cur, level)) + return; + + /* +- * Certain btree blocks /can/ have fewer than minrecs records. Any +- * level greater than or equal to the level of the highest dedicated +- * btree block are allowed to violate this constraint. +- * +- * For a btree rooted in a block, the btree root can have fewer than +- * minrecs records. If the btree is rooted in an inode and does not +- * store records in the root, the direct children of the root and the +- * root itself can have fewer than minrecs records. ++ * For btrees rooted in the inode, it's possible that the root block ++ * contents spilled into a regular ondisk block because there wasn't ++ * enough space in the inode root. The number of records in that ++ * child block might be less than the standard minrecs, but that's ok ++ * provided that there's only one direct child of the root. + */ +- ok_level = bs->cur->bc_nlevels - 1; +- if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) +- ok_level--; +- if (level >= ok_level) ++ if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) && ++ level == cur->bc_nlevels - 2) { ++ struct xfs_btree_block *root_block; ++ struct xfs_buf *root_bp; ++ int root_maxrecs; ++ ++ root_block = xfs_btree_get_block(cur, root_level, &root_bp); ++ root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level); ++ if (be16_to_cpu(root_block->bb_numrecs) != 1 || ++ numrecs <= root_maxrecs) ++ xchk_btree_set_corrupt(bs->sc, cur, level); + return; ++ } + +- xchk_btree_set_corrupt(bs->sc, bs->cur, level); ++ /* ++ * Otherwise, only the root level is allowed to have fewer than minrecs ++ * records or keyptrs. ++ */ ++ if (level < root_level) ++ xchk_btree_set_corrupt(bs->sc, cur, level); + } + + /* +-- +2.27.0 + diff --git a/queue-5.9/xfs-return-corresponding-errcode-if-xfs_initialize_p.patch b/queue-5.9/xfs-return-corresponding-errcode-if-xfs_initialize_p.patch new file mode 100644 index 00000000000..484d6130369 --- /dev/null +++ b/queue-5.9/xfs-return-corresponding-errcode-if-xfs_initialize_p.patch @@ -0,0 +1,60 @@ +From 9fe1b5c1548414a7ef6112f5e45d2f82e2fe59fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 09:21:26 -0800 +Subject: xfs: return corresponding errcode if xfs_initialize_perag() fail + +From: Yu Kuai + +[ Upstream commit 595189c25c28a55523354336bf24453242c81c15 ] + +In xfs_initialize_perag(), if kmem_zalloc(), xfs_buf_hash_init(), or +radix_tree_preload() failed, the returned value 'error' is not set +accordingly. + +Reported-as-fixing: 8b26c5825e02 ("xfs: handle ENOMEM correctly during initialisation of perag structures") +Fixes: 9b2471797942 ("xfs: cache unlinked pointers in an rhashtable") +Reported-by: Hulk Robot +Signed-off-by: Yu Kuai +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_mount.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c +index c8ae49a1e99c3..2a491a043ec97 100644 +--- a/fs/xfs/xfs_mount.c ++++ b/fs/xfs/xfs_mount.c +@@ -194,20 +194,25 @@ xfs_initialize_perag( + } + + pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL); +- if (!pag) ++ if (!pag) { ++ error = -ENOMEM; + goto out_unwind_new_pags; ++ } + pag->pag_agno = index; + pag->pag_mount = mp; + spin_lock_init(&pag->pag_ici_lock); + INIT_RADIX_TREE(&pag->pag_ici_root, GFP_ATOMIC); +- if (xfs_buf_hash_init(pag)) ++ ++ error = xfs_buf_hash_init(pag); ++ if (error) + goto out_free_pag; + init_waitqueue_head(&pag->pagb_wait); + spin_lock_init(&pag->pagb_lock); + pag->pagb_count = 0; + pag->pagb_tree = RB_ROOT; + +- if (radix_tree_preload(GFP_NOFS)) ++ error = radix_tree_preload(GFP_NOFS); ++ if (error) + goto out_hash_destroy; + + spin_lock(&mp->m_perag_lock); +-- +2.27.0 + diff --git a/queue-5.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch b/queue-5.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch new file mode 100644 index 00000000000..2d98edba396 --- /dev/null +++ b/queue-5.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch @@ -0,0 +1,83 @@ +From 3ac3a50ac1d382b8f5b18bc3dcd54d94225ff4a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 15:17:50 -0800 +Subject: xfs: revert "xfs: fix rmap key and record comparison functions" + +From: Darrick J. Wong + +[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ] + +This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f. + +Your maintainer committed a major braino in the rmap code by adding the +attr fork, bmbt, and unwritten extent usage bits into rmap record key +comparisons. While XFS uses the usage bits *in the rmap records* for +cross-referencing metadata in xfs_scrub and xfs_repair, it only needs +the owner and offset information to distinguish between reverse mappings +of the same physical extent into the data fork of a file at multiple +offsets. The other bits are not important for key comparisons for index +lookups, and never have been. + +Eric Sandeen reports that this causes regressions in generic/299, so +undo this patch before it does more damage. + +Reported-by: Eric Sandeen +Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions") +Signed-off-by: Darrick J. Wong +Reviewed-by: Eric Sandeen +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c +index 577a66381327c..beb81c84a9375 100644 +--- a/fs/xfs/libxfs/xfs_rmap_btree.c ++++ b/fs/xfs/libxfs/xfs_rmap_btree.c +@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp->rm_offset); +- y = xfs_rmap_irec_offset_pack(rec); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset)); ++ y = rec->rm_offset; + if (x > y) + return 1; + else if (y > x) +@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp1->rm_offset); +- y = be64_to_cpu(kp2->rm_offset); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset)); ++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset)); + if (x > y) + return 1; + else if (y > x) +@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(k1->rmap.rm_offset); +- b = be64_to_cpu(k2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(r1->rmap.rm_offset); +- b = be64_to_cpu(r2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +-- +2.27.0 + diff --git a/queue-5.9/xfs-strengthen-rmap-record-flags-checking.patch b/queue-5.9/xfs-strengthen-rmap-record-flags-checking.patch new file mode 100644 index 00000000000..e6316b3400c --- /dev/null +++ b/queue-5.9/xfs-strengthen-rmap-record-flags-checking.patch @@ -0,0 +1,46 @@ +From 77805f1364ef7f5e4c89c75ad06d14765d0fccc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:41 -0800 +Subject: xfs: strengthen rmap record flags checking + +From: Darrick J. Wong + +[ Upstream commit 498fe261f0d6d5189f8e11d283705dd97b474b54 ] + +We always know the correct state of the rmap record flags (attr, bmbt, +unwritten) so check them by direct comparison. + +Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/bmap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c +index 412e2ec55e388..fed56d213a3f9 100644 +--- a/fs/xfs/scrub/bmap.c ++++ b/fs/xfs/scrub/bmap.c +@@ -218,13 +218,13 @@ xchk_bmap_xref_rmap( + * which doesn't track unwritten state. + */ + if (owner != XFS_RMAP_OWN_COW && +- irec->br_state == XFS_EXT_UNWRITTEN && +- !(rmap.rm_flags & XFS_RMAP_UNWRITTEN)) ++ !!(irec->br_state == XFS_EXT_UNWRITTEN) != ++ !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN)) + xchk_fblock_xref_set_corrupt(info->sc, info->whichfork, + irec->br_startoff); + +- if (info->whichfork == XFS_ATTR_FORK && +- !(rmap.rm_flags & XFS_RMAP_ATTR_FORK)) ++ if (!!(info->whichfork == XFS_ATTR_FORK) != ++ !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK)) + xchk_fblock_xref_set_corrupt(info->sc, info->whichfork, + irec->br_startoff); + if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK) +-- +2.27.0 +