From: Sasha Levin Date: Wed, 12 May 2021 11:50:02 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.4.119~28 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6504a288bf8a7de8a6054dfc1cbef210c9eb80e9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch b/queue-5.10/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch new file mode 100644 index 00000000000..5db27afa879 --- /dev/null +++ b/queue-5.10/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch @@ -0,0 +1,90 @@ +From 750f425e6a282302cece3c05bbc5add851bee688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 14:30:48 -0700 +Subject: ACPI: CPPC: Replace cppc_attr with kobj_attribute + +From: Nathan Chancellor + +[ Upstream commit 2bc6262c6117dd18106d5aa50d53e945b5d99c51 ] + +All of the CPPC sysfs show functions are called via indirect call in +kobj_attr_show(), where they should be of type + +ssize_t (*show)(struct kobject *kobj, struct kobj_attribute *attr, char *buf); + +because that is the type of the ->show() member in +'struct kobj_attribute' but they are actually of type + +ssize_t (*show)(struct kobject *kobj, struct attribute *attr, char *buf); + +because of the ->show() member in 'struct cppc_attr', resulting in a +Control Flow Integrity violation [1]. + +$ cat /sys/devices/system/cpu/cpu0/acpi_cppc/highest_perf +3400 + +$ dmesg | grep "CFI failure" +[ 175.970559] CFI failure (target: show_highest_perf+0x0/0x8): + +As far as I can tell, the only difference between 'struct cppc_attr' +and 'struct kobj_attribute' aside from the type of the attr parameter +is the type of the count parameter in the ->store() member (ssize_t vs. +size_t), which does not actually matter because all of these nodes are +read-only. + +Eliminate 'struct cppc_attr' in favor of 'struct kobj_attribute' to fix +the violation. + +[1]: https://lore.kernel.org/r/20210401233216.2540591-1-samitolvanen@google.com/ + +Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") +Link: https://github.com/ClangBuiltLinux/linux/issues/1343 +Signed-off-by: Nathan Chancellor +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 7a99b19bb893..0a2da06e9d8b 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -118,23 +118,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); + */ + #define NUM_RETRIES 500ULL + +-struct cppc_attr { +- struct attribute attr; +- ssize_t (*show)(struct kobject *kobj, +- struct attribute *attr, char *buf); +- ssize_t (*store)(struct kobject *kobj, +- struct attribute *attr, const char *c, ssize_t count); +-}; +- + #define define_one_cppc_ro(_name) \ +-static struct cppc_attr _name = \ ++static struct kobj_attribute _name = \ + __ATTR(_name, 0444, show_##_name, NULL) + + #define to_cpc_desc(a) container_of(a, struct cpc_desc, kobj) + + #define show_cppc_data(access_fn, struct_name, member_name) \ + static ssize_t show_##member_name(struct kobject *kobj, \ +- struct attribute *attr, char *buf) \ ++ struct kobj_attribute *attr, char *buf) \ + { \ + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \ + struct struct_name st_name = {0}; \ +@@ -160,7 +152,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + + static ssize_t show_feedback_ctrs(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); + struct cppc_perf_fb_ctrs fb_ctrs = {0}; +-- +2.30.2 + diff --git a/queue-5.10/afs-fix-speculative-status-fetches.patch b/queue-5.10/afs-fix-speculative-status-fetches.patch new file mode 100644 index 00000000000..d006f065750 --- /dev/null +++ b/queue-5.10/afs-fix-speculative-status-fetches.patch @@ -0,0 +1,242 @@ +From ad16fec63bc142d8df83b24ff894df80f5168122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 13:47:08 +0100 +Subject: afs: Fix speculative status fetches + +From: David Howells + +[ Upstream commit 22650f148126571be1098d34160eb4931fc77241 ] + +The generic/464 xfstest causes kAFS to emit occasional warnings of the +form: + + kAFS: vnode modified {100055:8a} 30->31 YFS.StoreData64 (c=6015) + +This indicates that the data version received back from the server did not +match the expected value (the DV should be incremented monotonically for +each individual modification op committed to a vnode). + +What is happening is that a lookup call is doing a bulk status fetch +speculatively on a bunch of vnodes in a directory besides getting the +status of the vnode it's actually interested in. This is racing with a +StoreData operation (though it could also occur with, say, a MakeDir op). + +On the client, a modification operation locks the vnode, but the bulk +status fetch only locks the parent directory, so no ordering is imposed +there (thereby avoiding an avenue to deadlock). + +On the server, the StoreData op handler doesn't lock the vnode until it's +received all the request data, and downgrades the lock after committing the +data until it has finished sending change notifications to other clients - +which allows the status fetch to occur before it has finished. + +This means that: + + - a status fetch can access the target vnode either side of the exclusive + section of the modification + + - the status fetch could start before the modification, yet finish after, + and vice-versa. + + - the status fetch and the modification RPCs can complete in either order. + + - the status fetch can return either the before or the after DV from the + modification. + + - the status fetch might regress the locally cached DV. + +Some of these are handled by the previous fix[1], but that's not sufficient +because it checks the DV it received against the DV it cached at the start +of the op, but the DV might've been updated in the meantime by a locally +generated modification op. + +Fix this by the following means: + + (1) Keep track of when we're performing a modification operation on a + vnode. This is done by marking vnode parameters with a 'modification' + note that causes the AFS_VNODE_MODIFYING flag to be set on the vnode + for the duration. + + (2) Alter the speculation race detection to ignore speculative status + fetches if either the vnode is marked as being modified or the data + version number is not what we expected. + +Note that whilst the "vnode modified" warning does get recovered from as it +causes the client to refetch the status at the next opportunity, it will +also invalidate the pagecache, so changes might get lost. + +Fixes: a9e5c87ca744 ("afs: Fix speculative status fetch going out of order wrt to modifications") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Tested-and-reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/160605082531.252452.14708077925602709042.stgit@warthog.procyon.org.uk/ [1] +Link: https://lore.kernel.org/linux-fsdevel/161961335926.39335.2552653972195467566.stgit@warthog.procyon.org.uk/ # v1 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 7 +++++++ + fs/afs/dir_silly.c | 3 +++ + fs/afs/fs_operation.c | 6 ++++++ + fs/afs/inode.c | 6 ++++-- + fs/afs/internal.h | 2 ++ + fs/afs/write.c | 1 + + 6 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 9dc6f4b1c417..628ba3fed36d 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -1337,6 +1337,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + + afs_op_set_vnode(op, 0, dvnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + op->dentry = dentry; + op->create.mode = S_IFDIR | mode; +@@ -1418,6 +1419,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry) + + afs_op_set_vnode(op, 0, dvnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + + op->dentry = dentry; +@@ -1554,6 +1556,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry) + + afs_op_set_vnode(op, 0, dvnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + + /* Try to make sure we have a callback promise on the victim. */ +@@ -1636,6 +1639,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode, + + afs_op_set_vnode(op, 0, dvnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + + op->dentry = dentry; +@@ -1710,6 +1714,7 @@ static int afs_link(struct dentry *from, struct inode *dir, + afs_op_set_vnode(op, 0, dvnode); + afs_op_set_vnode(op, 1, vnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + op->file[1].update_ctime = true; + +@@ -1905,6 +1910,8 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry, + afs_op_set_vnode(op, 1, new_dvnode); /* May be same as orig_dvnode */ + op->file[0].dv_delta = 1; + op->file[1].dv_delta = 1; ++ op->file[0].modification = true; ++ op->file[1].modification = true; + op->file[0].update_ctime = true; + op->file[1].update_ctime = true; + +diff --git a/fs/afs/dir_silly.c b/fs/afs/dir_silly.c +index 04f75a44f243..dae9a57d7ec0 100644 +--- a/fs/afs/dir_silly.c ++++ b/fs/afs/dir_silly.c +@@ -73,6 +73,8 @@ static int afs_do_silly_rename(struct afs_vnode *dvnode, struct afs_vnode *vnode + afs_op_set_vnode(op, 1, dvnode); + op->file[0].dv_delta = 1; + op->file[1].dv_delta = 1; ++ op->file[0].modification = true; ++ op->file[1].modification = true; + op->file[0].update_ctime = true; + op->file[1].update_ctime = true; + +@@ -201,6 +203,7 @@ static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnode + afs_op_set_vnode(op, 0, dvnode); + afs_op_set_vnode(op, 1, vnode); + op->file[0].dv_delta = 1; ++ op->file[0].modification = true; + op->file[0].update_ctime = true; + op->file[1].op_unlinked = true; + op->file[1].update_ctime = true; +diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c +index 71c58723763d..a82515b47350 100644 +--- a/fs/afs/fs_operation.c ++++ b/fs/afs/fs_operation.c +@@ -118,6 +118,8 @@ static void afs_prepare_vnode(struct afs_operation *op, struct afs_vnode_param * + vp->cb_break_before = afs_calc_vnode_cb_break(vnode); + if (vnode->lock_state != AFS_VNODE_LOCK_NONE) + op->flags |= AFS_OPERATION_CUR_ONLY; ++ if (vp->modification) ++ set_bit(AFS_VNODE_MODIFYING, &vnode->flags); + } + + if (vp->fid.vnode) +@@ -223,6 +225,10 @@ int afs_put_operation(struct afs_operation *op) + + if (op->ops && op->ops->put) + op->ops->put(op); ++ if (op->file[0].modification) ++ clear_bit(AFS_VNODE_MODIFYING, &op->file[0].vnode->flags); ++ if (op->file[1].modification && op->file[1].vnode != op->file[0].vnode) ++ clear_bit(AFS_VNODE_MODIFYING, &op->file[1].vnode->flags); + if (op->file[0].put_vnode) + iput(&op->file[0].vnode->vfs_inode); + if (op->file[1].put_vnode) +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index bf44e245d7dc..ae3016a9fb23 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -293,8 +293,9 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v + op->flags &= ~AFS_OPERATION_DIR_CONFLICT; + } + } else if (vp->scb.have_status) { +- if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version && +- vp->speculative) ++ if (vp->speculative && ++ (test_bit(AFS_VNODE_MODIFYING, &vnode->flags) || ++ vp->dv_before != vnode->status.data_version)) + /* Ignore the result of a speculative bulk status fetch + * if it splits around a modification op, thereby + * appearing to regress the data version. +@@ -909,6 +910,7 @@ int afs_setattr(struct dentry *dentry, struct iattr *attr) + } + op->ctime = attr->ia_ctime; + op->file[0].update_ctime = 1; ++ op->file[0].modification = true; + + op->ops = &afs_setattr_operation; + ret = afs_do_sync_operation(op); +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 525ef075fcd9..ffe318ad2e02 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -640,6 +640,7 @@ struct afs_vnode { + #define AFS_VNODE_PSEUDODIR 7 /* set if Vnode is a pseudo directory */ + #define AFS_VNODE_NEW_CONTENT 8 /* Set if file has new content (create/trunc-0) */ + #define AFS_VNODE_SILLY_DELETED 9 /* Set if file has been silly-deleted */ ++#define AFS_VNODE_MODIFYING 10 /* Set if we're performing a modification op */ + + struct list_head wb_keys; /* List of keys available for writeback */ + struct list_head pending_locks; /* locks waiting to be granted */ +@@ -756,6 +757,7 @@ struct afs_vnode_param { + bool set_size:1; /* Must update i_size */ + bool op_unlinked:1; /* True if file was unlinked by op */ + bool speculative:1; /* T if speculative status fetch (no vnode lock) */ ++ bool modification:1; /* Set if the content gets modified */ + }; + + /* +diff --git a/fs/afs/write.c b/fs/afs/write.c +index c9195fc67fd8..d37b5cfcf28f 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -450,6 +450,7 @@ static int afs_store_data(struct address_space *mapping, + afs_op_set_vnode(op, 0, vnode); + op->file[0].dv_delta = 1; + op->store.mapping = mapping; ++ op->file[0].modification = true; + op->store.first = first; + op->store.last = last; + op->store.first_offset = offset; +-- +2.30.2 + diff --git a/queue-5.10/afs-fix-updating-of-i_mode-due-to-3rd-party-change.patch b/queue-5.10/afs-fix-updating-of-i_mode-due-to-3rd-party-change.patch new file mode 100644 index 00000000000..500675ab65e --- /dev/null +++ b/queue-5.10/afs-fix-updating-of-i_mode-due-to-3rd-party-change.patch @@ -0,0 +1,57 @@ +From 70cdf6cbe004f47a5d9ad187930c3ecfb81cccc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 08:59:52 +0000 +Subject: afs: Fix updating of i_mode due to 3rd party change + +From: David Howells + +[ Upstream commit 6e1eb04a87f954eb06a89ee6034c166351dfff6e ] + +Fix afs_apply_status() to mask off the irrelevant bits from status->mode +when OR'ing them into i_mode. This can happen when a 3rd party chmod +occurs. + +Also fix afs_inode_init_from_status() to mask off the mode bits when +initialising i_mode. + +Fixes: 260a980317da ("[AFS]: Add "directory write" support.") +Reported-by: Al Viro +Signed-off-by: David Howells +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 1d03eb1920ec..bf44e245d7dc 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -102,13 +102,13 @@ static int afs_inode_init_from_status(struct afs_operation *op, + + switch (status->type) { + case AFS_FTYPE_FILE: +- inode->i_mode = S_IFREG | status->mode; ++ inode->i_mode = S_IFREG | (status->mode & S_IALLUGO); + inode->i_op = &afs_file_inode_operations; + inode->i_fop = &afs_file_operations; + inode->i_mapping->a_ops = &afs_fs_aops; + break; + case AFS_FTYPE_DIR: +- inode->i_mode = S_IFDIR | status->mode; ++ inode->i_mode = S_IFDIR | (status->mode & S_IALLUGO); + inode->i_op = &afs_dir_inode_operations; + inode->i_fop = &afs_dir_file_operations; + inode->i_mapping->a_ops = &afs_dir_aops; +@@ -198,7 +198,7 @@ static void afs_apply_status(struct afs_operation *op, + if (status->mode != vnode->status.mode) { + mode = inode->i_mode; + mode &= ~S_IALLUGO; +- mode |= status->mode; ++ mode |= status->mode & S_IALLUGO; + WRITE_ONCE(inode->i_mode, mode); + } + +-- +2.30.2 + diff --git a/queue-5.10/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch b/queue-5.10/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch new file mode 100644 index 00000000000..676f4586ace --- /dev/null +++ b/queue-5.10/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch @@ -0,0 +1,40 @@ +From 8912c1f8ac12a85f3ba0ccb1adf75b28aa59807c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 13:19:23 +0200 +Subject: ALSA: core: remove redundant spin_lock pair in snd_card_disconnect + +From: Jia Zhou + +[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ] + +modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between +register and disconnect") resulting in this problem. + +Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect") +Signed-off-by: Jia Zhou +Signed-off-by: Yi Wang +Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/init.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/core/init.c b/sound/core/init.c +index 018ce4ef12ec..9f5270c90a10 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -390,10 +390,8 @@ int snd_card_disconnect(struct snd_card *card) + return 0; + } + card->shutdown = 1; +- spin_unlock(&card->files_lock); + + /* replace file->f_op with special dummy operations */ +- spin_lock(&card->files_lock); + list_for_each_entry(mfile, &card->files_list, list) { + /* it's critical part, use endless loop */ + /* we have no room to fail */ +-- +2.30.2 + diff --git a/queue-5.10/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch b/queue-5.10/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch new file mode 100644 index 00000000000..13a855e67ab --- /dev/null +++ b/queue-5.10/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch @@ -0,0 +1,136 @@ +From 79ae347e43671b34abbbbf44c41efd648e9b45fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 13:35:34 +0200 +Subject: ALSA: usb-audio: Add error checks for usb_driver_claim_interface() + calls + +From: Takashi Iwai + +[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ] + +There are a few calls of usb_driver_claim_interface() but all of those +miss the proper error checks, as reported by Coverity. This patch +adds those missing checks. + +Along with it, replace the magic pointer with -1 with a constant +USB_AUDIO_IFACE_UNUSED for better readability. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1475943 ("Error handling issues") +Addresses-Coverity-ID: 1475944 ("Error handling issues") +Addresses-Coverity-ID: 1475945 ("Error handling issues") +Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once") +Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code") +Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook +Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 14 +++++++------- + sound/usb/quirks.c | 16 ++++++++++++---- + sound/usb/usbaudio.h | 2 ++ + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index fc7c359ae215..258b81b39917 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -182,9 +182,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + ctrlif, interface); + return -EINVAL; + } +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); +- +- return 0; ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + if ((altsd->bInterfaceClass != USB_CLASS_AUDIO && +@@ -204,7 +203,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + + if (! snd_usb_parse_audio_interface(chip, interface)) { + usb_set_interface(dev, interface, 0); /* reset the current interface */ +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + return 0; +@@ -864,7 +864,7 @@ static void usb_audio_disconnect(struct usb_interface *intf) + struct snd_card *card; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return; + + card = chip->card; +@@ -993,7 +993,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + struct usb_mixer_interface *mixer; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + if (!chip->num_suspended_intf++) { +@@ -1024,7 +1024,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + struct list_head *p; + int err = 0; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + atomic_inc(&chip->active); /* avoid autopm */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 5ab2a4580bfb..bddef8ad5778 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -55,8 +55,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip, + if (!iface) + continue; + if (quirk->ifnum != probed_ifnum && +- !usb_interface_claimed(iface)) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ !usb_interface_claimed(iface)) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +@@ -390,8 +394,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip, + continue; + + err = create_autodetect_quirk(chip, iface, driver); +- if (err >= 0) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ if (err >= 0) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index 9667060ff92b..e54a98f46549 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -63,6 +63,8 @@ struct snd_usb_audio { + struct media_intf_devnode *ctl_intf_media_devnode; + }; + ++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) ++ + #define usb_audio_err(chip, fmt, args...) \ + dev_err(&(chip)->dev->dev, fmt, ##args) + #define usb_audio_warn(chip, fmt, args...) \ +-- +2.30.2 + diff --git a/queue-5.10/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch b/queue-5.10/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch new file mode 100644 index 00000000000..83c54e055b0 --- /dev/null +++ b/queue-5.10/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch @@ -0,0 +1,43 @@ +From 7a716527f9792bba67a8f77c80ad90a2789cb9bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 14:47:19 +0100 +Subject: ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check + fails + +From: Colin Ian King + +[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ] + +Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL) +the error return path returns -ENOMEM via the exit label "error". Other +uses of the same error exit label set the err variable to -ENOMEM but this +is not being used. I believe the original intent was for the error exit +path to return the value in err rather than the hard coded -ENOMEM, so +return this rather than the hard coded -ENOMEM. + +Addresses-Coverity: ("Unused value") +Fixes: 738d9edcfd44 ("ALSA: usb-audio: Add sanity checks for invalid EPs") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210420134719.381409-1-colin.king@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/midi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 0c23fa6d8525..cd46ca7cd28d 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1332,7 +1332,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi, + + error: + snd_usbmidi_in_endpoint_delete(ep); +- return -ENOMEM; ++ return err; + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-aspeed-rainier-fix-humidity-sensor-bus-addre.patch b/queue-5.10/arm-dts-aspeed-rainier-fix-humidity-sensor-bus-addre.patch new file mode 100644 index 00000000000..e0a4f5a49b0 --- /dev/null +++ b/queue-5.10/arm-dts-aspeed-rainier-fix-humidity-sensor-bus-addre.patch @@ -0,0 +1,39 @@ +From b2b0aa88ca63c02d8bdac0182dd273a047a57503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 14:43:06 -0500 +Subject: ARM: dts: aspeed: Rainier: Fix humidity sensor bus address + +From: Eddie James + +[ Upstream commit 1d5d46a1adafafce2b0c9105eab563709c84e3db ] + +The si7021 was incorrectly placed at 0x20 on i2c bus 7. It is at 0x40. + +Fixes: 9c44db7096e0 ("ARM: dts: aspeed: rainier: Add i2c devices") +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts b/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts +index 21ae880c7530..c76b0046b402 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts +@@ -707,9 +707,9 @@ + multi-master; + status = "okay"; + +- si7021-a20@20 { ++ si7021-a20@40 { + compatible = "silabs,si7020"; +- reg = <0x20>; ++ reg = <0x40>; + }; + + tmp275@48 { +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch b/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch new file mode 100644 index 00000000000..92f91084b2a --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch @@ -0,0 +1,38 @@ +From 0992c0bae73f21c89074f47fd89c5ae87e327076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:17 +0100 +Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on + GT-I9100 + +From: Krzysztof Kozlowski + +[ Upstream commit 46799802136670e00498f19898f1635fbc85f583 ] + +The Maxim fuel gauge datasheets describe the interrupt line as active +low with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-1-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4210-i9100.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4210-i9100.dts b/arch/arm/boot/dts/exynos4210-i9100.dts +index 5370ee477186..7777bf51a6e6 100644 +--- a/arch/arm/boot/dts/exynos4210-i9100.dts ++++ b/arch/arm/boot/dts/exynos4210-i9100.dts +@@ -136,7 +136,7 @@ + compatible = "maxim,max17042"; + + interrupt-parent = <&gpx2>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + + pinctrl-0 = <&max17042_fuel_irq>; + pinctrl-names = "default"; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-27655 b/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-27655 new file mode 100644 index 00000000000..3edee568a34 --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-27655 @@ -0,0 +1,38 @@ +From 1adc87513570679ac365f95ef0ecd90a19f7743c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:19 +0100 +Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit 8a45f33bd36efbb624198cfa9fdf1f66fd1c3d26 ] + +The Maxim fuel gauge datasheets describe the interrupt line as active +low with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: e8614292cd41 ("ARM: dts: Add Maxim 77693 fuel gauge node for exynos4412-trats2") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-3-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index 7e7c243ff196..1d56d6fa9077 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -223,7 +223,7 @@ + max77693-fuel-gauge@36 { + compatible = "maxim,max17047"; + interrupt-parent = <&gpx2>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77693_fuel_irq>; + reg = <0x36>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch b/queue-5.10/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..62a61346131 --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch @@ -0,0 +1,42 @@ +From c370b701008aa362991a21cf0317f5dd1ca64de9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:20 +0100 +Subject: ARM: dts: exynos: correct MUIC interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit 15107e443ab8c6cb35eff10438993e4bc944d9ae ] + +The Maxim MUIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 7eec1266751b ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-4-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index 1d56d6fa9077..a8eadcaa0a10 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -174,7 +174,7 @@ + max77693@66 { + compatible = "maxim,max77693"; + interrupt-parent = <&gpx1>; +- interrupts = <5 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77693_irq>; + reg = <0x66>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..909a086d9ff --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch @@ -0,0 +1,42 @@ +From a1059ad1c2ce5b2b0d6618883aec7a11ffa34201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:21 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit e52dcd6e70fab51f53292e53336ecb007bb60889 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 15dfdfad2d4a ("ARM: dts: Add basic dts for Exynos4412-based Trats 2 board") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-5-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index a8eadcaa0a10..06450066b178 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -668,7 +668,7 @@ + max77686: max77686_pmic@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx0>; +- interrupts = <7 IRQ_TYPE_NONE>; ++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; + pinctrl-0 = <&max77686_irq>; + pinctrl-names = "default"; + reg = <0x09>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-12139 b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-12139 new file mode 100644 index 00000000000..01cdb408880 --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-12139 @@ -0,0 +1,41 @@ +From ec43637bc5c18ac0acdc1e8eef5cffa654181db7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:25 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Snow + +From: Krzysztof Kozlowski + +[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +index c952a615148e..737f0e20a452 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi ++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +@@ -292,7 +292,7 @@ + max77686: max77686@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-29838 b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-29838 new file mode 100644 index 00000000000..51c91a86edb --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-29838 @@ -0,0 +1,42 @@ +From 23d37284015ec8c11d48a0cca56ddc951e41b2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:22 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 + family + +From: Krzysztof Kozlowski + +[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: eea6653aae7b ("ARM: dts: Enable PMIC interrupts for exynos4412-odroid-common") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-6-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +index 2983e91bc7dd..869d80be1b36 100644 +--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi ++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +@@ -279,7 +279,7 @@ + max77686: pmic@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + reg = <0x09>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3210 b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3210 new file mode 100644 index 00000000000..7c9ae3925d1 --- /dev/null +++ b/queue-5.10/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3210 @@ -0,0 +1,41 @@ +From f4b223798bc14072dcc6014da5cb6165d279887b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:24 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 + +From: Krzysztof Kozlowski + +[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 186790f39e4d..d0e48c10aec2 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -134,7 +134,7 @@ + compatible = "maxim,max77686"; + reg = <0x09>; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + #clock-cells = <1>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-renesas-add-mmc-aliases-into-r-car-gen2-boar.patch b/queue-5.10/arm-dts-renesas-add-mmc-aliases-into-r-car-gen2-boar.patch new file mode 100644 index 00000000000..5abfeee32a1 --- /dev/null +++ b/queue-5.10/arm-dts-renesas-add-mmc-aliases-into-r-car-gen2-boar.patch @@ -0,0 +1,124 @@ +From de02822713ac16c5392bdfb7a2127ed68d74e41b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 21:01:56 +0900 +Subject: ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files + +From: Yoshihiro Shimoda + +[ Upstream commit da926e813fc7f9f0912fa413981a1f5ba63a536d ] + +After set PROBE_PREFER_ASYNCHRONOUS flag on the mmc host drivers, +the order of /dev/mmcblkN was not fixed in some SoCs which have +multiple SDHI and/or MMCIF controllers. So, we were hard to use +such a device as rootfs by using the kernel parameter like +"root=/dev/mmcblkNpM". + +According to the discussion on a mainling list [1], we can add +mmc aliases to fix the issue. So, add such aliases into R-Car Gen2 +board dts files. Note that, since R-Car Gen2 is even more complicated +about SDHI and/or MMCIF channels variations and they share pins, +add the aliases into board dts files instead of SoC dtsi files. + +[1] +https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/ + +Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14") +Fixes: 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4") +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1613131316-30994-1-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/r8a7790-lager.dts | 3 +++ + arch/arm/boot/dts/r8a7791-koelsch.dts | 3 +++ + arch/arm/boot/dts/r8a7791-porter.dts | 2 ++ + arch/arm/boot/dts/r8a7793-gose.dts | 3 +++ + arch/arm/boot/dts/r8a7794-alt.dts | 3 +++ + arch/arm/boot/dts/r8a7794-silk.dts | 2 ++ + 6 files changed, 16 insertions(+) + +diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts +index 09a152b91557..1d6f0c5d02e9 100644 +--- a/arch/arm/boot/dts/r8a7790-lager.dts ++++ b/arch/arm/boot/dts/r8a7790-lager.dts +@@ -53,6 +53,9 @@ + i2c11 = &i2cexio1; + i2c12 = &i2chdmi; + i2c13 = &i2cpwr; ++ mmc0 = &mmcif1; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts +index f603cba5441f..6af1727b8269 100644 +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -53,6 +53,9 @@ + i2c12 = &i2cexio1; + i2c13 = &i2chdmi; + i2c14 = &i2cexio4; ++ mmc0 = &sdhi0; ++ mmc1 = &sdhi1; ++ mmc2 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts +index c6d563fb7ec7..bf51e29c793a 100644 +--- a/arch/arm/boot/dts/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/r8a7791-porter.dts +@@ -28,6 +28,8 @@ + serial0 = &scif0; + i2c9 = &gpioi2c2; + i2c10 = &i2chdmi; ++ mmc0 = &sdhi0; ++ mmc1 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts +index abf487e8fe0f..2b59a0491350 100644 +--- a/arch/arm/boot/dts/r8a7793-gose.dts ++++ b/arch/arm/boot/dts/r8a7793-gose.dts +@@ -49,6 +49,9 @@ + i2c10 = &gpioi2c4; + i2c11 = &i2chdmi; + i2c12 = &i2cexio4; ++ mmc0 = &sdhi0; ++ mmc1 = &sdhi1; ++ mmc2 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm/boot/dts/r8a7794-alt.dts b/arch/arm/boot/dts/r8a7794-alt.dts +index 3f1cc5bbf329..32025986b3b9 100644 +--- a/arch/arm/boot/dts/r8a7794-alt.dts ++++ b/arch/arm/boot/dts/r8a7794-alt.dts +@@ -19,6 +19,9 @@ + i2c10 = &gpioi2c4; + i2c11 = &i2chdmi; + i2c12 = &i2cexio4; ++ mmc0 = &mmcif0; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi1; + }; + + chosen { +diff --git a/arch/arm/boot/dts/r8a7794-silk.dts b/arch/arm/boot/dts/r8a7794-silk.dts +index 677596f6c9c9..af066ee5e275 100644 +--- a/arch/arm/boot/dts/r8a7794-silk.dts ++++ b/arch/arm/boot/dts/r8a7794-silk.dts +@@ -31,6 +31,8 @@ + serial0 = &scif2; + i2c9 = &gpioi2c1; + i2c10 = &i2chdmi; ++ mmc0 = &mmcif0; ++ mmc1 = &sdhi1; + }; + + chosen { +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-s5pv210-correct-fuel-gauge-interrupt-trigger.patch b/queue-5.10/arm-dts-s5pv210-correct-fuel-gauge-interrupt-trigger.patch new file mode 100644 index 00000000000..30ae3452f00 --- /dev/null +++ b/queue-5.10/arm-dts-s5pv210-correct-fuel-gauge-interrupt-trigger.patch @@ -0,0 +1,38 @@ +From f50dd43799edad64e0dd4344c94302f22fa4b2a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:26 +0100 +Subject: ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on + Fascinate family + +From: Krzysztof Kozlowski + +[ Upstream commit 214e6ec8c9f5a3353d3282b3ff475d3ee86cc21a ] + +The Maxim fuel gauge datasheets describe the interrupt line as active +low with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: 99bb20321f0e ("ARM: dts: s5pv210: Correct fuelgauge definition on Aries") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-10-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-fascinate4g.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/s5pv210-fascinate4g.dts b/arch/arm/boot/dts/s5pv210-fascinate4g.dts +index ca064359dd30..b47d8300e536 100644 +--- a/arch/arm/boot/dts/s5pv210-fascinate4g.dts ++++ b/arch/arm/boot/dts/s5pv210-fascinate4g.dts +@@ -115,7 +115,7 @@ + compatible = "maxim,max77836-battery"; + + interrupt-parent = <&gph3>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + + pinctrl-names = "default"; + pinctrl-0 = <&fg_irq>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-stm32-fix-usart-2-3-pinconf-to-wake-up-with-.patch b/queue-5.10/arm-dts-stm32-fix-usart-2-3-pinconf-to-wake-up-with-.patch new file mode 100644 index 00000000000..7d64b4e7fbb --- /dev/null +++ b/queue-5.10/arm-dts-stm32-fix-usart-2-3-pinconf-to-wake-up-with-.patch @@ -0,0 +1,80 @@ +From ccd43e5c8165fe039ce952870fc8fe59f68f0764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 12:07:03 +0100 +Subject: ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control + +From: Valentin CARON - foss + +[ Upstream commit a1429f3d3029b65cd4032f6218d5290911377ce4 ] + +Modify usart 2 & 3 pins to allow wake up from low power mode while the +hardware flow control is activated. UART RTS pin need to stay configure +in idle mode to receive characters in order to wake up. + +Fixes: 842ed898a757 ("ARM: dts: stm32: add usart2, usart3 and uart7 pins in stm32mp15-pinctrl") + +Signed-off-by: Valentin Caron +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +index d84686e00370..dee4d32ab32c 100644 +--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi +@@ -1806,10 +1806,15 @@ + usart2_idle_pins_c: usart2-idle-2 { + pins1 { + pinmux = , /* USART2_TX */ +- , /* USART2_RTS */ + ; /* USART2_CTS_NSS */ + }; + pins2 { ++ pinmux = ; /* USART2_RTS */ ++ bias-disable; ++ drive-push-pull; ++ slew-rate = <3>; ++ }; ++ pins3 { + pinmux = ; /* USART2_RX */ + bias-disable; + }; +@@ -1855,10 +1860,15 @@ + usart3_idle_pins_b: usart3-idle-1 { + pins1 { + pinmux = , /* USART3_TX */ +- , /* USART3_RTS */ + ; /* USART3_CTS_NSS */ + }; + pins2 { ++ pinmux = ; /* USART3_RTS */ ++ bias-disable; ++ drive-push-pull; ++ slew-rate = <0>; ++ }; ++ pins3 { + pinmux = ; /* USART3_RX */ + bias-disable; + }; +@@ -1891,10 +1901,15 @@ + usart3_idle_pins_c: usart3-idle-2 { + pins1 { + pinmux = , /* USART3_TX */ +- , /* USART3_RTS */ + ; /* USART3_CTS_NSS */ + }; + pins2 { ++ pinmux = ; /* USART3_RTS */ ++ bias-disable; ++ drive-push-pull; ++ slew-rate = <0>; ++ }; ++ pins3 { + pinmux = ; /* USART3_RX */ + bias-disable; + }; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch b/queue-5.10/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch new file mode 100644 index 00000000000..86b782b17f2 --- /dev/null +++ b/queue-5.10/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch @@ -0,0 +1,42 @@ +From 43335ab14c401d28ad7677db8182ace8e5e235f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 02:31:48 +0900 +Subject: ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins + for RTL8211E + +From: Kunihiko Hayashi + +[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ] + +UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX +delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins. + +After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the delays are working correctly, however, "rgmii" means +no delay and the phy doesn't work. So need to set the phy-mode to +"rgmii-id" to show that RX/TX delays are enabled. + +Fixes: e3cc931921d2 ("ARM: dts: uniphier: add AVE ethernet node") +Signed-off-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi +index b0b15c97306b..e81e5937a60a 100644 +--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi ++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi +@@ -583,7 +583,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-mediatek-fix-reset-gpio-level-on-pumpkin.patch b/queue-5.10/arm64-dts-mediatek-fix-reset-gpio-level-on-pumpkin.patch new file mode 100644 index 00000000000..b53b2324fde --- /dev/null +++ b/queue-5.10/arm64-dts-mediatek-fix-reset-gpio-level-on-pumpkin.patch @@ -0,0 +1,36 @@ +From ac01d03984c4fd38134dc91f2d6856e12c779e36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 23:18:26 +0100 +Subject: arm64: dts: mediatek: fix reset GPIO level on pumpkin + +From: Fabien Parent + +[ Upstream commit a7dceafed43a4a610d340da3703653cca2c50c1d ] + +The tca6416 chip is active low. Fix the reset-gpios value. + +Fixes: e2a8fa1e0faa ("arm64: dts: mediatek: fix tca6416 reset GPIOs in pumpkin") +Signed-off-by: Fabien Parent +Link: https://lore.kernel.org/r/20210223221826.2063911-1-fparent@baylibre.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +index 29d8cf6df46b..99c2d6fd6304 100644 +--- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi ++++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi +@@ -56,7 +56,7 @@ + tca6416: gpio@20 { + compatible = "ti,tca6416"; + reg = <0x20>; +- reset-gpios = <&pio 65 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&pio 65 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&tca6416_pins>; + +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-db845c-fix-correct-powerdown-pin-for-.patch b/queue-5.10/arm64-dts-qcom-db845c-fix-correct-powerdown-pin-for-.patch new file mode 100644 index 00000000000..0a49ea6f2e9 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-db845c-fix-correct-powerdown-pin-for-.patch @@ -0,0 +1,47 @@ +From 809fa8b397ecfbcecc2661fc2d81c95e81e03bc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:20:25 +0000 +Subject: arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x + +From: Srinivas Kandagatla + +[ Upstream commit c561740e7cfefaf3003a256f3a0cd9f8a069137c ] + +WSA881x powerdown pin is connected to GPIO1 not gpio2, so correct this. +This was working so far due to a shift bug in gpio driver, however +once that is fixed this will stop working, so fix this! + +Fixes: 89a32a4e769cc ("arm64: dts: qcom: db845c: add analog audio support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20210309102025.28405-1-srinivas.kandagatla@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index c4ac6f5dc008..96d36b38f269 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -1015,7 +1015,7 @@ + left_spkr: wsa8810-left{ + compatible = "sdw10217201000"; + reg = <0 1>; +- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrLeft"; + #sound-dai-cells = <0>; +@@ -1023,7 +1023,7 @@ + + right_spkr: wsa8810-right{ + compatible = "sdw10217201000"; +- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>; + reg = <0 2>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrRight"; +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-sdm845-fix-number-of-pins-in-gpio-ran.patch b/queue-5.10/arm64-dts-qcom-sdm845-fix-number-of-pins-in-gpio-ran.patch new file mode 100644 index 00000000000..5f3e806bf2e --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sdm845-fix-number-of-pins-in-gpio-ran.patch @@ -0,0 +1,47 @@ +From ca5a267387c1b7912dadfaa10d99a69b971de79f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:31:03 +0800 +Subject: arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges' + +From: Shawn Guo + +[ Upstream commit 02058fc3839df65ff64de2a6b1c5de8c9fd705c1 ] + +The last cell of 'gpio-ranges' should be number of GPIO pins, and in +case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather +than msm_pinctrl_soc_data.ngpio - 1. + +This fixes the problem that when the last GPIO pin in the range is +configured with the following call sequence, it always fails with +-EPROBE_DEFER. + + pinctrl_gpio_set_config() + pinctrl_get_device_gpio_range() + pinctrl_match_gpio_range() + +Fixes: bc2c806293c6 ("arm64: dts: qcom: sdm845: Add gpio-ranges to TLMM node") +Cc: Evan Green +Signed-off-by: Shawn Guo +Link: https://lore.kernel.org/r/20210303033106.549-2-shawn.guo@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index f97f354af86f..ea6e3a11e641 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2192,7 +2192,7 @@ + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; +- gpio-ranges = <&tlmm 0 0 150>; ++ gpio-ranges = <&tlmm 0 0 151>; + wakeup-parent = <&pdc_intc>; + + cci0_default: cci0-default { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch b/queue-5.10/arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch new file mode 100644 index 00000000000..42b7c4432e1 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch @@ -0,0 +1,47 @@ +From 5674891378c6a2563d515d844aff96db7e0f037c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:31:04 +0800 +Subject: arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges' + +From: Shawn Guo + +[ Upstream commit de3abdf3d15c6e7f456e2de3f9da78f3a31414cc ] + +The last cell of 'gpio-ranges' should be number of GPIO pins, and in +case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather +than msm_pinctrl_soc_data.ngpio - 1. + +This fixes the problem that when the last GPIO pin in the range is +configured with the following call sequence, it always fails with +-EPROBE_DEFER. + + pinctrl_gpio_set_config() + pinctrl_get_device_gpio_range() + pinctrl_match_gpio_range() + +Fixes: e13c6d144fa0 ("arm64: dts: qcom: sm8150: Add base dts file") +Cc: Vinod Koul +Signed-off-by: Shawn Guo +Link: https://lore.kernel.org/r/20210303033106.549-3-shawn.guo@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index f0a872e02686..1aec54590a11 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -748,7 +748,7 @@ + <0x0 0x03D00000 0x0 0x300000>; + reg-names = "west", "east", "north", "south"; + interrupts = ; +- gpio-ranges = <&tlmm 0 0 175>; ++ gpio-ranges = <&tlmm 0 0 176>; + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-sm8250-fix-level-triggered-pmu-interr.patch b/queue-5.10/arm64-dts-qcom-sm8250-fix-level-triggered-pmu-interr.patch new file mode 100644 index 00000000000..02560e39317 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sm8250-fix-level-triggered-pmu-interr.patch @@ -0,0 +1,37 @@ +From 39f292258a44e151d1032b556bb82a8a4667265d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 15:17:47 +0530 +Subject: arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity + +From: Sai Prakash Ranjan + +[ Upstream commit 93138ef5ac923b10f81575d35dbcb83136cbfc40 ] + +As per interrupt documentation for SM8250 SoC, the polarity +for level triggered PMU interrupt is low, fix this. + +Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file") +Signed-off-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/r/96680a1c6488955c9eef7973c28026462b2a4ec0.1613468366.git.saiprakash.ranjan@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index d057d85a19fb..3bcd067c0dcd 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -216,7 +216,7 @@ + + pmu { + compatible = "arm,armv8-pmuv3"; +- interrupts = ; ++ interrupts = ; + }; + + psci { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-sm8250-fix-number-of-pins-in-gpio-ran.patch b/queue-5.10/arm64-dts-qcom-sm8250-fix-number-of-pins-in-gpio-ran.patch new file mode 100644 index 00000000000..1ba0b8c51fb --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sm8250-fix-number-of-pins-in-gpio-ran.patch @@ -0,0 +1,47 @@ +From 903a0a67f0125bf8262d7129447ca62e5c3202b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:31:05 +0800 +Subject: arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges' + +From: Shawn Guo + +[ Upstream commit e526cb03e2aed42866a0919485a3d8ac130972cf ] + +The last cell of 'gpio-ranges' should be number of GPIO pins, and in +case of qcom platform it should match msm_pinctrl_soc_data.ngpio rather +than msm_pinctrl_soc_data.ngpio - 1. + +This fixes the problem that when the last GPIO pin in the range is +configured with the following call sequence, it always fails with +-EPROBE_DEFER. + + pinctrl_gpio_set_config() + pinctrl_get_device_gpio_range() + pinctrl_match_gpio_range() + +Fixes: 16951b490b20 ("arm64: dts: qcom: sm8250: Add TLMM pinctrl node") +Cc: Bjorn Andersson +Signed-off-by: Shawn Guo +Link: https://lore.kernel.org/r/20210303033106.549-4-shawn.guo@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index f96c8a4fc3cc..d4547a192748 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -1555,7 +1555,7 @@ + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; +- gpio-ranges = <&tlmm 0 0 180>; ++ gpio-ranges = <&tlmm 0 0 181>; + wakeup-parent = <&pdc>; + + qup_i2c0_default: qup-i2c0-default { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-sm8250-fix-timer-interrupt-to-specify.patch b/queue-5.10/arm64-dts-qcom-sm8250-fix-timer-interrupt-to-specify.patch new file mode 100644 index 00000000000..7359390aa8a --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sm8250-fix-timer-interrupt-to-specify.patch @@ -0,0 +1,42 @@ +From 99b5996fa11c2374ac8fcbffae0a4ab6ab1ad3b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 15:17:49 +0530 +Subject: arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical + timer + +From: Sai Prakash Ranjan + +[ Upstream commit 29a3349543e4ce3fe4e2a761403cc629e3534c67 ] + +ARM architected timer interrupts DT property specifies EL2/HYP +physical interrupt and not EL2/HYP virtual interrupt for the 4th +interrupt property. As per interrupt documentation for SM8250 SoC, +the EL2/HYP physical timer interrupt is 10 and EL2/HYP virtual timer +interrupt is 12, so fix the 4th timer interrupt to be EL2 physical +timer interrupt (10 in this case). + +Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file") +Signed-off-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/r/744e58f725d279eb2b049a7da42b0f09189f4054.1613468366.git.saiprakash.ranjan@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 3bcd067c0dcd..f96c8a4fc3cc 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2379,7 +2379,7 @@ + (GIC_CPU_MASK_SIMPLE(8) | IRQ_TYPE_LEVEL_LOW)>, + , +- ; + }; + +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-renesas-add-mmc-aliases-into-board-dts-fil.patch b/queue-5.10/arm64-dts-renesas-add-mmc-aliases-into-board-dts-fil.patch new file mode 100644 index 00000000000..e2ebb8a35d7 --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-add-mmc-aliases-into-board-dts-fil.patch @@ -0,0 +1,135 @@ +From fb2dd97f0fecdd7d33949c4d1c30d0d7ff998c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 20:06:26 +0900 +Subject: arm64: dts: renesas: Add mmc aliases into board dts files + +From: Yoshihiro Shimoda + +[ Upstream commit d765a4f302cc046ca23453ba990d21120ceadbbd ] + +After the commit 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS +for drivers that existed in v4.14"), the order of /dev/mmcblkN +was not fixed in some SoCs which have multiple sdhi controllers. +So, we were hard to use an sdhi device as rootfs by using +the kernel parameter like "root=/dev/mmcblkNpM". + +According to the discussion on a mainling list [1], we can add +mmc aliases to fix the issue. So, add such aliases into Renesas +arm64 board dts files. Notes that mmc0 is an eMMC channel if +available. + +[1] +https://lore.kernel.org/linux-arm-kernel/CAPDyKFptyEQNJu8cqzMt2WRFZcwEdjDiytMBp96nkoZyprTgmA@mail.gmail.com/ + +Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14") +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1614596786-22326-1-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/hihope-common.dtsi | 3 +++ + arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts | 3 +++ + arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts | 2 ++ + arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 3 +++ + arch/arm64/boot/dts/renesas/salvator-common.dtsi | 3 +++ + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 1 + + arch/arm64/boot/dts/renesas/ulcb.dtsi | 2 ++ + 7 files changed, 17 insertions(+) + +diff --git a/arch/arm64/boot/dts/renesas/hihope-common.dtsi b/arch/arm64/boot/dts/renesas/hihope-common.dtsi +index 2eda9f66ae81..e8bf6f0c4c40 100644 +--- a/arch/arm64/boot/dts/renesas/hihope-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/hihope-common.dtsi +@@ -12,6 +12,9 @@ + aliases { + serial0 = &scif2; + serial1 = &hscif0; ++ mmc0 = &sdhi3; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts +index 2c5b057c30c6..ad26f5bf0648 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts ++++ b/arch/arm64/boot/dts/renesas/r8a774a1-beacon-rzg2m-kit.dts +@@ -21,6 +21,9 @@ + serial4 = &hscif2; + serial5 = &scif5; + ethernet0 = &avb; ++ mmc0 = &sdhi3; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi2; + }; + + chosen { +diff --git a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts +index 26aee004a44e..c4b50a5e3d92 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts ++++ b/arch/arm64/boot/dts/renesas/r8a774c0-cat874.dts +@@ -17,6 +17,8 @@ + aliases { + serial0 = &scif2; + serial1 = &hscif2; ++ mmc0 = &sdhi0; ++ mmc1 = &sdhi3; + }; + + chosen { +diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts +index e0ccca2222d2..b9e3b6762ff4 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts +@@ -16,6 +16,9 @@ + aliases { + serial0 = &scif2; + ethernet0 = &avb; ++ mmc0 = &sdhi3; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi1; + }; + + chosen { +diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +index 1bf77957d2c2..08b8525bb725 100644 +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -36,6 +36,9 @@ + serial0 = &scif2; + serial1 = &hscif1; + ethernet0 = &avb; ++ mmc0 = &sdhi2; ++ mmc1 = &sdhi0; ++ mmc2 = &sdhi3; + }; + + chosen { +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 202177706cde..05e64bfad023 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -16,6 +16,7 @@ + aliases { + serial1 = &hscif0; + serial2 = &scif1; ++ mmc2 = &sdhi3; + }; + + clksndsel: clksndsel { +diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi +index a2e085db87c5..e11521b4b9ca 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi +@@ -23,6 +23,8 @@ + aliases { + serial0 = &scif2; + ethernet0 = &avb; ++ mmc0 = &sdhi2; ++ mmc1 = &sdhi0; + }; + + chosen { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch b/queue-5.10/arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch new file mode 100644 index 00000000000..6503d8a137b --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch @@ -0,0 +1,78 @@ +From 4e7d8cde362e41ea1ec2afef8b3179e0e8e0d43e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 18:47:35 +0100 +Subject: arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Barinov + +[ Upstream commit c8aebc1346522d3569690867ce3996642ad52e01 ] + +This fixes the bindings in media framework: +The CSI40 is endpoint number 2 +The CSI41 is endpoint number 3 + +Signed-off-by: Vladimir Barinov +Reviewed-by: Niklas Söderlund +Signed-off-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20210312174735.2118212-1-niklas.soderlund+renesas@ragnatech.se +Fixes: 3182aa4e0bf4d0ee ("arm64: dts: renesas: r8a77980: add CSI2/VIN support") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77980.dtsi | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi +index d6cae90d7fd9..e6ef837c4a3b 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi +@@ -990,8 +990,8 @@ + + reg = <1>; + +- vin4csi41: endpoint@2 { +- reg = <2>; ++ vin4csi41: endpoint@3 { ++ reg = <3>; + remote-endpoint = <&csi41vin4>; + }; + }; +@@ -1018,8 +1018,8 @@ + + reg = <1>; + +- vin5csi41: endpoint@2 { +- reg = <2>; ++ vin5csi41: endpoint@3 { ++ reg = <3>; + remote-endpoint = <&csi41vin5>; + }; + }; +@@ -1046,8 +1046,8 @@ + + reg = <1>; + +- vin6csi41: endpoint@2 { +- reg = <2>; ++ vin6csi41: endpoint@3 { ++ reg = <3>; + remote-endpoint = <&csi41vin6>; + }; + }; +@@ -1074,8 +1074,8 @@ + + reg = <1>; + +- vin7csi41: endpoint@2 { +- reg = <2>; ++ vin7csi41: endpoint@3 { ++ reg = <3>; + remote-endpoint = <&csi41vin7>; + }; + }; +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-renesas-r8a779a0-fix-pmu-interrupt.patch b/queue-5.10/arm64-dts-renesas-r8a779a0-fix-pmu-interrupt.patch new file mode 100644 index 00000000000..7f0299e6c31 --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-r8a779a0-fix-pmu-interrupt.patch @@ -0,0 +1,40 @@ +From eead0053655f0fdd7d3de8024ed511df1bb25864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:19:49 +0900 +Subject: arm64: dts: renesas: r8a779a0: Fix PMU interrupt + +From: Yoshihiro Shimoda + +[ Upstream commit bbbf6db5a0b56199702bb225132831bced2eee41 ] + +Should use PPI No.7 for the PMU. Otherwise, the perf command didn't +show any information. + +Fixes: 834c310f5418 ("arm64: dts: renesas: Add Renesas R8A779A0 SoC support") +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20210325041949.925777-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +index 6cf77ce9aa93..86ec32a919d2 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +@@ -50,10 +50,7 @@ + + pmu_a76 { + compatible = "arm,cortex-a76-pmu"; +- interrupts-extended = <&gic GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>, +- <&gic GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>, +- <&gic GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>, +- <&gic GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts-extended = <&gic GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>; + }; + + /* External SCIF clock - to be overridden by boards that provide it */ +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch b/queue-5.10/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch new file mode 100644 index 00000000000..f901f573c07 --- /dev/null +++ b/queue-5.10/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch @@ -0,0 +1,66 @@ +From e0daaa3d541af333bdce82660abc4ae9cdc45779 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 02:31:49 +0900 +Subject: arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay + pins for RTL8211E + +From: Kunihiko Hayashi + +[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ] + +UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have +the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY +pins. + +After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the delays are working correctly, however, "rgmii" means +no delay and the phy doesn't work. So need to set the phy-mode to +"rgmii-id" to show that RX/TX delays are enabled. + +Fixes: c73730ee4c9a ("arm64: dts: uniphier: add AVE ethernet node") +Signed-off-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- + arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +index a87b8a678719..8f2c1c1e2c64 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +@@ -734,7 +734,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +index 0e52dadf54b3..be97da132258 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +@@ -564,7 +564,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +@@ -585,7 +585,7 @@ + clocks = <&sys_clk 7>; + reset-names = "ether"; + resets = <&sys_rst 7>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 1>; + +-- +2.30.2 + diff --git a/queue-5.10/asoc-ak5558-correct-reset-polarity.patch b/queue-5.10/asoc-ak5558-correct-reset-polarity.patch new file mode 100644 index 00000000000..bdbc38ce897 --- /dev/null +++ b/queue-5.10/asoc-ak5558-correct-reset-polarity.patch @@ -0,0 +1,46 @@ +From be8e6a866c5674f47e2871595d8ac6b0ea56734a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:33:43 +0800 +Subject: ASoC: ak5558: correct reset polarity + +From: Shengjiu Wang + +[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ] + +Reset (aka power off) happens when the reset gpio is made active. +The reset gpio is GPIO_ACTIVE_LOW + +Fixes: 920884777480 ("ASoC: ak5558: Add support for AK5558 ADC driver") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1618382024-31725-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak5558.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c +index 65a248c92f66..adbdfdbc7a38 100644 +--- a/sound/soc/codecs/ak5558.c ++++ b/sound/soc/codecs/ak5558.c +@@ -272,7 +272,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558) + if (!ak5558->reset_gpiod) + return; + +- gpiod_set_value_cansleep(ak5558->reset_gpiod, 0); ++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 1); + usleep_range(1000, 2000); + } + +@@ -281,7 +281,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558) + if (!ak5558->reset_gpiod) + return; + +- gpiod_set_value_cansleep(ak5558->reset_gpiod, 1); ++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 0); + usleep_range(1000, 2000); + } + +-- +2.30.2 + diff --git a/queue-5.10/asoc-intel-boards-sof-wm8804-add-check-for-pll-setti.patch b/queue-5.10/asoc-intel-boards-sof-wm8804-add-check-for-pll-setti.patch new file mode 100644 index 00000000000..f74335ca2a4 --- /dev/null +++ b/queue-5.10/asoc-intel-boards-sof-wm8804-add-check-for-pll-setti.patch @@ -0,0 +1,45 @@ +From c4292a3fed12c43e00610037cf9db69aee00425c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 18:56:53 +0000 +Subject: ASoC: Intel: boards: sof-wm8804: add check for PLL setting + +From: Colin Ian King + +[ Upstream commit 1730ef62874dbdc53dc2abfa430f09f0b304bafc ] + +Currently the return from snd_soc_dai_set_pll is not checking for +failure, this is the only driver in the kernel that ignores this, +so it probably should be added for sake of completeness. Fix this +by adding an error return check. + +Addresses-Coverity: ("Unchecked return value") +Fixes: f139546fb7d4 ("ASoC: Intel: boards: sof-wm8804: support for Hifiberry Digiplus boards") +Signed-off-by: Colin Ian King +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210226185653.1071321-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_wm8804.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_wm8804.c b/sound/soc/intel/boards/sof_wm8804.c +index a46ba13e8eb0..6a181e45143d 100644 +--- a/sound/soc/intel/boards/sof_wm8804.c ++++ b/sound/soc/intel/boards/sof_wm8804.c +@@ -124,7 +124,11 @@ static int sof_wm8804_hw_params(struct snd_pcm_substream *substream, + } + + snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div); +- snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq); ++ ret = snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq); ++ if (ret < 0) { ++ dev_err(rtd->card->dev, "Failed to set WM8804 PLL\n"); ++ return ret; ++ } + + ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL, + sysclk, SND_SOC_CLOCK_OUT); +-- +2.30.2 + diff --git a/queue-5.10/asoc-intel-skylake-compile-when-any-configuration-is.patch b/queue-5.10/asoc-intel-skylake-compile-when-any-configuration-is.patch new file mode 100644 index 00000000000..9f0891d5fe0 --- /dev/null +++ b/queue-5.10/asoc-intel-skylake-compile-when-any-configuration-is.patch @@ -0,0 +1,58 @@ +From 9386798bfec0fb419c19b04e71b7379f052127c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 12:54:41 +0100 +Subject: ASoC: Intel: Skylake: Compile when any configuration is selected +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cezary Rojewski + +[ Upstream commit 1b99d50b9709a2cddaba4a7faf1862b4f7bec865 ] + +Skylake is dependent on SND_SOC_INTEL_SKYLAKE (aka "all SST platforms") +whereas selecting specific configuration such as KBL-only will not +cause driver code to compile. Switch to SND_SOC_INTEL_SKYLAKE_COMMON +dependency so selecting any configuration causes the driver to be built. + +Reported-by: Kai-Heng Feng +Suggested-by: Amadeusz Sławiński +Fixes: 35bc99aaa1a3 ("ASoC: Intel: Skylake: Add more platform granularity") +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20210125115441.10383-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/Makefile | 2 +- + sound/soc/intel/skylake/Makefile | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/Makefile b/sound/soc/intel/Makefile +index 4e0248d2accc..7c5038803be7 100644 +--- a/sound/soc/intel/Makefile ++++ b/sound/soc/intel/Makefile +@@ -5,7 +5,7 @@ obj-$(CONFIG_SND_SOC) += common/ + # Platform Support + obj-$(CONFIG_SND_SST_ATOM_HIFI2_PLATFORM) += atom/ + obj-$(CONFIG_SND_SOC_INTEL_CATPT) += catpt/ +-obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE) += skylake/ ++obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE_COMMON) += skylake/ + obj-$(CONFIG_SND_SOC_INTEL_KEEMBAY) += keembay/ + + # Machine support +diff --git a/sound/soc/intel/skylake/Makefile b/sound/soc/intel/skylake/Makefile +index dd39149b89b1..1c4649bccec5 100644 +--- a/sound/soc/intel/skylake/Makefile ++++ b/sound/soc/intel/skylake/Makefile +@@ -7,7 +7,7 @@ ifdef CONFIG_DEBUG_FS + snd-soc-skl-objs += skl-debug.o + endif + +-obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE) += snd-soc-skl.o ++obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE_COMMON) += snd-soc-skl.o + + #Skylake Clock device support + snd-soc-skl-ssp-clk-objs := skl-ssp-clk.o +-- +2.30.2 + diff --git a/queue-5.10/asoc-simple-card-fix-possible-uninitialized-single_c.patch b/queue-5.10/asoc-simple-card-fix-possible-uninitialized-single_c.patch new file mode 100644 index 00000000000..18f2afa0235 --- /dev/null +++ b/queue-5.10/asoc-simple-card-fix-possible-uninitialized-single_c.patch @@ -0,0 +1,58 @@ +From f45d036c182bb531549cb908d66c71eb25b5051a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:20:27 +0200 +Subject: ASoC: simple-card: fix possible uninitialized single_cpu local + variable + +From: Krzysztof Kozlowski + +[ Upstream commit fa74c223b6fd78a5314b4c61b9abdbed3c2185b4 ] + +The 'single_cpu' local variable is assigned by asoc_simple_parse_dai() +and later used in a asoc_simple_canonicalize_cpu() call, assuming the +entire function did not exit on errors. + +However the first function returns 0 if passed device_node is NULL, +thus leaving the variable uninitialized and reporting success. + +Addresses-Coverity: Uninitialized scalar variable +Fixes: 8f7f298a3337 ("ASoC: simple-card-utils: separate asoc_simple_card_parse_dai()") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Sameer Pujar +Link: https://lore.kernel.org/r/20210407092027.60769-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/audio-graph-card.c | 2 +- + sound/soc/generic/simple-card.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index 97b4f5480a31..0c640308ed80 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -340,7 +340,7 @@ static int graph_dai_link_of(struct asoc_simple_priv *priv, + struct device_node *top = dev->of_node; + struct asoc_simple_dai *cpu_dai; + struct asoc_simple_dai *codec_dai; +- int ret, single_cpu; ++ int ret, single_cpu = 0; + + /* Do it only CPU turn */ + if (!li->cpu) +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 75365c7bb393..d916ec69c24f 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -258,7 +258,7 @@ static int simple_dai_link_of(struct asoc_simple_priv *priv, + struct device_node *plat = NULL; + char prop[128]; + char *prefix = ""; +- int ret, single_cpu; ++ int ret, single_cpu = 0; + + /* + * |CPU |Codec : turn +-- +2.30.2 + diff --git a/queue-5.10/asoc-wm8960-remove-bitclk-relax-condition-in-wm8960_.patch b/queue-5.10/asoc-wm8960-remove-bitclk-relax-condition-in-wm8960_.patch new file mode 100644 index 00000000000..a533052731b --- /dev/null +++ b/queue-5.10/asoc-wm8960-remove-bitclk-relax-condition-in-wm8960_.patch @@ -0,0 +1,88 @@ +From ce4ee51cca0fe2e7a2faa9e6b3dfb6d41994cad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:07:42 +0800 +Subject: ASoC: wm8960: Remove bitclk relax condition in + wm8960_configure_sysclk + +From: Shengjiu Wang + +[ Upstream commit 99067c07e8d877035f6249d194a317c78b7d052d ] + +The call sequence in wm8960_configure_clocking is + + ret = wm8960_configure_sysclk(); + if (ret >= 0) + goto configure_clock; + + .... + + ret = wm8960_configure_pll(); + +configure_clock: + ... + +wm8960_configure_sysclk is called before wm8960_configure_pll, as +there is bitclk relax on both functions, so wm8960_configure_sysclk +always return success, then wm8960_configure_pll() never be called. + +With this case: +aplay -Dhw:0,0 -d 5 -r 48000 -f S24_LE -c 2 audio48k24b2c.wav +the required bitclk is 48000 * 24 * 2 = 2304000, bitclk got from +wm8960_configure_sysclk is 3072000, but if go to wm8960_configure_pll. +it can get correct bitclk 2304000. + +So bitclk relax condition should be removed in wm8960_configure_sysclk, +then wm8960_configure_pll can be called, and there is also bitclk relax +function in wm8960_configure_pll. + +Fixes: 3c01b9ee2ab9 ("ASoC: codec: wm8960: Relax bit clock computation") +Signed-off-by: Shengjiu Wang +Signed-off-by: Daniel Baluta +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/1614740862-30196-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8960.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index ceaf3bbb18e6..9d325555e219 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -608,10 +608,6 @@ static const int bclk_divs[] = { + * - lrclk = sysclk / dac_divs + * - 10 * bclk = sysclk / bclk_divs + * +- * If we cannot find an exact match for (sysclk, lrclk, bclk) +- * triplet, we relax the bclk such that bclk is chosen as the +- * closest available frequency greater than expected bclk. +- * + * @wm8960: codec private data + * @mclk: MCLK used to derive sysclk + * @sysclk_idx: sysclk_divs index for found sysclk +@@ -629,7 +625,7 @@ int wm8960_configure_sysclk(struct wm8960_priv *wm8960, int mclk, + { + int sysclk, bclk, lrclk; + int i, j, k; +- int diff, closest = mclk; ++ int diff; + + /* marker for no match */ + *bclk_idx = -1; +@@ -653,12 +649,6 @@ int wm8960_configure_sysclk(struct wm8960_priv *wm8960, int mclk, + *bclk_idx = k; + break; + } +- if (diff > 0 && closest > diff) { +- *sysclk_idx = i; +- *dac_idx = j; +- *bclk_idx = k; +- closest = diff; +- } + } + if (k != ARRAY_SIZE(bclk_divs)) + break; +-- +2.30.2 + diff --git a/queue-5.10/ata-libahci_platform-fix-irq-check.patch b/queue-5.10/ata-libahci_platform-fix-irq-check.patch new file mode 100644 index 00000000000..2e1c06f458f --- /dev/null +++ b/queue-5.10/ata-libahci_platform-fix-irq-check.patch @@ -0,0 +1,44 @@ +From f8ce95ad432089ad8b8c9767c5e932a3c78fba74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 23:15:06 +0300 +Subject: ata: libahci_platform: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ] + +Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0 +early (as if the call was successful). Override IRQ0 with -EINVAL instead +as the 'libata' regards 0 as "no IRQ" (thus polling) anyway... + +Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libahci_platform.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index de638dafce21..b2f552088291 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -582,11 +582,13 @@ int ahci_platform_init_host(struct platform_device *pdev, + int i, irq, n_ports, rc; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + if (irq != -EPROBE_DEFER) + dev_err(dev, "no irq\n"); + return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv->irq = irq; + +-- +2.30.2 + diff --git a/queue-5.10/ath10k-fix-a-use-after-free-in-ath10k_htc_send_bundl.patch b/queue-5.10/ath10k-fix-a-use-after-free-in-ath10k_htc_send_bundl.patch new file mode 100644 index 00000000000..3a39299e0c1 --- /dev/null +++ b/queue-5.10/ath10k-fix-a-use-after-free-in-ath10k_htc_send_bundl.patch @@ -0,0 +1,41 @@ +From 56157fdf80fc9da46ac17685ddee16c41fd959eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 05:01:54 -0700 +Subject: ath10k: Fix a use after free in ath10k_htc_send_bundle + +From: Lv Yunlong + +[ Upstream commit 8392df5d7e0b6a7d21440da1fc259f9938f4dec3 ] + +In ath10k_htc_send_bundle, the bundle_skb could be freed by +dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later +by bundle_skb->len. + +As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to +skb_len after the bundle_skb was freed. + +Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio") +Signed-off-by: Lv Yunlong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210329120154.8963-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/htc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c +index 31df6dd04bf6..540dd59112a5 100644 +--- a/drivers/net/wireless/ath/ath10k/htc.c ++++ b/drivers/net/wireless/ath/ath10k/htc.c +@@ -665,7 +665,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep, + + ath10k_dbg(ar, ATH10K_DBG_HTC, + "bundle tx status %d eid %d req count %d count %d len %d\n", +- ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len); ++ ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.10/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch b/queue-5.10/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch new file mode 100644 index 00000000000..89d2328971e --- /dev/null +++ b/queue-5.10/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch @@ -0,0 +1,43 @@ +From ecdb1b2f92c8be739179ca489ca039f0378393e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 17:02:28 -0600 +Subject: ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without + lock + +From: Shuah Khan + +[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ] + +ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock +winthout locking it first when peer reason doesn't match the valid +cases for this function. + +Add a default case to return without unlocking. + +Fixes: 09078368d516 ("ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()") +Reported-by: Pavel Machek +Signed-off-by: Shuah Khan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210406230228.31301-1-skhan@linuxfoundation.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index e7072fc4f487..4f2fbc610d79 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -592,6 +592,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) + GFP_ATOMIC + ); + break; ++ default: ++ kfree(tb); ++ return; + } + + exit: +-- +2.30.2 + diff --git a/queue-5.10/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch b/queue-5.10/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch new file mode 100644 index 00000000000..c9a4f608ad1 --- /dev/null +++ b/queue-5.10/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch @@ -0,0 +1,61 @@ +From 5dd9362abeb59cdd20f7f1c8a362e769d1a03cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 19:08:19 +0100 +Subject: ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ] + +When the error check in ath9k_hw_read_revisions() was added, it checked for +-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, +for plain ath9k, the register read function uses ioread32(), which just +returns -1 on error. So if such a read fails, it still gets passed through +and ends up as a weird mac revision in the log output. + +Fix this by changing ath9k_regread() to return -1 on error like ioread32() +does, and fix the error check to look for that instead of -EIO. + +Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register") +Signed-off-by: Toke Høiland-Jørgensen +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- + drivers/net/wireless/ath/ath9k/hw.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index db0c6fa9c9dc..ff61ae34ecdf 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset) + if (unlikely(r)) { + ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n", + reg_offset, r); +- return -EIO; ++ return -1; + } + + return be32_to_cpu(val); +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index 6609ce122e6e..c86faebbc459 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) + + srev = REG_READ(ah, AR_SREV); + +- if (srev == -EIO) { ++ if (srev == -1) { + ath_err(ath9k_hw_common(ah), + "Failed to read SREV register"); + return false; +-- +2.30.2 + diff --git a/queue-5.10/bluetooth-avoid-deadlock-between-hci_dev-lock-and-so.patch b/queue-5.10/bluetooth-avoid-deadlock-between-hci_dev-lock-and-so.patch new file mode 100644 index 00000000000..b1fb71dc7bc --- /dev/null +++ b/queue-5.10/bluetooth-avoid-deadlock-between-hci_dev-lock-and-so.patch @@ -0,0 +1,160 @@ +From 4e08434fb349b3d4124493623c0d0596d9cb09fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 15:08:00 +0100 +Subject: Bluetooth: avoid deadlock between hci_dev->lock and socket lock + +From: Jiri Kosina + +[ Upstream commit 17486960d79b900c45e0bb8fbcac0262848582ba ] + +Commit eab2404ba798 ("Bluetooth: Add BT_PHY socket option") added a +dependency between socket lock and hci_dev->lock that could lead to +deadlock. + +It turns out that hci_conn_get_phy() is not in any way relying on hdev +being immutable during the runtime of this function, neither does it even +look at any of the members of hdev, and as such there is no need to hold +that lock. + +This fixes the lockdep splat below: + + ====================================================== + WARNING: possible circular locking dependency detected + 5.12.0-rc1-00026-g73d464503354 #10 Not tainted + ------------------------------------------------------ + bluetoothd/1118 is trying to acquire lock: + ffff8f078383c078 (&hdev->lock){+.+.}-{3:3}, at: hci_conn_get_phy+0x1c/0x150 [bluetooth] + + but task is already holding lock: + ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #3 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}: + lock_sock_nested+0x72/0xa0 + l2cap_sock_ready_cb+0x18/0x70 [bluetooth] + l2cap_config_rsp+0x27a/0x520 [bluetooth] + l2cap_sig_channel+0x658/0x1330 [bluetooth] + l2cap_recv_frame+0x1ba/0x310 [bluetooth] + hci_rx_work+0x1cc/0x640 [bluetooth] + process_one_work+0x244/0x5f0 + worker_thread+0x3c/0x380 + kthread+0x13e/0x160 + ret_from_fork+0x22/0x30 + + -> #2 (&chan->lock#2/1){+.+.}-{3:3}: + __mutex_lock+0xa3/0xa10 + l2cap_chan_connect+0x33a/0x940 [bluetooth] + l2cap_sock_connect+0x141/0x2a0 [bluetooth] + __sys_connect+0x9b/0xc0 + __x64_sys_connect+0x16/0x20 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + -> #1 (&conn->chan_lock){+.+.}-{3:3}: + __mutex_lock+0xa3/0xa10 + l2cap_chan_connect+0x322/0x940 [bluetooth] + l2cap_sock_connect+0x141/0x2a0 [bluetooth] + __sys_connect+0x9b/0xc0 + __x64_sys_connect+0x16/0x20 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + -> #0 (&hdev->lock){+.+.}-{3:3}: + __lock_acquire+0x147a/0x1a50 + lock_acquire+0x277/0x3d0 + __mutex_lock+0xa3/0xa10 + hci_conn_get_phy+0x1c/0x150 [bluetooth] + l2cap_sock_getsockopt+0x5a9/0x610 [bluetooth] + __sys_getsockopt+0xcc/0x200 + __x64_sys_getsockopt+0x20/0x30 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + other info that might help us debug this: + + Chain exists of: + &hdev->lock --> &chan->lock#2/1 --> sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP); + lock(&chan->lock#2/1); + lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP); + lock(&hdev->lock); + + *** DEADLOCK *** + + 1 lock held by bluetoothd/1118: + #0: ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610 [bluetooth] + + stack backtrace: + CPU: 3 PID: 1118 Comm: bluetoothd Not tainted 5.12.0-rc1-00026-g73d464503354 #10 + Hardware name: LENOVO 20K5S22R00/20K5S22R00, BIOS R0IET38W (1.16 ) 05/31/2017 + Call Trace: + dump_stack+0x7f/0xa1 + check_noncircular+0x105/0x120 + ? __lock_acquire+0x147a/0x1a50 + __lock_acquire+0x147a/0x1a50 + lock_acquire+0x277/0x3d0 + ? hci_conn_get_phy+0x1c/0x150 [bluetooth] + ? __lock_acquire+0x2e1/0x1a50 + ? lock_is_held_type+0xb4/0x120 + ? hci_conn_get_phy+0x1c/0x150 [bluetooth] + __mutex_lock+0xa3/0xa10 + ? hci_conn_get_phy+0x1c/0x150 [bluetooth] + ? lock_acquire+0x277/0x3d0 + ? mark_held_locks+0x49/0x70 + ? mark_held_locks+0x49/0x70 + ? hci_conn_get_phy+0x1c/0x150 [bluetooth] + hci_conn_get_phy+0x1c/0x150 [bluetooth] + l2cap_sock_getsockopt+0x5a9/0x610 [bluetooth] + __sys_getsockopt+0xcc/0x200 + __x64_sys_getsockopt+0x20/0x30 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7fb73df33eee + Code: 48 8b 0d 85 0f 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 52 0f 0c 00 f7 d8 64 89 01 48 + RSP: 002b:00007fffcfbbbf08 EFLAGS: 00000203 ORIG_RAX: 0000000000000037 + RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007fb73df33eee + RDX: 000000000000000e RSI: 0000000000000112 RDI: 0000000000000018 + RBP: 0000000000000000 R08: 00007fffcfbbbf44 R09: 0000000000000000 + R10: 00007fffcfbbbf3c R11: 0000000000000203 R12: 0000000000000000 + R13: 0000000000000018 R14: 0000000000000000 R15: 0000556fcefc70d0 + +Fixes: eab2404ba798 ("Bluetooth: Add BT_PHY socket option") +Signed-off-by: Jiri Kosina +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index d0c1024bf600..1c5a0a60292d 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1789,8 +1789,6 @@ u32 hci_conn_get_phy(struct hci_conn *conn) + { + u32 phys = 0; + +- hci_dev_lock(conn->hdev); +- + /* BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 2, Part B page 471: + * Table 6.2: Packets defined for synchronous, asynchronous, and + * CSB logical transport types. +@@ -1887,7 +1885,5 @@ u32 hci_conn_get_phy(struct hci_conn *conn) + break; + } + +- hci_dev_unlock(conn->hdev); +- + return phys; + } +-- +2.30.2 + diff --git a/queue-5.10/bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch b/queue-5.10/bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch new file mode 100644 index 00000000000..54a41fe332f --- /dev/null +++ b/queue-5.10/bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch @@ -0,0 +1,73 @@ +From b14f749d46755667f1db4312c1ed99652b760225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 18:13:19 -0400 +Subject: bnxt_en: Fix RX consumer index logic in the error path. + +From: Michael Chan + +[ Upstream commit bbd6f0a948139970f4a615dff189d9a503681a39 ] + +In bnxt_rx_pkt(), the RX buffers are expected to complete in order. +If the RX consumer index indicates an out of order buffer completion, +it means we are hitting a hardware bug and the driver will abort all +remaining RX packets and reset the RX ring. The RX consumer index +that we pass to bnxt_discard_rx() is not correct. We should be +passing the current index (tmp_raw_cons) instead of the old index +(raw_cons). This bug can cause us to be at the wrong index when +trying to abort the next RX packet. It can crash like this: + + #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 + #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 + #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e + #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978 + #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 + #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e + #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 + #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e + #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 + #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5 + [exception RIP: bnxt_rx_pkt+237] + RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213 + RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000 + RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000 + RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d + R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0 + R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.") +Reviewed-by: Pavan Chebbi +Reviewed-by: Andy Gospodarek +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 512457e0301d..7ddc2e2e4976 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1731,14 +1731,16 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + + cons = rxcmp->rx_cmp_opaque; + if (unlikely(cons != rxr->rx_next_cons)) { +- int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp); ++ int rc1 = bnxt_discard_rx(bp, cpr, &tmp_raw_cons, rxcmp); + + /* 0xffff is forced error, don't print it */ + if (rxr->rx_next_cons != 0xffff) + netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", + cons, rxr->rx_next_cons); + bnxt_sched_reset(bp, rxr); +- return rc1; ++ if (rc1) ++ return rc1; ++ goto next_rx_no_prod_no_len; + } + rx_buf = &rxr->rx_buf_ring[cons]; + data = rx_buf->data; +-- +2.30.2 + diff --git a/queue-5.10/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch b/queue-5.10/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch new file mode 100644 index 00000000000..8f4acbc7ff2 --- /dev/null +++ b/queue-5.10/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch @@ -0,0 +1,43 @@ +From f0e2125a8b9ce38c81b8cd41e61b00c2458341d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 12:10:28 +0300 +Subject: bnxt_en: fix ternary sign extension bug in bnxt_show_temp() + +From: Dan Carpenter + +[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ] + +The problem is that bnxt_show_temp() returns long but "rc" is an int +and "len" is a u32. With ternary operations the type promotion is quite +tricky. The negative "rc" is first promoted to u32 and then to long so +it ends up being a high positive value instead of a a negative as we +intended. + +Fix this by removing the ternary. + +Fixes: d69753fa1ecb ("bnxt_en: return proper error codes in bnxt_show_temp") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index a59c1f1fb31e..512457e0301d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9546,7 +9546,9 @@ static ssize_t bnxt_show_temp(struct device *dev, + if (!rc) + len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); +- return rc ?: len; ++ if (rc) ++ return rc; ++ return len; + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +-- +2.30.2 + diff --git a/queue-5.10/bpf-fix-propagation-of-32-bit-unsigned-bounds-from-6.patch b/queue-5.10/bpf-fix-propagation-of-32-bit-unsigned-bounds-from-6.patch new file mode 100644 index 00000000000..1ec6abc7895 --- /dev/null +++ b/queue-5.10/bpf-fix-propagation-of-32-bit-unsigned-bounds-from-6.patch @@ -0,0 +1,105 @@ +From 7372bfc40d2ab1f98cf179d6ba845a8d3602d8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:59:55 +0000 +Subject: bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds + +From: Daniel Borkmann + +[ Upstream commit 10bf4e83167cc68595b85fd73bb91e8f2c086e36 ] + +Similarly as b02709587ea3 ("bpf: Fix propagation of 32-bit signed bounds +from 64-bit bounds."), we also need to fix the propagation of 32 bit +unsigned bounds from 64 bit counterparts. That is, really only set the +u32_{min,max}_value when /both/ {umin,umax}_value safely fit in 32 bit +space. For example, the register with a umin_value == 1 does /not/ imply +that u32_min_value is also equal to 1, since umax_value could be much +larger than 32 bit subregister can hold, and thus u32_min_value is in +the interval [0,1] instead. + +Before fix, invalid tracking result of R2_w=inv1: + + [...] + 5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0 + 5: (35) if r2 >= 0x1 goto pc+1 + [...] // goto path + 7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0 + 7: (b6) if w2 <= 0x1 goto pc+1 + [...] // goto path + 9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smin_value=-9223372036854775807,smax_value=9223372032559808513,umin_value=1,umax_value=18446744069414584321,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_max_value=1) R10=fp0 + 9: (bc) w2 = w2 + 10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv1 R10=fp0 + [...] + +After fix, correct tracking result of R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)): + + [...] + 5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0 + 5: (35) if r2 >= 0x1 goto pc+1 + [...] // goto path + 7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0 + 7: (b6) if w2 <= 0x1 goto pc+1 + [...] // goto path + 9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smax_value=9223372032559808513,umax_value=18446744069414584321,var_off=(0x0; 0xffffffff00000001),s32_min_value=0,s32_max_value=1,u32_max_value=1) R10=fp0 + 9: (bc) w2 = w2 + 10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) R10=fp0 + [...] + +Thus, same issue as in b02709587ea3 holds for unsigned subregister tracking. +Also, align __reg64_bound_u32() similarly to __reg64_bound_s32() as done in +b02709587ea3 to make them uniform again. + +Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") +Reported-by: Manfred Paul (@_manfp) +Signed-off-by: Daniel Borkmann +Reviewed-by: John Fastabend +Acked-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 8 +++----- + tools/testing/selftests/bpf/verifier/array_access.c | 2 +- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index b6656d181c9e..dbde00ce60f0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1303,9 +1303,7 @@ static bool __reg64_bound_s32(s64 a) + + static bool __reg64_bound_u32(u64 a) + { +- if (a > U32_MIN && a < U32_MAX) +- return true; +- return false; ++ return a > U32_MIN && a < U32_MAX; + } + + static void __reg_combine_64_into_32(struct bpf_reg_state *reg) +@@ -1316,10 +1314,10 @@ static void __reg_combine_64_into_32(struct bpf_reg_state *reg) + reg->s32_min_value = (s32)reg->smin_value; + reg->s32_max_value = (s32)reg->smax_value; + } +- if (__reg64_bound_u32(reg->umin_value)) ++ if (__reg64_bound_u32(reg->umin_value) && __reg64_bound_u32(reg->umax_value)) { + reg->u32_min_value = (u32)reg->umin_value; +- if (__reg64_bound_u32(reg->umax_value)) + reg->u32_max_value = (u32)reg->umax_value; ++ } + + /* Intersecting with the old var_off might have improved our bounds + * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), +diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c +index 1b138cd2b187..1b1c798e9248 100644 +--- a/tools/testing/selftests/bpf/verifier/array_access.c ++++ b/tools/testing/selftests/bpf/verifier/array_access.c +@@ -186,7 +186,7 @@ + }, + .fixup_map_hash_48b = { 3 }, + .errstr_unpriv = "R0 leaks addr", +- .errstr = "invalid access to map value, value_size=48 off=44 size=8", ++ .errstr = "R0 unbounded memory access", + .result_unpriv = REJECT, + .result = REJECT, + .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, +-- +2.30.2 + diff --git a/queue-5.10/bpftool-fix-maybe-uninitialized-warnings.patch b/queue-5.10/bpftool-fix-maybe-uninitialized-warnings.patch new file mode 100644 index 00000000000..8dedde4eab8 --- /dev/null +++ b/queue-5.10/bpftool-fix-maybe-uninitialized-warnings.patch @@ -0,0 +1,86 @@ +From 2008451ad20218140300bc241f1c460bf58dc1ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 13:09:18 -0800 +Subject: bpftool: Fix maybe-uninitialized warnings + +From: Andrii Nakryiko + +[ Upstream commit 4bbb3583687051ef99966ddaeb1730441b777d40 ] + +Somehow when bpftool is compiled in -Og mode, compiler produces new warnings +about possibly uninitialized variables. Fix all the reported problems. + +Fixes: 2119f2189df1 ("bpftool: add C output format option to btf dump subcommand") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210313210920.1959628-3-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/btf.c | 3 +++ + tools/bpf/bpftool/main.c | 3 +-- + tools/bpf/bpftool/map.c | 2 +- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c +index 2afb7d5b1aca..592803af9734 100644 +--- a/tools/bpf/bpftool/btf.c ++++ b/tools/bpf/bpftool/btf.c +@@ -519,6 +519,7 @@ static int do_dump(int argc, char **argv) + NEXT_ARG(); + if (argc < 1) { + p_err("expecting value for 'format' option\n"); ++ err = -EINVAL; + goto done; + } + if (strcmp(*argv, "c") == 0) { +@@ -528,11 +529,13 @@ static int do_dump(int argc, char **argv) + } else { + p_err("unrecognized format specifier: '%s', possible values: raw, c", + *argv); ++ err = -EINVAL; + goto done; + } + NEXT_ARG(); + } else { + p_err("unrecognized option: '%s'", *argv); ++ err = -EINVAL; + goto done; + } + } +diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c +index 682daaa49e6a..33068d6ed5d6 100644 +--- a/tools/bpf/bpftool/main.c ++++ b/tools/bpf/bpftool/main.c +@@ -274,7 +274,7 @@ static int do_batch(int argc, char **argv) + int n_argc; + FILE *fp; + char *cp; +- int err; ++ int err = 0; + int i; + + if (argc < 2) { +@@ -368,7 +368,6 @@ static int do_batch(int argc, char **argv) + } else { + if (!json_output) + printf("processed %d commands\n", lines); +- err = 0; + } + err_close: + if (fp != stdin) +diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c +index a7efbd84fbcc..ce6faf1b90e8 100644 +--- a/tools/bpf/bpftool/map.c ++++ b/tools/bpf/bpftool/map.c +@@ -99,7 +99,7 @@ static int do_dump_btf(const struct btf_dumper *d, + void *value) + { + __u32 value_id; +- int ret; ++ int ret = 0; + + /* start of key-value pair */ + jsonw_start_object(d->jw); +-- +2.30.2 + diff --git a/queue-5.10/bug-remove-redundant-condition-check-in-report_bug.patch b/queue-5.10/bug-remove-redundant-condition-check-in-report_bug.patch new file mode 100644 index 00000000000..f13ef0929e4 --- /dev/null +++ b/queue-5.10/bug-remove-redundant-condition-check-in-report_bug.patch @@ -0,0 +1,79 @@ +From f82bcc5baccdfad36be308b4d8967d698ad94bbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 14:33:07 +0000 +Subject: bug: Remove redundant condition check in report_bug + +From: Andrew Scull + +[ Upstream commit 3ad1a6cb0abc63d036fc866bd7c2c5983516dec5 ] + +report_bug() will return early if it cannot find a bug corresponding to +the provided address. The subsequent test for the bug will always be +true so remove it. + +Fixes: 1b4cfe3c0a30d ("lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()") +Signed-off-by: Andrew Scull +Cc: Peter Zijlstra +Cc: "Steven Rostedt (VMware)" +Reviewed-by: Steven Rostedt (VMware) +Acked-by: Will Deacon +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210318143311.839894-2-ascull@google.com +Signed-off-by: Sasha Levin +--- + lib/bug.c | 33 +++++++++++++++------------------ + 1 file changed, 15 insertions(+), 18 deletions(-) + +diff --git a/lib/bug.c b/lib/bug.c +index 7103440c0ee1..4ab398a2de93 100644 +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -158,30 +158,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) + + file = NULL; + line = 0; +- warning = 0; + +- if (bug) { + #ifdef CONFIG_DEBUG_BUGVERBOSE + #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS +- file = bug->file; ++ file = bug->file; + #else +- file = (const char *)bug + bug->file_disp; ++ file = (const char *)bug + bug->file_disp; + #endif +- line = bug->line; ++ line = bug->line; + #endif +- warning = (bug->flags & BUGFLAG_WARNING) != 0; +- once = (bug->flags & BUGFLAG_ONCE) != 0; +- done = (bug->flags & BUGFLAG_DONE) != 0; +- +- if (warning && once) { +- if (done) +- return BUG_TRAP_TYPE_WARN; +- +- /* +- * Since this is the only store, concurrency is not an issue. +- */ +- bug->flags |= BUGFLAG_DONE; +- } ++ warning = (bug->flags & BUGFLAG_WARNING) != 0; ++ once = (bug->flags & BUGFLAG_ONCE) != 0; ++ done = (bug->flags & BUGFLAG_DONE) != 0; ++ ++ if (warning && once) { ++ if (done) ++ return BUG_TRAP_TYPE_WARN; ++ ++ /* ++ * Since this is the only store, concurrency is not an issue. ++ */ ++ bug->flags |= BUGFLAG_DONE; + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/bus-qcom-put-child-node-before-return.patch b/queue-5.10/bus-qcom-put-child-node-before-return.patch new file mode 100644 index 00000000000..20bd75f81f4 --- /dev/null +++ b/queue-5.10/bus-qcom-put-child-node-before-return.patch @@ -0,0 +1,43 @@ +From 277d2c42f624fbca3af8312cdbca535374086cc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 03:49:07 -0800 +Subject: bus: qcom: Put child node before return + +From: Pan Bian + +[ Upstream commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 ] + +Put child node before return to fix potential reference count leak. +Generally, the reference count of child is incremented and decremented +automatically in the macro for_each_available_child_of_node() and should +be decremented manually if the loop is broken in loop body. + +Reviewed-by: Linus Walleij +Fixes: 335a12754808 ("bus: qcom: add EBI2 driver") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/bus/qcom-ebi2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c +index 03ddcf426887..0b8f53a688b8 100644 +--- a/drivers/bus/qcom-ebi2.c ++++ b/drivers/bus/qcom-ebi2.c +@@ -353,8 +353,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) + + /* Figure out the chipselect */ + ret = of_property_read_u32(child, "reg", &csindex); +- if (ret) ++ if (ret) { ++ of_node_put(child); + return ret; ++ } + + if (csindex > 5) { + dev_err(dev, +-- +2.30.2 + diff --git a/queue-5.10/clk-imx-fix-reparenting-of-uarts-not-associated-with.patch b/queue-5.10/clk-imx-fix-reparenting-of-uarts-not-associated-with.patch new file mode 100644 index 00000000000..062e24206f4 --- /dev/null +++ b/queue-5.10/clk-imx-fix-reparenting-of-uarts-not-associated-with.patch @@ -0,0 +1,727 @@ +From f71993985b4d6b1e4dad1ecb8c1c3b48835ee121 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 06:28:17 -0600 +Subject: clk: imx: Fix reparenting of UARTs not associated with stdout + +From: Adam Ford + +[ Upstream commit 379c9a24cc239000b1dec53db02fe17a86947423 ] + +Most if not all i.MX SoC's call a function which enables all UARTS. +This is a problem for users who need to re-parent the clock source, +because any attempt to change the parent results in an busy error +due to the fact that the clocks have been enabled already. + + clk: failed to reparent uart1 to sys_pll1_80m: -16 + +Instead of pre-initializing all UARTS, scan the device tree to see +which UART clocks are associated to stdout, and only enable those +UART clocks if it's needed early. This will move initialization of +the remaining clocks until after the parenting of the clocks. + +When the clocks are shutdown, this mechanism will also disable any +clocks that were pre-initialized. + +Fixes: 9461f7b33d11c ("clk: fix CLK_SET_RATE_GATE with clock rate protection") +Suggested-by: Aisheng Dong +Signed-off-by: Adam Ford +Reviewed-by: Abel Vesa +Tested-by: Ahmad Fatoum +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx25.c | 12 +--------- + drivers/clk/imx/clk-imx27.c | 13 +---------- + drivers/clk/imx/clk-imx35.c | 10 +-------- + drivers/clk/imx/clk-imx5.c | 30 +++---------------------- + drivers/clk/imx/clk-imx6q.c | 16 +------------- + drivers/clk/imx/clk-imx6sl.c | 16 +------------- + drivers/clk/imx/clk-imx6sll.c | 24 +------------------- + drivers/clk/imx/clk-imx6sx.c | 16 +------------- + drivers/clk/imx/clk-imx7d.c | 22 +------------------ + drivers/clk/imx/clk-imx7ulp.c | 31 ++------------------------ + drivers/clk/imx/clk-imx8mm.c | 18 ++------------- + drivers/clk/imx/clk-imx8mn.c | 18 ++------------- + drivers/clk/imx/clk-imx8mp.c | 17 +-------------- + drivers/clk/imx/clk-imx8mq.c | 18 ++------------- + drivers/clk/imx/clk.c | 41 +++++++++++++++++++++++++++-------- + drivers/clk/imx/clk.h | 4 ++-- + 16 files changed, 54 insertions(+), 252 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx25.c b/drivers/clk/imx/clk-imx25.c +index a66cabfbf94f..66192fe0a898 100644 +--- a/drivers/clk/imx/clk-imx25.c ++++ b/drivers/clk/imx/clk-imx25.c +@@ -73,16 +73,6 @@ enum mx25_clks { + + static struct clk *clk[clk_max]; + +-static struct clk ** const uart_clks[] __initconst = { +- &clk[uart_ipg_per], +- &clk[uart1_ipg], +- &clk[uart2_ipg], +- &clk[uart3_ipg], +- &clk[uart4_ipg], +- &clk[uart5_ipg], +- NULL +-}; +- + static int __init __mx25_clocks_init(void __iomem *ccm_base) + { + BUG_ON(!ccm_base); +@@ -228,7 +218,7 @@ static int __init __mx25_clocks_init(void __iomem *ccm_base) + */ + clk_set_parent(clk[cko_sel], clk[ipg]); + +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(6); + + return 0; + } +diff --git a/drivers/clk/imx/clk-imx27.c b/drivers/clk/imx/clk-imx27.c +index 5585ded8b8c6..56a5fc402b10 100644 +--- a/drivers/clk/imx/clk-imx27.c ++++ b/drivers/clk/imx/clk-imx27.c +@@ -49,17 +49,6 @@ static const char *ssi_sel_clks[] = { "spll_gate", "mpll", }; + static struct clk *clk[IMX27_CLK_MAX]; + static struct clk_onecell_data clk_data; + +-static struct clk ** const uart_clks[] __initconst = { +- &clk[IMX27_CLK_PER1_GATE], +- &clk[IMX27_CLK_UART1_IPG_GATE], +- &clk[IMX27_CLK_UART2_IPG_GATE], +- &clk[IMX27_CLK_UART3_IPG_GATE], +- &clk[IMX27_CLK_UART4_IPG_GATE], +- &clk[IMX27_CLK_UART5_IPG_GATE], +- &clk[IMX27_CLK_UART6_IPG_GATE], +- NULL +-}; +- + static void __init _mx27_clocks_init(unsigned long fref) + { + BUG_ON(!ccm); +@@ -176,7 +165,7 @@ static void __init _mx27_clocks_init(unsigned long fref) + + clk_prepare_enable(clk[IMX27_CLK_EMI_AHB_GATE]); + +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(7); + + imx_print_silicon_rev("i.MX27", mx27_revision()); + } +diff --git a/drivers/clk/imx/clk-imx35.c b/drivers/clk/imx/clk-imx35.c +index c1df03665c09..0fe5ac210156 100644 +--- a/drivers/clk/imx/clk-imx35.c ++++ b/drivers/clk/imx/clk-imx35.c +@@ -82,14 +82,6 @@ enum mx35_clks { + + static struct clk *clk[clk_max]; + +-static struct clk ** const uart_clks[] __initconst = { +- &clk[ipg], +- &clk[uart1_gate], +- &clk[uart2_gate], +- &clk[uart3_gate], +- NULL +-}; +- + static void __init _mx35_clocks_init(void) + { + void __iomem *base; +@@ -243,7 +235,7 @@ static void __init _mx35_clocks_init(void) + */ + clk_prepare_enable(clk[scc_gate]); + +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(4); + + imx_print_silicon_rev("i.MX35", mx35_revision()); + } +diff --git a/drivers/clk/imx/clk-imx5.c b/drivers/clk/imx/clk-imx5.c +index 01e079b81026..e4493846454d 100644 +--- a/drivers/clk/imx/clk-imx5.c ++++ b/drivers/clk/imx/clk-imx5.c +@@ -128,30 +128,6 @@ static const char *ieee1588_sels[] = { "pll3_sw", "pll4_sw", "dummy" /* usbphy2_ + static struct clk *clk[IMX5_CLK_END]; + static struct clk_onecell_data clk_data; + +-static struct clk ** const uart_clks_mx51[] __initconst = { +- &clk[IMX5_CLK_UART1_IPG_GATE], +- &clk[IMX5_CLK_UART1_PER_GATE], +- &clk[IMX5_CLK_UART2_IPG_GATE], +- &clk[IMX5_CLK_UART2_PER_GATE], +- &clk[IMX5_CLK_UART3_IPG_GATE], +- &clk[IMX5_CLK_UART3_PER_GATE], +- NULL +-}; +- +-static struct clk ** const uart_clks_mx50_mx53[] __initconst = { +- &clk[IMX5_CLK_UART1_IPG_GATE], +- &clk[IMX5_CLK_UART1_PER_GATE], +- &clk[IMX5_CLK_UART2_IPG_GATE], +- &clk[IMX5_CLK_UART2_PER_GATE], +- &clk[IMX5_CLK_UART3_IPG_GATE], +- &clk[IMX5_CLK_UART3_PER_GATE], +- &clk[IMX5_CLK_UART4_IPG_GATE], +- &clk[IMX5_CLK_UART4_PER_GATE], +- &clk[IMX5_CLK_UART5_IPG_GATE], +- &clk[IMX5_CLK_UART5_PER_GATE], +- NULL +-}; +- + static void __init mx5_clocks_common_init(void __iomem *ccm_base) + { + clk[IMX5_CLK_DUMMY] = imx_clk_fixed("dummy", 0); +@@ -382,7 +358,7 @@ static void __init mx50_clocks_init(struct device_node *np) + r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000); + clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r); + +- imx_register_uart_clocks(uart_clks_mx50_mx53); ++ imx_register_uart_clocks(5); + } + CLK_OF_DECLARE(imx50_ccm, "fsl,imx50-ccm", mx50_clocks_init); + +@@ -488,7 +464,7 @@ static void __init mx51_clocks_init(struct device_node *np) + val |= 1 << 23; + writel(val, MXC_CCM_CLPCR); + +- imx_register_uart_clocks(uart_clks_mx51); ++ imx_register_uart_clocks(3); + } + CLK_OF_DECLARE(imx51_ccm, "fsl,imx51-ccm", mx51_clocks_init); + +@@ -633,6 +609,6 @@ static void __init mx53_clocks_init(struct device_node *np) + r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000); + clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r); + +- imx_register_uart_clocks(uart_clks_mx50_mx53); ++ imx_register_uart_clocks(5); + } + CLK_OF_DECLARE(imx53_ccm, "fsl,imx53-ccm", mx53_clocks_init); +diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c +index b2ff187cedab..f444bbe8244c 100644 +--- a/drivers/clk/imx/clk-imx6q.c ++++ b/drivers/clk/imx/clk-imx6q.c +@@ -140,13 +140,6 @@ static inline int clk_on_imx6dl(void) + return of_machine_is_compatible("fsl,imx6dl"); + } + +-static const int uart_clk_ids[] __initconst = { +- IMX6QDL_CLK_UART_IPG, +- IMX6QDL_CLK_UART_SERIAL, +-}; +- +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata; +- + static int ldb_di_sel_by_clock_id(int clock_id) + { + switch (clock_id) { +@@ -440,7 +433,6 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + struct device_node *np; + void __iomem *anatop_base, *base; + int ret; +- int i; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX6QDL_CLK_END), GFP_KERNEL); +@@ -982,12 +974,6 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + hws[IMX6QDL_CLK_PLL3_USB_OTG]->clk); + } + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(1); + } + CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init); +diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c +index 2f9361946a0e..d997b5b07818 100644 +--- a/drivers/clk/imx/clk-imx6sl.c ++++ b/drivers/clk/imx/clk-imx6sl.c +@@ -178,19 +178,11 @@ void imx6sl_set_wait_clk(bool enter) + imx6sl_enable_pll_arm(false); + } + +-static const int uart_clk_ids[] __initconst = { +- IMX6SL_CLK_UART, +- IMX6SL_CLK_UART_SERIAL, +-}; +- +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata; +- + static void __init imx6sl_clocks_init(struct device_node *ccm_node) + { + struct device_node *np; + void __iomem *base; + int ret; +- int i; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX6SL_CLK_END), GFP_KERNEL); +@@ -447,12 +439,6 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node) + clk_set_parent(hws[IMX6SL_CLK_LCDIF_AXI_SEL]->clk, + hws[IMX6SL_CLK_PLL2_PFD2]->clk); + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(2); + } + CLK_OF_DECLARE(imx6sl, "fsl,imx6sl-ccm", imx6sl_clocks_init); +diff --git a/drivers/clk/imx/clk-imx6sll.c b/drivers/clk/imx/clk-imx6sll.c +index 8e8288bda4d0..31d777f30039 100644 +--- a/drivers/clk/imx/clk-imx6sll.c ++++ b/drivers/clk/imx/clk-imx6sll.c +@@ -76,26 +76,10 @@ static u32 share_count_ssi1; + static u32 share_count_ssi2; + static u32 share_count_ssi3; + +-static const int uart_clk_ids[] __initconst = { +- IMX6SLL_CLK_UART1_IPG, +- IMX6SLL_CLK_UART1_SERIAL, +- IMX6SLL_CLK_UART2_IPG, +- IMX6SLL_CLK_UART2_SERIAL, +- IMX6SLL_CLK_UART3_IPG, +- IMX6SLL_CLK_UART3_SERIAL, +- IMX6SLL_CLK_UART4_IPG, +- IMX6SLL_CLK_UART4_SERIAL, +- IMX6SLL_CLK_UART5_IPG, +- IMX6SLL_CLK_UART5_SERIAL, +-}; +- +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata; +- + static void __init imx6sll_clocks_init(struct device_node *ccm_node) + { + struct device_node *np; + void __iomem *base; +- int i; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX6SLL_CLK_END), GFP_KERNEL); +@@ -356,13 +340,7 @@ static void __init imx6sll_clocks_init(struct device_node *ccm_node) + + of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(5); + + /* Lower the AHB clock rate before changing the clock source. */ + clk_set_rate(hws[IMX6SLL_CLK_AHB]->clk, 99000000); +diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c +index 20dcce526d07..fc1bd23d4583 100644 +--- a/drivers/clk/imx/clk-imx6sx.c ++++ b/drivers/clk/imx/clk-imx6sx.c +@@ -117,18 +117,10 @@ static u32 share_count_ssi3; + static u32 share_count_sai1; + static u32 share_count_sai2; + +-static const int uart_clk_ids[] __initconst = { +- IMX6SX_CLK_UART_IPG, +- IMX6SX_CLK_UART_SERIAL, +-}; +- +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata; +- + static void __init imx6sx_clocks_init(struct device_node *ccm_node) + { + struct device_node *np; + void __iomem *base; +- int i; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX6SX_CLK_CLK_END), GFP_KERNEL); +@@ -556,12 +548,6 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node) + clk_set_parent(hws[IMX6SX_CLK_QSPI1_SEL]->clk, hws[IMX6SX_CLK_PLL2_BUS]->clk); + clk_set_parent(hws[IMX6SX_CLK_QSPI2_SEL]->clk, hws[IMX6SX_CLK_PLL2_BUS]->clk); + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(2); + } + CLK_OF_DECLARE(imx6sx, "fsl,imx6sx-ccm", imx6sx_clocks_init); +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c +index 22d24a6a05e7..c4e0f1c07192 100644 +--- a/drivers/clk/imx/clk-imx7d.c ++++ b/drivers/clk/imx/clk-imx7d.c +@@ -377,23 +377,10 @@ static const char *pll_video_bypass_sel[] = { "pll_video_main", "pll_video_main_ + static struct clk_hw **hws; + static struct clk_hw_onecell_data *clk_hw_data; + +-static const int uart_clk_ids[] __initconst = { +- IMX7D_UART1_ROOT_CLK, +- IMX7D_UART2_ROOT_CLK, +- IMX7D_UART3_ROOT_CLK, +- IMX7D_UART4_ROOT_CLK, +- IMX7D_UART5_ROOT_CLK, +- IMX7D_UART6_ROOT_CLK, +- IMX7D_UART7_ROOT_CLK, +-}; +- +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1] __initdata; +- + static void __init imx7d_clocks_init(struct device_node *ccm_node) + { + struct device_node *np; + void __iomem *base; +- int i; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX7D_CLK_END), GFP_KERNEL); +@@ -897,14 +884,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) + hws[IMX7D_USB1_MAIN_480M_CLK] = imx_clk_hw_fixed_factor("pll_usb1_main_clk", "osc", 20, 1); + hws[IMX7D_USB_MAIN_480M_CLK] = imx_clk_hw_fixed_factor("pll_usb_main_clk", "osc", 20, 1); + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(7); + + } + CLK_OF_DECLARE(imx7d, "fsl,imx7d-ccm", imx7d_clocks_init); +diff --git a/drivers/clk/imx/clk-imx7ulp.c b/drivers/clk/imx/clk-imx7ulp.c +index 634c0b6636b0..779e09105da7 100644 +--- a/drivers/clk/imx/clk-imx7ulp.c ++++ b/drivers/clk/imx/clk-imx7ulp.c +@@ -43,19 +43,6 @@ static const struct clk_div_table ulp_div_table[] = { + { /* sentinel */ }, + }; + +-static const int pcc2_uart_clk_ids[] __initconst = { +- IMX7ULP_CLK_LPUART4, +- IMX7ULP_CLK_LPUART5, +-}; +- +-static const int pcc3_uart_clk_ids[] __initconst = { +- IMX7ULP_CLK_LPUART6, +- IMX7ULP_CLK_LPUART7, +-}; +- +-static struct clk **pcc2_uart_clks[ARRAY_SIZE(pcc2_uart_clk_ids) + 1] __initdata; +-static struct clk **pcc3_uart_clks[ARRAY_SIZE(pcc3_uart_clk_ids) + 1] __initdata; +- + static void __init imx7ulp_clk_scg1_init(struct device_node *np) + { + struct clk_hw_onecell_data *clk_data; +@@ -150,7 +137,6 @@ static void __init imx7ulp_clk_pcc2_init(struct device_node *np) + struct clk_hw_onecell_data *clk_data; + struct clk_hw **hws; + void __iomem *base; +- int i; + + clk_data = kzalloc(struct_size(clk_data, hws, IMX7ULP_CLK_PCC2_END), + GFP_KERNEL); +@@ -190,13 +176,7 @@ static void __init imx7ulp_clk_pcc2_init(struct device_node *np) + + of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data); + +- for (i = 0; i < ARRAY_SIZE(pcc2_uart_clk_ids); i++) { +- int index = pcc2_uart_clk_ids[i]; +- +- pcc2_uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(pcc2_uart_clks); ++ imx_register_uart_clocks(2); + } + CLK_OF_DECLARE(imx7ulp_clk_pcc2, "fsl,imx7ulp-pcc2", imx7ulp_clk_pcc2_init); + +@@ -205,7 +185,6 @@ static void __init imx7ulp_clk_pcc3_init(struct device_node *np) + struct clk_hw_onecell_data *clk_data; + struct clk_hw **hws; + void __iomem *base; +- int i; + + clk_data = kzalloc(struct_size(clk_data, hws, IMX7ULP_CLK_PCC3_END), + GFP_KERNEL); +@@ -244,13 +223,7 @@ static void __init imx7ulp_clk_pcc3_init(struct device_node *np) + + of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data); + +- for (i = 0; i < ARRAY_SIZE(pcc3_uart_clk_ids); i++) { +- int index = pcc3_uart_clk_ids[i]; +- +- pcc3_uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(pcc3_uart_clks); ++ imx_register_uart_clocks(7); + } + CLK_OF_DECLARE(imx7ulp_clk_pcc3, "fsl,imx7ulp-pcc3", imx7ulp_clk_pcc3_init); + +diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c +index f358ad907299..4cbf86ab2eac 100644 +--- a/drivers/clk/imx/clk-imx8mm.c ++++ b/drivers/clk/imx/clk-imx8mm.c +@@ -291,20 +291,12 @@ static const char *imx8mm_clko2_sels[] = {"osc_24m", "sys_pll2_200m", "sys_pll1_ + static struct clk_hw_onecell_data *clk_hw_data; + static struct clk_hw **hws; + +-static const int uart_clk_ids[] = { +- IMX8MM_CLK_UART1_ROOT, +- IMX8MM_CLK_UART2_ROOT, +- IMX8MM_CLK_UART3_ROOT, +- IMX8MM_CLK_UART4_ROOT, +-}; +-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1]; +- + static int imx8mm_clocks_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; + void __iomem *base; +- int ret, i; ++ int ret; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX8MM_CLK_END), GFP_KERNEL); +@@ -622,13 +614,7 @@ static int imx8mm_clocks_probe(struct platform_device *pdev) + goto unregister_hws; + } + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_hws[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_hws); ++ imx_register_uart_clocks(4); + + return 0; + +diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c +index f3c5e6cf55dd..f98f25279539 100644 +--- a/drivers/clk/imx/clk-imx8mn.c ++++ b/drivers/clk/imx/clk-imx8mn.c +@@ -284,20 +284,12 @@ static const char * const imx8mn_clko2_sels[] = {"osc_24m", "sys_pll2_200m", "sy + static struct clk_hw_onecell_data *clk_hw_data; + static struct clk_hw **hws; + +-static const int uart_clk_ids[] = { +- IMX8MN_CLK_UART1_ROOT, +- IMX8MN_CLK_UART2_ROOT, +- IMX8MN_CLK_UART3_ROOT, +- IMX8MN_CLK_UART4_ROOT, +-}; +-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1]; +- + static int imx8mn_clocks_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; + void __iomem *base; +- int ret, i; ++ int ret; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX8MN_CLK_END), GFP_KERNEL); +@@ -573,13 +565,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev) + goto unregister_hws; + } + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_hws[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_hws); ++ imx_register_uart_clocks(4); + + return 0; + +diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c +index 48e212477f52..0391f5bda5e4 100644 +--- a/drivers/clk/imx/clk-imx8mp.c ++++ b/drivers/clk/imx/clk-imx8mp.c +@@ -414,20 +414,11 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r + static struct clk_hw **hws; + static struct clk_hw_onecell_data *clk_hw_data; + +-static const int uart_clk_ids[] = { +- IMX8MP_CLK_UART1_ROOT, +- IMX8MP_CLK_UART2_ROOT, +- IMX8MP_CLK_UART3_ROOT, +- IMX8MP_CLK_UART4_ROOT, +-}; +-static struct clk **uart_clks[ARRAY_SIZE(uart_clk_ids) + 1]; +- + static int imx8mp_clocks_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; + void __iomem *anatop_base, *ccm_base; +- int i; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mp-anatop"); + anatop_base = of_iomap(np, 0); +@@ -737,13 +728,7 @@ static int imx8mp_clocks_probe(struct platform_device *pdev) + + of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_clks[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_clks); ++ imx_register_uart_clocks(4); + + return 0; + } +diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c +index 06292d4a98ff..4e6c81a70221 100644 +--- a/drivers/clk/imx/clk-imx8mq.c ++++ b/drivers/clk/imx/clk-imx8mq.c +@@ -273,20 +273,12 @@ static const char * const imx8mq_clko2_sels[] = {"osc_25m", "sys2_pll_200m", "sy + static struct clk_hw_onecell_data *clk_hw_data; + static struct clk_hw **hws; + +-static const int uart_clk_ids[] = { +- IMX8MQ_CLK_UART1_ROOT, +- IMX8MQ_CLK_UART2_ROOT, +- IMX8MQ_CLK_UART3_ROOT, +- IMX8MQ_CLK_UART4_ROOT, +-}; +-static struct clk **uart_hws[ARRAY_SIZE(uart_clk_ids) + 1]; +- + static int imx8mq_clocks_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; + void __iomem *base; +- int err, i; ++ int err; + + clk_hw_data = kzalloc(struct_size(clk_hw_data, hws, + IMX8MQ_CLK_END), GFP_KERNEL); +@@ -607,13 +599,7 @@ static int imx8mq_clocks_probe(struct platform_device *pdev) + goto unregister_hws; + } + +- for (i = 0; i < ARRAY_SIZE(uart_clk_ids); i++) { +- int index = uart_clk_ids[i]; +- +- uart_hws[i] = &hws[index]->clk; +- } +- +- imx_register_uart_clocks(uart_hws); ++ imx_register_uart_clocks(4); + + return 0; + +diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c +index 47882c51cb85..7cc669934253 100644 +--- a/drivers/clk/imx/clk.c ++++ b/drivers/clk/imx/clk.c +@@ -147,8 +147,10 @@ void imx_cscmr1_fixup(u32 *val) + } + + #ifndef MODULE +-static int imx_keep_uart_clocks; +-static struct clk ** const *imx_uart_clocks; ++ ++static bool imx_keep_uart_clocks; ++static int imx_enabled_uart_clocks; ++static struct clk **imx_uart_clocks; + + static int __init imx_keep_uart_clocks_param(char *str) + { +@@ -161,24 +163,45 @@ __setup_param("earlycon", imx_keep_uart_earlycon, + __setup_param("earlyprintk", imx_keep_uart_earlyprintk, + imx_keep_uart_clocks_param, 0); + +-void imx_register_uart_clocks(struct clk ** const clks[]) ++void imx_register_uart_clocks(unsigned int clk_count) + { ++ imx_enabled_uart_clocks = 0; ++ ++/* i.MX boards use device trees now. For build tests without CONFIG_OF, do nothing */ ++#ifdef CONFIG_OF + if (imx_keep_uart_clocks) { + int i; + +- imx_uart_clocks = clks; +- for (i = 0; imx_uart_clocks[i]; i++) +- clk_prepare_enable(*imx_uart_clocks[i]); ++ imx_uart_clocks = kcalloc(clk_count, sizeof(struct clk *), GFP_KERNEL); ++ ++ if (!of_stdout) ++ return; ++ ++ for (i = 0; i < clk_count; i++) { ++ imx_uart_clocks[imx_enabled_uart_clocks] = of_clk_get(of_stdout, i); ++ ++ /* Stop if there are no more of_stdout references */ ++ if (IS_ERR(imx_uart_clocks[imx_enabled_uart_clocks])) ++ return; ++ ++ /* Only enable the clock if it's not NULL */ ++ if (imx_uart_clocks[imx_enabled_uart_clocks]) ++ clk_prepare_enable(imx_uart_clocks[imx_enabled_uart_clocks++]); ++ } + } ++#endif + } + + static int __init imx_clk_disable_uart(void) + { +- if (imx_keep_uart_clocks && imx_uart_clocks) { ++ if (imx_keep_uart_clocks && imx_enabled_uart_clocks) { + int i; + +- for (i = 0; imx_uart_clocks[i]; i++) +- clk_disable_unprepare(*imx_uart_clocks[i]); ++ for (i = 0; i < imx_enabled_uart_clocks; i++) { ++ clk_disable_unprepare(imx_uart_clocks[i]); ++ clk_put(imx_uart_clocks[i]); ++ } ++ kfree(imx_uart_clocks); + } + + return 0; +diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h +index 1d7be0c86538..f04cbbab9fcc 100644 +--- a/drivers/clk/imx/clk.h ++++ b/drivers/clk/imx/clk.h +@@ -13,9 +13,9 @@ extern spinlock_t imx_ccm_lock; + void imx_check_clocks(struct clk *clks[], unsigned int count); + void imx_check_clk_hws(struct clk_hw *clks[], unsigned int count); + #ifndef MODULE +-void imx_register_uart_clocks(struct clk ** const clks[]); ++void imx_register_uart_clocks(unsigned int clk_count); + #else +-static inline void imx_register_uart_clocks(struct clk ** const clks[]) ++static inline void imx_register_uart_clocks(unsigned int clk_count) + { + } + #endif +-- +2.30.2 + diff --git a/queue-5.10/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch b/queue-5.10/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch new file mode 100644 index 00000000000..31ca875135d --- /dev/null +++ b/queue-5.10/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch @@ -0,0 +1,74 @@ +From 2c1bb7cbc9ee9c46fa0ff60c686d52442cec2115 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:18 +0200 +Subject: clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz + to 1 GHz +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 4decb9187589f61fe9fc2bc4d9b01160b0a610c5 ] + +It was observed that the workaround introduced by commit 61c40f35f5cd +("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to +1.2GHz") when base CPU frequency is 1.2 GHz is also required when base +CPU frequency is 1 GHz. Otherwise switching CPU frequency directly from +L2 (250 MHz) to L0 (1 GHz) causes a crash. + +When base CPU frequency is just 800 MHz no crashed were observed during +switch from L2 to L0. + +Signed-off-by: Pali Rohár +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index 6507bd2c5f31..b15e177bea7e 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -487,8 +487,10 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + } + + /* +- * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz +- * respectively) to L0 frequency (1.2 Ghz) requires a significant ++ * Workaround when base CPU frequnecy is 1000 or 1200 MHz ++ * ++ * Switching the CPU from the L2 or L3 frequencies (250/300 or 200 MHz ++ * respectively) to L0 frequency (1/1.2 GHz) requires a significant + * amount of time to let VDD stabilize to the appropriate + * voltage. This amount of time is large enough that it cannot be + * covered by the hardware countdown register. Due to this, the CPU +@@ -498,15 +500,15 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + * To work around this problem, we prevent switching directly from the + * L2/L3 frequencies to the L0 frequency, and instead switch to the L1 + * frequency in-between. The sequence therefore becomes: +- * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ) ++ * 1. First switch from L2/L3 (200/250/300 MHz) to L1 (500/600 MHz) + * 2. Sleep 20ms for stabling VDD voltage +- * 3. Then switch from L1(600MHZ) to L0(1200Mhz). ++ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz). + */ + static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base) + { + unsigned int cur_level; + +- if (rate != 1200 * 1000 * 1000) ++ if (rate < 1000 * 1000 * 1000) + return; + + regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level); +-- +2.30.2 + diff --git a/queue-5.10/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch b/queue-5.10/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch new file mode 100644 index 00000000000..98ed6f68073 --- /dev/null +++ b/queue-5.10/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch @@ -0,0 +1,122 @@ +From 9a2fbfb4c6dda7dce781123abce977e754654763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:19 +0200 +Subject: clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 + to L0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit e93033aff684641f71a436ca7a9d2a742126baaf ] + +When CPU frequency is at 250 MHz and set_rate() is called with 500 MHz (L1) +quickly followed by a call with 1 GHz (L0), the CPU does not necessarily +stay in L1 for at least 20ms as is required by Marvell errata. + +This situation happens frequently with the ondemand cpufreq governor and +can be also reproduced with userspace governor. In most cases it causes CPU +to crash. + +This change fixes the above issue and ensures that the CPU always stays in +L1 for at least 20ms when switching from any state to L0. + +Signed-off-by: Marek Behún +Signed-off-by: Pali Rohár +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 61c40f35f5cd ("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to 1.2GHz") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 45 ++++++++++++++++++++++---- + 1 file changed, 39 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index b15e177bea7e..32ac6b6b7530 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -84,6 +84,7 @@ struct clk_pm_cpu { + void __iomem *reg_div; + u8 shift_div; + struct regmap *nb_pm_base; ++ unsigned long l1_expiration; + }; + + #define to_clk_double_div(_hw) container_of(_hw, struct clk_double_div, hw) +@@ -504,22 +505,52 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + * 2. Sleep 20ms for stabling VDD voltage + * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz). + */ +-static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base) ++static void clk_pm_cpu_set_rate_wa(struct clk_pm_cpu *pm_cpu, ++ unsigned int new_level, unsigned long rate, ++ struct regmap *base) + { + unsigned int cur_level; + +- if (rate < 1000 * 1000 * 1000) +- return; +- + regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level); + cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK; +- if (cur_level <= ARMADA_37XX_DVFS_LOAD_1) ++ ++ if (cur_level == new_level) ++ return; ++ ++ /* ++ * System wants to go to L1 on its own. If we are going from L2/L3, ++ * remember when 20ms will expire. If from L0, set the value so that ++ * next switch to L0 won't have to wait. ++ */ ++ if (new_level == ARMADA_37XX_DVFS_LOAD_1) { ++ if (cur_level == ARMADA_37XX_DVFS_LOAD_0) ++ pm_cpu->l1_expiration = jiffies; ++ else ++ pm_cpu->l1_expiration = jiffies + msecs_to_jiffies(20); + return; ++ } ++ ++ /* ++ * If we are setting to L2/L3, just invalidate L1 expiration time, ++ * sleeping is not needed. ++ */ ++ if (rate < 1000*1000*1000) ++ goto invalidate_l1_exp; ++ ++ /* ++ * We are going to L0 with rate >= 1GHz. Check whether we have been at ++ * L1 for long enough time. If not, go to L1 for 20ms. ++ */ ++ if (pm_cpu->l1_expiration && jiffies >= pm_cpu->l1_expiration) ++ goto invalidate_l1_exp; + + regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD, + ARMADA_37XX_NB_CPU_LOAD_MASK, + ARMADA_37XX_DVFS_LOAD_1); + msleep(20); ++ ++invalidate_l1_exp: ++ pm_cpu->l1_expiration = 0; + } + + static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -553,7 +584,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + reg = ARMADA_37XX_NB_CPU_LOAD; + mask = ARMADA_37XX_NB_CPU_LOAD_MASK; + +- clk_pm_cpu_set_rate_wa(rate, base); ++ /* Apply workaround when base CPU frequency is 1000 or 1200 MHz */ ++ if (parent_rate >= 1000*1000*1000) ++ clk_pm_cpu_set_rate_wa(pm_cpu, load_level, rate, base); + + regmap_update_bits(base, reg, mask, load_level); + +-- +2.30.2 + diff --git a/queue-5.10/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch b/queue-5.10/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch new file mode 100644 index 00000000000..1c7752b1c39 --- /dev/null +++ b/queue-5.10/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch @@ -0,0 +1,83 @@ +From 9a388b0486f05dfa2803363b79c96c033363eea4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:16 +0200 +Subject: clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM + clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 4e435a9dd26c46ac018997cc0562d50b1a96f372 ] + +Remove the .set_parent method in clk_pm_cpu_ops. + +This method was supposed to be needed by the armada-37xx-cpufreq driver, +but was never actually called due to wrong assumptions in the cpufreq +driver. After this was fixed in the cpufreq driver, this method is not +needed anymore. + +Signed-off-by: Marek Behún +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Pali Rohár +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 28 -------------------------- + 1 file changed, 28 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index f5746f9ea929..6507bd2c5f31 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -440,33 +440,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw) + return val; + } + +-static int clk_pm_cpu_set_parent(struct clk_hw *hw, u8 index) +-{ +- struct clk_pm_cpu *pm_cpu = to_clk_pm_cpu(hw); +- struct regmap *base = pm_cpu->nb_pm_base; +- int load_level; +- +- /* +- * We set the clock parent only if the DVFS is available but +- * not enabled. +- */ +- if (IS_ERR(base) || armada_3700_pm_dvfs_is_enabled(base)) +- return -EINVAL; +- +- /* Set the parent clock for all the load level */ +- for (load_level = 0; load_level < LOAD_LEVEL_NR; load_level++) { +- unsigned int reg, mask, val, +- offset = ARMADA_37XX_NB_TBG_SEL_OFF; +- +- armada_3700_pm_dvfs_update_regs(load_level, ®, &offset); +- +- val = index << offset; +- mask = ARMADA_37XX_NB_TBG_SEL_MASK << offset; +- regmap_update_bits(base, reg, mask, val); +- } +- return 0; +-} +- + static unsigned long clk_pm_cpu_recalc_rate(struct clk_hw *hw, + unsigned long parent_rate) + { +@@ -592,7 +565,6 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops clk_pm_cpu_ops = { + .get_parent = clk_pm_cpu_get_parent, +- .set_parent = clk_pm_cpu_set_parent, + .round_rate = clk_pm_cpu_round_rate, + .set_rate = clk_pm_cpu_set_rate, + .recalc_rate = clk_pm_cpu_recalc_rate, +-- +2.30.2 + diff --git a/queue-5.10/clk-qcom-a53-pll-add-missing-module_device_table.patch b/queue-5.10/clk-qcom-a53-pll-add-missing-module_device_table.patch new file mode 100644 index 00000000000..970283b6a5d --- /dev/null +++ b/queue-5.10/clk-qcom-a53-pll-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From 9dd0c706b78c0e14c4cf1ffbcd24eba21cea5dee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 16:23:51 +0800 +Subject: clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE + +From: Chen Hui + +[ Upstream commit 790b516ada10a4dcc0f0a56dc0ced475d86d5820 ] + +CONFIG_QCOM_A53PLL is tristate option and therefore this driver can be +compiled as a module. This patch adds missing MODULE_DEVICE_TABLE +definition which generates correct modalias for automatic loading of +this driver when it is built as an external module. + +Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support") +Signed-off-by: Chen Hui +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20210409082352.233810-3-clare.chenhui@huawei.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/a53-pll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c +index 45cfc57bff92..af6ac17c7dae 100644 +--- a/drivers/clk/qcom/a53-pll.c ++++ b/drivers/clk/qcom/a53-pll.c +@@ -93,6 +93,7 @@ static const struct of_device_id qcom_a53pll_match_table[] = { + { .compatible = "qcom,msm8916-a53pll" }, + { } + }; ++MODULE_DEVICE_TABLE(of, qcom_a53pll_match_table); + + static struct platform_driver qcom_a53pll_driver = { + .probe = qcom_a53pll_probe, +-- +2.30.2 + diff --git a/queue-5.10/clk-qcom-apss-ipq-pll-add-missing-module_device_tabl.patch b/queue-5.10/clk-qcom-apss-ipq-pll-add-missing-module_device_tabl.patch new file mode 100644 index 00000000000..259fcf37c43 --- /dev/null +++ b/queue-5.10/clk-qcom-apss-ipq-pll-add-missing-module_device_tabl.patch @@ -0,0 +1,39 @@ +From a50fc72855b792c6ab77d128686fa80dafe9a72e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 16:23:52 +0800 +Subject: clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE + +From: Chen Hui + +[ Upstream commit d0a859edda46b45baeab9687d173102300d76e2b ] + +CONFIG_IPQ_APSS_PLL is tristate option and therefore this driver can +be compiled as a module. This patch adds missing MODULE_DEVICE_TABLE +definition which generates correct modalias for automatic loading of +this driver when it is built as an external module. + +Fixes: ecd2bacfbbc4 ("clk: qcom: Add ipq apss pll driver") +Signed-off-by: Chen Hui +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20210409082352.233810-4-clare.chenhui@huawei.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/apss-ipq-pll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/apss-ipq-pll.c b/drivers/clk/qcom/apss-ipq-pll.c +index 30be87fb222a..bef7899ad0d6 100644 +--- a/drivers/clk/qcom/apss-ipq-pll.c ++++ b/drivers/clk/qcom/apss-ipq-pll.c +@@ -81,6 +81,7 @@ static const struct of_device_id apss_ipq_pll_match_table[] = { + { .compatible = "qcom,ipq6018-a53pll" }, + { } + }; ++MODULE_DEVICE_TABLE(of, apss_ipq_pll_match_table); + + static struct platform_driver apss_ipq_pll_driver = { + .probe = apss_ipq_pll_probe, +-- +2.30.2 + diff --git a/queue-5.10/clk-uniphier-fix-potential-infinite-loop.patch b/queue-5.10/clk-uniphier-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..29689a0a01a --- /dev/null +++ b/queue-5.10/clk-uniphier-fix-potential-infinite-loop.patch @@ -0,0 +1,47 @@ +From 4fa39f53a03aef1c2f3dcb596e1ba4569ef663f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 10:01:03 +0100 +Subject: clk: uniphier: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit f6b1340dc751a6caa2a0567b667d0f4f4172cd58 ] + +The for-loop iterates with a u8 loop counter i and compares this +with the loop upper limit of num_parents that is an int type. +There is a potential infinite loop if num_parents is larger than +the u8 loop counter. Fix this by making the loop counter the same +type as num_parents. Also make num_parents an unsigned int to +match the return type of the call to clk_hw_get_num_parents. + +Addresses-Coverity: ("Infinite loop") +Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock driver") +Signed-off-by: Colin Ian King +Reviewed-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20210409090104.629722-1-colin.king@canonical.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c +index 462c84321b2d..1998e9d4cfc0 100644 +--- a/drivers/clk/uniphier/clk-uniphier-mux.c ++++ b/drivers/clk/uniphier/clk-uniphier-mux.c +@@ -31,10 +31,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index) + static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw) + { + struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw); +- int num_parents = clk_hw_get_num_parents(hw); ++ unsigned int num_parents = clk_hw_get_num_parents(hw); + int ret; + unsigned int val; +- u8 i; ++ unsigned int i; + + ret = regmap_read(mux->regmap, mux->reg, &val); + if (ret) +-- +2.30.2 + diff --git a/queue-5.10/clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch b/queue-5.10/clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch new file mode 100644 index 00000000000..5c011c4e11a --- /dev/null +++ b/queue-5.10/clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch @@ -0,0 +1,57 @@ +From 103af725bc7321b8ca141b8ce99da756a1163d70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 23:40:15 +0800 +Subject: clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback + +From: Quanyang Wang + +[ Upstream commit d7fd3f9f53df8bb2212dff70f66f12cae0e1a653 ] + +The round_rate callback should only perform rate calculation and not +involve calling zynqmp_pll_set_mode to change the pll mode. So let's +move zynqmp_pll_set_mode out of round_rate and to set_rate callback. + +Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") +Reported-by: Laurent Pinchart +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210406154015.602779-1-quanyang.wang@windriver.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/pll.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c +index 92f449ed38e5..03bfe62c1e62 100644 +--- a/drivers/clk/zynqmp/pll.c ++++ b/drivers/clk/zynqmp/pll.c +@@ -100,9 +100,7 @@ static long zynqmp_pll_round_rate(struct clk_hw *hw, unsigned long rate, + /* Enable the fractional mode if needed */ + rate_div = (rate * FRAC_DIV) / *prate; + f = rate_div % FRAC_DIV; +- zynqmp_pll_set_mode(hw, !!f); +- +- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) { ++ if (f) { + if (rate > PS_PLL_VCO_MAX) { + fbdiv = rate / PS_PLL_VCO_MAX; + rate = rate / (fbdiv + 1); +@@ -173,10 +171,12 @@ static int zynqmp_pll_set_rate(struct clk_hw *hw, unsigned long rate, + long rate_div, frac, m, f; + int ret; + +- if (zynqmp_pll_get_mode(hw) == PLL_MODE_FRAC) { +- rate_div = (rate * FRAC_DIV) / parent_rate; ++ rate_div = (rate * FRAC_DIV) / parent_rate; ++ f = rate_div % FRAC_DIV; ++ zynqmp_pll_set_mode(hw, !!f); ++ ++ if (f) { + m = rate_div / FRAC_DIV; +- f = rate_div % FRAC_DIV; + m = clamp_t(u32, m, (PLL_FBDIV_MIN), (PLL_FBDIV_MAX)); + rate = parent_rate * m; + frac = (parent_rate * f) / FRAC_DIV; +-- +2.30.2 + diff --git a/queue-5.10/clk-zynqmp-pll-add-set_pll_mode-to-check-condition-i.patch b/queue-5.10/clk-zynqmp-pll-add-set_pll_mode-to-check-condition-i.patch new file mode 100644 index 00000000000..b3d7b020f59 --- /dev/null +++ b/queue-5.10/clk-zynqmp-pll-add-set_pll_mode-to-check-condition-i.patch @@ -0,0 +1,87 @@ +From 4302bacf632333de1cd9f007871cdfe521cca519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 23:31:31 +0800 +Subject: clk: zynqmp: pll: add set_pll_mode to check condition in + zynqmp_pll_enable + +From: Quanyang Wang + +[ Upstream commit 394cdb69a3c30b33524cf1204afe5cceaba69cdc ] + +If there is a IOCTL_SET_PLL_FRAC_MODE request sent to ATF ever, +we shouldn't skip invoking PM_CLOCK_ENABLE fn even though this +pll has been enabled. In ATF implementation, it will only assign +the mode to the variable (struct pm_pll *)pll->mode when handling +IOCTL_SET_PLL_FRAC_MODE call. Invoking PM_CLOCK_ENABLE can force +ATF send request to PWU to set the pll mode to PLL's register. + +There is a scenario that happens in enabling VPLL_INT(clk_id:96): +1) VPLL_INT has been enabled during booting. +2) A driver calls clk_set_rate and according to the rate, the VPLL_INT + should be set to FRAC mode. Then zynqmp_pll_set_mode is called + to pass IOCTL_SET_PLL_FRAC_MODE to ATF. Note that at this point + ATF just stores the mode to a variable. +3) This driver calls clk_prepare_enable and zynqmp_pll_enable is + called to try to enable VPLL_INT pll. Because of 1), the function + zynqmp_pll_enable just returns without doing anything after checking + that this pll has been enabled. + +In the scenario above, the pll mode of VPLL_INT will never be set +successfully. So adding set_pll_mode to check condition to fix it. + +Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") +Signed-off-by: Quanyang Wang +Tested-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20210406153131.601701-1-quanyang.wang@windriver.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/pll.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/zynqmp/pll.c b/drivers/clk/zynqmp/pll.c +index 03bfe62c1e62..abe6afbf3407 100644 +--- a/drivers/clk/zynqmp/pll.c ++++ b/drivers/clk/zynqmp/pll.c +@@ -14,10 +14,12 @@ + * struct zynqmp_pll - PLL clock + * @hw: Handle between common and hardware-specific interfaces + * @clk_id: PLL clock ID ++ * @set_pll_mode: Whether an IOCTL_SET_PLL_FRAC_MODE request be sent to ATF + */ + struct zynqmp_pll { + struct clk_hw hw; + u32 clk_id; ++ bool set_pll_mode; + }; + + #define to_zynqmp_pll(_hw) container_of(_hw, struct zynqmp_pll, hw) +@@ -81,6 +83,8 @@ static inline void zynqmp_pll_set_mode(struct clk_hw *hw, bool on) + if (ret) + pr_warn_once("%s() PLL set frac mode failed for %s, ret = %d\n", + __func__, clk_name, ret); ++ else ++ clk->set_pll_mode = true; + } + + /** +@@ -240,9 +244,15 @@ static int zynqmp_pll_enable(struct clk_hw *hw) + u32 clk_id = clk->clk_id; + int ret; + +- if (zynqmp_pll_is_enabled(hw)) ++ /* ++ * Don't skip enabling clock if there is an IOCTL_SET_PLL_FRAC_MODE request ++ * that has been sent to ATF. ++ */ ++ if (zynqmp_pll_is_enabled(hw) && (!clk->set_pll_mode)) + return 0; + ++ clk->set_pll_mode = false; ++ + ret = zynqmp_pm_clock_enable(clk_id); + if (ret) + pr_warn_once("%s() clock enable failed for %s, ret = %d\n", +-- +2.30.2 + diff --git a/queue-5.10/clocksource-drivers-ingenic_ost-fix-return-value-che.patch b/queue-5.10/clocksource-drivers-ingenic_ost-fix-return-value-che.patch new file mode 100644 index 00000000000..b31e3d77a48 --- /dev/null +++ b/queue-5.10/clocksource-drivers-ingenic_ost-fix-return-value-che.patch @@ -0,0 +1,43 @@ +From 76f01c5d23d7b38f151622c2fa7b3a0ce47d544e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 12:30:31 +0000 +Subject: clocksource/drivers/ingenic_ost: Fix return value check in + ingenic_ost_probe() + +From: Wei Yongjun + +[ Upstream commit 2a65f7e2772613debd03fa2492e76a635aa04545 ] + +In case of error, the function device_node_to_regmap() returns +ERR_PTR() and never returns NULL. The NULL test in the return +value check should be replaced with IS_ERR(). + +Fixes: ca7b72b5a5f2 ("clocksource: Add driver for the Ingenic JZ47xx OST") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210308123031.2285083-1-weiyongjun1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/ingenic-ost.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clocksource/ingenic-ost.c b/drivers/clocksource/ingenic-ost.c +index 029efc2731b4..6af2470136bd 100644 +--- a/drivers/clocksource/ingenic-ost.c ++++ b/drivers/clocksource/ingenic-ost.c +@@ -88,9 +88,9 @@ static int __init ingenic_ost_probe(struct platform_device *pdev) + return PTR_ERR(ost->regs); + + map = device_node_to_regmap(dev->parent->of_node); +- if (!map) { ++ if (IS_ERR(map)) { + dev_err(dev, "regmap not found"); +- return -EINVAL; ++ return PTR_ERR(map); + } + + ost->clk = devm_clk_get(dev, "ost"); +-- +2.30.2 + diff --git a/queue-5.10/clocksource-drivers-timer-ti-dm-add-missing-set_stat.patch b/queue-5.10/clocksource-drivers-timer-ti-dm-add-missing-set_stat.patch new file mode 100644 index 00000000000..5f86db2f893 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-ti-dm-add-missing-set_stat.patch @@ -0,0 +1,44 @@ +From 4ec41b4634bed70bfb338be3c008172e7c5d4440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 09:21:35 +0200 +Subject: clocksource/drivers/timer-ti-dm: Add missing + set_state_oneshot_stopped + +From: Tony Lindgren + +[ Upstream commit ac4daf737674b4d29e19b7c300caff3bcf7160d8 ] + +To avoid spurious timer interrupts when KTIME_MAX is used, we need to +configure set_state_oneshot_stopped(). Although implementing this is +optional, it still affects things like power management for the extra +timer interrupt. + +For more information, please see commit 8fff52fd5093 ("clockevents: +Introduce CLOCK_EVT_STATE_ONESHOT_STOPPED state") and commit cf8c5009ee37 +("clockevents/drivers/arm_arch_timer: Implement +->set_state_oneshot_stopped()"). + +Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support") +Signed-off-by: Tony Lindgren +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210304072135.52712-4-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-ti-dm-systimer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c +index 422376680c8a..3fae9ebb58b8 100644 +--- a/drivers/clocksource/timer-ti-dm-systimer.c ++++ b/drivers/clocksource/timer-ti-dm-systimer.c +@@ -554,6 +554,7 @@ static int __init dmtimer_clockevent_init(struct device_node *np) + dev->set_state_shutdown = dmtimer_clockevent_shutdown; + dev->set_state_periodic = dmtimer_set_periodic; + dev->set_state_oneshot = dmtimer_clockevent_shutdown; ++ dev->set_state_oneshot_stopped = dmtimer_clockevent_shutdown; + dev->tick_resume = dmtimer_clockevent_shutdown; + dev->cpumask = cpu_possible_mask; + +-- +2.30.2 + diff --git a/queue-5.10/clocksource-drivers-timer-ti-dm-fix-posted-mode-stat.patch b/queue-5.10/clocksource-drivers-timer-ti-dm-fix-posted-mode-stat.patch new file mode 100644 index 00000000000..826dcc9cf67 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-ti-dm-fix-posted-mode-stat.patch @@ -0,0 +1,85 @@ +From 8ee44884a42e44d330b94fa23544ef30d6d37266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 09:21:33 +0200 +Subject: clocksource/drivers/timer-ti-dm: Fix posted mode status check order + +From: Tony Lindgren + +[ Upstream commit 212709926c5493a566ca4086ad4f4b0d4e66b553 ] + +When the timer is configured in posted mode, we need to check the write- +posted status register (TWPS) before writing to the register. + +We now check TWPS after the write starting with commit 52762fbd1c47 +("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource +support"). + +For example, in the TRM for am571x the following is documented in chapter +"22.2.4.13.1.1 Write Posting Synchronization Mode": + +"For each register, a status bit is provided in the timer write-posted + status (TWPS) register. In this mode, it is mandatory that software check + this status bit before any write access. If a write is attempted to a + register with a previous access pending, the previous access is discarded + without notice." + +The regression happened when I updated the code to use standard read/write +accessors for the driver instead of using __omap_dm_timer_load_start(). +We have__omap_dm_timer_load_start() check the TWPS status correctly using +__omap_dm_timer_write(). + +Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support") +Signed-off-by: Tony Lindgren +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210304072135.52712-2-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-ti-dm-systimer.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c +index 33b3e8aa2cc5..422376680c8a 100644 +--- a/drivers/clocksource/timer-ti-dm-systimer.c ++++ b/drivers/clocksource/timer-ti-dm-systimer.c +@@ -449,13 +449,13 @@ static int dmtimer_set_next_event(unsigned long cycles, + struct dmtimer_systimer *t = &clkevt->t; + void __iomem *pend = t->base + t->pend; + +- writel_relaxed(0xffffffff - cycles, t->base + t->counter); + while (readl_relaxed(pend) & WP_TCRR) + cpu_relax(); ++ writel_relaxed(0xffffffff - cycles, t->base + t->counter); + +- writel_relaxed(OMAP_TIMER_CTRL_ST, t->base + t->ctrl); + while (readl_relaxed(pend) & WP_TCLR) + cpu_relax(); ++ writel_relaxed(OMAP_TIMER_CTRL_ST, t->base + t->ctrl); + + return 0; + } +@@ -490,18 +490,18 @@ static int dmtimer_set_periodic(struct clock_event_device *evt) + dmtimer_clockevent_shutdown(evt); + + /* Looks like we need to first set the load value separately */ +- writel_relaxed(clkevt->period, t->base + t->load); + while (readl_relaxed(pend) & WP_TLDR) + cpu_relax(); ++ writel_relaxed(clkevt->period, t->base + t->load); + +- writel_relaxed(clkevt->period, t->base + t->counter); + while (readl_relaxed(pend) & WP_TCRR) + cpu_relax(); ++ writel_relaxed(clkevt->period, t->base + t->counter); + +- writel_relaxed(OMAP_TIMER_CTRL_AR | OMAP_TIMER_CTRL_ST, +- t->base + t->ctrl); + while (readl_relaxed(pend) & WP_TCLR) + cpu_relax(); ++ writel_relaxed(OMAP_TIMER_CTRL_AR | OMAP_TIMER_CTRL_ST, ++ t->base + t->ctrl); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.10/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch b/queue-5.10/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch new file mode 100644 index 00000000000..4a05f0a9b7c --- /dev/null +++ b/queue-5.10/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch @@ -0,0 +1,52 @@ +From d34f23b0ed9e073d396ddd662f64285a8a5ae862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:21 +0200 +Subject: cpufreq: armada-37xx: Fix determining base CPU frequency +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 8bad3bf23cbc40abe1d24cec08a114df6facf858 ] + +When current CPU load is not L0 then loading armada-37xx-cpufreq.ko driver +fails with following error: + + # modprobe armada-37xx-cpufreq + [ 502.702097] Unsupported CPU frequency 250 MHz + +This issue was partially fixed by commit 8db82563451f ("cpufreq: +armada-37xx: fix frequency calculation for opp"), but only for calculating +CPU frequency for opp. + +Fix this also for determination of base CPU frequency. + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 1ab2113daef5..e4782f562e7a 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -469,7 +469,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + return -EINVAL; + } + +- dvfs = armada_37xx_cpu_freq_info_get(cur_frequency); ++ dvfs = armada_37xx_cpu_freq_info_get(base_frequency); + if (!dvfs) { + clk_put(clk); + return -EINVAL; +-- +2.30.2 + diff --git a/queue-5.10/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch b/queue-5.10/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch new file mode 100644 index 00000000000..1934378578e --- /dev/null +++ b/queue-5.10/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch @@ -0,0 +1,47 @@ +From 0beaf1acff035fc13f3b48e95599a94398bb3486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:20 +0200 +Subject: cpufreq: armada-37xx: Fix driver cleanup when registration failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 92963903a8e11b9576eb7249f8e81eefa93b6f96 ] + +Commit 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for +opp") changed calculation of frequency passed to the dev_pm_opp_add() +function call. But the code for dev_pm_opp_remove() function call was not +updated, so the driver cleanup phase does not work when registration fails. + +This fixes the issue by using the same frequency in both calls. + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for opp") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index c7683d447b11..1ab2113daef5 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -521,7 +521,7 @@ disable_dvfs: + remove_opp: + /* clean-up the already added opp before leaving */ + while (load_lvl-- > ARMADA_37XX_DVFS_LOAD_0) { +- freq = cur_frequency / dvfs->divider[load_lvl]; ++ freq = base_frequency / dvfs->divider[load_lvl]; + dev_pm_opp_remove(cpu_dev, freq); + } + +-- +2.30.2 + diff --git a/queue-5.10/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch b/queue-5.10/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch new file mode 100644 index 00000000000..ea8345a09f3 --- /dev/null +++ b/queue-5.10/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch @@ -0,0 +1,153 @@ +From 05d9f2a7039dfb8ec8dedf6522cb98b060ffb7d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:15 +0200 +Subject: cpufreq: armada-37xx: Fix setting TBG parent for load levels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 22592df194e31baf371906cc720da38fa0ab68f5 ] + +With CPU frequency determining software [1] we have discovered that +after this driver does one CPU frequency change, the base frequency of +the CPU is set to the frequency of TBG-A-P clock, instead of the TBG +that is parent to the CPU. + +This can be reproduced on EspressoBIN and Turris MOX: + cd /sys/devices/system/cpu/cpufreq/policy0 + echo powersave >scaling_governor + echo performance >scaling_governor + +Running the mhz tool before this driver is loaded reports 1000 MHz, and +after loading the driver and executing commands above the tool reports +800 MHz. + +The change of TBG clock selector is supposed to happen in function +armada37xx_cpufreq_dvfs_setup. Before the function returns, it does +this: + parent = clk_get_parent(clk); + clk_set_parent(clk, parent); + +The armada-37xx-periph clock driver has the .set_parent method +implemented correctly for this, so if the method was actually called, +this would work. But since the introduction of the common clock +framework in commit b2476490ef11 ("clk: introduce the common clock..."), +the clk_set_parent function checks whether the parent is actually +changing, and if the requested new parent is same as the old parent +(which is obviously the case for the code above), the .set_parent method +is not called at all. + +This patch fixes this issue by filling the correct TBG clock selector +directly in the armada37xx_cpufreq_dvfs_setup during the filling of +other registers at the same address. But the determination of CPU TBG +index cannot be done via the common clock framework, therefore we need +to access the North Bridge Peripheral Clock registers directly in this +driver. + +[1] https://github.com/wtarreau/mhz + +Signed-off-by: Marek Behún +Acked-by: Gregory CLEMENT +Tested-by: Pali Rohár +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 35 ++++++++++++++++++--------- + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index b4af4094309b..b8dc6c849579 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -25,6 +25,10 @@ + + #include "cpufreq-dt.h" + ++/* Clk register set */ ++#define ARMADA_37XX_CLK_TBG_SEL 0 ++#define ARMADA_37XX_CLK_TBG_SEL_CPU_OFF 22 ++ + /* Power management in North Bridge register set */ + #define ARMADA_37XX_NB_L0L1 0x18 + #define ARMADA_37XX_NB_L2L3 0x1C +@@ -120,10 +124,15 @@ static struct armada_37xx_dvfs *armada_37xx_cpu_freq_info_get(u32 freq) + * will be configured then the DVFS will be enabled. + */ + static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, +- struct clk *clk, u8 *divider) ++ struct regmap *clk_base, u8 *divider) + { ++ u32 cpu_tbg_sel; + int load_lvl; +- struct clk *parent; ++ ++ /* Determine to which TBG clock is CPU connected */ ++ regmap_read(clk_base, ARMADA_37XX_CLK_TBG_SEL, &cpu_tbg_sel); ++ cpu_tbg_sel >>= ARMADA_37XX_CLK_TBG_SEL_CPU_OFF; ++ cpu_tbg_sel &= ARMADA_37XX_NB_TBG_SEL_MASK; + + for (load_lvl = 0; load_lvl < LOAD_LEVEL_NR; load_lvl++) { + unsigned int reg, mask, val, offset = 0; +@@ -142,6 +151,11 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, + mask = (ARMADA_37XX_NB_CLK_SEL_MASK + << ARMADA_37XX_NB_CLK_SEL_OFF); + ++ /* Set TBG index, for all levels we use the same TBG */ ++ val = cpu_tbg_sel << ARMADA_37XX_NB_TBG_SEL_OFF; ++ mask = (ARMADA_37XX_NB_TBG_SEL_MASK ++ << ARMADA_37XX_NB_TBG_SEL_OFF); ++ + /* + * Set cpu divider based on the pre-computed array in + * order to have balanced step. +@@ -160,14 +174,6 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, + + regmap_update_bits(base, reg, mask, val); + } +- +- /* +- * Set cpu clock source, for all the level we keep the same +- * clock source that the one already configured. For this one +- * we need to use the clock framework +- */ +- parent = clk_get_parent(clk); +- clk_set_parent(clk, parent); + } + + /* +@@ -358,11 +364,16 @@ static int __init armada37xx_cpufreq_driver_init(void) + struct platform_device *pdev; + unsigned long freq; + unsigned int cur_frequency, base_frequency; +- struct regmap *nb_pm_base, *avs_base; ++ struct regmap *nb_clk_base, *nb_pm_base, *avs_base; + struct device *cpu_dev; + int load_lvl, ret; + struct clk *clk, *parent; + ++ nb_clk_base = ++ syscon_regmap_lookup_by_compatible("marvell,armada-3700-periph-clock-nb"); ++ if (IS_ERR(nb_clk_base)) ++ return -ENODEV; ++ + nb_pm_base = + syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm"); + +@@ -439,7 +450,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + armada37xx_cpufreq_avs_configure(avs_base, dvfs); + armada37xx_cpufreq_avs_setup(avs_base, dvfs); + +- armada37xx_cpufreq_dvfs_setup(nb_pm_base, clk, dvfs->divider); ++ armada37xx_cpufreq_dvfs_setup(nb_pm_base, nb_clk_base, dvfs->divider); + clk_put(clk); + + for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR; +-- +2.30.2 + diff --git a/queue-5.10/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch b/queue-5.10/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch new file mode 100644 index 00000000000..6cfc2ffc4f9 --- /dev/null +++ b/queue-5.10/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch @@ -0,0 +1,127 @@ +From 8f3a37302f8a0de75271ca54ab4ce99ba22012a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:17 +0200 +Subject: cpufreq: armada-37xx: Fix the AVS value for load L1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit d118ac2062b5b8331c8768ac81e016617e0996ee ] + +The original CPU voltage value for load L1 is too low for Armada 37xx SoC +when base CPU frequency is 1000 or 1200 MHz. It leads to instabilities +where CPU gets stuck soon after dynamic voltage scaling from load L1 to L0. + +Update the CPU voltage value for load L1 accordingly when base frequency is +1000 or 1200 MHz. The minimal L1 value for base CPU frequency 1000 MHz is +updated from the original 1.05V to 1.108V and for 1200 MHz is updated to +1.155V. This minimal L1 value is used only in the case when it is lower +than value for L0. + +This change fixes CPU instability issues on 1 GHz and 1.2 GHz variants of +Espressobin and 1 GHz Turris Mox. + +Marvell previously for 1 GHz variant of Espressobin provided a patch [1] +suitable only for their Marvell Linux kernel 4.4 fork which workarounded +this issue. Patch forced CPU voltage value to 1.108V in all loads. But +such change does not fix CPU instability issues on 1.2 GHz variants of +Armada 3720 SoC. + +During testing we come to the conclusion that using 1.108V as minimal +value for L1 load makes 1 GHz variants of Espressobin and Turris Mox boards +stable. And similarly 1.155V for 1.2 GHz variant of Espressobin. + +These two values 1.108V and 1.155V are documented in Armada 3700 Hardware +Specifications as typical initial CPU voltage values. + +Discussion about this issue is also at the Armbian forum [2]. + +[1] - https://github.com/MarvellEmbeddedProcessors/linux-marvell/commit/dc33b62c90696afb6adc7dbcc4ebbd48bedec269 +[2] - https://forum.armbian.com/topic/10429-how-to-make-espressobin-v7-stable/ + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 1c3528232f4b ("cpufreq: armada-37xx: Add AVS support") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 37 +++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index b8dc6c849579..c7683d447b11 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -73,6 +73,8 @@ + #define LOAD_LEVEL_NR 4 + + #define MIN_VOLT_MV 1000 ++#define MIN_VOLT_MV_FOR_L1_1000MHZ 1108 ++#define MIN_VOLT_MV_FOR_L1_1200MHZ 1155 + + /* AVS value for the corresponding voltage (in mV) */ + static int avs_map[] = { +@@ -208,6 +210,8 @@ static u32 armada_37xx_avs_val_match(int target_vm) + * - L2 & L3 voltage should be about 150mv smaller than L0 voltage. + * This function calculates L1 & L2 & L3 AVS values dynamically based + * on L0 voltage and fill all AVS values to the AVS value table. ++ * When base CPU frequency is 1000 or 1200 MHz then there is additional ++ * minimal avs value for load L1. + */ + static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + struct armada_37xx_dvfs *dvfs) +@@ -239,6 +243,19 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + for (load_level = 1; load_level < LOAD_LEVEL_NR; load_level++) + dvfs->avs[load_level] = avs_min; + ++ /* ++ * Set the avs values for load L0 and L1 when base CPU frequency ++ * is 1000/1200 MHz to its typical initial values according to ++ * the Armada 3700 Hardware Specifications. ++ */ ++ if (dvfs->cpu_freq_max >= 1000*1000*1000) { ++ if (dvfs->cpu_freq_max >= 1200*1000*1000) ++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ); ++ else ++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ); ++ dvfs->avs[0] = dvfs->avs[1] = avs_min; ++ } ++ + return; + } + +@@ -258,6 +275,26 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + target_vm = avs_map[l0_vdd_min] - 150; + target_vm = target_vm > MIN_VOLT_MV ? target_vm : MIN_VOLT_MV; + dvfs->avs[2] = dvfs->avs[3] = armada_37xx_avs_val_match(target_vm); ++ ++ /* ++ * Fix the avs value for load L1 when base CPU frequency is 1000/1200 MHz, ++ * otherwise the CPU gets stuck when switching from load L1 to load L0. ++ * Also ensure that avs value for load L1 is not higher than for L0. ++ */ ++ if (dvfs->cpu_freq_max >= 1000*1000*1000) { ++ u32 avs_min_l1; ++ ++ if (dvfs->cpu_freq_max >= 1200*1000*1000) ++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ); ++ else ++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ); ++ ++ if (avs_min_l1 > dvfs->avs[0]) ++ avs_min_l1 = dvfs->avs[0]; ++ ++ if (dvfs->avs[1] < avs_min_l1) ++ dvfs->avs[1] = avs_min_l1; ++ } + } + + static void __init armada37xx_cpufreq_avs_setup(struct regmap *base, +-- +2.30.2 + diff --git a/queue-5.10/cpuidle-fix-arm_qcom_spm_cpuidle-configuration.patch b/queue-5.10/cpuidle-fix-arm_qcom_spm_cpuidle-configuration.patch new file mode 100644 index 00000000000..b90eda5042c --- /dev/null +++ b/queue-5.10/cpuidle-fix-arm_qcom_spm_cpuidle-configuration.patch @@ -0,0 +1,45 @@ +From 4a5108b17b287777d0b324a24859ac2c76a7869c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 08:33:28 -0400 +Subject: cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration + +From: He Ying + +[ Upstream commit 498ba2a8a2756694b6f3888857426dbc8a5e6b6c ] + +When CONFIG_ARM_QCOM_SPM_CPUIDLE is y and CONFIG_MMU is not set, +compiling errors are encountered as follows: + +drivers/cpuidle/cpuidle-qcom-spm.o: In function `spm_dev_probe': +cpuidle-qcom-spm.c:(.text+0x140): undefined reference to `cpu_resume_arm' +cpuidle-qcom-spm.c:(.text+0x148): undefined reference to `cpu_resume_arm' + +Note that cpu_resume_arm is defined when MMU is set. So, add dependency +on MMU in ARM_QCOM_SPM_CPUIDLE configuration. + +Fixes: a871be6b8eee ("cpuidle: Convert Qualcomm SPM driver to a generic CPUidle driver") +Reported-by: Hulk Robot +Signed-off-by: He Ying +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210406123328.92904-1-heying24@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/Kconfig.arm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/Kconfig.arm b/drivers/cpuidle/Kconfig.arm +index 0844fadc4be8..334f83e56120 100644 +--- a/drivers/cpuidle/Kconfig.arm ++++ b/drivers/cpuidle/Kconfig.arm +@@ -107,7 +107,7 @@ config ARM_TEGRA_CPUIDLE + + config ARM_QCOM_SPM_CPUIDLE + bool "CPU Idle Driver for Qualcomm Subsystem Power Manager (SPM)" +- depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64 ++ depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64 && MMU + select ARM_CPU_SUSPEND + select CPU_IDLE_MULTIPLE_DRIVERS + select DT_IDLE_STATES +-- +2.30.2 + diff --git a/queue-5.10/crypto-allwinner-add-missing-crypto_-prefix.patch b/queue-5.10/crypto-allwinner-add-missing-crypto_-prefix.patch new file mode 100644 index 00000000000..a8472feb999 --- /dev/null +++ b/queue-5.10/crypto-allwinner-add-missing-crypto_-prefix.patch @@ -0,0 +1,55 @@ +From ead60038f22d5bfe8716458ee7a2b5d027c0630d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 22:12:00 +0200 +Subject: crypto: allwinner - add missing CRYPTO_ prefix + +From: Corentin Labbe + +[ Upstream commit ac1af1a788b2002eb9d6f5ca6054517ad27f1930 ] + +Some CONFIG select miss CRYPTO_. + +Reported-by: Chen-Yu Tsai +Fixes: 56f6d5aee88d1 ("crypto: sun8i-ce - support hash algorithms") +Fixes: d9b45418a9177 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/Kconfig | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/crypto/allwinner/Kconfig b/drivers/crypto/allwinner/Kconfig +index 0cdfe0e8cc66..ce34048d0d68 100644 +--- a/drivers/crypto/allwinner/Kconfig ++++ b/drivers/crypto/allwinner/Kconfig +@@ -62,10 +62,10 @@ config CRYPTO_DEV_SUN8I_CE_DEBUG + config CRYPTO_DEV_SUN8I_CE_HASH + bool "Enable support for hash on sun8i-ce" + depends on CRYPTO_DEV_SUN8I_CE +- select MD5 +- select SHA1 +- select SHA256 +- select SHA512 ++ select CRYPTO_MD5 ++ select CRYPTO_SHA1 ++ select CRYPTO_SHA256 ++ select CRYPTO_SHA512 + help + Say y to enable support for hash algorithms. + +@@ -123,8 +123,8 @@ config CRYPTO_DEV_SUN8I_SS_PRNG + config CRYPTO_DEV_SUN8I_SS_HASH + bool "Enable support for hash on sun8i-ss" + depends on CRYPTO_DEV_SUN8I_SS +- select MD5 +- select SHA1 +- select SHA256 ++ select CRYPTO_MD5 ++ select CRYPTO_SHA1 ++ select CRYPTO_SHA256 + help + Say y to enable support for hash algorithms. +-- +2.30.2 + diff --git a/queue-5.10/crypto-ccp-detect-and-reject-invalid-addresses-desti.patch b/queue-5.10/crypto-ccp-detect-and-reject-invalid-addresses-desti.patch new file mode 100644 index 00000000000..475b182ffc6 --- /dev/null +++ b/queue-5.10/crypto-ccp-detect-and-reject-invalid-addresses-desti.patch @@ -0,0 +1,56 @@ +From afbaa9a17e553951892bbcea25a61f18b86dab8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:49:46 -0700 +Subject: crypto: ccp: Detect and reject "invalid" addresses destined for PSP + +From: Sean Christopherson + +[ Upstream commit 74c1f1366eb7714b8b211554f6c5cee315ff3fbc ] + +Explicitly reject using pointers that are not virt_to_phys() friendly +as the source for SEV commands that are sent to the PSP. The PSP works +with physical addresses, and __pa()/virt_to_phys() will not return the +correct address in these cases, e.g. for a vmalloc'd pointer. At best, +the bogus address will cause the command to fail, and at worst lead to +system instability. + +While it's unlikely that callers will deliberately use a bad pointer for +SEV buffers, a caller can easily use a vmalloc'd pointer unknowingly when +running with CONFIG_VMAP_STACK=y as it's not obvious that putting the +command buffers on the stack would be bad. The command buffers are +relative small and easily fit on the stack, and the APIs to do not +document that the incoming pointer must be a physically contiguous, +__pa() friendly pointer. + +Cc: Brijesh Singh +Cc: Borislav Petkov +Cc: Tom Lendacky +Cc: Christophe Leroy +Fixes: 200664d5237f ("crypto: ccp: Add Secure Encrypted Virtualization (SEV) command support") +Signed-off-by: Sean Christopherson +Message-Id: <20210406224952.4177376-3-seanjc@google.com> +Reviewed-by: Brijesh Singh +Acked-by: Tom Lendacky +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 476113e12489..5b82ba7acc7c 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -149,6 +149,9 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) + + sev = psp->sev_data; + ++ if (data && WARN_ON_ONCE(!virt_addr_valid(data))) ++ return -EINVAL; ++ + /* Get the physical address of the command buffer */ + phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0; + phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0; +-- +2.30.2 + diff --git a/queue-5.10/crypto-ccp-fix-command-queuing-to-tee-ring-buffer.patch b/queue-5.10/crypto-ccp-fix-command-queuing-to-tee-ring-buffer.patch new file mode 100644 index 00000000000..c3009c5e562 --- /dev/null +++ b/queue-5.10/crypto-ccp-fix-command-queuing-to-tee-ring-buffer.patch @@ -0,0 +1,206 @@ +From 8e2278736229c7ff74d4ab6f2ccd6d9c9a78729d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 13:55:29 +0530 +Subject: crypto: ccp - fix command queuing to TEE ring buffer + +From: Rijo Thomas + +[ Upstream commit 00aa6e65aa04e500a11a2c91e92a11c37b9e234d ] + +Multiple threads or clients can submit a command to the TEE ring +buffer. This patch helps to synchronize command submission to the +ring. + +One thread shall write a command to a TEE ring buffer entry only if: + + - Trusted OS has notified that the TEE command for the given entry + has been processed and driver has copied the TEE response into + client buffer. + + - The command entry is empty and can be written into. + +After a command has been written to the TEE ring buffer, the global +wptr (mutex protected) shall be incremented for use by next client. + +If PSP became unresponsive while processing TEE request from a +client, then further command submission to queue will be disabled. + +Fixes: 33960acccfbd (crypto: ccp - add TEE support for Raven Ridge) +Reviewed-by: Devaraj Rangasamy +Signed-off-by: Rijo Thomas +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/tee-dev.c | 49 +++++++++++++++++++++++++----------- + drivers/crypto/ccp/tee-dev.h | 20 +++++++++++++-- + 2 files changed, 53 insertions(+), 16 deletions(-) + +diff --git a/drivers/crypto/ccp/tee-dev.c b/drivers/crypto/ccp/tee-dev.c +index 5e697a90ea7f..bcb81fef4211 100644 +--- a/drivers/crypto/ccp/tee-dev.c ++++ b/drivers/crypto/ccp/tee-dev.c +@@ -36,6 +36,7 @@ static int tee_alloc_ring(struct psp_tee_device *tee, int ring_size) + if (!start_addr) + return -ENOMEM; + ++ memset(start_addr, 0x0, ring_size); + rb_mgr->ring_start = start_addr; + rb_mgr->ring_size = ring_size; + rb_mgr->ring_pa = __psp_pa(start_addr); +@@ -244,41 +245,54 @@ static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id, + void *buf, size_t len, struct tee_ring_cmd **resp) + { + struct tee_ring_cmd *cmd; +- u32 rptr, wptr; + int nloop = 1000, ret = 0; ++ u32 rptr; + + *resp = NULL; + + mutex_lock(&tee->rb_mgr.mutex); + +- wptr = tee->rb_mgr.wptr; +- +- /* Check if ring buffer is full */ ++ /* Loop until empty entry found in ring buffer */ + do { ++ /* Get pointer to ring buffer command entry */ ++ cmd = (struct tee_ring_cmd *) ++ (tee->rb_mgr.ring_start + tee->rb_mgr.wptr); ++ + rptr = ioread32(tee->io_regs + tee->vdata->ring_rptr_reg); + +- if (!(wptr + sizeof(struct tee_ring_cmd) == rptr)) ++ /* Check if ring buffer is full or command entry is waiting ++ * for response from TEE ++ */ ++ if (!(tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr || ++ cmd->flag == CMD_WAITING_FOR_RESPONSE)) + break; + +- dev_info(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n", +- rptr, wptr); ++ dev_dbg(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n", ++ rptr, tee->rb_mgr.wptr); + +- /* Wait if ring buffer is full */ ++ /* Wait if ring buffer is full or TEE is processing data */ + mutex_unlock(&tee->rb_mgr.mutex); + schedule_timeout_interruptible(msecs_to_jiffies(10)); + mutex_lock(&tee->rb_mgr.mutex); + + } while (--nloop); + +- if (!nloop && (wptr + sizeof(struct tee_ring_cmd) == rptr)) { +- dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n", +- rptr, wptr); ++ if (!nloop && ++ (tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr || ++ cmd->flag == CMD_WAITING_FOR_RESPONSE)) { ++ dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u response flag %u\n", ++ rptr, tee->rb_mgr.wptr, cmd->flag); + ret = -EBUSY; + goto unlock; + } + +- /* Pointer to empty data entry in ring buffer */ +- cmd = (struct tee_ring_cmd *)(tee->rb_mgr.ring_start + wptr); ++ /* Do not submit command if PSP got disabled while processing any ++ * command in another thread ++ */ ++ if (psp_dead) { ++ ret = -EBUSY; ++ goto unlock; ++ } + + /* Write command data into ring buffer */ + cmd->cmd_id = cmd_id; +@@ -286,6 +300,9 @@ static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id, + memset(&cmd->buf[0], 0, sizeof(cmd->buf)); + memcpy(&cmd->buf[0], buf, len); + ++ /* Indicate driver is waiting for response */ ++ cmd->flag = CMD_WAITING_FOR_RESPONSE; ++ + /* Update local copy of write pointer */ + tee->rb_mgr.wptr += sizeof(struct tee_ring_cmd); + if (tee->rb_mgr.wptr >= tee->rb_mgr.ring_size) +@@ -353,12 +370,16 @@ int psp_tee_process_cmd(enum tee_cmd_id cmd_id, void *buf, size_t len, + return ret; + + ret = tee_wait_cmd_completion(tee, resp, TEE_DEFAULT_TIMEOUT); +- if (ret) ++ if (ret) { ++ resp->flag = CMD_RESPONSE_TIMEDOUT; + return ret; ++ } + + memcpy(buf, &resp->buf[0], len); + *status = resp->status; + ++ resp->flag = CMD_RESPONSE_COPIED; ++ + return 0; + } + EXPORT_SYMBOL(psp_tee_process_cmd); +diff --git a/drivers/crypto/ccp/tee-dev.h b/drivers/crypto/ccp/tee-dev.h +index f09960112115..49d26158b71e 100644 +--- a/drivers/crypto/ccp/tee-dev.h ++++ b/drivers/crypto/ccp/tee-dev.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: MIT */ + /* +- * Copyright 2019 Advanced Micro Devices, Inc. ++ * Copyright (C) 2019,2021 Advanced Micro Devices, Inc. + * + * Author: Rijo Thomas + * Author: Devaraj Rangasamy +@@ -18,7 +18,7 @@ + #include + + #define TEE_DEFAULT_TIMEOUT 10 +-#define MAX_BUFFER_SIZE 992 ++#define MAX_BUFFER_SIZE 988 + + /** + * enum tee_ring_cmd_id - TEE interface commands for ring buffer configuration +@@ -81,6 +81,20 @@ enum tee_cmd_state { + TEE_CMD_STATE_COMPLETED, + }; + ++/** ++ * enum cmd_resp_state - TEE command's response status maintained by driver ++ * @CMD_RESPONSE_INVALID: initial state when no command is written to ring ++ * @CMD_WAITING_FOR_RESPONSE: driver waiting for response from TEE ++ * @CMD_RESPONSE_TIMEDOUT: failed to get response from TEE ++ * @CMD_RESPONSE_COPIED: driver has copied response from TEE ++ */ ++enum cmd_resp_state { ++ CMD_RESPONSE_INVALID, ++ CMD_WAITING_FOR_RESPONSE, ++ CMD_RESPONSE_TIMEDOUT, ++ CMD_RESPONSE_COPIED, ++}; ++ + /** + * struct tee_ring_cmd - Structure of the command buffer in TEE ring + * @cmd_id: refers to &enum tee_cmd_id. Command id for the ring buffer +@@ -91,6 +105,7 @@ enum tee_cmd_state { + * @pdata: private data (currently unused) + * @res1: reserved region + * @buf: TEE command specific buffer ++ * @flag: refers to &enum cmd_resp_state + */ + struct tee_ring_cmd { + u32 cmd_id; +@@ -100,6 +115,7 @@ struct tee_ring_cmd { + u64 pdata; + u32 res1[2]; + u8 buf[MAX_BUFFER_SIZE]; ++ u32 flag; + + /* Total size: 1024 bytes */ + } __packed; +-- +2.30.2 + diff --git a/queue-5.10/crypto-chelsio-read-rxchannel-id-from-firmware.patch b/queue-5.10/crypto-chelsio-read-rxchannel-id-from-firmware.patch new file mode 100644 index 00000000000..b2f153e0868 --- /dev/null +++ b/queue-5.10/crypto-chelsio-read-rxchannel-id-from-firmware.patch @@ -0,0 +1,143 @@ +From 1bb88ff7d00eb7c4eed0acaec37281758207fa7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Apr 2021 00:55:48 +0530 +Subject: crypto: chelsio - Read rxchannel-id from firmware + +From: Ayush Sawal + +[ Upstream commit 16a9874fe468855e8ddd72883ca903f706d0a9d0 ] + +The rxchannel id is updated by the driver using the +port no value, but this does not ensure that the value +is correct. So now rx channel value is obtained from +etoc channel map value. + +Fixes: 567be3a5d227 ("crypto: chelsio - Use multiple txq/rxq per...") +Signed-off-by: Ayush Sawal +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/chelsio/chcr_algo.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c +index 13b908ea4873..884adeb63ba3 100644 +--- a/drivers/crypto/chelsio/chcr_algo.c ++++ b/drivers/crypto/chelsio/chcr_algo.c +@@ -768,13 +768,14 @@ static inline void create_wreq(struct chcr_context *ctx, + struct uld_ctx *u_ctx = ULD_CTX(ctx); + unsigned int tx_channel_id, rx_channel_id; + unsigned int txqidx = 0, rxqidx = 0; +- unsigned int qid, fid; ++ unsigned int qid, fid, portno; + + get_qidxs(req, &txqidx, &rxqidx); + qid = u_ctx->lldi.rxq_ids[rxqidx]; + fid = u_ctx->lldi.rxq_ids[0]; ++ portno = rxqidx / ctx->rxq_perchan; + tx_channel_id = txqidx / ctx->txq_perchan; +- rx_channel_id = rxqidx / ctx->rxq_perchan; ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[portno]); + + + chcr_req->wreq.op_to_cctx_size = FILL_WR_OP_CCTX_SIZE; +@@ -805,6 +806,7 @@ static struct sk_buff *create_cipher_wr(struct cipher_wr_param *wrparam) + { + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(wrparam->req); + struct chcr_context *ctx = c_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + struct ablk_ctx *ablkctx = ABLK_CTX(ctx); + struct sk_buff *skb = NULL; + struct chcr_wr *chcr_req; +@@ -821,6 +823,7 @@ static struct sk_buff *create_cipher_wr(struct cipher_wr_param *wrparam) + struct adapter *adap = padap(ctx->dev); + unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + nents = sg_nents_xlen(reqctx->dstsg, wrparam->bytes, CHCR_DST_SG_SIZE, + reqctx->dst_ofst); + dst_size = get_space_for_phys_dsgl(nents); +@@ -1579,6 +1582,7 @@ static struct sk_buff *create_hash_wr(struct ahash_request *req, + int error = 0; + unsigned int rx_channel_id = req_ctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + transhdr_len = HASH_TRANSHDR_SIZE(param->kctx_len); + req_ctx->hctx_wr.imm = (transhdr_len + param->bfr_len + + param->sg_len) <= SGE_MAX_WR_LEN; +@@ -2437,6 +2441,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct chcr_context *ctx = a_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx); + struct chcr_authenc_ctx *actx = AUTHENC_CTX(aeadctx); + struct chcr_aead_reqctx *reqctx = aead_request_ctx(req); +@@ -2456,6 +2461,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req, + struct adapter *adap = padap(ctx->dev); + unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + if (req->cryptlen == 0) + return NULL; + +@@ -2709,9 +2715,11 @@ void chcr_add_aead_dst_ent(struct aead_request *req, + struct dsgl_walk dsgl_walk; + unsigned int authsize = crypto_aead_authsize(tfm); + struct chcr_context *ctx = a_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + u32 temp; + unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + dsgl_walk_init(&dsgl_walk, phys_cpl); + dsgl_walk_add_page(&dsgl_walk, IV + reqctx->b0_len, reqctx->iv_dma); + temp = req->assoclen + req->cryptlen + +@@ -2751,9 +2759,11 @@ void chcr_add_cipher_dst_ent(struct skcipher_request *req, + struct chcr_skcipher_req_ctx *reqctx = skcipher_request_ctx(req); + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(wrparam->req); + struct chcr_context *ctx = c_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + struct dsgl_walk dsgl_walk; + unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + dsgl_walk_init(&dsgl_walk, phys_cpl); + dsgl_walk_add_sg(&dsgl_walk, reqctx->dstsg, wrparam->bytes, + reqctx->dst_ofst); +@@ -2957,6 +2967,7 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct chcr_context *ctx = a_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx); + struct chcr_aead_reqctx *reqctx = aead_request_ctx(req); + unsigned int cipher_mode = CHCR_SCMD_CIPHER_MODE_AES_CCM; +@@ -2966,6 +2977,8 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl, + unsigned int tag_offset = 0, auth_offset = 0; + unsigned int assoclen; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); ++ + if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4309) + assoclen = req->assoclen - 8; + else +@@ -3126,6 +3139,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req, + { + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct chcr_context *ctx = a_ctx(tfm); ++ struct uld_ctx *u_ctx = ULD_CTX(ctx); + struct chcr_aead_ctx *aeadctx = AEAD_CTX(ctx); + struct chcr_aead_reqctx *reqctx = aead_request_ctx(req); + struct sk_buff *skb = NULL; +@@ -3142,6 +3156,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req, + struct adapter *adap = padap(ctx->dev); + unsigned int rx_channel_id = reqctx->rxqidx / ctx->rxq_perchan; + ++ rx_channel_id = cxgb4_port_e2cchan(u_ctx->lldi.ports[rx_channel_id]); + if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106) + assoclen = req->assoclen - 8; + +-- +2.30.2 + diff --git a/queue-5.10/crypto-poly1305-fix-poly1305_core_setkey-declaration.patch b/queue-5.10/crypto-poly1305-fix-poly1305_core_setkey-declaration.patch new file mode 100644 index 00000000000..303df58acbb --- /dev/null +++ b/queue-5.10/crypto-poly1305-fix-poly1305_core_setkey-declaration.patch @@ -0,0 +1,195 @@ +From 78d01e7b23f720792a055b3369088fab312b0985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 18:05:15 +0100 +Subject: crypto: poly1305 - fix poly1305_core_setkey() declaration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 8d195e7a8ada68928f2aedb2c18302a4518fe68e ] + +gcc-11 points out a mismatch between the declaration and the definition +of poly1305_core_setkey(): + +lib/crypto/poly1305-donna32.c:13:67: error: argument 2 of type ‘const u8[16]’ {aka ‘const unsigned char[16]’} with mismatched bound [-Werror=array-parameter=] + 13 | void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16]) + | ~~~~~~~~~^~~~~~~~~~~ +In file included from lib/crypto/poly1305-donna32.c:11: +include/crypto/internal/poly1305.h:21:68: note: previously declared as ‘const u8 *’ {aka ‘const unsigned char *’} + 21 | void poly1305_core_setkey(struct poly1305_core_key *key, const u8 *raw_key); + +This is harmless in principle, as the calling conventions are the same, +but the more specific prototype allows better type checking in the +caller. + +Change the declaration to match the actual function definition. +The poly1305_simd_init() is a bit suspicious here, as it previously +had a 32-byte argument type, but looks like it needs to take the +16-byte POLY1305_BLOCK_SIZE array instead. + +Fixes: 1c08a104360f ("crypto: poly1305 - add new 32 and 64-bit generic versions") +Signed-off-by: Arnd Bergmann +Reviewed-by: Ard Biesheuvel +Reviewed-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/arm/crypto/poly1305-glue.c | 2 +- + arch/arm64/crypto/poly1305-glue.c | 2 +- + arch/mips/crypto/poly1305-glue.c | 2 +- + arch/x86/crypto/poly1305_glue.c | 6 +++--- + include/crypto/internal/poly1305.h | 3 ++- + include/crypto/poly1305.h | 6 ++++-- + lib/crypto/poly1305-donna32.c | 3 ++- + lib/crypto/poly1305-donna64.c | 3 ++- + lib/crypto/poly1305.c | 3 ++- + 9 files changed, 18 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/crypto/poly1305-glue.c b/arch/arm/crypto/poly1305-glue.c +index 3023c1acfa19..c31bd8f7c092 100644 +--- a/arch/arm/crypto/poly1305-glue.c ++++ b/arch/arm/crypto/poly1305-glue.c +@@ -29,7 +29,7 @@ void __weak poly1305_blocks_neon(void *state, const u8 *src, u32 len, u32 hibit) + + static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon); + +-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key) ++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE]) + { + poly1305_init_arm(&dctx->h, key); + dctx->s[0] = get_unaligned_le32(key + 16); +diff --git a/arch/arm64/crypto/poly1305-glue.c b/arch/arm64/crypto/poly1305-glue.c +index f33ada70c4ed..01e22fe40823 100644 +--- a/arch/arm64/crypto/poly1305-glue.c ++++ b/arch/arm64/crypto/poly1305-glue.c +@@ -25,7 +25,7 @@ asmlinkage void poly1305_emit(void *state, u8 *digest, const u32 *nonce); + + static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon); + +-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key) ++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE]) + { + poly1305_init_arm64(&dctx->h, key); + dctx->s[0] = get_unaligned_le32(key + 16); +diff --git a/arch/mips/crypto/poly1305-glue.c b/arch/mips/crypto/poly1305-glue.c +index fc881b46d911..bc6110fb98e0 100644 +--- a/arch/mips/crypto/poly1305-glue.c ++++ b/arch/mips/crypto/poly1305-glue.c +@@ -17,7 +17,7 @@ asmlinkage void poly1305_init_mips(void *state, const u8 *key); + asmlinkage void poly1305_blocks_mips(void *state, const u8 *src, u32 len, u32 hibit); + asmlinkage void poly1305_emit_mips(void *state, u8 *digest, const u32 *nonce); + +-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key) ++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE]) + { + poly1305_init_mips(&dctx->h, key); + dctx->s[0] = get_unaligned_le32(key + 16); +diff --git a/arch/x86/crypto/poly1305_glue.c b/arch/x86/crypto/poly1305_glue.c +index c44aba290fbb..2bc312ffee52 100644 +--- a/arch/x86/crypto/poly1305_glue.c ++++ b/arch/x86/crypto/poly1305_glue.c +@@ -16,7 +16,7 @@ + #include + + asmlinkage void poly1305_init_x86_64(void *ctx, +- const u8 key[POLY1305_KEY_SIZE]); ++ const u8 key[POLY1305_BLOCK_SIZE]); + asmlinkage void poly1305_blocks_x86_64(void *ctx, const u8 *inp, + const size_t len, const u32 padbit); + asmlinkage void poly1305_emit_x86_64(void *ctx, u8 mac[POLY1305_DIGEST_SIZE], +@@ -81,7 +81,7 @@ static void convert_to_base2_64(void *ctx) + state->is_base2_26 = 0; + } + +-static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_KEY_SIZE]) ++static void poly1305_simd_init(void *ctx, const u8 key[POLY1305_BLOCK_SIZE]) + { + poly1305_init_x86_64(ctx, key); + } +@@ -129,7 +129,7 @@ static void poly1305_simd_emit(void *ctx, u8 mac[POLY1305_DIGEST_SIZE], + poly1305_emit_avx(ctx, mac, nonce); + } + +-void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 *key) ++void poly1305_init_arch(struct poly1305_desc_ctx *dctx, const u8 key[POLY1305_KEY_SIZE]) + { + poly1305_simd_init(&dctx->h, key); + dctx->s[0] = get_unaligned_le32(&key[16]); +diff --git a/include/crypto/internal/poly1305.h b/include/crypto/internal/poly1305.h +index 064e52ca5248..196aa769f296 100644 +--- a/include/crypto/internal/poly1305.h ++++ b/include/crypto/internal/poly1305.h +@@ -18,7 +18,8 @@ + * only the ε-almost-∆-universal hash function (not the full MAC) is computed. + */ + +-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 *raw_key); ++void poly1305_core_setkey(struct poly1305_core_key *key, ++ const u8 raw_key[POLY1305_BLOCK_SIZE]); + static inline void poly1305_core_init(struct poly1305_state *state) + { + *state = (struct poly1305_state){}; +diff --git a/include/crypto/poly1305.h b/include/crypto/poly1305.h +index f1f67fc749cf..090692ec3bc7 100644 +--- a/include/crypto/poly1305.h ++++ b/include/crypto/poly1305.h +@@ -58,8 +58,10 @@ struct poly1305_desc_ctx { + }; + }; + +-void poly1305_init_arch(struct poly1305_desc_ctx *desc, const u8 *key); +-void poly1305_init_generic(struct poly1305_desc_ctx *desc, const u8 *key); ++void poly1305_init_arch(struct poly1305_desc_ctx *desc, ++ const u8 key[POLY1305_KEY_SIZE]); ++void poly1305_init_generic(struct poly1305_desc_ctx *desc, ++ const u8 key[POLY1305_KEY_SIZE]); + + static inline void poly1305_init(struct poly1305_desc_ctx *desc, const u8 *key) + { +diff --git a/lib/crypto/poly1305-donna32.c b/lib/crypto/poly1305-donna32.c +index 3cc77d94390b..7fb71845cc84 100644 +--- a/lib/crypto/poly1305-donna32.c ++++ b/lib/crypto/poly1305-donna32.c +@@ -10,7 +10,8 @@ + #include + #include + +-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16]) ++void poly1305_core_setkey(struct poly1305_core_key *key, ++ const u8 raw_key[POLY1305_BLOCK_SIZE]) + { + /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */ + key->key.r[0] = (get_unaligned_le32(&raw_key[0])) & 0x3ffffff; +diff --git a/lib/crypto/poly1305-donna64.c b/lib/crypto/poly1305-donna64.c +index 6ae181bb4345..d34cf4053668 100644 +--- a/lib/crypto/poly1305-donna64.c ++++ b/lib/crypto/poly1305-donna64.c +@@ -12,7 +12,8 @@ + + typedef __uint128_t u128; + +-void poly1305_core_setkey(struct poly1305_core_key *key, const u8 raw_key[16]) ++void poly1305_core_setkey(struct poly1305_core_key *key, ++ const u8 raw_key[POLY1305_BLOCK_SIZE]) + { + u64 t0, t1; + +diff --git a/lib/crypto/poly1305.c b/lib/crypto/poly1305.c +index 9d2d14df0fee..26d87fc3823e 100644 +--- a/lib/crypto/poly1305.c ++++ b/lib/crypto/poly1305.c +@@ -12,7 +12,8 @@ + #include + #include + +-void poly1305_init_generic(struct poly1305_desc_ctx *desc, const u8 *key) ++void poly1305_init_generic(struct poly1305_desc_ctx *desc, ++ const u8 key[POLY1305_KEY_SIZE]) + { + poly1305_core_setkey(&desc->core_r, key); + desc->s[0] = get_unaligned_le32(key + 16); +-- +2.30.2 + diff --git a/queue-5.10/crypto-qat-adf_status_pf_running-should-be-set-after.patch b/queue-5.10/crypto-qat-adf_status_pf_running-should-be-set-after.patch new file mode 100644 index 00000000000..8416cec53ba --- /dev/null +++ b/queue-5.10/crypto-qat-adf_status_pf_running-should-be-set-after.patch @@ -0,0 +1,96 @@ +From f09f7e53d929b44af3477e9d99619348b5d9735f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 23:40:00 -0400 +Subject: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init + +From: Tong Zhang + +[ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ] + +ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() +before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the +vf2pf_lock is initialized in adf_dev_init(), which can fail and when it +fail, the vf2pf_lock is either not initialized or destroyed, a subsequent +use of vf2pf_lock will cause issue. +To fix this issue, only set this flag if adf_dev_init() returns 0. + +[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 +[ 7.180345] Call Trace: +[ 7.182576] mutex_lock+0xc9/0xd0 +[ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] +[ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] +[ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] +[ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf] + +Signed-off-by: Tong Zhang +Reviewed-by: Andy Shevchenko +Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running") +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++-- + drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++-- + drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +index 456979b136a2..ea932b6c4534 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +index b9810f79eb84..6200ad448b11 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +index 404cf9df6922..737508ded37b 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +-- +2.30.2 + diff --git a/queue-5.10/crypto-qat-don-t-release-uninitialized-resources.patch b/queue-5.10/crypto-qat-don-t-release-uninitialized-resources.patch new file mode 100644 index 00000000000..66ce6178dd1 --- /dev/null +++ b/queue-5.10/crypto-qat-don-t-release-uninitialized-resources.patch @@ -0,0 +1,68 @@ +From 5cdf795514e7a103ba4fb494799363bdb986a88d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 23:39:59 -0400 +Subject: crypto: qat - don't release uninitialized resources + +From: Tong Zhang + +[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ] + +adf_vf_isr_resource_alloc() is not unwinding correctly when error +happens and it want to release uninitialized resources. +To fix this, only release initialized resources. + +[ 1.792845] Trying to free already-free IRQ 11 +[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380 +[ 1.801340] Call Trace: +[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat] +[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat] +[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat] + +Signed-off-by: Tong Zhang +Reviewed-by: Andy Shevchenko +Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver") +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c +index c4a44dc6af3e..31a36288623a 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c +@@ -260,17 +260,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + goto err_out; + + if (adf_setup_pf2vf_bh(accel_dev)) +- goto err_out; ++ goto err_disable_msi; + + if (adf_setup_bh(accel_dev)) +- goto err_out; ++ goto err_cleanup_pf2vf_bh; + + if (adf_request_msi_irq(accel_dev)) +- goto err_out; ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_cleanup_pf2vf_bh: ++ adf_cleanup_pf2vf_bh(accel_dev); ++ ++err_disable_msi: ++ adf_disable_msi(accel_dev); ++ + err_out: +- adf_vf_isr_resource_free(accel_dev); + return -EFAULT; + } + EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc); +-- +2.30.2 + diff --git a/queue-5.10/crypto-qat-fix-a-double-free-in-adf_create_ring.patch b/queue-5.10/crypto-qat-fix-a-double-free-in-adf_create_ring.patch new file mode 100644 index 00000000000..86c647edfd4 --- /dev/null +++ b/queue-5.10/crypto-qat-fix-a-double-free-in-adf_create_ring.patch @@ -0,0 +1,40 @@ +From db33e549c36502ed04ae4573e94f23f1a3d0094c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 10:13:48 -0700 +Subject: crypto: qat - Fix a double free in adf_create_ring + +From: Lv Yunlong + +[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ] + +In adf_create_ring, if the callee adf_init_ring() failed, the callee will +free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then +adf_create_ring will goto err and the ring->base_addr will be freed again +in adf_cleanup_ring(). + +My patch sets ring->base_addr to NULL after the first freed to avoid the +double free. + +Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code") +Signed-off-by: Lv Yunlong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_transport.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c +index 2ad774017200..cdfd56c9e345 100644 +--- a/drivers/crypto/qat/qat_common/adf_transport.c ++++ b/drivers/crypto/qat/qat_common/adf_transport.c +@@ -153,6 +153,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring) + dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n"); + dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes, + ring->base_addr, ring->dma_addr); ++ ring->base_addr = NULL; + return -EFAULT; + } + +-- +2.30.2 + diff --git a/queue-5.10/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch b/queue-5.10/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch new file mode 100644 index 00000000000..13ed23fc9c4 --- /dev/null +++ b/queue-5.10/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch @@ -0,0 +1,70 @@ +From 227a818efb086b36cf2332d36a879adfd1e99152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:34:18 +0000 +Subject: crypto: qat - fix error path in adf_isr_resource_alloc() + +From: Giovanni Cabiddu + +[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ] + +The function adf_isr_resource_alloc() is not unwinding correctly in case +of error. +This patch fixes the error paths and propagate the errors to the caller. + +Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_isr.c | 29 ++++++++++++++++++------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c +index 36136f7db509..da6ef007a6ae 100644 +--- a/drivers/crypto/qat/qat_common/adf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_isr.c +@@ -286,19 +286,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + + ret = adf_isr_alloc_msix_entry_table(accel_dev); + if (ret) +- return ret; +- if (adf_enable_msix(accel_dev)) + goto err_out; + +- if (adf_setup_bh(accel_dev)) +- goto err_out; ++ ret = adf_enable_msix(accel_dev); ++ if (ret) ++ goto err_free_msix_table; + +- if (adf_request_irqs(accel_dev)) +- goto err_out; ++ ret = adf_setup_bh(accel_dev); ++ if (ret) ++ goto err_disable_msix; ++ ++ ret = adf_request_irqs(accel_dev); ++ if (ret) ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_disable_msix: ++ adf_disable_msix(&accel_dev->accel_pci_dev); ++ ++err_free_msix_table: ++ adf_isr_free_msix_entry_table(accel_dev); ++ + err_out: +- adf_isr_resource_free(accel_dev); +- return -EFAULT; ++ return ret; + } + EXPORT_SYMBOL_GPL(adf_isr_resource_alloc); +-- +2.30.2 + diff --git a/queue-5.10/crypto-sa2ul-fix-memory-leak-of-rxd.patch b/queue-5.10/crypto-sa2ul-fix-memory-leak-of-rxd.patch new file mode 100644 index 00000000000..bb9f5ebec22 --- /dev/null +++ b/queue-5.10/crypto-sa2ul-fix-memory-leak-of-rxd.patch @@ -0,0 +1,52 @@ +From d7bf10e024aeeaddc8526c3f0b224305dec6d8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 16:28:39 +0100 +Subject: crypto: sa2ul - Fix memory leak of rxd + +From: Colin Ian King + +[ Upstream commit 854b7737199848a91f6adfa0a03cf6f0c46c86e8 ] + +There are two error return paths that are not freeing rxd and causing +memory leaks. Fix these. + +Addresses-Coverity: ("Resource leak") +Fixes: 00c9211f60db ("crypto: sa2ul - Fix DMA mapping API usage") +Signed-off-by: Colin Ian King +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sa2ul.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c +index 39d56ab12f27..4640fe0c1f22 100644 +--- a/drivers/crypto/sa2ul.c ++++ b/drivers/crypto/sa2ul.c +@@ -1138,8 +1138,10 @@ static int sa_run(struct sa_req *req) + mapped_sg->sgt.sgl = src; + mapped_sg->sgt.orig_nents = src_nents; + ret = dma_map_sgtable(ddev, &mapped_sg->sgt, dir_src, 0); +- if (ret) ++ if (ret) { ++ kfree(rxd); + return ret; ++ } + + mapped_sg->dir = dir_src; + mapped_sg->mapped = true; +@@ -1147,8 +1149,10 @@ static int sa_run(struct sa_req *req) + mapped_sg->sgt.sgl = req->src; + mapped_sg->sgt.orig_nents = sg_nents; + ret = dma_map_sgtable(ddev, &mapped_sg->sgt, dir_src, 0); +- if (ret) ++ if (ret) { ++ kfree(rxd); + return ret; ++ } + + mapped_sg->dir = dir_src; + mapped_sg->mapped = true; +-- +2.30.2 + diff --git a/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-object-d-when-dma.patch b/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-object-d-when-dma.patch new file mode 100644 index 00000000000..c6a888731b4 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-object-d-when-dma.patch @@ -0,0 +1,51 @@ +From 4eddb7db798c2eec56f373df2cbbc540469f9498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 16:34:46 +0000 +Subject: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to + map + +From: Colin Ian King + +[ Upstream commit 98b5ef3e97b16eaeeedb936f8bda3594ff84a70e ] + +In the case where the dma_iv mapping fails, the return error path leaks +the memory allocated to object d. Fix this by adding a new error return +label and jumping to this to ensure d is free'd before the return. + +Addresses-Coverity: ("Resource leak") +Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG") +Signed-off-by: Colin Ian King +Acked-by: Corentin Labbe +Tested-by: Corentin Labbe +Acked-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c +index 08a1473b2145..3191527928e4 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c +@@ -103,7 +103,8 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, + dma_iv = dma_map_single(ss->dev, ctx->seed, ctx->slen, DMA_TO_DEVICE); + if (dma_mapping_error(ss->dev, dma_iv)) { + dev_err(ss->dev, "Cannot DMA MAP IV\n"); +- return -EFAULT; ++ err = -EFAULT; ++ goto err_free; + } + + dma_dst = dma_map_single(ss->dev, d, todo, DMA_FROM_DEVICE); +@@ -167,6 +168,7 @@ err_iv: + memcpy(ctx->seed, d + dlen, ctx->slen); + } + memzero_explicit(d, todo); ++err_free: + kfree(d); + + return err; +-- +2.30.2 + diff --git a/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-pad.patch b/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-pad.patch new file mode 100644 index 00000000000..7f73c723402 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-fix-memory-leak-of-pad.patch @@ -0,0 +1,54 @@ +From b4c3b951eaa8ef514f12de4be6418f65a7f9d190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 16:18:27 +0100 +Subject: crypto: sun8i-ss - Fix memory leak of pad + +From: Colin Ian King + +[ Upstream commit 50274b01ac1689b1a3f6bc4b5b3dbf361a55dd3a ] + +It appears there are several failure return paths that don't seem +to be free'ing pad. Fix these. + +Addresses-Coverity: ("Resource leak") +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Colin Ian King +Acked-by: Corentin Labbe +Tested-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index 541bcd814384..756d5a783548 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -347,8 +347,10 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + bf = (__le32 *)pad; + + result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA); +- if (!result) ++ if (!result) { ++ kfree(pad); + return -ENOMEM; ++ } + + for (i = 0; i < MAX_SG; i++) { + rctx->t_dst[i].addr = 0; +@@ -434,10 +436,9 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + dma_unmap_sg(ss->dev, areq->src, nr_sgs, DMA_TO_DEVICE); + dma_unmap_single(ss->dev, addr_res, digestsize, DMA_FROM_DEVICE); + +- kfree(pad); +- + memcpy(areq->result, result, algt->alg.hash.halg.digestsize); + theend: ++ kfree(pad); + kfree(result); + crypto_finalize_hash_request(engine, breq, err); + return 0; +-- +2.30.2 + diff --git a/queue-5.10/crypto-sun8i-ss-fix-result-memory-leak-on-error-path.patch b/queue-5.10/crypto-sun8i-ss-fix-result-memory-leak-on-error-path.patch new file mode 100644 index 00000000000..1d44d8dbdfc --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-fix-result-memory-leak-on-error-path.patch @@ -0,0 +1,38 @@ +From 7f9ebea6565d2c4810681c901ce33bc1e3cbfcc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 09:46:10 +0100 +Subject: crypto: sun8i-ss - fix result memory leak on error path + +From: Corentin Labbe + +[ Upstream commit 1dbc6a1e25be8575d6c4114d1d2b841a796507f7 ] + +This patch fixes a memory leak on an error path. + +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index b6ab2054f217..541bcd814384 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -437,8 +437,8 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + kfree(pad); + + memcpy(areq->result, result, algt->alg.hash.halg.digestsize); +- kfree(result); + theend: ++ kfree(result); + crypto_finalize_hash_request(engine, breq, err); + return 0; + } +-- +2.30.2 + diff --git a/queue-5.10/cxgb4-fix-unintentional-sign-extension-issues.patch b/queue-5.10/cxgb4-fix-unintentional-sign-extension-issues.patch new file mode 100644 index 00000000000..44d580c79ea --- /dev/null +++ b/queue-5.10/cxgb4-fix-unintentional-sign-extension-issues.patch @@ -0,0 +1,115 @@ +From d1ddf8d85801b93cb8f04a6c94231a2d58f357cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 12:08:57 +0100 +Subject: cxgb4: Fix unintentional sign extension issues + +From: Colin Ian King + +[ Upstream commit dd2c79677375c37f8f9f8d663eb4708495d595ef ] + +The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that the top bit of the u8 +is set then all then all the upper 32 bits of the u64 end up as +also being set because of the sign-extension. Fix this by +casting the u8 values to a u64 before the 24 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++---------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +index 83b46440408b..bde8494215c4 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f, + WORD_MASK, f->fs.nat_lip[15] | + f->fs.nat_lip[14] << 8 | + f->fs.nat_lip[13] << 16 | +- f->fs.nat_lip[12] << 24, 1); ++ (u64)f->fs.nat_lip[12] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 1, + WORD_MASK, f->fs.nat_lip[11] | + f->fs.nat_lip[10] << 8 | + f->fs.nat_lip[9] << 16 | +- f->fs.nat_lip[8] << 24, 1); ++ (u64)f->fs.nat_lip[8] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 2, + WORD_MASK, f->fs.nat_lip[7] | + f->fs.nat_lip[6] << 8 | + f->fs.nat_lip[5] << 16 | +- f->fs.nat_lip[4] << 24, 1); ++ (u64)f->fs.nat_lip[4] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W + 3, + WORD_MASK, f->fs.nat_lip[3] | + f->fs.nat_lip[2] << 8 | + f->fs.nat_lip[1] << 16 | +- f->fs.nat_lip[0] << 24, 1); ++ (u64)f->fs.nat_lip[0] << 24, 1); + } else { + set_tcb_field(adap, f, tid, TCB_RX_FRAG3_LEN_RAW_W, + WORD_MASK, f->fs.nat_lip[3] | + f->fs.nat_lip[2] << 8 | + f->fs.nat_lip[1] << 16 | +- f->fs.nat_lip[0] << 24, 1); ++ (u64)f->fs.nat_lip[0] << 25, 1); + } + } + +@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f, + WORD_MASK, f->fs.nat_fip[15] | + f->fs.nat_fip[14] << 8 | + f->fs.nat_fip[13] << 16 | +- f->fs.nat_fip[12] << 24, 1); ++ (u64)f->fs.nat_fip[12] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 1, + WORD_MASK, f->fs.nat_fip[11] | + f->fs.nat_fip[10] << 8 | + f->fs.nat_fip[9] << 16 | +- f->fs.nat_fip[8] << 24, 1); ++ (u64)f->fs.nat_fip[8] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 2, + WORD_MASK, f->fs.nat_fip[7] | + f->fs.nat_fip[6] << 8 | + f->fs.nat_fip[5] << 16 | +- f->fs.nat_fip[4] << 24, 1); ++ (u64)f->fs.nat_fip[4] << 24, 1); + + set_tcb_field(adap, f, tid, TCB_RX_FRAG2_PTR_RAW_W + 3, + WORD_MASK, f->fs.nat_fip[3] | + f->fs.nat_fip[2] << 8 | + f->fs.nat_fip[1] << 16 | +- f->fs.nat_fip[0] << 24, 1); ++ (u64)f->fs.nat_fip[0] << 24, 1); + + } else { + set_tcb_field(adap, f, tid, +@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f, + WORD_MASK, f->fs.nat_fip[3] | + f->fs.nat_fip[2] << 8 | + f->fs.nat_fip[1] << 16 | +- f->fs.nat_fip[0] << 24, 1); ++ (u64)f->fs.nat_fip[0] << 24, 1); + } + } + + set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK, + (dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) | +- (sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0), ++ (sp ? (nat_fp[1] << 16 | (u64)nat_fp[0] << 24) : 0), + 1); + } + +-- +2.30.2 + diff --git a/queue-5.10/devtmpfs-fix-placement-of-complete-call.patch b/queue-5.10/devtmpfs-fix-placement-of-complete-call.patch new file mode 100644 index 00000000000..6683b623f98 --- /dev/null +++ b/queue-5.10/devtmpfs-fix-placement-of-complete-call.patch @@ -0,0 +1,54 @@ +From 90a12b19a6d910bcb6aaa5b625d5908d4e700bc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:30:26 +0100 +Subject: devtmpfs: fix placement of complete() call + +From: Rasmus Villemoes + +[ Upstream commit 38f087de8947700d3b06d3d1594490e0f611c5d1 ] + +Calling complete() from within the __init function is wrong - +theoretically, the init process could proceed all the way to freeing +the init mem before the devtmpfsd thread gets to execute the return +instruction in devtmpfs_setup(). + +In practice, it seems to be harmless as gcc inlines devtmpfs_setup() +into devtmpfsd(). So the calls of the __init functions init_chdir() +etc. actually happen from devtmpfs_setup(), but the __ref on that one +silences modpost (it's all right, because those calls happen before +the complete()). But it does make the __init annotation of the setup +function moot, which we'll fix in a subsequent patch. + +Fixes: bcbacc4909f1 ("devtmpfs: refactor devtmpfsd()") +Reviewed-by: Christoph Hellwig +Signed-off-by: Rasmus Villemoes +Link: https://lore.kernel.org/r/20210312103027.2701413-1-linux@rasmusvillemoes.dk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/devtmpfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c +index eac184e6d657..a71d14117943 100644 +--- a/drivers/base/devtmpfs.c ++++ b/drivers/base/devtmpfs.c +@@ -416,7 +416,6 @@ static int __init devtmpfs_setup(void *p) + init_chroot("."); + out: + *(int *)p = err; +- complete(&setup_done); + return err; + } + +@@ -429,6 +428,7 @@ static int __ref devtmpfsd(void *p) + { + int err = devtmpfs_setup(p); + ++ complete(&setup_done); + if (err) + return err; + devtmpfs_work_loop(); +-- +2.30.2 + diff --git a/queue-5.10/driver-core-platform-declare-early_platform_cleanup-.patch b/queue-5.10/driver-core-platform-declare-early_platform_cleanup-.patch new file mode 100644 index 00000000000..6bca9a8db91 --- /dev/null +++ b/queue-5.10/driver-core-platform-declare-early_platform_cleanup-.patch @@ -0,0 +1,47 @@ +From 8b83c91ebfc3fbfb9ec3fb8850f829341803bc10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 18:05:25 +0300 +Subject: driver core: platform: Declare early_platform_cleanup() prototype +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 1768289b44bae847612751d418fc5c5e680b5e5c ] + +Compiler is not happy: + + CC drivers/base/platform.o +drivers/base/platform.c:1557:20: warning: no previous prototype for ‘early_platform_cleanup’ [-Wmissing-prototypes] + 1557 | void __weak __init early_platform_cleanup(void) { } + | ^~~~~~~~~~~~~~~~~~~~~~ + +Declare early_platform_cleanup() prototype in the header to make everyone happy. + +Fixes: eecd37e105f0 ("drivers: Fix boot problem on SuperH") +Cc: Guenter Roeck +Reviewed-by: Guenter Roeck +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210331150525.59223-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/platform_device.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h +index 77a2aada106d..17f9cd5626c8 100644 +--- a/include/linux/platform_device.h ++++ b/include/linux/platform_device.h +@@ -350,4 +350,7 @@ static inline int is_sh_early_platform_device(struct platform_device *pdev) + } + #endif /* CONFIG_SUPERH */ + ++/* For now only SuperH uses it */ ++void early_platform_cleanup(void); ++ + #endif /* _PLATFORM_DEVICE_H_ */ +-- +2.30.2 + diff --git a/queue-5.10/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch b/queue-5.10/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch new file mode 100644 index 00000000000..6016db8dddc --- /dev/null +++ b/queue-5.10/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch @@ -0,0 +1,44 @@ +From 749ce6bf5999221983f06ff7a6024617bf007f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 07:32:29 -0700 +Subject: drivers/block/null_blk/main: Fix a double free in null_init. + +From: Lv Yunlong + +[ Upstream commit 72ce11ddfa4e9e1879103581a60b7e34547eaa0a ] + +In null_init, null_add_dev(dev) is called. +In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones +via kvfree(dev->zones) in out_cleanup_zone branch and returns err. +Then null_init accept the err code and then calls null_free_dev(dev). + +But in null_free_dev(dev), dev->zones is freed again by +null_free_zoned_dev(). + +My patch set dev->zones to NULL in null_free_zoned_dev() after +kvfree(dev->zones) is called, to avoid the double free. + +Fixes: 2984c8684f962 ("nullb: factor disk parameters") +Signed-off-by: Lv Yunlong +Link: https://lore.kernel.org/r/20210426143229.7374-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk_zoned.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c +index 172f720b8d63..f5df82c26c16 100644 +--- a/drivers/block/null_blk_zoned.c ++++ b/drivers/block/null_blk_zoned.c +@@ -149,6 +149,7 @@ void null_free_zoned_dev(struct nullb_device *dev) + { + bitmap_free(dev->zone_locks); + kvfree(dev->zones); ++ dev->zones = NULL; + } + + static inline void null_lock_zone(struct nullb_device *dev, unsigned int zno) +-- +2.30.2 + diff --git a/queue-5.10/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch b/queue-5.10/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch new file mode 100644 index 00000000000..f32455d438c --- /dev/null +++ b/queue-5.10/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch @@ -0,0 +1,98 @@ +From 8531b985011d70bdf7ed33d20939481db26a6dcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 21:48:09 -0700 +Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload + +From: Michael Kelley + +[ Upstream commit 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 ] + +When running in Azure, disks may be connected to a Linux VM with +read/write caching enabled. If a VM panics and issues a VMbus +UNLOAD request to Hyper-V, the response is delayed until all dirty +data in the disk cache is flushed. In extreme cases, this flushing +can take 10's of seconds, depending on the disk speed and the amount +of dirty data. If kdump is configured for the VM, the current 10 second +timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD +complete message may arrive well after the kdump kernel is already +running, causing problems. Note that no problem occurs if kdump is +not enabled because Hyper-V waits for the cache flush before doing +a reboot through the BIOS/UEFI code. + +Fix this problem by increasing the timeout in vmbus_wait_for_unload() +to 100 seconds. Also output periodic messages so that if anyone is +watching the serial console, they won't think the VM is completely +hung. + +Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload") +Signed-off-by: Michael Kelley +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 6be9f56cb627..6476bfe193af 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -725,6 +725,12 @@ static void init_vp_index(struct vmbus_channel *channel) + free_cpumask_var(available_mask); + } + ++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */ ++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */ ++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) ++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */ ++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) ++ + static void vmbus_wait_for_unload(void) + { + int cpu; +@@ -742,12 +748,17 @@ static void vmbus_wait_for_unload(void) + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. + * +- * Wait no more than 10 seconds so that the panic path can't get +- * hung forever in case the response message isn't seen. ++ * Wait up to 100 seconds since an Azure host must writeback any dirty ++ * data in its disk cache before the VMbus UNLOAD request will ++ * complete. This flushing has been empirically observed to take up ++ * to 50 seconds in cases with a lot of dirty data, so allow additional ++ * leeway and for inaccuracies in mdelay(). But eventually time out so ++ * that the panic path can't get hung forever in case the response ++ * message isn't seen. + */ +- for (i = 0; i < 1000; i++) { ++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) { + if (completion_done(&vmbus_connection.unload_event)) +- break; ++ goto completed; + + for_each_online_cpu(cpu) { + struct hv_per_cpu_context *hv_cpu +@@ -770,9 +781,18 @@ static void vmbus_wait_for_unload(void) + vmbus_signal_eom(msg, message_type); + } + +- mdelay(10); ++ /* ++ * Give a notice periodically so someone watching the ++ * serial output won't think it is completely hung. ++ */ ++ if (!(i % UNLOAD_MSG_LOOPS)) ++ pr_notice("Waiting for VMBus UNLOAD to complete\n"); ++ ++ mdelay(UNLOAD_DELAY_UNIT_MS); + } ++ pr_err("Continuing even though VMBus UNLOAD did not complete\n"); + ++completed: + /* + * We're crashing and already got the UNLOAD_RESPONSE, cleanup all + * maybe-pending messages on all CPUs to be able to receive new +-- +2.30.2 + diff --git a/queue-5.10/drivers-hv-vmbus-use-after-free-in-__vmbus_open.patch b/queue-5.10/drivers-hv-vmbus-use-after-free-in-__vmbus_open.patch new file mode 100644 index 00000000000..b2ecf1e2a11 --- /dev/null +++ b/queue-5.10/drivers-hv-vmbus-use-after-free-in-__vmbus_open.patch @@ -0,0 +1,40 @@ +From 064fc733a260fb89198e5a6804f3cecb95be67bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 13:50:04 +0300 +Subject: Drivers: hv: vmbus: Use after free in __vmbus_open() + +From: Dan Carpenter + +[ Upstream commit 3e9bf43f7f7a46f21ec071cb47be92d0874c48da ] + +The "open_info" variable is added to the &vmbus_connection.chn_msg_list, +but the error handling frees "open_info" without removing it from the +list. This will result in a use after free. First remove it from the +list, and then free it. + +Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrea Parri +Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index fbdda9938039..f064fa6ef181 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -583,7 +583,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel, + + if (newchannel->rescind) { + err = -ENODEV; +- goto error_free_info; ++ goto error_clean_msglist; + } + + err = vmbus_post_msg(open_msg, +-- +2.30.2 + diff --git a/queue-5.10/drivers-nvmem-fix-voltage-settings-for-qti-qfprom-ef.patch b/queue-5.10/drivers-nvmem-fix-voltage-settings-for-qti-qfprom-ef.patch new file mode 100644 index 00000000000..4f153312bd4 --- /dev/null +++ b/queue-5.10/drivers-nvmem-fix-voltage-settings-for-qti-qfprom-ef.patch @@ -0,0 +1,72 @@ +From c0508a52ab9b28346809a47ce057187411a41993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 12:12:34 +0100 +Subject: drivers: nvmem: Fix voltage settings for QTI qfprom-efuse + +From: Ravi Kumar Bokka + +[ Upstream commit 9ec4f4b0e9fd3ad4b9a38bddb75b516ea09f4628 ] + +QFPROM controller hardware requires 1.8V min for fuse blowing. +So, this change sets the voltage to 1.8V, required to blow the fuse +for qfprom-efuse controller. + +To disable fuse blowing, we set the voltage to 0V since this may +be a shared rail and may be able to run at a lower rate when we're +not blowing fuses. + +Fixes: 93b4e49f8c86 ("nvmem: qfprom: Add fuse blowing support") +Reported-by: Douglas Anderson +Suggested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Signed-off-by: Ravi Kumar Bokka +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20210330111241.19401-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/qfprom.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c +index 5e9e60e2e591..955b8b8c8238 100644 +--- a/drivers/nvmem/qfprom.c ++++ b/drivers/nvmem/qfprom.c +@@ -104,6 +104,16 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv, + { + int ret; + ++ /* ++ * This may be a shared rail and may be able to run at a lower rate ++ * when we're not blowing fuses. At the moment, the regulator framework ++ * applies voltage constraints even on disabled rails, so remove our ++ * constraints and allow the rail to be adjusted by other users. ++ */ ++ ret = regulator_set_voltage(priv->vcc, 0, INT_MAX); ++ if (ret) ++ dev_warn(priv->dev, "Failed to set 0 voltage (ignoring)\n"); ++ + ret = regulator_disable(priv->vcc); + if (ret) + dev_warn(priv->dev, "Failed to disable regulator (ignoring)\n"); +@@ -149,6 +159,17 @@ static int qfprom_enable_fuse_blowing(const struct qfprom_priv *priv, + goto err_clk_prepared; + } + ++ /* ++ * Hardware requires 1.8V min for fuse blowing; this may be ++ * a rail shared do don't specify a max--regulator constraints ++ * will handle. ++ */ ++ ret = regulator_set_voltage(priv->vcc, 1800000, INT_MAX); ++ if (ret) { ++ dev_err(priv->dev, "Failed to set 1.8 voltage\n"); ++ goto err_clk_rate_set; ++ } ++ + ret = regulator_enable(priv->vcc); + if (ret) { + dev_err(priv->dev, "Failed to enable regulator\n"); +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-off-by-one-in-hdmi_14_process_tr.patch b/queue-5.10/drm-amd-display-fix-off-by-one-in-hdmi_14_process_tr.patch new file mode 100644 index 00000000000..d85496f38a2 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-off-by-one-in-hdmi_14_process_tr.patch @@ -0,0 +1,71 @@ +From ffcaf0a102a3445f6ff9e46e84b838a0b209299a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 14:15:48 +0300 +Subject: drm/amd/display: Fix off by one in hdmi_14_process_transaction() + +From: Dan Carpenter + +[ Upstream commit 8e6fafd5a22e7a2eb216f5510db7aab54cc545c1 ] + +The hdcp_i2c_offsets[] array did not have an entry for +HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one +read overflow. I added an entry and copied the 0x0 value for the offset +from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c. + +I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX +entries. This doesn't change the code, but it's just a belt and +suspenders approach to try future proof the code. + +Fixes: 4c283fdac08a ("drm/amd/display: Add HDCP module") +Reviewed-by: Bhawanpreet Lakha +Signed-off-by: Dan Carpenter +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +index 5e384a8a83dc..51855a2624cf 100644 +--- a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c ++++ b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +@@ -39,7 +39,7 @@ + #define HDCP14_KSV_SIZE 5 + #define HDCP14_MAX_KSV_FIFO_SIZE 127*HDCP14_KSV_SIZE + +-static const bool hdcp_cmd_is_read[] = { ++static const bool hdcp_cmd_is_read[HDCP_MESSAGE_ID_MAX] = { + [HDCP_MESSAGE_ID_READ_BKSV] = true, + [HDCP_MESSAGE_ID_READ_RI_R0] = true, + [HDCP_MESSAGE_ID_READ_PJ] = true, +@@ -75,7 +75,7 @@ static const bool hdcp_cmd_is_read[] = { + [HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE] = false + }; + +-static const uint8_t hdcp_i2c_offsets[] = { ++static const uint8_t hdcp_i2c_offsets[HDCP_MESSAGE_ID_MAX] = { + [HDCP_MESSAGE_ID_READ_BKSV] = 0x0, + [HDCP_MESSAGE_ID_READ_RI_R0] = 0x8, + [HDCP_MESSAGE_ID_READ_PJ] = 0xA, +@@ -106,7 +106,8 @@ static const uint8_t hdcp_i2c_offsets[] = { + [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_SEND_ACK] = 0x60, + [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_STREAM_MANAGE] = 0x60, + [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_STREAM_READY] = 0x80, +- [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70 ++ [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70, ++ [HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE] = 0x0, + }; + + struct protection_properties { +@@ -184,7 +185,7 @@ static const struct protection_properties hdmi_14_protection = { + .process_transaction = hdmi_14_process_transaction + }; + +-static const uint32_t hdcp_dpcd_addrs[] = { ++static const uint32_t hdcp_dpcd_addrs[HDCP_MESSAGE_ID_MAX] = { + [HDCP_MESSAGE_ID_READ_BKSV] = 0x68000, + [HDCP_MESSAGE_ID_READ_RI_R0] = 0x68005, + [HDCP_MESSAGE_ID_READ_PJ] = 0xFFFFFFFF, +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-use-gfp_atomic-in-dcn20_resource_con.patch b/queue-5.10/drm-amd-display-use-gfp_atomic-in-dcn20_resource_con.patch new file mode 100644 index 00000000000..0b72cdec04e --- /dev/null +++ b/queue-5.10/drm-amd-display-use-gfp_atomic-in-dcn20_resource_con.patch @@ -0,0 +1,208 @@ +From 743bdb4a75787c5d29e4d09d7d52fdd1a08abe1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 11:38:11 +0100 +Subject: drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct + +From: Nirmoy Das + +[ Upstream commit 3bb1105071fb974e3e3ca2f92ddfd69c81285ab6 ] + +Replace GFP_KERNEL with GFP_ATOMIC as dcn20_resource_construct() +can't sleep. + +Partially fixes: https://bugzilla.kernel.org/show_bug.cgi?id=212311 +as dcn20_resource_construct() also calls into SMU functions which does +mutex_lock(). + +Reviewed-by: Harry Wentland +Signed-off-by: Nirmoy Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 2 +- + drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c | 6 ++--- + .../gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c | 2 +- + .../drm/amd/display/dc/dcn20/dcn20_resource.c | 26 +++++++++---------- + 4 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +index 4e87e70237e3..874b132fe1d7 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +@@ -283,7 +283,7 @@ struct abm *dce_abm_create( + const struct dce_abm_shift *abm_shift, + const struct dce_abm_mask *abm_mask) + { +- struct dce_abm *abm_dce = kzalloc(sizeof(*abm_dce), GFP_KERNEL); ++ struct dce_abm *abm_dce = kzalloc(sizeof(*abm_dce), GFP_ATOMIC); + + if (abm_dce == NULL) { + BREAK_TO_DEBUGGER(); +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c +index f0cebe721bcc..4216419503af 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_dmcu.c +@@ -925,7 +925,7 @@ struct dmcu *dcn10_dmcu_create( + const struct dce_dmcu_shift *dmcu_shift, + const struct dce_dmcu_mask *dmcu_mask) + { +- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL); ++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC); + + if (dmcu_dce == NULL) { + BREAK_TO_DEBUGGER(); +@@ -946,7 +946,7 @@ struct dmcu *dcn20_dmcu_create( + const struct dce_dmcu_shift *dmcu_shift, + const struct dce_dmcu_mask *dmcu_mask) + { +- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL); ++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC); + + if (dmcu_dce == NULL) { + BREAK_TO_DEBUGGER(); +@@ -967,7 +967,7 @@ struct dmcu *dcn21_dmcu_create( + const struct dce_dmcu_shift *dmcu_shift, + const struct dce_dmcu_mask *dmcu_mask) + { +- struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_KERNEL); ++ struct dce_dmcu *dmcu_dce = kzalloc(sizeof(*dmcu_dce), GFP_ATOMIC); + + if (dmcu_dce == NULL) { + BREAK_TO_DEBUGGER(); +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c +index 62cc2651e00c..8774406120fc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dccg.c +@@ -112,7 +112,7 @@ struct dccg *dccg2_create( + const struct dccg_shift *dccg_shift, + const struct dccg_mask *dccg_mask) + { +- struct dcn_dccg *dccg_dcn = kzalloc(sizeof(*dccg_dcn), GFP_KERNEL); ++ struct dcn_dccg *dccg_dcn = kzalloc(sizeof(*dccg_dcn), GFP_ATOMIC); + struct dccg *base; + + if (dccg_dcn == NULL) { +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 4ea53c543e08..33488b3c5c3c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -1104,7 +1104,7 @@ struct dpp *dcn20_dpp_create( + uint32_t inst) + { + struct dcn20_dpp *dpp = +- kzalloc(sizeof(struct dcn20_dpp), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn20_dpp), GFP_ATOMIC); + + if (!dpp) + return NULL; +@@ -1122,7 +1122,7 @@ struct input_pixel_processor *dcn20_ipp_create( + struct dc_context *ctx, uint32_t inst) + { + struct dcn10_ipp *ipp = +- kzalloc(sizeof(struct dcn10_ipp), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn10_ipp), GFP_ATOMIC); + + if (!ipp) { + BREAK_TO_DEBUGGER(); +@@ -1139,7 +1139,7 @@ struct output_pixel_processor *dcn20_opp_create( + struct dc_context *ctx, uint32_t inst) + { + struct dcn20_opp *opp = +- kzalloc(sizeof(struct dcn20_opp), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn20_opp), GFP_ATOMIC); + + if (!opp) { + BREAK_TO_DEBUGGER(); +@@ -1156,7 +1156,7 @@ struct dce_aux *dcn20_aux_engine_create( + uint32_t inst) + { + struct aux_engine_dce110 *aux_engine = +- kzalloc(sizeof(struct aux_engine_dce110), GFP_KERNEL); ++ kzalloc(sizeof(struct aux_engine_dce110), GFP_ATOMIC); + + if (!aux_engine) + return NULL; +@@ -1194,7 +1194,7 @@ struct dce_i2c_hw *dcn20_i2c_hw_create( + uint32_t inst) + { + struct dce_i2c_hw *dce_i2c_hw = +- kzalloc(sizeof(struct dce_i2c_hw), GFP_KERNEL); ++ kzalloc(sizeof(struct dce_i2c_hw), GFP_ATOMIC); + + if (!dce_i2c_hw) + return NULL; +@@ -1207,7 +1207,7 @@ struct dce_i2c_hw *dcn20_i2c_hw_create( + struct mpc *dcn20_mpc_create(struct dc_context *ctx) + { + struct dcn20_mpc *mpc20 = kzalloc(sizeof(struct dcn20_mpc), +- GFP_KERNEL); ++ GFP_ATOMIC); + + if (!mpc20) + return NULL; +@@ -1225,7 +1225,7 @@ struct hubbub *dcn20_hubbub_create(struct dc_context *ctx) + { + int i; + struct dcn20_hubbub *hubbub = kzalloc(sizeof(struct dcn20_hubbub), +- GFP_KERNEL); ++ GFP_ATOMIC); + + if (!hubbub) + return NULL; +@@ -1253,7 +1253,7 @@ struct timing_generator *dcn20_timing_generator_create( + uint32_t instance) + { + struct optc *tgn10 = +- kzalloc(sizeof(struct optc), GFP_KERNEL); ++ kzalloc(sizeof(struct optc), GFP_ATOMIC); + + if (!tgn10) + return NULL; +@@ -1332,7 +1332,7 @@ static struct clock_source *dcn20_clock_source_create( + bool dp_clk_src) + { + struct dce110_clk_src *clk_src = +- kzalloc(sizeof(struct dce110_clk_src), GFP_KERNEL); ++ kzalloc(sizeof(struct dce110_clk_src), GFP_ATOMIC); + + if (!clk_src) + return NULL; +@@ -1438,7 +1438,7 @@ struct display_stream_compressor *dcn20_dsc_create( + struct dc_context *ctx, uint32_t inst) + { + struct dcn20_dsc *dsc = +- kzalloc(sizeof(struct dcn20_dsc), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn20_dsc), GFP_ATOMIC); + + if (!dsc) { + BREAK_TO_DEBUGGER(); +@@ -1572,7 +1572,7 @@ struct hubp *dcn20_hubp_create( + uint32_t inst) + { + struct dcn20_hubp *hubp2 = +- kzalloc(sizeof(struct dcn20_hubp), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn20_hubp), GFP_ATOMIC); + + if (!hubp2) + return NULL; +@@ -3391,7 +3391,7 @@ bool dcn20_mmhubbub_create(struct dc_context *ctx, struct resource_pool *pool) + + static struct pp_smu_funcs *dcn20_pp_smu_create(struct dc_context *ctx) + { +- struct pp_smu_funcs *pp_smu = kzalloc(sizeof(*pp_smu), GFP_KERNEL); ++ struct pp_smu_funcs *pp_smu = kzalloc(sizeof(*pp_smu), GFP_ATOMIC); + + if (!pp_smu) + return pp_smu; +@@ -4142,7 +4142,7 @@ struct resource_pool *dcn20_create_resource_pool( + struct dc *dc) + { + struct dcn20_resource_pool *pool = +- kzalloc(sizeof(struct dcn20_resource_pool), GFP_KERNEL); ++ kzalloc(sizeof(struct dcn20_resource_pool), GFP_ATOMIC); + + if (!pool) + return NULL; +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-pm-fix-error-code-in-smu_set_power_limit.patch b/queue-5.10/drm-amd-pm-fix-error-code-in-smu_set_power_limit.patch new file mode 100644 index 00000000000..6b62aa933ed --- /dev/null +++ b/queue-5.10/drm-amd-pm-fix-error-code-in-smu_set_power_limit.patch @@ -0,0 +1,34 @@ +From f4b3d72a3ba8b5686e1aeaf4df934ea95024f7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 08:59:22 +0300 +Subject: drm/amd/pm: fix error code in smu_set_power_limit() + +From: Dan Carpenter + +[ Upstream commit bbdfe5aaef3c1d5c5e62fa235ef13f064e4c1c17 ] + +We should return -EINVAL instead of success if the "limit" is too high. + +Fixes: e098bc9612c2 ("drm/amd/pm: optimize the power related source code layout") +Signed-off-by: Dan Carpenter +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +index 5cc45b1cff7e..e5893218fa4b 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -2001,6 +2001,7 @@ int smu_set_power_limit(struct smu_context *smu, uint32_t limit) + dev_err(smu->adev->dev, + "New power limit (%d) is over the max allowed %d\n", + limit, smu->max_power_limit); ++ ret = -EINVAL; + goto out; + } + +-- +2.30.2 + diff --git a/queue-5.10/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch b/queue-5.10/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch new file mode 100644 index 00000000000..5763b518f31 --- /dev/null +++ b/queue-5.10/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch @@ -0,0 +1,106 @@ +From bddb9ea99fccac47ce36e17319c9b24a60b46d93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 22:15:42 -0500 +Subject: drm/amdkfd: fix build error with AMD_IOMMU_V2=m +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit 1e87068570a2cc4db5f95a881686add71729e769 ] + +Using 'imply AMD_IOMMU_V2' does not guarantee that the driver can link +against the exported functions. If the GPU driver is built-in but the +IOMMU driver is a loadable module, the kfd_iommu.c file is indeed +built but does not work: + +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_bind_process_to_device': +kfd_iommu.c:(.text+0x516): undefined reference to `amd_iommu_bind_pasid' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_unbind_process': +kfd_iommu.c:(.text+0x691): undefined reference to `amd_iommu_unbind_pasid' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_suspend': +kfd_iommu.c:(.text+0x966): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0x97f): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0x9a4): undefined reference to `amd_iommu_free_device' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_resume': +kfd_iommu.c:(.text+0xa9a): undefined reference to `amd_iommu_init_device' +x86_64-linux-ld: kfd_iommu.c:(.text+0xadc): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xaff): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xc72): undefined reference to `amd_iommu_bind_pasid' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe08): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe26): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe42): undefined reference to `amd_iommu_free_device' + +Use IS_REACHABLE to only build IOMMU-V2 support if the amd_iommu symbols +are reachable by the amdkfd driver. Output a warning if they are not, +because that may not be what the user was expecting. + +Fixes: 64d1c3a43a6f ("drm/amdkfd: Centralize IOMMUv2 code and make it conditional") +Reported-by: Arnd Bergmann +Signed-off-by: Felix Kuehling +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 6 ++++++ + drivers/gpu/drm/amd/amdkfd/kfd_iommu.h | 9 +++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c +index 66bbca61e3ef..9318936aa805 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c +@@ -20,6 +20,10 @@ + * OTHER DEALINGS IN THE SOFTWARE. + */ + ++#include ++ ++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2) ++ + #include + #include + #include +@@ -355,3 +359,5 @@ int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev) + + return 0; + } ++ ++#endif +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h +index dd23d9fdf6a8..afd420b01a0c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h +@@ -23,7 +23,9 @@ + #ifndef __KFD_IOMMU_H__ + #define __KFD_IOMMU_H__ + +-#if defined(CONFIG_AMD_IOMMU_V2_MODULE) || defined(CONFIG_AMD_IOMMU_V2) ++#include ++ ++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2) + + #define KFD_SUPPORT_IOMMU_V2 + +@@ -46,6 +48,9 @@ static inline int kfd_iommu_check_device(struct kfd_dev *kfd) + } + static inline int kfd_iommu_device_init(struct kfd_dev *kfd) + { ++#if IS_MODULE(CONFIG_AMD_IOMMU_V2) ++ WARN_ONCE(1, "iommu_v2 module is not usable by built-in KFD"); ++#endif + return 0; + } + +@@ -73,6 +78,6 @@ static inline int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev) + return 0; + } + +-#endif /* defined(CONFIG_AMD_IOMMU_V2) */ ++#endif /* IS_REACHABLE(CONFIG_AMD_IOMMU_V2) */ + + #endif /* __KFD_IOMMU_H__ */ +-- +2.30.2 + diff --git a/queue-5.10/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch b/queue-5.10/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch new file mode 100644 index 00000000000..7dd6840e468 --- /dev/null +++ b/queue-5.10/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch @@ -0,0 +1,68 @@ +From 89e5341875f318e2d1f1ab83f03ade52796e39cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 09:01:38 +0300 +Subject: drm/i915/gvt: Fix error code in intel_gvt_init_device() + +From: Dan Carpenter + +[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ] + +The intel_gvt_init_vgpu_type_groups() function is only called from +intel_gvt_init_device(). If it fails then the intel_gvt_init_device() +prints the error code and propagates it back again. That's a bug +because false is zero/success. The fix is to modify it to return zero +or negative error codes and make everything consistent. + +Fixes: c5d71cb31723 ("drm/i915/gvt: Move vGPU type related code into gvt file") +Signed-off-by: Dan Carpenter +Signed-off-by: Zhenyu Wang +Link: http://patchwork.freedesktop.org/patch/msgid/YHaFQtk/DIVYK1u5@mwanda +Reviewed-by: Zhenyu Wang +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c +index c7c561237883..5c9ef8e58a08 100644 +--- a/drivers/gpu/drm/i915/gvt/gvt.c ++++ b/drivers/gpu/drm/i915/gvt/gvt.c +@@ -126,7 +126,7 @@ static bool intel_get_gvt_attrs(struct attribute_group ***intel_vgpu_type_groups + return true; + } + +-static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) ++static int intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) + { + int i, j; + struct intel_vgpu_type *type; +@@ -144,7 +144,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) + gvt_vgpu_type_groups[i] = group; + } + +- return true; ++ return 0; + + unwind: + for (j = 0; j < i; j++) { +@@ -152,7 +152,7 @@ unwind: + kfree(group); + } + +- return false; ++ return -ENOMEM; + } + + static void intel_gvt_cleanup_vgpu_type_groups(struct intel_gvt *gvt) +@@ -360,7 +360,7 @@ int intel_gvt_init_device(struct drm_i915_private *i915) + goto out_clean_thread; + + ret = intel_gvt_init_vgpu_type_groups(gvt); +- if (ret == false) { ++ if (ret) { + gvt_err("failed to init vgpu type groups: %d\n", ret); + goto out_clean_types; + } +-- +2.30.2 + diff --git a/queue-5.10/drm-mcde-panel-inverse-misunderstood-flag.patch b/queue-5.10/drm-mcde-panel-inverse-misunderstood-flag.patch new file mode 100644 index 00000000000..7dd02b7663d --- /dev/null +++ b/queue-5.10/drm-mcde-panel-inverse-misunderstood-flag.patch @@ -0,0 +1,109 @@ +From dd68d6f877124a1a8a1b302205c7ed3b7f749a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 01:41:38 +0100 +Subject: drm/mcde/panel: Inverse misunderstood flag + +From: Linus Walleij + +[ Upstream commit d0c5ac04e7feedbc069f26f4dcbf35b521ae7fc5 ] + +A recent patch renaming MIPI_DSI_MODE_EOT_PACKET to +MIPI_DSI_MODE_NO_EOT_PACKET brought to light the +misunderstanding in the current MCDE driver and all +its associated panel drivers that MIPI_DSI_MODE_EOT_PACKET +would mean "use EOT packet" when in fact it means the +reverse. + +Fix it up by implementing the flag right in the MCDE +DSI driver and remove the flag from panels that actually +want the EOT packet. + +Suggested-by: Nicolas Boichat +Signed-off-by: Linus Walleij +Reviewed-by: Nicolas Boichat +Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE") +Fixes: 899f24ed8d3a ("drm/panel: Add driver for Novatek NT35510-based panels") +Fixes: ac1d6d74884e ("drm/panel: Add driver for Samsung S6D16D0 panel") +Fixes: 435e06c06cb2 ("drm/panel: s6e63m0: Add DSI transport") +Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel") +Link: https://patchwork.freedesktop.org/patch/msgid/20210304004138.1785057-1-linus.walleij@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_dsi.c | 2 +- + drivers/gpu/drm/panel/panel-novatek-nt35510.c | 3 +-- + drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 4 +--- + drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c | 1 - + drivers/gpu/drm/panel/panel-sony-acx424akp.c | 3 +-- + 5 files changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c +index 2314c8122992..b3fd3501c412 100644 +--- a/drivers/gpu/drm/mcde/mcde_dsi.c ++++ b/drivers/gpu/drm/mcde/mcde_dsi.c +@@ -760,7 +760,7 @@ static void mcde_dsi_start(struct mcde_dsi *d) + DSI_MCTL_MAIN_DATA_CTL_BTA_EN | + DSI_MCTL_MAIN_DATA_CTL_READ_EN | + DSI_MCTL_MAIN_DATA_CTL_REG_TE_EN; +- if (d->mdsi->mode_flags & MIPI_DSI_MODE_EOT_PACKET) ++ if (!(d->mdsi->mode_flags & MIPI_DSI_MODE_EOT_PACKET)) + val |= DSI_MCTL_MAIN_DATA_CTL_HOST_EOT_GEN; + writel(val, d->regs + DSI_MCTL_MAIN_DATA_CTL); + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35510.c b/drivers/gpu/drm/panel/panel-novatek-nt35510.c +index b9a0e56f33e2..ef70140c5b09 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35510.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35510.c +@@ -898,8 +898,7 @@ static int nt35510_probe(struct mipi_dsi_device *dsi) + */ + dsi->hs_rate = 349440000; + dsi->lp_rate = 9600000; +- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS | +- MIPI_DSI_MODE_EOT_PACKET; ++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS; + + /* + * Every new incarnation of this display must have a unique +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c +index 4aac0d1573dd..70560cac53a9 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c +@@ -184,9 +184,7 @@ static int s6d16d0_probe(struct mipi_dsi_device *dsi) + * As we only send commands we do not need to be continuously + * clocked. + */ +- dsi->mode_flags = +- MIPI_DSI_CLOCK_NON_CONTINUOUS | +- MIPI_DSI_MODE_EOT_PACKET; ++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS; + + s6->supply = devm_regulator_get(dev, "vdd1"); + if (IS_ERR(s6->supply)) +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c +index eec74c10ddda..9c3563c61e8c 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0-dsi.c +@@ -97,7 +97,6 @@ static int s6e63m0_dsi_probe(struct mipi_dsi_device *dsi) + dsi->hs_rate = 349440000; + dsi->lp_rate = 9600000; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | +- MIPI_DSI_MODE_EOT_PACKET | + MIPI_DSI_MODE_VIDEO_BURST; + + ret = s6e63m0_probe(dev, s6e63m0_dsi_dcs_read, s6e63m0_dsi_dcs_write, +diff --git a/drivers/gpu/drm/panel/panel-sony-acx424akp.c b/drivers/gpu/drm/panel/panel-sony-acx424akp.c +index 065efae213f5..95659a4d15e9 100644 +--- a/drivers/gpu/drm/panel/panel-sony-acx424akp.c ++++ b/drivers/gpu/drm/panel/panel-sony-acx424akp.c +@@ -449,8 +449,7 @@ static int acx424akp_probe(struct mipi_dsi_device *dsi) + MIPI_DSI_MODE_VIDEO_BURST; + else + dsi->mode_flags = +- MIPI_DSI_CLOCK_NON_CONTINUOUS | +- MIPI_DSI_MODE_EOT_PACKET; ++ MIPI_DSI_CLOCK_NON_CONTINUOUS; + + acx->supply = devm_regulator_get(dev, "vddi"); + if (IS_ERR(acx->supply)) +-- +2.30.2 + diff --git a/queue-5.10/drm-probe-helper-check-epoch-counter-in-output_poll_.patch b/queue-5.10/drm-probe-helper-check-epoch-counter-in-output_poll_.patch new file mode 100644 index 00000000000..7500cb48fb0 --- /dev/null +++ b/queue-5.10/drm-probe-helper-check-epoch-counter-in-output_poll_.patch @@ -0,0 +1,66 @@ +From 870de0868b5b616eb32c0cc08c1047faf5e53d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 12:25:44 +0100 +Subject: drm/probe-helper: Check epoch counter in output_poll_execute() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Noralf Trønnes + +[ Upstream commit dc659a4e852b591771fc2e5abb60f4455b0cf316 ] + +drm_helper_hpd_irq_event() checks the epoch counter to determine +connector status change. This was introduced in +commit 5186421cbfe2 ("drm: Introduce epoch counter to drm_connector"). +Do the same for output_poll_execute() so it can detect other changes +beside connection status value changes. + +v2: +- Add Fixes tag (Daniel) + +Fixes: 5186421cbfe2 ("drm: Introduce epoch counter to drm_connector") +Reviewed-by: Daniel Vetter +Signed-off-by: Noralf Trønnes +Link: https://patchwork.freedesktop.org/patch/msgid/20210313112545.37527-3-noralf@tronnes.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index d6017726cc2a..e5432dcf6999 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -623,6 +623,7 @@ static void output_poll_execute(struct work_struct *work) + struct drm_connector_list_iter conn_iter; + enum drm_connector_status old_status; + bool repoll = false, changed; ++ u64 old_epoch_counter; + + if (!dev->mode_config.poll_enabled) + return; +@@ -659,8 +660,9 @@ static void output_poll_execute(struct work_struct *work) + + repoll = true; + ++ old_epoch_counter = connector->epoch_counter; + connector->status = drm_helper_probe_detect(connector, NULL, false); +- if (old_status != connector->status) { ++ if (old_epoch_counter != connector->epoch_counter) { + const char *old, *new; + + /* +@@ -689,6 +691,9 @@ static void output_poll_execute(struct work_struct *work) + connector->base.id, + connector->name, + old, new); ++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] epoch counter %llu -> %llu\n", ++ connector->base.id, connector->name, ++ old_epoch_counter, connector->epoch_counter); + + changed = true; + } +-- +2.30.2 + diff --git a/queue-5.10/drm-radeon-fix-a-missing-check-bug-in-radeon_dp_mst_.patch b/queue-5.10/drm-radeon-fix-a-missing-check-bug-in-radeon_dp_mst_.patch new file mode 100644 index 00000000000..a45cb86c98f --- /dev/null +++ b/queue-5.10/drm-radeon-fix-a-missing-check-bug-in-radeon_dp_mst_.patch @@ -0,0 +1,38 @@ +From 7f4428d6166c7a1847137a91f1570feb58d61046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 20:10:04 -0700 +Subject: drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() + +From: Yingjie Wang + +[ Upstream commit 25315ebfaefcffd126a266116b37bb8a3d1c4620 ] + +In radeon_dp_mst_detect(), We should check whether or not @connector +has been unregistered from userspace. If the connector is unregistered, +we should return disconnected status. + +Fixes: 9843ead08f18 ("drm/radeon: add DisplayPort MST support (v2)") +Signed-off-by: Yingjie Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_dp_mst.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c +index 008308780443..9bd6c0697538 100644 +--- a/drivers/gpu/drm/radeon/radeon_dp_mst.c ++++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c +@@ -242,6 +242,9 @@ radeon_dp_mst_detect(struct drm_connector *connector, + to_radeon_connector(connector); + struct radeon_connector *master = radeon_connector->mst_port; + ++ if (drm_connector_is_unregistered(connector)) ++ return connector_status_disconnected; ++ + return drm_dp_mst_detect_port(connector, ctx, &master->mst_mgr, + radeon_connector->port); + } +-- +2.30.2 + diff --git a/queue-5.10/drm-stm-fix-bus_flags-handling.patch b/queue-5.10/drm-stm-fix-bus_flags-handling.patch new file mode 100644 index 00000000000..808b5142f46 --- /dev/null +++ b/queue-5.10/drm-stm-fix-bus_flags-handling.patch @@ -0,0 +1,107 @@ +From 738a1ad49b98a47d1a7b940b2b74ba2391a30479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 12:07:56 +0100 +Subject: drm/stm: Fix bus_flags handling + +From: Marek Vasut + +[ Upstream commit 99e360442f223dd40fc23ae07c7a263836fd27e6 ] + +The drm_display_mode_to_videomode() does not populate DISPLAY_FLAGS_DE_LOW +or DISPLAY_FLAGS_PIXDATA_NEGEDGE flags in struct videomode. Therefore, no +matter what polarity the next bridge or display might require, these flags +are never set, and thus the LTDC GCR_DEPOL and GCR_PCPOL bits are never set +and the LTDC behaves as if both DISPLAY_FLAGS_PIXDATA_POSEDGE and +DISPLAY_FLAGS_DE_HIGH were always set. + +The fix for this problem is taken almost verbatim from MXSFB driver. In +case there is a bridge attached to the LTDC, the bridge might have extra +polarity requirements, so extract bus_flags from the bridge and use them +for LTDC configuration. Otherwise, extract bus_flags from the connector, +which is the display. + +Fixes: b759012c5fa7 ("drm/stm: Add STM32 LTDC driver") +Signed-off-by: Marek Vasut +Signed-off-by: Yannick Fertre +Cc: Alexandre Torgue +Cc: Antonio Borneo +Cc: Benjamin Gaignard +Cc: Maxime Coquelin +Cc: Philippe Cornu +Cc: Sam Ravnborg +Cc: Vincent Abriou +Cc: Yannick Fertre +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-stm32@st-md-mailman.stormreply.com +To: dri-devel@lists.freedesktop.org +Tested-by: Yannick Fertre +Signed-off-by: Philippe Cornu +Link: https://patchwork.freedesktop.org/patch/msgid/20210127110756.125570-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/stm/ltdc.c | 33 +++++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c +index 6e28f707092f..62488ac14923 100644 +--- a/drivers/gpu/drm/stm/ltdc.c ++++ b/drivers/gpu/drm/stm/ltdc.c +@@ -525,13 +525,42 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) + { + struct ltdc_device *ldev = crtc_to_ltdc(crtc); + struct drm_device *ddev = crtc->dev; ++ struct drm_connector_list_iter iter; ++ struct drm_connector *connector = NULL; ++ struct drm_encoder *encoder = NULL; ++ struct drm_bridge *bridge = NULL; + struct drm_display_mode *mode = &crtc->state->adjusted_mode; + struct videomode vm; + u32 hsync, vsync, accum_hbp, accum_vbp, accum_act_w, accum_act_h; + u32 total_width, total_height; ++ u32 bus_flags = 0; + u32 val; + int ret; + ++ /* get encoder from crtc */ ++ drm_for_each_encoder(encoder, ddev) ++ if (encoder->crtc == crtc) ++ break; ++ ++ if (encoder) { ++ /* get bridge from encoder */ ++ list_for_each_entry(bridge, &encoder->bridge_chain, chain_node) ++ if (bridge->encoder == encoder) ++ break; ++ ++ /* Get the connector from encoder */ ++ drm_connector_list_iter_begin(ddev, &iter); ++ drm_for_each_connector_iter(connector, &iter) ++ if (connector->encoder == encoder) ++ break; ++ drm_connector_list_iter_end(&iter); ++ } ++ ++ if (bridge && bridge->timings) ++ bus_flags = bridge->timings->input_bus_flags; ++ else if (connector) ++ bus_flags = connector->display_info.bus_flags; ++ + if (!pm_runtime_active(ddev->dev)) { + ret = pm_runtime_get_sync(ddev->dev); + if (ret) { +@@ -567,10 +596,10 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) + if (vm.flags & DISPLAY_FLAGS_VSYNC_HIGH) + val |= GCR_VSPOL; + +- if (vm.flags & DISPLAY_FLAGS_DE_LOW) ++ if (bus_flags & DRM_BUS_FLAG_DE_LOW) + val |= GCR_DEPOL; + +- if (vm.flags & DISPLAY_FLAGS_PIXDATA_NEGEDGE) ++ if (bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE) + val |= GCR_PCPOL; + + reg_update_bits(ldev->regs, LTDC_GCR, +-- +2.30.2 + diff --git a/queue-5.10/drm-tilcdc-send-vblank-event-when-disabling-crtc.patch b/queue-5.10/drm-tilcdc-send-vblank-event-when-disabling-crtc.patch new file mode 100644 index 00000000000..8dd2359dd87 --- /dev/null +++ b/queue-5.10/drm-tilcdc-send-vblank-event-when-disabling-crtc.patch @@ -0,0 +1,79 @@ +From b173ee5baf90485ae247b7cfe96c8158030596fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 16:24:15 +0800 +Subject: drm/tilcdc: send vblank event when disabling crtc + +From: Quanyang Wang + +[ Upstream commit f1a75f4dd8edf272b6b7cdccf6ba6254ec9d15fa ] + +When run xrandr to change resolution on Beaglebone Black board, it will +print the error information: + +root@beaglebone:~# xrandr -display :0 --output HDMI-1 --mode 720x400 +[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CRTC:32:tilcdc crtc] commit wait timed out +[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CONNECTOR:34:HDMI-A-1] commit wait timed out +[drm:drm_crtc_commit_wait] *ERROR* flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [PLANE:31:plane-0] commit wait timed out +tilcdc 4830e000.lcdc: already pending page flip! + +This is because there is operation sequence as below: + +drm_atomic_connector_commit_dpms(mode is DRM_MODE_DPMS_OFF): + ... + drm_atomic_helper_setup_commit <- init_completion(commit_A->flip_done) + drm_atomic_helper_commit_tail + tilcdc_crtc_atomic_disable + tilcdc_plane_atomic_update <- drm_crtc_send_vblank_event in tilcdc_crtc_irq + is skipped since tilcdc_crtc->enabled is 0 + tilcdc_crtc_atomic_flush <- drm_crtc_send_vblank_event is skipped since + crtc->state->event is set to be NULL in + tilcdc_plane_atomic_update +drm_mode_setcrtc: + ... + drm_atomic_helper_setup_commit <- init_completion(commit_B->flip_done) + drm_atomic_helper_wait_for_dependencies + drm_crtc_commit_wait <- wait for commit_A->flip_done completing + +Just as shown above, the steps which could complete commit_A->flip_done +are all skipped and commit_A->flip_done will never be completed. This will +result a time-out ERROR when drm_crtc_commit_wait check the commit_A->flip_done. +So add drm_crtc_send_vblank_event in tilcdc_crtc_atomic_disable to +complete commit_A->flip_done. + +Fixes: cb345decb4d2 ("drm/tilcdc: Use standard drm_atomic_helper_commit") +Signed-off-by: Quanyang Wang +Reviewed-by: Jyri Sarha +Tested-by: Jyri Sarha +Signed-off-by: Jyri Sarha +Link: https://patchwork.freedesktop.org/patch/msgid/20210209082415.382602-1-quanyang.wang@windriver.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +index 518220bd092a..0aaa4a26b5db 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +@@ -518,6 +518,15 @@ static void tilcdc_crtc_off(struct drm_crtc *crtc, bool shutdown) + + drm_crtc_vblank_off(crtc); + ++ spin_lock_irq(&crtc->dev->event_lock); ++ ++ if (crtc->state->event) { ++ drm_crtc_send_vblank_event(crtc, crtc->state->event); ++ crtc->state->event = NULL; ++ } ++ ++ spin_unlock_irq(&crtc->dev->event_lock); ++ + tilcdc_crtc_disable_irqs(dev); + + pm_runtime_put_sync(dev->dev); +-- +2.30.2 + diff --git a/queue-5.10/drm-xlnx-zynqmp-fix-a-memset-in-zynqmp_dp_train.patch b/queue-5.10/drm-xlnx-zynqmp-fix-a-memset-in-zynqmp_dp_train.patch new file mode 100644 index 00000000000..025efb3eda3 --- /dev/null +++ b/queue-5.10/drm-xlnx-zynqmp-fix-a-memset-in-zynqmp_dp_train.patch @@ -0,0 +1,39 @@ +From 9e5c6e515f7dcfeb82f30ba0742a4c2a09181031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 12:31:52 +0300 +Subject: drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() + +From: Dan Carpenter + +[ Upstream commit 5842ab76bbfadb37eaea91e53c1efe34ae504e4a ] + +The dp->train_set[] for this driver is only two characters, not four so +this memsets too much. Fortunately, this ends up corrupting a struct +hole and not anything important. + +Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") +Signed-off-by: Dan Carpenter +Reviewed-by: Michal Simek +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/YGLwCBMotnrKZu6P@mwanda +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c +index 99158ee67d02..59d1fb017da0 100644 +--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c +@@ -866,7 +866,7 @@ static int zynqmp_dp_train(struct zynqmp_dp *dp) + return ret; + + zynqmp_dp_write(dp, ZYNQMP_DP_SCRAMBLING_DISABLE, 1); +- memset(dp->train_set, 0, 4); ++ memset(dp->train_set, 0, sizeof(dp->train_set)); + ret = zynqmp_dp_link_train_cr(dp); + if (ret) + return ret; +-- +2.30.2 + diff --git a/queue-5.10/dt-bindings-serial-stm32-use-type-object-instead-of-.patch b/queue-5.10/dt-bindings-serial-stm32-use-type-object-instead-of-.patch new file mode 100644 index 00000000000..79df971ddab --- /dev/null +++ b/queue-5.10/dt-bindings-serial-stm32-use-type-object-instead-of-.patch @@ -0,0 +1,46 @@ +From 821cf5704ad9e5b6dd582bf7b3fa971b378c1254 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 19:15:02 +0800 +Subject: dt-bindings: serial: stm32: Use 'type: object' instead of false for + 'additionalProperties' + +From: dillon min + +[ Upstream commit 9f299d3264c67a892af87337dbaa0bdd20830c0c ] + +To use additional properties 'bluetooth' on serial, need replace false with +'type: object' for 'additionalProperties' to make it as a node, else will +run into dtbs_check warnings. + +'arch/arm/boot/dts/stm32h750i-art-pi.dt.yaml: serial@40004800: +'bluetooth' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: af1c2d81695b ("dt-bindings: serial: Convert STM32 UART to json-schema") +Reported-by: kernel test robot +Tested-by: Valentin Caron +Signed-off-by: dillon min +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/1616757302-7889-8-git-send-email-dillon.minfei@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/serial/st,stm32-uart.yaml | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml b/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml +index 06d5f251ec88..51f390e5c276 100644 +--- a/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml ++++ b/Documentation/devicetree/bindings/serial/st,stm32-uart.yaml +@@ -77,7 +77,8 @@ required: + - interrupts + - clocks + +-additionalProperties: false ++additionalProperties: ++ type: object + + examples: + - | +-- +2.30.2 + diff --git a/queue-5.10/firmware-qcom-scm-fix-qcom_scm-configuration.patch b/queue-5.10/firmware-qcom-scm-fix-qcom_scm-configuration.patch new file mode 100644 index 00000000000..9a3baf86fbd --- /dev/null +++ b/queue-5.10/firmware-qcom-scm-fix-qcom_scm-configuration.patch @@ -0,0 +1,47 @@ +From fe1e03fc12530bdb772cfbe6b9e89e55f749d880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 05:42:00 -0400 +Subject: firmware: qcom-scm: Fix QCOM_SCM configuration + +From: He Ying + +[ Upstream commit 2954a6f12f250890ec2433cec03ba92784d613e8 ] + +When CONFIG_QCOM_SCM is y and CONFIG_HAVE_ARM_SMCCC +is not set, compiling errors are encountered as follows: + +drivers/firmware/qcom_scm-smc.o: In function `__scm_smc_do_quirk': +qcom_scm-smc.c:(.text+0x36): undefined reference to `__arm_smccc_smc' +drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call': +qcom_scm-legacy.c:(.text+0xe2): undefined reference to `__arm_smccc_smc' +drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call_atomic': +qcom_scm-legacy.c:(.text+0x1f0): undefined reference to `__arm_smccc_smc' + +Note that __arm_smccc_smc is defined when HAVE_ARM_SMCCC is y. +So add dependency on HAVE_ARM_SMCCC in QCOM_SCM configuration. + +Fixes: 916f743da354 ("firmware: qcom: scm: Move the scm driver to drivers/firmware") +Reported-by: Hulk Robot +Signed-off-by: He Ying +Link: https://lore.kernel.org/r/20210406094200.60952-1-heying24@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig +index 3315e3c21586..5fa6b3ca0a38 100644 +--- a/drivers/firmware/Kconfig ++++ b/drivers/firmware/Kconfig +@@ -237,6 +237,7 @@ config INTEL_STRATIX10_RSU + config QCOM_SCM + bool + depends on ARM || ARM64 ++ depends on HAVE_ARM_SMCCC + select RESET_CONTROLLER + + config QCOM_SCM_DOWNLOAD_MODE_DEFAULT +-- +2.30.2 + diff --git a/queue-5.10/firmware-qcom_scm-make-__qcom_scm_is_call_available-.patch b/queue-5.10/firmware-qcom_scm-make-__qcom_scm_is_call_available-.patch new file mode 100644 index 00000000000..42f931993f0 --- /dev/null +++ b/queue-5.10/firmware-qcom_scm-make-__qcom_scm_is_call_available-.patch @@ -0,0 +1,103 @@ +From c9467351e43fc07a4d488f3485e224fea350117d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 13:45:34 -0800 +Subject: firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool + +From: Stephen Boyd + +[ Upstream commit 9d11af8b06a811c5c4878625f51ce109e2af4e80 ] + +Make __qcom_scm_is_call_available() return bool instead of int. The +function has "is" in the name, so it should return a bool to indicate +the truth of the call being available. Unfortunately, it can return a +number < 0 which also looks "true", but not all callers expect that and +thus they think a call is available when really the check to see if the +call is available failed to figure it out. + +Reviewed-by: Bjorn Andersson +Cc: Elliot Berman +Cc: Brian Masney +Cc: Stephan Gerhold +Cc: Jeffrey Hugo +Cc: Douglas Anderson +Fixes: 0f206514749b ("scsi: firmware: qcom_scm: Add support for programming inline crypto keys") +Fixes: 0434a4061471 ("firmware: qcom: scm: add support to restore secure config to qcm_scm-32") +Fixes: b0a1614fb1f5 ("firmware: qcom: scm: add OCMEM lock/unlock interface") +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210223214539.1336155-2-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index 7be48c1bec96..54ba2834e763 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -113,9 +113,6 @@ static void qcom_scm_clk_disable(void) + clk_disable_unprepare(__scm->bus_clk); + } + +-static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id, +- u32 cmd_id); +- + enum qcom_scm_convention qcom_scm_convention; + static bool has_queried __read_mostly; + static DEFINE_SPINLOCK(query_lock); +@@ -219,8 +216,8 @@ static int qcom_scm_call_atomic(struct device *dev, + } + } + +-static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id, +- u32 cmd_id) ++static bool __qcom_scm_is_call_available(struct device *dev, u32 svc_id, ++ u32 cmd_id) + { + int ret; + struct qcom_scm_desc desc = { +@@ -247,7 +244,7 @@ static int __qcom_scm_is_call_available(struct device *dev, u32 svc_id, + + ret = qcom_scm_call(dev, &desc, &res); + +- return ret ? : res.result[0]; ++ return ret ? false : !!res.result[0]; + } + + /** +@@ -585,9 +582,8 @@ bool qcom_scm_pas_supported(u32 peripheral) + }; + struct qcom_scm_res res; + +- ret = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_PIL, +- QCOM_SCM_PIL_PAS_IS_SUPPORTED); +- if (ret <= 0) ++ if (!__qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_PIL, ++ QCOM_SCM_PIL_PAS_IS_SUPPORTED)) + return false; + + ret = qcom_scm_call(__scm->dev, &desc, &res); +@@ -1054,17 +1050,18 @@ EXPORT_SYMBOL(qcom_scm_ice_set_key); + */ + bool qcom_scm_hdcp_available(void) + { ++ bool avail; + int ret = qcom_scm_clk_enable(); + + if (ret) + return ret; + +- ret = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_HDCP, ++ avail = __qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_HDCP, + QCOM_SCM_HDCP_INVOKE); + + qcom_scm_clk_disable(); + +- return ret > 0; ++ return avail; + } + EXPORT_SYMBOL(qcom_scm_hdcp_available); + +-- +2.30.2 + diff --git a/queue-5.10/firmware-qcom_scm-reduce-locking-section-for-__get_c.patch b/queue-5.10/firmware-qcom_scm-reduce-locking-section-for-__get_c.patch new file mode 100644 index 00000000000..975e92157ae --- /dev/null +++ b/queue-5.10/firmware-qcom_scm-reduce-locking-section-for-__get_c.patch @@ -0,0 +1,190 @@ +From 7c31bb3ef9d86ab741115981673aa0ec7821d787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 13:45:35 -0800 +Subject: firmware: qcom_scm: Reduce locking section for __get_convention() + +From: Stephen Boyd + +[ Upstream commit f6ea568f0ddcdfad52807110ed8983e610f0e03b ] + +We shouldn't need to hold this spinlock here around the entire SCM call +into the firmware and back. Instead, we should be able to query the +firmware, potentially in parallel with other CPUs making the same +convention detection firmware call, and then grab the lock to update the +calling convention detected. The convention doesn't change at runtime so +calling into firmware more than once is possibly wasteful but simpler. +Besides, this is the slow path, not the fast path where we've already +detected the convention used. + +More importantly, this allows us to add more logic here to workaround +the case where the firmware call to check for availability isn't +implemented in the firmware at all. In that case we can check the +firmware node compatible string and force a calling convention. + +Note that we remove the 'has_queried' logic that is repeated twice. That +could lead to the calling convention being printed multiple times to the +kernel logs if the bool is true but __query_convention() is running on +multiple CPUs. We also shorten the time where the lock is held, but we +keep the lock held around the printk because it doesn't seem hugely +important to drop it for that. + +Cc: Elliot Berman +Cc: Brian Masney +Cc: Stephan Gerhold +Cc: Jeffrey Hugo +Cc: Douglas Anderson +Fixes: 9a434cee773a ("firmware: qcom_scm: Dynamically support SMCCC and legacy conventions") +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210223214539.1336155-3-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm-smc.c | 12 ++++--- + drivers/firmware/qcom_scm.c | 55 ++++++++++++++++----------------- + drivers/firmware/qcom_scm.h | 7 +++-- + 3 files changed, 39 insertions(+), 35 deletions(-) + +diff --git a/drivers/firmware/qcom_scm-smc.c b/drivers/firmware/qcom_scm-smc.c +index 497c13ba98d6..d111833364ba 100644 +--- a/drivers/firmware/qcom_scm-smc.c ++++ b/drivers/firmware/qcom_scm-smc.c +@@ -77,8 +77,10 @@ static void __scm_smc_do(const struct arm_smccc_args *smc, + } while (res->a0 == QCOM_SCM_V2_EBUSY); + } + +-int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, +- struct qcom_scm_res *res, bool atomic) ++ ++int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, ++ enum qcom_scm_convention qcom_convention, ++ struct qcom_scm_res *res, bool atomic) + { + int arglen = desc->arginfo & 0xf; + int i; +@@ -87,9 +89,8 @@ int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, + size_t alloc_len; + gfp_t flag = atomic ? GFP_ATOMIC : GFP_KERNEL; + u32 smccc_call_type = atomic ? ARM_SMCCC_FAST_CALL : ARM_SMCCC_STD_CALL; +- u32 qcom_smccc_convention = +- (qcom_scm_convention == SMC_CONVENTION_ARM_32) ? +- ARM_SMCCC_SMC_32 : ARM_SMCCC_SMC_64; ++ u32 qcom_smccc_convention = (qcom_convention == SMC_CONVENTION_ARM_32) ? ++ ARM_SMCCC_SMC_32 : ARM_SMCCC_SMC_64; + struct arm_smccc_res smc_res; + struct arm_smccc_args smc = {0}; + +@@ -148,4 +149,5 @@ int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, + } + + return (long)smc_res.a0 ? qcom_scm_remap_error(smc_res.a0) : 0; ++ + } +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index 54ba2834e763..a455c22bcdbd 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -113,11 +113,10 @@ static void qcom_scm_clk_disable(void) + clk_disable_unprepare(__scm->bus_clk); + } + +-enum qcom_scm_convention qcom_scm_convention; +-static bool has_queried __read_mostly; +-static DEFINE_SPINLOCK(query_lock); ++enum qcom_scm_convention qcom_scm_convention = SMC_CONVENTION_UNKNOWN; ++static DEFINE_SPINLOCK(scm_query_lock); + +-static void __query_convention(void) ++static enum qcom_scm_convention __get_convention(void) + { + unsigned long flags; + struct qcom_scm_desc desc = { +@@ -130,36 +129,36 @@ static void __query_convention(void) + .owner = ARM_SMCCC_OWNER_SIP, + }; + struct qcom_scm_res res; ++ enum qcom_scm_convention probed_convention; + int ret; + +- spin_lock_irqsave(&query_lock, flags); +- if (has_queried) +- goto out; ++ if (likely(qcom_scm_convention != SMC_CONVENTION_UNKNOWN)) ++ return qcom_scm_convention; + +- qcom_scm_convention = SMC_CONVENTION_ARM_64; +- // Device isn't required as there is only one argument - no device +- // needed to dma_map_single to secure world +- ret = scm_smc_call(NULL, &desc, &res, true); ++ /* ++ * Device isn't required as there is only one argument - no device ++ * needed to dma_map_single to secure world ++ */ ++ probed_convention = SMC_CONVENTION_ARM_64; ++ ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true); + if (!ret && res.result[0] == 1) +- goto out; ++ goto found; + +- qcom_scm_convention = SMC_CONVENTION_ARM_32; +- ret = scm_smc_call(NULL, &desc, &res, true); ++ probed_convention = SMC_CONVENTION_ARM_32; ++ ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true); + if (!ret && res.result[0] == 1) +- goto out; +- +- qcom_scm_convention = SMC_CONVENTION_LEGACY; +-out: +- has_queried = true; +- spin_unlock_irqrestore(&query_lock, flags); +- pr_info("qcom_scm: convention: %s\n", +- qcom_scm_convention_names[qcom_scm_convention]); +-} ++ goto found; ++ ++ probed_convention = SMC_CONVENTION_LEGACY; ++found: ++ spin_lock_irqsave(&scm_query_lock, flags); ++ if (probed_convention != qcom_scm_convention) { ++ qcom_scm_convention = probed_convention; ++ pr_info("qcom_scm: convention: %s\n", ++ qcom_scm_convention_names[qcom_scm_convention]); ++ } ++ spin_unlock_irqrestore(&scm_query_lock, flags); + +-static inline enum qcom_scm_convention __get_convention(void) +-{ +- if (unlikely(!has_queried)) +- __query_convention(); + return qcom_scm_convention; + } + +@@ -1233,7 +1232,7 @@ static int qcom_scm_probe(struct platform_device *pdev) + __scm = scm; + __scm->dev = &pdev->dev; + +- __query_convention(); ++ __get_convention(); + + /* + * If requested enable "download mode", from this point on warmboot +diff --git a/drivers/firmware/qcom_scm.h b/drivers/firmware/qcom_scm.h +index 95cd1ac30ab0..632fe3142462 100644 +--- a/drivers/firmware/qcom_scm.h ++++ b/drivers/firmware/qcom_scm.h +@@ -61,8 +61,11 @@ struct qcom_scm_res { + }; + + #define SCM_SMC_FNID(s, c) ((((s) & 0xFF) << 8) | ((c) & 0xFF)) +-extern int scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, +- struct qcom_scm_res *res, bool atomic); ++extern int __scm_smc_call(struct device *dev, const struct qcom_scm_desc *desc, ++ enum qcom_scm_convention qcom_convention, ++ struct qcom_scm_res *res, bool atomic); ++#define scm_smc_call(dev, desc, res, atomic) \ ++ __scm_smc_call((dev), (desc), qcom_scm_convention, (res), (atomic)) + + #define SCM_LEGACY_FNID(s, c) (((s) << 10) | ((c) & 0x3ff)) + extern int scm_legacy_call_atomic(struct device *dev, +-- +2.30.2 + diff --git a/queue-5.10/firmware-qcom_scm-workaround-lack-of-is-available-ca.patch b/queue-5.10/firmware-qcom_scm-workaround-lack-of-is-available-ca.patch new file mode 100644 index 00000000000..ffec590e277 --- /dev/null +++ b/queue-5.10/firmware-qcom_scm-workaround-lack-of-is-available-ca.patch @@ -0,0 +1,87 @@ +From f4a837b3f47a79d41953ea47234a68444ead2485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 13:45:36 -0800 +Subject: firmware: qcom_scm: Workaround lack of "is available" call on SC7180 + +From: Stephen Boyd + +[ Upstream commit 257f2935cbbf14b16912c635fcd8ff43345c953b ] + +Some SC7180 firmwares don't implement the QCOM_SCM_INFO_IS_CALL_AVAIL +API, so we can't probe the calling convention. We detect the legacy +calling convention on these firmwares, because the availability call +always fails and legacy is the fallback. This leads to problems where +the rmtfs driver fails to probe, because it tries to assign memory with +a bad calling convention, which then leads to modem failing to load and +all networking, even wifi, to fail. Ouch! + +Let's force the calling convention to be what it always is on this SoC, +i.e. arm64. Of course, the calling convention is not the same thing as +implementing the QCOM_SCM_INFO_IS_CALL_AVAIL API. The absence of the "is +this call available" API from the firmware means that any call to +__qcom_scm_is_call_available() fails. This is OK for now though because +none of the calls that are checked for existence are implemented on +firmware running on sc7180. If such a call needs to be checked for +existence in the future, we presume that firmware will implement this +API and then things will "just work". + +Cc: Elliot Berman +Cc: Brian Masney +Cc: Stephan Gerhold +Cc: Jeffrey Hugo +Cc: Douglas Anderson +Fixes: 9a434cee773a ("firmware: qcom_scm: Dynamically support SMCCC and legacy conventions") +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210223214539.1336155-4-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index a455c22bcdbd..c5b20bdc08e9 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -131,6 +131,7 @@ static enum qcom_scm_convention __get_convention(void) + struct qcom_scm_res res; + enum qcom_scm_convention probed_convention; + int ret; ++ bool forced = false; + + if (likely(qcom_scm_convention != SMC_CONVENTION_UNKNOWN)) + return qcom_scm_convention; +@@ -144,6 +145,18 @@ static enum qcom_scm_convention __get_convention(void) + if (!ret && res.result[0] == 1) + goto found; + ++ /* ++ * Some SC7180 firmwares didn't implement the ++ * QCOM_SCM_INFO_IS_CALL_AVAIL call, so we fallback to forcing ARM_64 ++ * calling conventions on these firmwares. Luckily we don't make any ++ * early calls into the firmware on these SoCs so the device pointer ++ * will be valid here to check if the compatible matches. ++ */ ++ if (of_device_is_compatible(__scm ? __scm->dev->of_node : NULL, "qcom,scm-sc7180")) { ++ forced = true; ++ goto found; ++ } ++ + probed_convention = SMC_CONVENTION_ARM_32; + ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true); + if (!ret && res.result[0] == 1) +@@ -154,8 +167,9 @@ found: + spin_lock_irqsave(&scm_query_lock, flags); + if (probed_convention != qcom_scm_convention) { + qcom_scm_convention = probed_convention; +- pr_info("qcom_scm: convention: %s\n", +- qcom_scm_convention_names[qcom_scm_convention]); ++ pr_info("qcom_scm: convention: %s%s\n", ++ qcom_scm_convention_names[qcom_scm_convention], ++ forced ? " (forced)" : ""); + } + spin_unlock_irqrestore(&scm_query_lock, flags); + +-- +2.30.2 + diff --git a/queue-5.10/firmware-xilinx-add-a-blank-line-after-function-decl.patch b/queue-5.10/firmware-xilinx-add-a-blank-line-after-function-decl.patch new file mode 100644 index 00000000000..85f32bf788a --- /dev/null +++ b/queue-5.10/firmware-xilinx-add-a-blank-line-after-function-decl.patch @@ -0,0 +1,207 @@ +From 9f5b5a109775d844c8b8ed409ec32ed6591c2f40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 08:38:49 +0100 +Subject: firmware: xilinx: Add a blank line after function declaration + +From: Michal Simek + +[ Upstream commit a80cefec2c2783166727324bde724c39aa8a12df ] + +Fix all these issues which are also reported by checkpatch --strict. + +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/7b6007e05f6c01214861a37f198cd5bee62a4d3e.1606894725.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + include/linux/firmware/xlnx-zynqmp.h | 34 ++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h +index 41a1bab98b7e..7fb3274a4a9e 100644 +--- a/include/linux/firmware/xlnx-zynqmp.h ++++ b/include/linux/firmware/xlnx-zynqmp.h +@@ -358,107 +358,132 @@ static inline struct zynqmp_eemi_ops *zynqmp_pm_get_eemi_ops(void) + { + return ERR_PTR(-ENODEV); + } ++ + static inline int zynqmp_pm_get_api_version(u32 *version) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_get_chipid(u32 *idcode, u32 *version) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_query_data(struct zynqmp_pm_query_data qdata, + u32 *out) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_enable(u32 clock_id) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_disable(u32 clock_id) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_getstate(u32 clock_id, u32 *state) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_setdivider(u32 clock_id, u32 divider) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_getdivider(u32 clock_id, u32 *divider) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_setrate(u32 clock_id, u64 rate) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_getrate(u32 clock_id, u64 *rate) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_setparent(u32 clock_id, u32 parent_id) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_clock_getparent(u32 clock_id, u32 *parent_id) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_pll_frac_mode(u32 clk_id, u32 mode) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_get_pll_frac_mode(u32 clk_id, u32 *mode) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_pll_frac_data(u32 clk_id, u32 data) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_get_pll_frac_data(u32 clk_id, u32 *data) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_sd_tapdelay(u32 node_id, u32 type, u32 value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_sd_dll_reset(u32 node_id, u32 type) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_reset_assert(const enum zynqmp_pm_reset reset, + const enum zynqmp_pm_reset_action assert_flag) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_reset_get_status(const enum zynqmp_pm_reset reset, + u32 *status) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_init_finalize(void) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_suspend_mode(u32 mode) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_request_node(const u32 node, const u32 capabilities, + const u32 qos, + const enum zynqmp_pm_request_ack ack) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_release_node(const u32 node) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_requirement(const u32 node, + const u32 capabilities, + const u32 qos, +@@ -466,39 +491,48 @@ static inline int zynqmp_pm_set_requirement(const u32 node, + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_aes_engine(const u64 address, u32 *out) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_fpga_load(const u64 address, const u32 size, + const u32 flags) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_fpga_get_status(u32 *value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_write_ggs(u32 index, u32 value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_read_ggs(u32 index, u32 *value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_write_pggs(u32 index, u32 value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_read_pggs(u32 index, u32 *value) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_system_shutdown(const u32 type, const u32 subtype) + { + return -ENODEV; + } ++ + static inline int zynqmp_pm_set_boot_health_status(u32 value) + { + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.10/firmware-xilinx-fix-dereferencing-freed-memory.patch b/queue-5.10/firmware-xilinx-fix-dereferencing-freed-memory.patch new file mode 100644 index 00000000000..f369e328157 --- /dev/null +++ b/queue-5.10/firmware-xilinx-fix-dereferencing-freed-memory.patch @@ -0,0 +1,58 @@ +From 47e993e0002b2e05162b7fedcef1d572932dffe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Feb 2021 22:31:23 -0800 +Subject: firmware: xilinx: Fix dereferencing freed memory + +From: Tejas Patel + +[ Upstream commit f1f21bece82c76a56a96988ec7d51ccc033d8949 ] + +Fix smatch warning: +drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove() +error: dereferencing freed memory 'feature_data' + +Use hash_for_each_safe for safe removal of hash entry. + +Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Tejas Patel +Signed-off-by: Rajan Vaja +Link: https://lore.kernel.org/r/1612765883-22018-1-git-send-email-rajan.vaja@xilinx.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + drivers/firmware/xilinx/zynqmp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c +index fd95edeb702b..9e6504592646 100644 +--- a/drivers/firmware/xilinx/zynqmp.c ++++ b/drivers/firmware/xilinx/zynqmp.c +@@ -2,7 +2,7 @@ + /* + * Xilinx Zynq MPSoC Firmware layer + * +- * Copyright (C) 2014-2020 Xilinx, Inc. ++ * Copyright (C) 2014-2021 Xilinx, Inc. + * + * Michal Simek + * Davorin Mista +@@ -1280,12 +1280,13 @@ static int zynqmp_firmware_probe(struct platform_device *pdev) + static int zynqmp_firmware_remove(struct platform_device *pdev) + { + struct pm_api_feature_data *feature_data; ++ struct hlist_node *tmp; + int i; + + mfd_remove_devices(&pdev->dev); + zynqmp_pm_api_debugfs_exit(); + +- hash_for_each(pm_api_features_map, i, feature_data, hentry) { ++ hash_for_each_safe(pm_api_features_map, i, tmp, feature_data, hentry) { + hash_del(&feature_data->hentry); + kfree(feature_data); + } +-- +2.30.2 + diff --git a/queue-5.10/firmware-xilinx-remove-zynqmp_pm_get_eemi_ops-in-is_.patch b/queue-5.10/firmware-xilinx-remove-zynqmp_pm_get_eemi_ops-in-is_.patch new file mode 100644 index 00000000000..b3e2d812871 --- /dev/null +++ b/queue-5.10/firmware-xilinx-remove-zynqmp_pm_get_eemi_ops-in-is_.patch @@ -0,0 +1,88 @@ +From 1d69d43cc27d2f8229bad70769c6fb0cbc5f75e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 00:58:49 +0900 +Subject: firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in + IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) + +From: Nobuhiro Iwamatsu + +[ Upstream commit 79bfe480a0a0b259ab9fddcd2fe52c03542b1196 ] + +zynqmp_pm_get_eemi_ops() was removed in commit 4db8180ffe7c: "Firmware: xilinx: +Remove eemi ops for fpga related APIs", but not in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE). +Any driver who want to communicate with PMC using EEMI APIs use the functions provided +for each function +This removed zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE), and also +modify the documentation for this driver. + +Fixes: 4db8180ffe7c ("firmware: xilinx: Remove eemi ops for fpga related APIs") +Signed-off-by: Nobuhiro Iwamatsu +Link: https://lore.kernel.org/r/20210215155849.2425846-1-iwamatsu@nigauri.org +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + Documentation/driver-api/xilinx/eemi.rst | 31 ++---------------------- + include/linux/firmware/xlnx-zynqmp.h | 5 ---- + 2 files changed, 2 insertions(+), 34 deletions(-) + +diff --git a/Documentation/driver-api/xilinx/eemi.rst b/Documentation/driver-api/xilinx/eemi.rst +index 9dcbc6f18d75..c1bc47b9000d 100644 +--- a/Documentation/driver-api/xilinx/eemi.rst ++++ b/Documentation/driver-api/xilinx/eemi.rst +@@ -16,35 +16,8 @@ components running across different processing clusters on a chip or + device to communicate with a power management controller (PMC) on a + device to issue or respond to power management requests. + +-EEMI ops is a structure containing all eemi APIs supported by Zynq MPSoC. +-The zynqmp-firmware driver maintain all EEMI APIs in zynqmp_eemi_ops +-structure. Any driver who want to communicate with PMC using EEMI APIs +-can call zynqmp_pm_get_eemi_ops(). +- +-Example of EEMI ops:: +- +- /* zynqmp-firmware driver maintain all EEMI APIs */ +- struct zynqmp_eemi_ops { +- int (*get_api_version)(u32 *version); +- int (*query_data)(struct zynqmp_pm_query_data qdata, u32 *out); +- }; +- +- static const struct zynqmp_eemi_ops eemi_ops = { +- .get_api_version = zynqmp_pm_get_api_version, +- .query_data = zynqmp_pm_query_data, +- }; +- +-Example of EEMI ops usage:: +- +- static const struct zynqmp_eemi_ops *eemi_ops; +- u32 ret_payload[PAYLOAD_ARG_CNT]; +- int ret; +- +- eemi_ops = zynqmp_pm_get_eemi_ops(); +- if (IS_ERR(eemi_ops)) +- return PTR_ERR(eemi_ops); +- +- ret = eemi_ops->query_data(qdata, ret_payload); ++Any driver who wants to communicate with PMC using EEMI APIs use the ++functions provided for each function. + + IOCTL + ------ +diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h +index 7fb3274a4a9e..4930ece07fd8 100644 +--- a/include/linux/firmware/xlnx-zynqmp.h ++++ b/include/linux/firmware/xlnx-zynqmp.h +@@ -354,11 +354,6 @@ int zynqmp_pm_read_pggs(u32 index, u32 *value); + int zynqmp_pm_system_shutdown(const u32 type, const u32 subtype); + int zynqmp_pm_set_boot_health_status(u32 value); + #else +-static inline struct zynqmp_eemi_ops *zynqmp_pm_get_eemi_ops(void) +-{ +- return ERR_PTR(-ENODEV); +-} +- + static inline int zynqmp_pm_get_api_version(u32 *version) + { + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-complete-out-requests-on-short-packets.patch b/queue-5.10/fotg210-udc-complete-out-requests-on-short-packets.patch new file mode 100644 index 00000000000..a82da99899b --- /dev/null +++ b/queue-5.10/fotg210-udc-complete-out-requests-on-short-packets.patch @@ -0,0 +1,47 @@ +From 4b3dafd4359d1b670e2f04c5e2485e510db8eb09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:15 +0100 +Subject: fotg210-udc: Complete OUT requests on short packets + +From: Fabian Vogt + +[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ] + +A short packet indicates the end of a transfer and marks the request as +complete. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 9925d7ac9138..75bf446f4a66 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -849,12 +849,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep) + { + struct fotg210_request *req = list_entry(ep->queue.next, + struct fotg210_request, queue); ++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1); + + fotg210_start_dma(ep, req); + +- /* finish out transfer */ ++ /* Complete the request when it's full or a short packet arrived. ++ * Like other drivers, short_not_ok isn't handled. ++ */ ++ + if (req->req.length == req->req.actual || +- req->req.actual < ep->ep.maxpacket) ++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1))) + fotg210_done(ep, req, 0); + } + +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch b/queue-5.10/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch new file mode 100644 index 00000000000..c2df0a9fec7 --- /dev/null +++ b/queue-5.10/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch @@ -0,0 +1,40 @@ +From d070dd44c074c872c8b1b20718b7ec94fbc079ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:14 +0100 +Subject: fotg210-udc: Don't DMA more than the buffer can take + +From: Fabian Vogt + +[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ] + +Before this, it wrote as much as available into the buffer, even if it +didn't fit. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index bbcc92376307..9925d7ac9138 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -338,8 +338,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + } else { + buffer = req->req.buf + req->req.actual; + length = ioread32(ep->fotg210->reg + +- FOTG210_FIBCR(ep->epnum - 1)); +- length &= FIBCR_BCFX; ++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX; ++ if (length > req->req.length - req->req.actual) ++ length = req->req.length - req->req.actual; + } + } else { + buffer = req->req.buf + req->req.actual; +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch b/queue-5.10/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch new file mode 100644 index 00000000000..70b66d94a5e --- /dev/null +++ b/queue-5.10/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch @@ -0,0 +1,40 @@ +From 51fa2808e20353b678e99f4c09d08c12cf9a01be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:09 +0100 +Subject: fotg210-udc: Fix DMA on EP0 for length > max packet size + +From: Fabian Vogt + +[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ] + +For a 75 Byte request, it would send the first 64 separately, then detect +that the remaining 11 Byte fit into a single DMA, but due to this bug set +the length to the original 75 Bytes. This leads to a DMA failure (which is +ignored...) and the request completes without the remaining bytes having +been sent. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index d6ca50f01985..39260007ebf8 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -346,7 +346,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + if (req->req.length - req->req.actual > ep->ep.maxpacket) + length = ep->ep.maxpacket; + else +- length = req->req.length; ++ length = req->req.length - req->req.actual; + } + + d = dma_map_single(dev, buffer, length, +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch b/queue-5.10/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch new file mode 100644 index 00000000000..57ec25e7d8d --- /dev/null +++ b/queue-5.10/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch @@ -0,0 +1,38 @@ +From 650ace4baa7739b7347883495af8b24c29dc306e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:10 +0100 +Subject: fotg210-udc: Fix EP0 IN requests bigger than two packets + +From: Fabian Vogt + +[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ] + +For a 134 Byte packet, it sends the first two 64 Byte packets just fine, +but then notice that less than a packet is remaining and call fotg210_done +without actually sending the rest. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 39260007ebf8..345827cf1b64 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -820,7 +820,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210) + if (req->req.length) + fotg210_start_dma(ep, req); + +- if ((req->req.length - req->req.actual) < ep->ep.maxpacket) ++ if (req->req.actual == req->req.length) + fotg210_done(ep, req, 0); + } else { + fotg210_set_cxdone(fotg210); +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch b/queue-5.10/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch new file mode 100644 index 00000000000..49105d528bf --- /dev/null +++ b/queue-5.10/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch @@ -0,0 +1,42 @@ +From 54dbf18da773a7042704a0d738e63881eddda791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:12 +0100 +Subject: fotg210-udc: Mask GRP2 interrupts we don't handle + +From: Fabian Vogt + +[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ] + +Currently it leaves unhandled interrupts unmasked, but those are never +acked. In the case of a "device idle" interrupt, this leads to an +effectively frozen system until plugging it in. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index a3ad93bfd256..bbcc92376307 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -1026,6 +1026,12 @@ static void fotg210_init(struct fotg210_udc *fotg210) + value &= ~DMCR_GLINT_EN; + iowrite32(value, fotg210->reg + FOTG210_DMCR); + ++ /* enable only grp2 irqs we handle */ ++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT ++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT ++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT), ++ fotg210->reg + FOTG210_DMISGR2); ++ + /* disable all fifo interrupt */ + iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1); + +-- +2.30.2 + diff --git a/queue-5.10/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch b/queue-5.10/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch new file mode 100644 index 00000000000..7297bcc4fee --- /dev/null +++ b/queue-5.10/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch @@ -0,0 +1,40 @@ +From e07e9327bf461da9ca50fb534cf39c74ccef3754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:11 +0100 +Subject: fotg210-udc: Remove a dubious condition leading to fotg210_done + +From: Fabian Vogt + +[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ] + +When the EP0 IN request was not completed but less than a packet sent, +it would complete the request successfully. That doesn't make sense +and can't really happen as fotg210_start_dma always sends +min(length, maxpkt) bytes. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 345827cf1b64..a3ad93bfd256 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -379,8 +379,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep, + } + if (ep->dir_in) { /* if IN */ + fotg210_start_dma(ep, req); +- if ((req->req.length == req->req.actual) || +- (req->req.actual < ep->ep.maxpacket)) ++ if (req->req.length == req->req.actual) + fotg210_done(ep, req, 0); + } else { /* OUT */ + u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0); +-- +2.30.2 + diff --git a/queue-5.10/fpga-fpga-mgr-xilinx-spi-fix-error-messages-on-eprob.patch b/queue-5.10/fpga-fpga-mgr-xilinx-spi-fix-error-messages-on-eprob.patch new file mode 100644 index 00000000000..24debdbf99f --- /dev/null +++ b/queue-5.10/fpga-fpga-mgr-xilinx-spi-fix-error-messages-on-eprob.patch @@ -0,0 +1,69 @@ +From 49f95d5e8fc1bd9a04d4aa6127f354e4b61945cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 13:13:13 +0100 +Subject: fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER + +From: Luca Ceresoli + +[ Upstream commit 484a58607a808c3721917f5ca5fba7eff809e4df ] + +The current code produces an error message on devm_gpiod_get() errors even +when the error is -EPROBE_DEFER, which should be silent. + +This has been observed producing a significant amount of messages like: + + xlnx-slave-spi spi1.1: Failed to get PROGRAM_B gpio: -517 + +Fix and simplify code by using the dev_err_probe() helper function. + +Signed-off-by: Luca Ceresoli +Fixes: dd2784c01d93 ("fpga manager: xilinx-spi: check INIT_B pin during write_init") +Fixes: 061c97d13f1a ("fpga manager: Add Xilinx slave serial SPI driver") +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/xilinx-spi.c | 24 +++++++++--------------- + 1 file changed, 9 insertions(+), 15 deletions(-) + +diff --git a/drivers/fpga/xilinx-spi.c b/drivers/fpga/xilinx-spi.c +index 824abbbd631e..d3e6f41e78bf 100644 +--- a/drivers/fpga/xilinx-spi.c ++++ b/drivers/fpga/xilinx-spi.c +@@ -233,25 +233,19 @@ static int xilinx_spi_probe(struct spi_device *spi) + + /* PROGRAM_B is active low */ + conf->prog_b = devm_gpiod_get(&spi->dev, "prog_b", GPIOD_OUT_LOW); +- if (IS_ERR(conf->prog_b)) { +- dev_err(&spi->dev, "Failed to get PROGRAM_B gpio: %ld\n", +- PTR_ERR(conf->prog_b)); +- return PTR_ERR(conf->prog_b); +- } ++ if (IS_ERR(conf->prog_b)) ++ return dev_err_probe(&spi->dev, PTR_ERR(conf->prog_b), ++ "Failed to get PROGRAM_B gpio\n"); + + conf->init_b = devm_gpiod_get_optional(&spi->dev, "init-b", GPIOD_IN); +- if (IS_ERR(conf->init_b)) { +- dev_err(&spi->dev, "Failed to get INIT_B gpio: %ld\n", +- PTR_ERR(conf->init_b)); +- return PTR_ERR(conf->init_b); +- } ++ if (IS_ERR(conf->init_b)) ++ return dev_err_probe(&spi->dev, PTR_ERR(conf->init_b), ++ "Failed to get INIT_B gpio\n"); + + conf->done = devm_gpiod_get(&spi->dev, "done", GPIOD_IN); +- if (IS_ERR(conf->done)) { +- dev_err(&spi->dev, "Failed to get DONE gpio: %ld\n", +- PTR_ERR(conf->done)); +- return PTR_ERR(conf->done); +- } ++ if (IS_ERR(conf->done)) ++ return dev_err_probe(&spi->dev, PTR_ERR(conf->done), ++ "Failed to get DONE gpio\n"); + + mgr = devm_fpga_mgr_create(&spi->dev, + "Xilinx Slave Serial FPGA Manager", +-- +2.30.2 + diff --git a/queue-5.10/gpio-guard-gpiochip_irqchip_add_domain-with-gpiolib_.patch b/queue-5.10/gpio-guard-gpiochip_irqchip_add_domain-with-gpiolib_.patch new file mode 100644 index 00000000000..256ec5a9c41 --- /dev/null +++ b/queue-5.10/gpio-guard-gpiochip_irqchip_add_domain-with-gpiolib_.patch @@ -0,0 +1,54 @@ +From ac6a022829f4b678812a2e66f9271825577a9bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 09:19:02 +0100 +Subject: gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit 9c7d24693d864f90b27aad5d15fbfe226c02898b ] + +The current code doesn't check if GPIOLIB_IRQCHIP is enabled, which results in +a compilation error when trying to build gpio-regmap if CONFIG_GPIOLIB_IRQCHIP +isn't enabled. + +Fixes: 6a45b0e2589f ("gpiolib: Introduce gpiochip_irqchip_add_domain()") +Suggested-by: Michael Walle +Signed-off-by: Álvaro Fernández Rojas +Reviewed-by: Linus Walleij +Reviewed-by: Michael Walle +Acked-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20210324081923.20379-2-noltari@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + include/linux/gpio/driver.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h +index 4a7e295c3640..8e144306e262 100644 +--- a/include/linux/gpio/driver.h ++++ b/include/linux/gpio/driver.h +@@ -637,8 +637,17 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gc, + bool gpiochip_irqchip_irq_valid(const struct gpio_chip *gc, + unsigned int offset); + ++#ifdef CONFIG_GPIOLIB_IRQCHIP + int gpiochip_irqchip_add_domain(struct gpio_chip *gc, + struct irq_domain *domain); ++#else ++static inline int gpiochip_irqchip_add_domain(struct gpio_chip *gc, ++ struct irq_domain *domain) ++{ ++ WARN_ON(1); ++ return -EINVAL; ++} ++#endif + + #ifdef CONFIG_LOCKDEP + +-- +2.30.2 + diff --git a/queue-5.10/gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch b/queue-5.10/gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch new file mode 100644 index 00000000000..9f68abb91bd --- /dev/null +++ b/queue-5.10/gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch @@ -0,0 +1,82 @@ +From a344f4693b481782f527088d053f259e48493ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 12:53:06 +0000 +Subject: gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check + +From: Alexander Lobakin + +[ Upstream commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 ] + +Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") +did the right thing, but missed the fact that napi_gro_frags() logics +calls for skb_gro_reset_offset() *before* pulling Ethernet header +to the skb linear space. +That said, the introduced check for frag0 address being aligned to 4 +always fails for it as Ethernet header is obviously 14 bytes long, +and in case with NET_IP_ALIGN its start is not aligned to 4. + +Fix this by adding @nhoff argument to skb_gro_reset_offset() which +tells if an IP header is placed right at the start of frag0 or not. +This restores Fast GRO for napi_gro_frags() that became very slow +after the mentioned commit, and preserves the introduced check to +avoid silent unaligned accesses. + +From v1 [0]: + - inline tiny skb_gro_reset_offset() to let the code be optimized + more efficively (esp. for the !NET_IP_ALIGN case) (Eric); + - pull in Reviewed-by from Eric. + +[0] https://lore.kernel.org/netdev/20210418114200.5839-1-alobakin@pm.me + +Fixes: 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") +Reviewed-by: Eric Dumazet +Signed-off-by: Alexander Lobakin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 64f4c7ec729d..2f17a4ac82f0 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5857,7 +5857,7 @@ static struct list_head *gro_list_prepare(struct napi_struct *napi, + return head; + } + +-static void skb_gro_reset_offset(struct sk_buff *skb) ++static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff) + { + const struct skb_shared_info *pinfo = skb_shinfo(skb); + const skb_frag_t *frag0 = &pinfo->frags[0]; +@@ -5868,7 +5868,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb) + + if (!skb_headlen(skb) && pinfo->nr_frags && + !PageHighMem(skb_frag_page(frag0)) && +- (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) { ++ (!NET_IP_ALIGN || !((skb_frag_off(frag0) + nhoff) & 3))) { + NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0); + NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int, + skb_frag_size(frag0), +@@ -6101,7 +6101,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb) + skb_mark_napi_id(skb, napi); + trace_napi_gro_receive_entry(skb); + +- skb_gro_reset_offset(skb); ++ skb_gro_reset_offset(skb, 0); + + ret = napi_skb_finish(napi, skb, dev_gro_receive(napi, skb)); + trace_napi_gro_receive_exit(ret); +@@ -6194,7 +6194,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi) + napi->skb = NULL; + + skb_reset_mac_header(skb); +- skb_gro_reset_offset(skb); ++ skb_gro_reset_offset(skb, hlen); + + if (unlikely(skb_gro_header_hard(skb, hlen))) { + eth = skb_gro_header_slow(skb, hlen, 0); +-- +2.30.2 + diff --git a/queue-5.10/hid-lenovo-check-hid_get_drvdata-returns-non-null-in.patch b/queue-5.10/hid-lenovo-check-hid_get_drvdata-returns-non-null-in.patch new file mode 100644 index 00000000000..942f50c9539 --- /dev/null +++ b/queue-5.10/hid-lenovo-check-hid_get_drvdata-returns-non-null-in.patch @@ -0,0 +1,51 @@ +From 66ce38973cf971681355ef9883218cdaeb4ed1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 10:04:26 +0200 +Subject: HID: lenovo: Check hid_get_drvdata() returns non NULL in + lenovo_event() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 34348a8661e3cd67dcf6938f08c8bb77522301f7 ] + +The HID lenovo probe function only attaches drvdata to one of the +USB interfaces, but lenovo_event() will get called for all USB interfaces +to which hid-lenovo is bound. + +This allows a malicious device to fake being a device handled by +hid-lenovo, which generates events for which lenovo_event() has +special handling (and thus dereferences hid_get_drvdata()) on another +interface triggering a NULL pointer exception. + +Add a check for hid_get_drvdata() returning NULL, avoiding this +possible NULL pointer exception. + +Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") +Reviewed-by: Marek Behún +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index ee175ab54281..b2596ed37880 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -508,6 +508,9 @@ static int lenovo_event_cptkbd(struct hid_device *hdev, + static int lenovo_event(struct hid_device *hdev, struct hid_field *field, + struct hid_usage *usage, __s32 value) + { ++ if (!hid_get_drvdata(hdev)) ++ return 0; ++ + switch (hdev->product) { + case USB_DEVICE_ID_LENOVO_CUSBKBD: + case USB_DEVICE_ID_LENOVO_CBTKBD: +-- +2.30.2 + diff --git a/queue-5.10/hid-lenovo-fix-lenovo_led_set_tp10ubkbd-error-handli.patch b/queue-5.10/hid-lenovo-fix-lenovo_led_set_tp10ubkbd-error-handli.patch new file mode 100644 index 00000000000..bf85e4dfbd8 --- /dev/null +++ b/queue-5.10/hid-lenovo-fix-lenovo_led_set_tp10ubkbd-error-handli.patch @@ -0,0 +1,130 @@ +From 450223937e6df42b1d84fdea18ee2d60144d1f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 10:04:25 +0200 +Subject: HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 658d04e6eb6be1601ae95d7bee92bbf4096cdc1e ] + +Fix the following issues with lenovo_led_set_tp10ubkbd() error handling: + +1. On success hid_hw_raw_request() returns the number of bytes sent. + So we should check for (ret != 3) rather then for (ret != 0). + +2. Actually propagate errors to the caller. + +3. Since the LEDs are part of an USB keyboard-dock the mute LEDs can go + away at any time. Don't log an error when ret == -ENODEV and set the + LED_HW_PLUGGABLE flag to avoid errors getting logged when the USB gets + disconnected. + +Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") +Reviewed-by: Marek Behún +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index 4dc5e5f932ed..ee175ab54281 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -62,8 +62,8 @@ struct lenovo_drvdata { + #define TP10UBKBD_LED_OFF 1 + #define TP10UBKBD_LED_ON 2 + +-static void lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code, +- enum led_brightness value) ++static int lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code, ++ enum led_brightness value) + { + struct lenovo_drvdata *data = hid_get_drvdata(hdev); + int ret; +@@ -75,10 +75,18 @@ static void lenovo_led_set_tp10ubkbd(struct hid_device *hdev, u8 led_code, + data->led_report[2] = value ? TP10UBKBD_LED_ON : TP10UBKBD_LED_OFF; + ret = hid_hw_raw_request(hdev, data->led_report[0], data->led_report, 3, + HID_OUTPUT_REPORT, HID_REQ_SET_REPORT); +- if (ret) +- hid_err(hdev, "Set LED output report error: %d\n", ret); ++ if (ret != 3) { ++ if (ret != -ENODEV) ++ hid_err(hdev, "Set LED output report error: %d\n", ret); ++ ++ ret = ret < 0 ? ret : -EIO; ++ } else { ++ ret = 0; ++ } + + mutex_unlock(&data->led_report_mutex); ++ ++ return ret; + } + + static void lenovo_tp10ubkbd_sync_fn_lock(struct work_struct *work) +@@ -349,7 +357,7 @@ static ssize_t attr_fn_lock_store(struct device *dev, + { + struct hid_device *hdev = to_hid_device(dev); + struct lenovo_drvdata *data = hid_get_drvdata(hdev); +- int value; ++ int value, ret; + + if (kstrtoint(buf, 10, &value)) + return -EINVAL; +@@ -364,7 +372,9 @@ static ssize_t attr_fn_lock_store(struct device *dev, + lenovo_features_set_cptkbd(hdev); + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: +- lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value); ++ ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value); ++ if (ret) ++ return ret; + break; + } + +@@ -785,6 +795,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev, + struct lenovo_drvdata *data_pointer = hid_get_drvdata(hdev); + u8 tp10ubkbd_led[] = { TP10UBKBD_MUTE_LED, TP10UBKBD_MICMUTE_LED }; + int led_nr = 0; ++ int ret = 0; + + if (led_cdev == &data_pointer->led_micmute) + led_nr = 1; +@@ -799,11 +810,11 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev, + lenovo_led_set_tpkbd(hdev); + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: +- lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value); ++ ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value); + break; + } + +- return 0; ++ return ret; + } + + static int lenovo_register_leds(struct hid_device *hdev) +@@ -825,6 +836,7 @@ static int lenovo_register_leds(struct hid_device *hdev) + data->led_mute.name = name_mute; + data->led_mute.brightness_get = lenovo_led_brightness_get; + data->led_mute.brightness_set_blocking = lenovo_led_brightness_set; ++ data->led_mute.flags = LED_HW_PLUGGABLE; + data->led_mute.dev = &hdev->dev; + ret = led_classdev_register(&hdev->dev, &data->led_mute); + if (ret < 0) +@@ -833,6 +845,7 @@ static int lenovo_register_leds(struct hid_device *hdev) + data->led_micmute.name = name_micm; + data->led_micmute.brightness_get = lenovo_led_brightness_get; + data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set; ++ data->led_micmute.flags = LED_HW_PLUGGABLE; + data->led_micmute.dev = &hdev->dev; + ret = led_classdev_register(&hdev->dev, &data->led_micmute); + if (ret < 0) { +-- +2.30.2 + diff --git a/queue-5.10/hid-lenovo-map-mic-mute-button-to-key_f20-instead-of.patch b/queue-5.10/hid-lenovo-map-mic-mute-button-to-key_f20-instead-of.patch new file mode 100644 index 00000000000..8d9fca2b9d4 --- /dev/null +++ b/queue-5.10/hid-lenovo-map-mic-mute-button-to-key_f20-instead-of.patch @@ -0,0 +1,74 @@ +From 72e0f93ae496f9d6545abee11ea479ec0b47b658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 10:04:29 +0200 +Subject: HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 617103246cfd19af837e4cb614ba9f877c4f7779 ] + +Mapping the mic-mute button to KEY_MICMUTE is technically correct but +KEY_MICMUTE translates to a scancode of 256 (248 + 8) under X, +which does not fit in 8 bits, so it does not work. + +Because of this userspace is expecting KEY_F20 instead, +theoretically KEY_MICMUTE should work under Wayland but even +there it does not work, because the desktop-environment is +listening only for KEY_F20 and not for KEY_MICMUTE. + +Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") +Reviewed-by: Marek Behún +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index b2596ed37880..0ff03fed9770 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -33,6 +33,9 @@ + + #include "hid-ids.h" + ++/* Userspace expects F20 for mic-mute KEY_MICMUTE does not work */ ++#define LENOVO_KEY_MICMUTE KEY_F20 ++ + struct lenovo_drvdata { + u8 led_report[3]; /* Must be first for proper alignment */ + int led_state; +@@ -134,7 +137,7 @@ static int lenovo_input_mapping_tpkbd(struct hid_device *hdev, + if (usage->hid == (HID_UP_BUTTON | 0x0010)) { + /* This sub-device contains trackpoint, mark it */ + hid_set_drvdata(hdev, (void *)1); +- map_key_clear(KEY_MICMUTE); ++ map_key_clear(LENOVO_KEY_MICMUTE); + return 1; + } + return 0; +@@ -149,7 +152,7 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev, + (usage->hid & HID_USAGE_PAGE) == HID_UP_LNVENDOR) { + switch (usage->hid & HID_USAGE) { + case 0x00f1: /* Fn-F4: Mic mute */ +- map_key_clear(KEY_MICMUTE); ++ map_key_clear(LENOVO_KEY_MICMUTE); + return 1; + case 0x00f2: /* Fn-F5: Brightness down */ + map_key_clear(KEY_BRIGHTNESSDOWN); +@@ -239,7 +242,7 @@ static int lenovo_input_mapping_tp10_ultrabook_kbd(struct hid_device *hdev, + map_key_clear(KEY_FN_ESC); + return 1; + case 9: /* Fn-F4: Mic mute */ +- map_key_clear(KEY_MICMUTE); ++ map_key_clear(LENOVO_KEY_MICMUTE); + return 1; + case 10: /* Fn-F7: Control panel */ + map_key_clear(KEY_CONFIG); +-- +2.30.2 + diff --git a/queue-5.10/hid-lenovo-use-brightness_set_blocking-callback-for-.patch b/queue-5.10/hid-lenovo-use-brightness_set_blocking-callback-for-.patch new file mode 100644 index 00000000000..8d84f6a8104 --- /dev/null +++ b/queue-5.10/hid-lenovo-use-brightness_set_blocking-callback-for-.patch @@ -0,0 +1,73 @@ +From b499876ec5ed0640f2276a48155c72a72e3341f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 10:04:24 +0200 +Subject: HID: lenovo: Use brightness_set_blocking callback for setting LEDs + brightness +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit bbf62645255f120bc2e7488c237e3f04da42ec70 ] + +The lenovo_led_brightness_set function may sleep, so we should have the +the led_class_dev's brightness_set_blocking callback point to it, rather +then the regular brightness_set callback. + +When toggled through sysfs this is not a problem, but the brightness_set +callback may be called from atomic context when using LED-triggers. + +Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") +Reviewed-by: Marek Behún +Acked-by: Pavel Machek +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index c6c8e20f3e8d..4dc5e5f932ed 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -777,7 +777,7 @@ static enum led_brightness lenovo_led_brightness_get( + : LED_OFF; + } + +-static void lenovo_led_brightness_set(struct led_classdev *led_cdev, ++static int lenovo_led_brightness_set(struct led_classdev *led_cdev, + enum led_brightness value) + { + struct device *dev = led_cdev->dev->parent; +@@ -802,6 +802,8 @@ static void lenovo_led_brightness_set(struct led_classdev *led_cdev, + lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value); + break; + } ++ ++ return 0; + } + + static int lenovo_register_leds(struct hid_device *hdev) +@@ -822,7 +824,7 @@ static int lenovo_register_leds(struct hid_device *hdev) + + data->led_mute.name = name_mute; + data->led_mute.brightness_get = lenovo_led_brightness_get; +- data->led_mute.brightness_set = lenovo_led_brightness_set; ++ data->led_mute.brightness_set_blocking = lenovo_led_brightness_set; + data->led_mute.dev = &hdev->dev; + ret = led_classdev_register(&hdev->dev, &data->led_mute); + if (ret < 0) +@@ -830,7 +832,7 @@ static int lenovo_register_leds(struct hid_device *hdev) + + data->led_micmute.name = name_micm; + data->led_micmute.brightness_get = lenovo_led_brightness_get; +- data->led_micmute.brightness_set = lenovo_led_brightness_set; ++ data->led_micmute.brightness_set_blocking = lenovo_led_brightness_set; + data->led_micmute.dev = &hdev->dev; + ret = led_classdev_register(&hdev->dev, &data->led_micmute); + if (ret < 0) { +-- +2.30.2 + diff --git a/queue-5.10/hid-plantronics-workaround-for-double-volume-key-pre.patch b/queue-5.10/hid-plantronics-workaround-for-double-volume-key-pre.patch new file mode 100644 index 00000000000..799273ba32d --- /dev/null +++ b/queue-5.10/hid-plantronics-workaround-for-double-volume-key-pre.patch @@ -0,0 +1,181 @@ +From f080dc5de988cf85f05b8be15aaf4149c1addd1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Feb 2021 16:47:40 +0200 +Subject: HID: plantronics: Workaround for double volume key presses + +From: Maxim Mikityanskiy + +[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ] + +Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice +for each volume key press. This patch adds a quirk to hid-plantronics +for this product ID, which will ignore the second volume key press if +it happens within 5 ms from the last one that was handled. + +The patch was tested on the mentioned model only, it shouldn't affect +other models, however, this quirk might be needed for them too. +Auto-repeat (when a key is held pressed) is not affected, because the +rate is about 3 times per second, which is far less frequent than once +in 5 ms. + +Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++-- + include/linux/hid.h | 2 ++ + 3 files changed, 61 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b93ce0d475e0..e220a05a05b4 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -938,6 +938,7 @@ + #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003 + + #define USB_VENDOR_ID_PLANTRONICS 0x047f ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056 + + #define USB_VENDOR_ID_PANASONIC 0x04da + #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044 +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index 85b685efc12f..e81b7cec2d12 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -13,6 +13,7 @@ + + #include + #include ++#include + + #define PLT_HID_1_0_PAGE 0xffa00000 + #define PLT_HID_2_0_PAGE 0xffa20000 +@@ -36,6 +37,16 @@ + #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ + (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) + ++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) ++ ++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */ ++ ++struct plt_drv_data { ++ unsigned long device_type; ++ unsigned long last_volume_key_ts; ++ u32 quirks; ++}; ++ + static int plantronics_input_mapping(struct hid_device *hdev, + struct hid_input *hi, + struct hid_field *field, +@@ -43,7 +54,8 @@ static int plantronics_input_mapping(struct hid_device *hdev, + unsigned long **bit, int *max) + { + unsigned short mapped_key; +- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ unsigned long plt_type = drv_data->device_type; + + /* special case for PTT products */ + if (field->application == HID_GD_JOYSTICK) +@@ -105,6 +117,30 @@ mapped: + return 1; + } + ++static int plantronics_event(struct hid_device *hdev, struct hid_field *field, ++ struct hid_usage *usage, __s32 value) ++{ ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ ++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) { ++ unsigned long prev_ts, cur_ts; ++ ++ /* Usages are filtered in plantronics_usages. */ ++ ++ if (!value) /* Handle key presses only. */ ++ return 0; ++ ++ prev_ts = drv_data->last_volume_key_ts; ++ cur_ts = jiffies; ++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT) ++ return 1; /* Ignore the repeated key. */ ++ ++ drv_data->last_volume_key_ts = cur_ts; ++ } ++ ++ return 0; ++} ++ + static unsigned long plantronics_device_type(struct hid_device *hdev) + { + unsigned i, col_page; +@@ -133,15 +169,24 @@ exit: + static int plantronics_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { ++ struct plt_drv_data *drv_data; + int ret; + ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); ++ if (!drv_data) ++ return -ENOMEM; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); + goto err; + } + +- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev)); ++ drv_data->device_type = plantronics_device_type(hdev); ++ drv_data->quirks = id->driver_data; ++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); ++ ++ hid_set_drvdata(hdev, drv_data); + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT | + HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE); +@@ -153,15 +198,26 @@ err: + } + + static const struct hid_device_id plantronics_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, + { } + }; + MODULE_DEVICE_TABLE(hid, plantronics_devices); + ++static const struct hid_usage_id plantronics_usages[] = { ++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID }, ++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID }, ++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR } ++}; ++ + static struct hid_driver plantronics_driver = { + .name = "plantronics", + .id_table = plantronics_devices, ++ .usage_table = plantronics_usages, + .input_mapping = plantronics_input_mapping, ++ .event = plantronics_event, + .probe = plantronics_probe, + }; + module_hid_driver(plantronics_driver); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 58684657960b..8578db50ad73 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -262,6 +262,8 @@ struct hid_item { + #define HID_CP_SELECTION 0x000c0080 + #define HID_CP_MEDIASELECTION 0x000c0087 + #define HID_CP_SELECTDISC 0x000c00ba ++#define HID_CP_VOLUMEUP 0x000c00e9 ++#define HID_CP_VOLUMEDOWN 0x000c00ea + #define HID_CP_PLAYBACKSPEED 0x000c00f1 + #define HID_CP_PROXIMITY 0x000c0109 + #define HID_CP_SPEAKERSYSTEM 0x000c0160 +-- +2.30.2 + diff --git a/queue-5.10/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch b/queue-5.10/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch new file mode 100644 index 00000000000..34fac7c285e --- /dev/null +++ b/queue-5.10/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch @@ -0,0 +1,46 @@ +From a36d3b23ae6bc5c90021bb16f3ece6155789bba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:08:17 +0300 +Subject: HSI: core: fix resource leaks in hsi_add_client_from_dt() + +From: Dan Carpenter + +[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ] + +If some of the allocations fail between the dev_set_name() and the +device_register() then the name will not be freed. Fix this by +moving dev_set_name() directly in front of the call to device_register(). + +Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices") +Signed-off-by: Dan Carpenter +Reviewed-by: Jason Gunthorpe +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/hsi_core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c +index 47f0208aa7c3..a5f92e2889cb 100644 +--- a/drivers/hsi/hsi_core.c ++++ b/drivers/hsi/hsi_core.c +@@ -210,8 +210,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + if (err) + goto err; + +- dev_set_name(&cl->device, "%s", name); +- + err = hsi_of_property_parse_mode(client, "hsi-mode", &mode); + if (err) { + err = hsi_of_property_parse_mode(client, "hsi-rx-mode", +@@ -293,6 +291,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + cl->device.release = hsi_client_release; + cl->device.of_node = client; + ++ dev_set_name(&cl->device, "%s", name); + if (device_register(&cl->device) < 0) { + pr_err("hsi: failed to register client: %s\n", name); + put_device(&cl->device); +-- +2.30.2 + diff --git a/queue-5.10/hwmon-pmbus-pxe1610-don-t-bail-out-when-not-all-page.patch b/queue-5.10/hwmon-pmbus-pxe1610-don-t-bail-out-when-not-all-page.patch new file mode 100644 index 00000000000..7caef667633 --- /dev/null +++ b/queue-5.10/hwmon-pmbus-pxe1610-don-t-bail-out-when-not-all-page.patch @@ -0,0 +1,44 @@ +From d38f5b7f0c286fd731e411e192561fd8a738b243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 13:29:04 +0300 +Subject: hwmon: (pmbus/pxe1610) don't bail out when not all pages are active + +From: Paul Fertser + +[ Upstream commit f025314306ae17a3fdaf2874d7e878ce19cea363 ] + +Certain VRs might be configured to use only the first output channel and +so the mode for the second will be 0. Handle this gracefully. + +Fixes: b9fa0a3acfd8 ("hwmon: (pmbus/core) Add support for vid mode detection per page bases") +Signed-off-by: Paul Fertser +Link: https://lore.kernel.org/r/20210416102926.13614-1-fercerpav@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/pxe1610.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c +index fa5c5dd29b7a..212433eb6cc3 100644 +--- a/drivers/hwmon/pmbus/pxe1610.c ++++ b/drivers/hwmon/pmbus/pxe1610.c +@@ -41,6 +41,15 @@ static int pxe1610_identify(struct i2c_client *client, + info->vrm_version[i] = vr13; + break; + default: ++ /* ++ * If prior pages are available limit operation ++ * to them ++ */ ++ if (i != 0) { ++ info->pages = i; ++ return 0; ++ } ++ + return -ENODEV; + } + } +-- +2.30.2 + diff --git a/queue-5.10/i2c-cadence-add-irq-check.patch b/queue-5.10/i2c-cadence-add-irq-check.patch new file mode 100644 index 00000000000..88191b2fc61 --- /dev/null +++ b/queue-5.10/i2c-cadence-add-irq-check.patch @@ -0,0 +1,42 @@ +From 133b3bdfe436760c14e9add3d475755d11ace770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:14:35 +0300 +Subject: i2c: cadence: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index e8eae8725900..c1bbc4caeb5c 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -1200,7 +1200,10 @@ static int cdns_i2c_probe(struct platform_device *pdev) + if (IS_ERR(id->membase)) + return PTR_ERR(id->membase); + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.owner = THIS_MODULE; + id->adap.dev.of_node = pdev->dev.of_node; +-- +2.30.2 + diff --git a/queue-5.10/i2c-cadence-fix-reference-leak-when-pm_runtime_get_s.patch b/queue-5.10/i2c-cadence-fix-reference-leak-when-pm_runtime_get_s.patch new file mode 100644 index 00000000000..d5fdaf756b9 --- /dev/null +++ b/queue-5.10/i2c-cadence-fix-reference-leak-when-pm_runtime_get_s.patch @@ -0,0 +1,53 @@ +From 978dbc2f9fccdf99e43fc95b3b4722e0e27b010d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:17 +0800 +Subject: i2c: cadence: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 ] + +The PM reference count is not expected to be incremented on +return in functions cdns_i2c_master_xfer and cdns_reg_slave. + +However, pm_runtime_get_sync will increment pm usage counter +even failed. Forgetting to putting operation will result in a +reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 7fa32329ca03 ("i2c: cadence: Move to sensible power management") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index e4b7f2a951ad..e8eae8725900 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -789,7 +789,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + bool change_role = false; + #endif + +- ret = pm_runtime_get_sync(id->dev); ++ ret = pm_runtime_resume_and_get(id->dev); + if (ret < 0) + return ret; + +@@ -911,7 +911,7 @@ static int cdns_reg_slave(struct i2c_client *slave) + if (slave->flags & I2C_CLIENT_TEN) + return -EAFNOSUPPORT; + +- ret = pm_runtime_get_sync(id->dev); ++ ret = pm_runtime_resume_and_get(id->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-emev2-add-irq-check.patch b/queue-5.10/i2c-emev2-add-irq-check.patch new file mode 100644 index 00000000000..2a45ab97ef8 --- /dev/null +++ b/queue-5.10/i2c-emev2-add-irq-check.patch @@ -0,0 +1,42 @@ +From 986dea18c531a2319aad9d03fcea492dee6e307f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:16:41 +0300 +Subject: i2c: emev2: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: 5faf6e1f58b4 ("i2c: emev2: add driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-emev2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index a08554c1a570..bdff0e6345d9 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -395,7 +395,10 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- priv->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err_clk; ++ priv->irq = ret; + ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) +-- +2.30.2 + diff --git a/queue-5.10/i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch b/queue-5.10/i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch new file mode 100644 index 00000000000..d6c02436227 --- /dev/null +++ b/queue-5.10/i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch @@ -0,0 +1,53 @@ +From 4faa6a48476df07b37b8b62e15458fecf56d4f2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:39 +0800 +Subject: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ] + +The PM reference count is not expected to be incremented on +return in functions img_i2c_xfer and img_i2c_init. + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 93222bd9b966 ("i2c: img-scb: Add runtime PM") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-img-scb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c +index 98a89301ed2a..8e987945ed45 100644 +--- a/drivers/i2c/busses/i2c-img-scb.c ++++ b/drivers/i2c/busses/i2c-img-scb.c +@@ -1057,7 +1057,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, + atomic = true; + } + +- ret = pm_runtime_get_sync(adap->dev.parent); ++ ret = pm_runtime_resume_and_get(adap->dev.parent); + if (ret < 0) + return ret; + +@@ -1158,7 +1158,7 @@ static int img_i2c_init(struct img_i2c *i2c) + u32 rev; + int ret; + +- ret = pm_runtime_get_sync(i2c->adap.dev.parent); ++ ret = pm_runtime_resume_and_get(i2c->adap.dev.parent); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-imx-fix-reference-leak-when-pm_runtime_get_sync-.patch b/queue-5.10/i2c-imx-fix-reference-leak-when-pm_runtime_get_sync-.patch new file mode 100644 index 00000000000..778bb73f3e4 --- /dev/null +++ b/queue-5.10/i2c-imx-fix-reference-leak-when-pm_runtime_get_sync-.patch @@ -0,0 +1,54 @@ +From c31186395dd5329287f9a7e89e5fa068a85da0ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:41 +0800 +Subject: i2c: imx: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 47ff617217ca6a13194fcb35c6c3a0c57c080693 ] + +In i2c_imx_xfer() and i2c_imx_remove(), the pm reference count +is not expected to be incremented on return. + +However, pm_runtime_get_sync will increment pm reference count +even failed. Forgetting to putting operation will result in a +reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 3a5ee18d2a32 ("i2c: imx: implement master_xfer_atomic callback") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Reviewed-by: Oleksij Rempel +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index e6f8d6e45a15..72af4b4d1318 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1036,7 +1036,7 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter, + struct imx_i2c_struct *i2c_imx = i2c_get_adapdata(adapter); + int result; + +- result = pm_runtime_get_sync(i2c_imx->adapter.dev.parent); ++ result = pm_runtime_resume_and_get(i2c_imx->adapter.dev.parent); + if (result < 0) + return result; + +@@ -1280,7 +1280,7 @@ static int i2c_imx_remove(struct platform_device *pdev) + struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev); + int irq, ret; + +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch b/queue-5.10/i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch new file mode 100644 index 00000000000..9755aeaa920 --- /dev/null +++ b/queue-5.10/i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch @@ -0,0 +1,44 @@ +From 538aabfc67546e647f321f300a08b84c75f6d289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:40 +0800 +Subject: i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 ] + +The PM reference count is not expected to be incremented on +return in lpi2c_imx_master_enable. + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c +index 9db6ccded5e9..8b9ba055c418 100644 +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -259,7 +259,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx) + unsigned int temp; + int ret; + +- ret = pm_runtime_get_sync(lpi2c_imx->adapter.dev.parent); ++ ret = pm_runtime_resume_and_get(lpi2c_imx->adapter.dev.parent); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-jz4780-add-irq-check.patch b/queue-5.10/i2c-jz4780-add-irq-check.patch new file mode 100644 index 00000000000..b18974fc2f5 --- /dev/null +++ b/queue-5.10/i2c-jz4780-add-irq-check.patch @@ -0,0 +1,42 @@ +From b732bccb28a5e447019713ca54aadc64013b3dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:18:31 +0300 +Subject: i2c: jz4780: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-jz4780.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c +index 2a946c207928..e181db3fd2cc 100644 +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -826,7 +826,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev) + + jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0); + +- i2c->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err; ++ i2c->irq = ret; + ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0, + dev_name(&pdev->dev), i2c); + if (ret) +-- +2.30.2 + diff --git a/queue-5.10/i2c-mediatek-fix-wrong-dma-sync-flag.patch b/queue-5.10/i2c-mediatek-fix-wrong-dma-sync-flag.patch new file mode 100644 index 00000000000..1e5fb6a3251 --- /dev/null +++ b/queue-5.10/i2c-mediatek-fix-wrong-dma-sync-flag.patch @@ -0,0 +1,35 @@ +From 7209b3e140d525fb54ac8fb58d307075347fe70c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 14:46:51 +0800 +Subject: i2c: mediatek: Fix wrong dma sync flag + +From: Qii Wang + +[ Upstream commit 3186b880447ad3cc9b6487fa626a71d64b831524 ] + +The right flag is apdma_sync when apdma remove hand-shake signel. + +Fixes: 05f6f7271a38 ("i2c: mediatek: Fix apdma and i2c hand-shake timeout") +Signed-off-by: Qii Wang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 2ffd2f354d0a..86f70c751319 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -479,7 +479,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) + { + u16 control_reg; + +- if (i2c->dev_comp->dma_sync) { ++ if (i2c->dev_comp->apdma_sync) { + writel(I2C_DMA_WARM_RST, i2c->pdmabase + OFFSET_RST); + udelay(10); + writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST); +-- +2.30.2 + diff --git a/queue-5.10/i2c-mlxbf-add-irq-check.patch b/queue-5.10/i2c-mlxbf-add-irq-check.patch new file mode 100644 index 00000000000..b6f5d5770b8 --- /dev/null +++ b/queue-5.10/i2c-mlxbf-add-irq-check.patch @@ -0,0 +1,39 @@ +From ddd8e435ebb92154f335c6a0c9d92f77a9c40e50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:20:49 +0300 +Subject: i2c: mlxbf: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 0d3bf53e897dce943b98d975bbde77156af6cd81 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mlxbf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c +index 2fb0532d8a16..ab261d762dea 100644 +--- a/drivers/i2c/busses/i2c-mlxbf.c ++++ b/drivers/i2c/busses/i2c-mlxbf.c +@@ -2376,6 +2376,8 @@ static int mlxbf_i2c_probe(struct platform_device *pdev) + mlxbf_i2c_init_slave(pdev, priv); + + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + ret = devm_request_irq(dev, irq, mlxbf_smbus_irq, + IRQF_ONESHOT | IRQF_SHARED | IRQF_PROBE_SHARED, + dev_name(dev), priv); +-- +2.30.2 + diff --git a/queue-5.10/i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch b/queue-5.10/i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch new file mode 100644 index 00000000000..df5dc9f9ee3 --- /dev/null +++ b/queue-5.10/i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch @@ -0,0 +1,71 @@ +From c6ec178c5d91fb578db950236c865517db5e1d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:43 +0800 +Subject: i2c: omap: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 780f629741257ed6c54bd3eb53b57f648eabf200 ] + +The PM reference count is not expected to be incremented on +return in omap_i2c_probe() and omap_i2c_remove(). + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. I Replace it with pm_runtime_resume_and_get +to keep usage counter balanced. + +What's more, error path 'err_free_mem' seems not like a proper +name any more. So I change the name to err_disable_pm and move +pm_runtime_disable below, for pm_runtime of 'pdev->dev' should +be disabled when pm_runtime_resume_and_get fails. + +Fixes: 3b0fb97c8dc4 ("I2C: OMAP: Handle error check for pm runtime") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Reviewed-by: Grygorii Strashko +Reviewed-by: Vignesh Raghavendra +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-omap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c +index 12ac4212aded..d4f6c6d60683 100644 +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1404,9 +1404,9 @@ omap_i2c_probe(struct platform_device *pdev) + pm_runtime_set_autosuspend_delay(omap->dev, OMAP_I2C_PM_TIMEOUT); + pm_runtime_use_autosuspend(omap->dev); + +- r = pm_runtime_get_sync(omap->dev); ++ r = pm_runtime_resume_and_get(omap->dev); + if (r < 0) +- goto err_free_mem; ++ goto err_disable_pm; + + /* + * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2. +@@ -1513,8 +1513,8 @@ err_unuse_clocks: + omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0); + pm_runtime_dont_use_autosuspend(omap->dev); + pm_runtime_put_sync(omap->dev); ++err_disable_pm: + pm_runtime_disable(&pdev->dev); +-err_free_mem: + + return r; + } +@@ -1525,7 +1525,7 @@ static int omap_i2c_remove(struct platform_device *pdev) + int ret; + + i2c_del_adapter(&omap->adapter); +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-rcar-add-irq-check.patch b/queue-5.10/i2c-rcar-add-irq-check.patch new file mode 100644 index 00000000000..8eb66564972 --- /dev/null +++ b/queue-5.10/i2c-rcar-add-irq-check.patch @@ -0,0 +1,43 @@ +From 1d0aa51675648d4464e58dc8a4d0ce38c12d546e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:23:33 +0300 +Subject: i2c: rcar: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 147178cf03a6dcb337e703d4dacd008683022a58 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with the +invalid IRQ #s. + +Fixes: 6ccbe607132b ("i2c: add Renesas R-Car I2C driver") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 12f6d452c0f7..8722ca23f889 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -1027,7 +1027,10 @@ static int rcar_i2c_probe(struct platform_device *pdev) + if (of_property_read_bool(dev->of_node, "smbus")) + priv->flags |= ID_P_HOST_NOTIFY; + +- priv->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto out_pm_disable; ++ priv->irq = ret; + ret = devm_request_irq(dev, priv->irq, irqhandler, irqflags, dev_name(dev), priv); + if (ret < 0) { + dev_err(dev, "cannot get irq %d\n", priv->irq); +-- +2.30.2 + diff --git a/queue-5.10/i2c-rcar-make-sure-irq-is-not-threaded-on-gen2-and-e.patch b/queue-5.10/i2c-rcar-make-sure-irq-is-not-threaded-on-gen2-and-e.patch new file mode 100644 index 00000000000..de793cbf8bb --- /dev/null +++ b/queue-5.10/i2c-rcar-make-sure-irq-is-not-threaded-on-gen2-and-e.patch @@ -0,0 +1,56 @@ +From 9b1fea730a677315cdc9414aec0303ca6b042324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 18:21:53 +0100 +Subject: i2c: rcar: make sure irq is not threaded on Gen2 and earlier +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit 24c6d4bc563881539d2cd4433e502436ad87d512 ] + +Ensure this irq runs as fast as possible. + +Signed-off-by: Wolfram Sang +Reviewed-by: Niklas Söderlund +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index ad6630e3cc77..3c9c3a6f7ac8 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -928,6 +928,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + struct rcar_i2c_priv *priv; + struct i2c_adapter *adap; + struct device *dev = &pdev->dev; ++ unsigned long irqflags = 0; + int ret; + + /* Otherwise logic will break because some bytes must always use PIO */ +@@ -976,6 +977,9 @@ static int rcar_i2c_probe(struct platform_device *pdev) + + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + ++ if (priv->devtype < I2C_RCAR_GEN3) ++ irqflags |= IRQF_NO_THREAD; ++ + if (priv->devtype == I2C_RCAR_GEN3) { + priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); + if (!IS_ERR(priv->rstc)) { +@@ -995,7 +999,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + priv->flags |= ID_P_HOST_NOTIFY; + + priv->irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv); ++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, irqflags, dev_name(dev), priv); + if (ret < 0) { + dev_err(dev, "cannot get irq %d\n", priv->irq); + goto out_pm_disable; +-- +2.30.2 + diff --git a/queue-5.10/i2c-rcar-protect-against-supurious-interrupts-on-v3u.patch b/queue-5.10/i2c-rcar-protect-against-supurious-interrupts-on-v3u.patch new file mode 100644 index 00000000000..b63af60b670 --- /dev/null +++ b/queue-5.10/i2c-rcar-protect-against-supurious-interrupts-on-v3u.patch @@ -0,0 +1,128 @@ +From f85810cdce9d1474e8c1d810f373cd8f1679834c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 18:21:54 +0100 +Subject: i2c: rcar: protect against supurious interrupts on V3U +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit 9c975c432bc0aa53a90438fc80b369cb35134a48 ] + +V3U creates spurious interrupts which we need to handle. This costs time +until BUS_PHASE_DATA can be activated which is problematic for Gen2 SoCs +and earlier. Because of this we introduce two interrupt handlers here +which will call a generic main irq function once the timing critical +stuff is done. + +Signed-off-by: Wolfram Sang +Reviewed-by: Niklas Söderlund +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 57 ++++++++++++++++++++++++++--------- + 1 file changed, 43 insertions(+), 14 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 3c9c3a6f7ac8..12f6d452c0f7 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -625,20 +625,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + * generated. It turned out that taking a spinlock at the beginning of the ISR + * was already causing repeated messages. Thus, this driver was converted to + * the now lockless behaviour. Please keep this in mind when hacking the driver. ++ * R-Car Gen3 seems to have this fixed but earlier versions than R-Car Gen2 are ++ * likely affected. Therefore, we have different interrupt handler entries. + */ +-static irqreturn_t rcar_i2c_irq(int irq, void *ptr) ++static irqreturn_t rcar_i2c_irq(int irq, struct rcar_i2c_priv *priv, u32 msr) + { +- struct rcar_i2c_priv *priv = ptr; +- u32 msr; +- +- /* Clear START or STOP immediately, except for REPSTART after read */ +- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) +- rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA); +- +- msr = rcar_i2c_read(priv, ICMSR); +- +- /* Only handle interrupts that are currently enabled */ +- msr &= rcar_i2c_read(priv, ICMIER); + if (!msr) { + if (rcar_i2c_slave_irq(priv)) + return IRQ_HANDLED; +@@ -682,6 +673,41 @@ out: + return IRQ_HANDLED; + } + ++static irqreturn_t rcar_i2c_gen2_irq(int irq, void *ptr) ++{ ++ struct rcar_i2c_priv *priv = ptr; ++ u32 msr; ++ ++ /* Clear START or STOP immediately, except for REPSTART after read */ ++ if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) ++ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA); ++ ++ /* Only handle interrupts that are currently enabled */ ++ msr = rcar_i2c_read(priv, ICMSR); ++ msr &= rcar_i2c_read(priv, ICMIER); ++ ++ return rcar_i2c_irq(irq, priv, msr); ++} ++ ++static irqreturn_t rcar_i2c_gen3_irq(int irq, void *ptr) ++{ ++ struct rcar_i2c_priv *priv = ptr; ++ u32 msr; ++ ++ /* Only handle interrupts that are currently enabled */ ++ msr = rcar_i2c_read(priv, ICMSR); ++ msr &= rcar_i2c_read(priv, ICMIER); ++ ++ /* ++ * Clear START or STOP immediately, except for REPSTART after read or ++ * if a spurious interrupt was detected. ++ */ ++ if (likely(!(priv->flags & ID_P_REP_AFTER_RD) && msr)) ++ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA); ++ ++ return rcar_i2c_irq(irq, priv, msr); ++} ++ + static struct dma_chan *rcar_i2c_request_dma_chan(struct device *dev, + enum dma_transfer_direction dir, + dma_addr_t port_addr) +@@ -929,6 +955,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + struct i2c_adapter *adap; + struct device *dev = &pdev->dev; + unsigned long irqflags = 0; ++ irqreturn_t (*irqhandler)(int irq, void *ptr) = rcar_i2c_gen3_irq; + int ret; + + /* Otherwise logic will break because some bytes must always use PIO */ +@@ -977,8 +1004,10 @@ static int rcar_i2c_probe(struct platform_device *pdev) + + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + +- if (priv->devtype < I2C_RCAR_GEN3) ++ if (priv->devtype < I2C_RCAR_GEN3) { + irqflags |= IRQF_NO_THREAD; ++ irqhandler = rcar_i2c_gen2_irq; ++ } + + if (priv->devtype == I2C_RCAR_GEN3) { + priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); +@@ -999,7 +1028,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + priv->flags |= ID_P_HOST_NOTIFY; + + priv->irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, irqflags, dev_name(dev), priv); ++ ret = devm_request_irq(dev, priv->irq, irqhandler, irqflags, dev_name(dev), priv); + if (ret < 0) { + dev_err(dev, "cannot get irq %d\n", priv->irq); + goto out_pm_disable; +-- +2.30.2 + diff --git a/queue-5.10/i2c-sh7760-add-irq-check.patch b/queue-5.10/i2c-sh7760-add-irq-check.patch new file mode 100644 index 00000000000..cc4983591fe --- /dev/null +++ b/queue-5.10/i2c-sh7760-add-irq-check.patch @@ -0,0 +1,42 @@ +From 16ecb795ae46423134fa546d7d4d8124904179de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:25:10 +0300 +Subject: i2c: sh7760: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c2005c789d2b..c79c9f542c5a 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + goto out2; + } + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.nr = pdev->id; + id->adap.algo = &sh7760_i2c_algo; +-- +2.30.2 + diff --git a/queue-5.10/i2c-sh7760-fix-irq-error-path.patch b/queue-5.10/i2c-sh7760-fix-irq-error-path.patch new file mode 100644 index 00000000000..27091cb0071 --- /dev/null +++ b/queue-5.10/i2c-sh7760-fix-irq-error-path.patch @@ -0,0 +1,38 @@ +From 2fd964acaeda5969b2c82f377a910dac2f16b4d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 22:05:05 +0300 +Subject: i2c: sh7760: fix IRQ error path + +From: Sergey Shtylyov + +[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ] + +While adding the invalid IRQ check after calling platform_get_irq(), +I managed to overlook that the driver has a complex error path in its +probe() method, thus a simple *return* couldn't be used. Use a proper +*goto* instead! + +Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c79c9f542c5a..319d1fa617c8 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + + ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto out3; + id->irq = ret; + + id->adap.nr = pdev->id; +-- +2.30.2 + diff --git a/queue-5.10/i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch b/queue-5.10/i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch new file mode 100644 index 00000000000..90a75cd72d1 --- /dev/null +++ b/queue-5.10/i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch @@ -0,0 +1,53 @@ +From 045941508f0be4206d359715b446499276be7582 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:44 +0800 +Subject: i2c: sprd: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 3a4f326463117cee3adcb72999ca34a9aaafda93 ] + +The PM reference count is not expected to be incremented on +return in sprd_i2c_master_xfer() and sprd_i2c_remove(). + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sprd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c +index 2917fecf6c80..8ead7e021008 100644 +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -290,7 +290,7 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap, + struct sprd_i2c *i2c_dev = i2c_adap->algo_data; + int im, ret; + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +@@ -576,7 +576,7 @@ static int sprd_i2c_remove(struct platform_device *pdev) + struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev); + int ret; + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-stm32f7-fix-reference-leak-when-pm_runtime_get_s.patch b/queue-5.10/i2c-stm32f7-fix-reference-leak-when-pm_runtime_get_s.patch new file mode 100644 index 00000000000..925719f8d3a --- /dev/null +++ b/queue-5.10/i2c-stm32f7-fix-reference-leak-when-pm_runtime_get_s.patch @@ -0,0 +1,89 @@ +From 9a2b72977677e567d0935bae0f12b0bddfc2159a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:45 +0800 +Subject: i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit 2c662660ce2bd3b09dae21a9a9ac9395e1e6c00b ] + +The PM reference count is not expected to be incremented on +return in these stm32f7_i2c_xx serious functions. + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: ea6dd25deeb5 ("i2c: stm32f7: add PM_SLEEP suspend/resume support") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-stm32f7.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index 674735334547..1e800b65e20a 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1652,7 +1652,7 @@ static int stm32f7_i2c_xfer(struct i2c_adapter *i2c_adap, + i2c_dev->msg_id = 0; + f7_msg->smbus = false; + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +@@ -1698,7 +1698,7 @@ static int stm32f7_i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr, + f7_msg->read_write = read_write; + f7_msg->smbus = true; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +@@ -1799,7 +1799,7 @@ static int stm32f7_i2c_reg_slave(struct i2c_client *slave) + if (ret) + return ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +@@ -1880,7 +1880,7 @@ static int stm32f7_i2c_unreg_slave(struct i2c_client *slave) + + WARN_ON(!i2c_dev->slave[id]); + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +@@ -2277,7 +2277,7 @@ static int stm32f7_i2c_regs_backup(struct stm32f7_i2c_dev *i2c_dev) + int ret; + struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +@@ -2299,7 +2299,7 @@ static int stm32f7_i2c_regs_restore(struct stm32f7_i2c_dev *i2c_dev) + int ret; + struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; + +- ret = pm_runtime_get_sync(i2c_dev->dev); ++ ret = pm_runtime_resume_and_get(i2c_dev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/i2c-xiic-fix-reference-leak-when-pm_runtime_get_sync.patch b/queue-5.10/i2c-xiic-fix-reference-leak-when-pm_runtime_get_sync.patch new file mode 100644 index 00000000000..4c337fbb13a --- /dev/null +++ b/queue-5.10/i2c-xiic-fix-reference-leak-when-pm_runtime_get_sync.patch @@ -0,0 +1,53 @@ +From d0cb1dae59b20b6b6f489788f4f0c6285652e88a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 17:31:46 +0800 +Subject: i2c: xiic: fix reference leak when pm_runtime_get_sync fails + +From: Qinglang Miao + +[ Upstream commit a85c5c7a3aa8041777ff691400b4046e56149fd3 ] + +The PM reference count is not expected to be incremented on +return in xiic_xfer and xiic_i2c_remove. + +However, pm_runtime_get_sync will increment the PM reference +count even failed. Forgetting to putting operation will result +in a reference leak here. + +Replace it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 10b17004a74c ("i2c: xiic: Fix the clocking across bind unbind") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 087b2951942e..2a8568b97c14 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -706,7 +706,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + dev_dbg(adap->dev.parent, "%s entry SR: 0x%x\n", __func__, + xiic_getreg8(i2c, XIIC_SR_REG_OFFSET)); + +- err = pm_runtime_get_sync(i2c->dev); ++ err = pm_runtime_resume_and_get(i2c->dev); + if (err < 0) + return err; + +@@ -873,7 +873,7 @@ static int xiic_i2c_remove(struct platform_device *pdev) + /* remove adapter & data */ + i2c_del_adapter(&i2c->adap); + +- ret = pm_runtime_get_sync(i2c->dev); ++ ret = pm_runtime_resume_and_get(i2c->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/ia64-fix-efi_debug-build.patch b/queue-5.10/ia64-fix-efi_debug-build.patch new file mode 100644 index 00000000000..11e0d07852d --- /dev/null +++ b/queue-5.10/ia64-fix-efi_debug-build.patch @@ -0,0 +1,71 @@ +From 1bfbb6c5d7481f388b2b2f935e096bf75307c3ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:53:39 -0700 +Subject: ia64: fix EFI_DEBUG build + +From: Sergei Trofimovich + +[ Upstream commit e3db00b79d74caaf84cd9e1d4927979abfd0d7c9 ] + +When enabled local debugging via `#define EFI_DEBUG 1` noticed build +failure: + + arch/ia64/kernel/efi.c:564:8: error: 'i' undeclared (first use in this function) + +While at it fixed benign string format mismatches visible only when +EFI_DEBUG is enabled: + + arch/ia64/kernel/efi.c:589:11: + warning: format '%lx' expects argument of type 'long unsigned int', + but argument 5 has type 'u64' {aka 'long long unsigned int'} [-Wformat=] + +Link: https://lkml.kernel.org/r/20210328212246.685601-1-slyfox@gentoo.org +Fixes: 14fb42090943559 ("efi: Merge EFI system table revision and vendor checks") +Signed-off-by: Sergei Trofimovich +Cc: Ard Biesheuvel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/efi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c +index f932b25fb817..33282f33466e 100644 +--- a/arch/ia64/kernel/efi.c ++++ b/arch/ia64/kernel/efi.c +@@ -413,10 +413,10 @@ efi_get_pal_addr (void) + mask = ~((1 << IA64_GRANULE_SHIFT) - 1); + + printk(KERN_INFO "CPU %d: mapping PAL code " +- "[0x%lx-0x%lx) into [0x%lx-0x%lx)\n", +- smp_processor_id(), md->phys_addr, +- md->phys_addr + efi_md_size(md), +- vaddr & mask, (vaddr & mask) + IA64_GRANULE_SIZE); ++ "[0x%llx-0x%llx) into [0x%llx-0x%llx)\n", ++ smp_processor_id(), md->phys_addr, ++ md->phys_addr + efi_md_size(md), ++ vaddr & mask, (vaddr & mask) + IA64_GRANULE_SIZE); + #endif + return __va(md->phys_addr); + } +@@ -558,6 +558,7 @@ efi_init (void) + { + efi_memory_desc_t *md; + void *p; ++ unsigned int i; + + for (i = 0, p = efi_map_start; p < efi_map_end; + ++i, p += efi_desc_size) +@@ -584,7 +585,7 @@ efi_init (void) + } + + printk("mem%02d: %s " +- "range=[0x%016lx-0x%016lx) (%4lu%s)\n", ++ "range=[0x%016llx-0x%016llx) (%4lu%s)\n", + i, efi_md_typeattr_format(buf, sizeof(buf), md), + md->phys_addr, + md->phys_addr + efi_md_size(md), size, unit); +-- +2.30.2 + diff --git a/queue-5.10/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch b/queue-5.10/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch new file mode 100644 index 00000000000..504791fa8bf --- /dev/null +++ b/queue-5.10/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch @@ -0,0 +1,37 @@ +From 0dbb277dc5df9770394a0e4d7f9fc385cc5ab50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:40 +0000 +Subject: IB/hfi1: Fix error return code in parse_platform_config() + +From: Wang Wensheng + +[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20210408113140.103032-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/firmware.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c +index 0e83d4b61e46..2cf102b5abd4 100644 +--- a/drivers/infiniband/hw/hfi1/firmware.c ++++ b/drivers/infiniband/hw/hfi1/firmware.c +@@ -1916,6 +1916,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + dd_dev_err(dd, "%s: Failed CRC check at offset %ld\n", + __func__, (ptr - + (u32 *)dd->platform_config.data)); ++ ret = -EINVAL; + goto bail; + } + /* Jump the CRC DWORD */ +-- +2.30.2 + diff --git a/queue-5.10/ib-hfi1-use-kzalloc-for-mmu_rb_handler-allocation.patch b/queue-5.10/ib-hfi1-use-kzalloc-for-mmu_rb_handler-allocation.patch new file mode 100644 index 00000000000..80ee3d04e04 --- /dev/null +++ b/queue-5.10/ib-hfi1-use-kzalloc-for-mmu_rb_handler-allocation.patch @@ -0,0 +1,53 @@ +From 0d887aa9b2d6d86b1b1ead76bc7a3150803a8baa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 09:54:14 -0400 +Subject: IB/hfi1: Use kzalloc() for mmu_rb_handler allocation + +From: Mike Marciniszyn + +[ Upstream commit ca5f72568e034e1295a7ae350b1f786fcbfb2848 ] + +The code currently assumes that the mmu_notifier struct +embedded in mmu_rb_handler only contains two fields. + +There are now extra fields: + +struct mmu_notifier { + struct hlist_node hlist; + const struct mmu_notifier_ops *ops; + struct mm_struct *mm; + struct rcu_head rcu; + unsigned int users; +}; + +Given that there in no init for the mmu_notifier, a kzalloc() should +be used to insure that any newly added fields are given a predictable +initial value of zero. + +Fixes: 06e0ffa69312 ("IB/hfi1: Re-factor MMU notification code") +Link: https://lore.kernel.org/r/1617026056-50483-9-git-send-email-dennis.dalessandro@cornelisnetworks.com +Reviewed-by: Adam Goldman +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index f3fb28e3d5d7..d213f65d4cdd 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -89,7 +89,7 @@ int hfi1_mmu_rb_register(void *ops_arg, + struct mmu_rb_handler *h; + int ret; + +- h = kmalloc(sizeof(*h), GFP_KERNEL); ++ h = kzalloc(sizeof(*h), GFP_KERNEL); + if (!h) + return -ENOMEM; + +-- +2.30.2 + diff --git a/queue-5.10/ib-isert-fix-a-use-after-free-in-isert_connect_reque.patch b/queue-5.10/ib-isert-fix-a-use-after-free-in-isert_connect_reque.patch new file mode 100644 index 00000000000..5fdfe8bb1ad --- /dev/null +++ b/queue-5.10/ib-isert-fix-a-use-after-free-in-isert_connect_reque.patch @@ -0,0 +1,83 @@ +From ab622f8298d805ec7655d0125c731ecd5d9d6bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 09:13:25 -0700 +Subject: IB/isert: Fix a use after free in isert_connect_request + +From: Lv Yunlong + +[ Upstream commit adb76a520d068a54ee5ca82e756cf8e5a47363a4 ] + +The device is got by isert_device_get() with refcount is 1, and is +assigned to isert_conn by + isert_conn->device = device. + +When isert_create_qp() failed, device will be freed with +isert_device_put(). + +Later, the device is used in isert_free_login_buf(isert_conn) by the +isert_conn->device->ib_device statement. + +Free the device in the correct order. + +Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines") +Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Lv Yunlong +Acked-by: Sagi Grimberg +Reviewed-by: Leon Romanovsky +Reviewed-by: Max Gurtovoy +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index bd478947b93a..e653c83f8a35 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + isert_init_conn(isert_conn); + isert_conn->cm_id = cma_id; + +- ret = isert_alloc_login_buf(isert_conn, cma_id->device); +- if (ret) +- goto out; +- + device = isert_device_get(cma_id); + if (IS_ERR(device)) { + ret = PTR_ERR(device); +- goto out_rsp_dma_map; ++ goto out; + } + isert_conn->device = device; + ++ ret = isert_alloc_login_buf(isert_conn, cma_id->device); ++ if (ret) ++ goto out_conn_dev; ++ + isert_set_nego_params(isert_conn, &event->param.conn); + + isert_conn->qp = isert_create_qp(isert_conn, cma_id); + if (IS_ERR(isert_conn->qp)) { + ret = PTR_ERR(isert_conn->qp); +- goto out_conn_dev; ++ goto out_rsp_dma_map; + } + + ret = isert_login_post_recv(isert_conn); +@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + + out_destroy_qp: + isert_destroy_qp(isert_conn); +-out_conn_dev: +- isert_device_put(device); + out_rsp_dma_map: + isert_free_login_buf(isert_conn); ++out_conn_dev: ++ isert_device_put(device); + out: + kfree(isert_conn); + rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED); +-- +2.30.2 + diff --git a/queue-5.10/iio-adc-kconfig-make-ad9467-depend-on-adi_axi_adc-sy.patch b/queue-5.10/iio-adc-kconfig-make-ad9467-depend-on-adi_axi_adc-sy.patch new file mode 100644 index 00000000000..57ec1b0ddb0 --- /dev/null +++ b/queue-5.10/iio-adc-kconfig-make-ad9467-depend-on-adi_axi_adc-sy.patch @@ -0,0 +1,51 @@ +From 1fce3cd58a0e133b354746ab81fcb033a917d585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 20:27:46 +0200 +Subject: iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol + +From: Alexandru Ardelean + +[ Upstream commit 194eafc9c1d49b53b59de9821fb63d423344cae3 ] + +Because a dependency on HAS_IOMEM and OF was added for the ADI AXI ADC +driver, this makes the AD9467 driver have some build/dependency issues +when OF is disabled (typically on ACPI archs like x86). + +This is because the selection of the AD9467 enforces the ADI_AXI_ADC symbol +which is blocked by the OF (and potentially HAS_IOMEM) being disabled. + +To fix this, we make the AD9467 driver depend on the ADI_AXI_ADC symbol. +The AD9467 driver cannot operate on it's own. It requires the ADI AXI ADC +driver to stream data (or some similar IIO interface). + +So, the fix here is to make the AD9467 symbol depend on the ADI_AXI_ADC +symbol. At some point this could become it's own subgroup of high-speed +ADCs. + +Fixes: be24c65e9fa24 ("iio: adc: adi-axi-adc: add proper Kconfig dependencies") +Reported-by: Randy Dunlap +Signed-off-by: Alexandru Ardelean +Acked-by: Randy Dunlap +Link: https://lore.kernel.org/r/20210324182746.9337-1-aardelean@deviqon.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig +index 86fda6182543..e39b679126a2 100644 +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -249,7 +249,7 @@ config AD799X + config AD9467 + tristate "Analog Devices AD9467 High Speed ADC driver" + depends on SPI +- select ADI_AXI_ADC ++ depends on ADI_AXI_ADC + help + Say yes here to build support for Analog Devices: + * AD9467 16-Bit, 200 MSPS/250 MSPS Analog-to-Digital Converter +-- +2.30.2 + diff --git a/queue-5.10/ima-fix-the-error-code-for-restoring-the-pcr-value.patch b/queue-5.10/ima-fix-the-error-code-for-restoring-the-pcr-value.patch new file mode 100644 index 00000000000..605bb8536a9 --- /dev/null +++ b/queue-5.10/ima-fix-the-error-code-for-restoring-the-pcr-value.patch @@ -0,0 +1,42 @@ +From 0e1e824de9244276a441227d04a5d85705bd3e52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:28:24 +0800 +Subject: ima: Fix the error code for restoring the PCR value + +From: Li Huafei + +[ Upstream commit 7990ccafaa37dc6d8bb095d4d7cd997e8903fd10 ] + +In ima_restore_measurement_list(), hdr[HDR_PCR].data is pointing to a +buffer of type u8, which contains the dumped 32-bit pcr value. +Currently, only the least significant byte is used to restore the pcr +value. We should convert hdr[HDR_PCR].data to a pointer of type u32 +before fetching the value to restore the correct pcr value. + +Fixes: 47fdee60b47f ("ima: use ima_parse_buf() to parse measurements headers") +Signed-off-by: Li Huafei +Reviewed-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_template.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c +index 1e89e2d3851f..f83255a39e65 100644 +--- a/security/integrity/ima/ima_template.c ++++ b/security/integrity/ima/ima_template.c +@@ -468,8 +468,8 @@ int ima_restore_measurement_list(loff_t size, void *buf) + } + } + +- entry->pcr = !ima_canonical_fmt ? *(hdr[HDR_PCR].data) : +- le32_to_cpu(*(hdr[HDR_PCR].data)); ++ entry->pcr = !ima_canonical_fmt ? *(u32 *)(hdr[HDR_PCR].data) : ++ le32_to_cpu(*(u32 *)(hdr[HDR_PCR].data)); + ret = ima_restore_measurement_entry(entry); + if (ret < 0) + break; +-- +2.30.2 + diff --git a/queue-5.10/inet-use-bigger-hash-table-for-ip-id-generation.patch b/queue-5.10/inet-use-bigger-hash-table-for-ip-id-generation.patch new file mode 100644 index 00000000000..b0bef5d2d62 --- /dev/null +++ b/queue-5.10/inet-use-bigger-hash-table-for-ip-id-generation.patch @@ -0,0 +1,115 @@ +From cd09f5e1dc39a92cc1d93135d21930878f5233cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 14:53:37 -0700 +Subject: inet: use bigger hash table for IP ID generation + +From: Eric Dumazet + +[ Upstream commit aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba ] + +In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count") +I used a very small hash table that could be abused +by patient attackers to reveal sensitive information. + +Switch to a dynamic sizing, depending on RAM size. + +Typical big hosts will now use 128x more storage (2 MB) +to get a similar increase in security and reduction +of hash collisions. + +As a bonus, use of alloc_large_system_hash() spreads +allocated memory among all NUMA nodes. + +Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count") +Reported-by: Amit Klein +Signed-off-by: Eric Dumazet +Cc: Willy Tarreau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 42 ++++++++++++++++++++++++++++-------------- + 1 file changed, 28 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 50a6d935376f..798dc85bde5b 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -66,6 +66,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -476,8 +477,10 @@ static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr) + __ipv4_confirm_neigh(dev, *(__force u32 *)pkey); + } + +-#define IP_IDENTS_SZ 2048u +- ++/* Hash tables of size 2048..262144 depending on RAM size. ++ * Each bucket uses 8 bytes. ++ */ ++static u32 ip_idents_mask __read_mostly; + static atomic_t *ip_idents __read_mostly; + static u32 *ip_tstamps __read_mostly; + +@@ -487,12 +490,16 @@ static u32 *ip_tstamps __read_mostly; + */ + u32 ip_idents_reserve(u32 hash, int segs) + { +- u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ; +- atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ; +- u32 old = READ_ONCE(*p_tstamp); +- u32 now = (u32)jiffies; ++ u32 bucket, old, now = (u32)jiffies; ++ atomic_t *p_id; ++ u32 *p_tstamp; + u32 delta = 0; + ++ bucket = hash & ip_idents_mask; ++ p_tstamp = ip_tstamps + bucket; ++ p_id = ip_idents + bucket; ++ old = READ_ONCE(*p_tstamp); ++ + if (old != now && cmpxchg(p_tstamp, old, now) == old) + delta = prandom_u32_max(now - old); + +@@ -3544,18 +3551,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly; + + int __init ip_rt_init(void) + { ++ void *idents_hash; + int cpu; + +- ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents), +- GFP_KERNEL); +- if (!ip_idents) +- panic("IP: failed to allocate ip_idents\n"); ++ /* For modern hosts, this will use 2 MB of memory */ ++ idents_hash = alloc_large_system_hash("IP idents", ++ sizeof(*ip_idents) + sizeof(*ip_tstamps), ++ 0, ++ 16, /* one bucket per 64 KB */ ++ HASH_ZERO, ++ NULL, ++ &ip_idents_mask, ++ 2048, ++ 256*1024); ++ ++ ip_idents = idents_hash; + +- prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents)); ++ prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents)); + +- ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL); +- if (!ip_tstamps) +- panic("IP: failed to allocate ip_tstamps\n"); ++ ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents); + + for_each_possible_cpu(cpu) { + struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu); +-- +2.30.2 + diff --git a/queue-5.10/io_uring-fix-overflows-checks-in-provide-buffers.patch b/queue-5.10/io_uring-fix-overflows-checks-in-provide-buffers.patch new file mode 100644 index 00000000000..7f94c11f173 --- /dev/null +++ b/queue-5.10/io_uring-fix-overflows-checks-in-provide-buffers.patch @@ -0,0 +1,65 @@ +From 009bd82b57fa29884b0f4621d8a5a13885eab2a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 13:07:39 +0100 +Subject: io_uring: fix overflows checks in provide buffers + +From: Pavel Begunkov + +[ Upstream commit 38134ada0ceea3e848fe993263c0ff6207fd46e7 ] + +Colin reported before possible overflow and sign extension problems in +io_provide_buffers_prep(). As Linus pointed out previous attempt did nothing +useful, see d81269fecb8ce ("io_uring: fix provide_buffers sign extension"). + +Do that with help of check__overflow helpers. And fix struct +io_provide_buf::len type, as it doesn't make much sense to keep it +signed. + +Reported-by: Colin Ian King +Fixes: efe68c1ca8f49 ("io_uring: validate the full range of provided buffers for access") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/46538827e70fce5f6cdb50897cff4cacc490f380.1618488258.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 55e214defb42..369ec81033d6 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -527,7 +527,7 @@ struct io_splice { + struct io_provide_buf { + struct file *file; + __u64 addr; +- __s32 len; ++ __u32 len; + __u32 bgid; + __u16 nbufs; + __u16 bid; +@@ -3996,7 +3996,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock, + static int io_provide_buffers_prep(struct io_kiocb *req, + const struct io_uring_sqe *sqe) + { +- unsigned long size; ++ unsigned long size, tmp_check; + struct io_provide_buf *p = &req->pbuf; + u64 tmp; + +@@ -4010,6 +4010,12 @@ static int io_provide_buffers_prep(struct io_kiocb *req, + p->addr = READ_ONCE(sqe->addr); + p->len = READ_ONCE(sqe->len); + ++ if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, ++ &size)) ++ return -EOVERFLOW; ++ if (check_add_overflow((unsigned long)p->addr, size, &tmp_check)) ++ return -EOVERFLOW; ++ + size = (unsigned long)p->len * p->nbufs; + if (!access_ok(u64_to_user_ptr(p->addr), size)) + return -EFAULT; +-- +2.30.2 + diff --git a/queue-5.10/iommu-amd-put-newline-after-closing-bracket-in-warni.patch b/queue-5.10/iommu-amd-put-newline-after-closing-bracket-in-warni.patch new file mode 100644 index 00000000000..0c45f07559a --- /dev/null +++ b/queue-5.10/iommu-amd-put-newline-after-closing-bracket-in-warni.patch @@ -0,0 +1,51 @@ +From 8da606539b703047ce022d65ff875721c25e5351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 20:01:41 +0200 +Subject: iommu/amd: Put newline after closing bracket in warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Menzel + +[ Upstream commit 304c73ba69459d4c18c2a4b843be6f5777b4b85c ] + +Currently, on the Dell OptiPlex 5055 the EFR mismatch warning looks like +below. + + [ 1.479774] smpboot: CPU0: AMD Ryzen 5 PRO 1500 Quad-Core Processor (family: 0x17, model: 0x1, stepping: 0x1) + […] + [ 2.507370] AMD-Vi: [Firmware Warn]: EFR mismatch. Use IVHD EFR (0xf77ef22294ada : 0x400f77ef22294ada + ). + +Add the newline after the `).`, so it’s on one line. + +Fixes: a44092e326d4 ("iommu/amd: Use IVHD EFR for early initialization of IOMMU features") +Cc: iommu@lists.linux-foundation.org +Cc: Suravee Suthikulpanit +Cc: Brijesh Singh +Cc: Robert Richter +Signed-off-by: Paul Menzel +Link: https://lore.kernel.org/r/20210412180141.29605-1-pmenzel@molgen.mpg.de +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 3c215f0a6052..fa502c0e2e31 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1840,7 +1840,7 @@ static void __init late_iommu_features_init(struct amd_iommu *iommu) + * IVHD and MMIO conflict. + */ + if (features != iommu->features) +- pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n).", ++ pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx).\n", + features, iommu->features); + } + +-- +2.30.2 + diff --git a/queue-5.10/iommu-arm-smmu-v3-add-bit-field-sfm-into-gerror_err_.patch b/queue-5.10/iommu-arm-smmu-v3-add-bit-field-sfm-into-gerror_err_.patch new file mode 100644 index 00000000000..4aa53b52b65 --- /dev/null +++ b/queue-5.10/iommu-arm-smmu-v3-add-bit-field-sfm-into-gerror_err_.patch @@ -0,0 +1,40 @@ +From a31da41f429e34bb5f6f064d270355e02eef3a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 16:16:03 +0800 +Subject: iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK + +From: Zhen Lei + +[ Upstream commit 655c447c97d7fe462e6cd9e15809037be028bc70 ] + +In arm_smmu_gerror_handler(), the value of the SMMU_GERROR register is +filtered by GERROR_ERR_MASK. However, the GERROR_ERR_MASK does not contain +the SFM bit. As a result, the subsequent error processing is not performed +when only the SFM error occurs. + +Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices") +Reported-by: Rui Zhu +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210324081603.1074-1-thunder.leizhen@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +index d4b7f40ccb02..57e5d223c467 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +@@ -115,7 +115,7 @@ + #define GERROR_PRIQ_ABT_ERR (1 << 3) + #define GERROR_EVTQ_ABT_ERR (1 << 2) + #define GERROR_CMDQ_ERR (1 << 0) +-#define GERROR_ERR_MASK 0xfd ++#define GERROR_ERR_MASK 0x1fd + + #define ARM_SMMU_GERRORN 0x64 + +-- +2.30.2 + diff --git a/queue-5.10/iommu-check-dev-iommu-in-iommu_dev_xxx-functions.patch b/queue-5.10/iommu-check-dev-iommu-in-iommu_dev_xxx-functions.patch new file mode 100644 index 00000000000..65de716f337 --- /dev/null +++ b/queue-5.10/iommu-check-dev-iommu-in-iommu_dev_xxx-functions.patch @@ -0,0 +1,80 @@ +From d9d21f7665ec656e00ecb9712373d5a9beff6645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 17:36:11 +0000 +Subject: iommu: Check dev->iommu in iommu_dev_xxx functions + +From: Shameer Kolothum + +[ Upstream commit b9abb19fa5fd2d8a4be61c6cd4b2a48aa1a17f9c ] + +The device iommu probe/attach might have failed leaving dev->iommu +to NULL and device drivers may still invoke these functions resulting +in a crash in iommu vendor driver code. + +Hence make sure we check that. + +Fixes: a3a195929d40 ("iommu: Add APIs for multiple domains per device") +Signed-off-by: Shameer Kolothum +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20210303173611.520-1-shameerali.kolothum.thodi@huawei.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 0d9adce6d812..9b8664d388af 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -2872,10 +2872,12 @@ EXPORT_SYMBOL_GPL(iommu_dev_has_feature); + + int iommu_dev_enable_feature(struct device *dev, enum iommu_dev_features feat) + { +- const struct iommu_ops *ops = dev->bus->iommu_ops; ++ if (dev->iommu && dev->iommu->iommu_dev) { ++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops; + +- if (ops && ops->dev_enable_feat) +- return ops->dev_enable_feat(dev, feat); ++ if (ops->dev_enable_feat) ++ return ops->dev_enable_feat(dev, feat); ++ } + + return -ENODEV; + } +@@ -2888,10 +2890,12 @@ EXPORT_SYMBOL_GPL(iommu_dev_enable_feature); + */ + int iommu_dev_disable_feature(struct device *dev, enum iommu_dev_features feat) + { +- const struct iommu_ops *ops = dev->bus->iommu_ops; ++ if (dev->iommu && dev->iommu->iommu_dev) { ++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops; + +- if (ops && ops->dev_disable_feat) +- return ops->dev_disable_feat(dev, feat); ++ if (ops->dev_disable_feat) ++ return ops->dev_disable_feat(dev, feat); ++ } + + return -EBUSY; + } +@@ -2899,10 +2903,12 @@ EXPORT_SYMBOL_GPL(iommu_dev_disable_feature); + + bool iommu_dev_feature_enabled(struct device *dev, enum iommu_dev_features feat) + { +- const struct iommu_ops *ops = dev->bus->iommu_ops; ++ if (dev->iommu && dev->iommu->iommu_dev) { ++ const struct iommu_ops *ops = dev->iommu->iommu_dev->ops; + +- if (ops && ops->dev_feat_enabled) +- return ops->dev_feat_enabled(dev, feat); ++ if (ops->dev_feat_enabled) ++ return ops->dev_feat_enabled(dev, feat); ++ } + + return false; + } +-- +2.30.2 + diff --git a/queue-5.10/iommu-fix-a-boundary-issue-to-avoid-performance-drop.patch b/queue-5.10/iommu-fix-a-boundary-issue-to-avoid-performance-drop.patch new file mode 100644 index 00000000000..d55e0402c32 --- /dev/null +++ b/queue-5.10/iommu-fix-a-boundary-issue-to-avoid-performance-drop.patch @@ -0,0 +1,43 @@ +From 993c67f534b1ec74000a4f7cae507fc55be06641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 11:38:24 +0800 +Subject: iommu: Fix a boundary issue to avoid performance drop + +From: Xiang Chen + +[ Upstream commit 3431c3f660a39f6ced954548a59dba6541ce3eb1 ] + +After the change of patch ("iommu: Switch gather->end to the +inclusive end"), the performace drops from 1600+K IOPS to 1200K in our +kunpeng ARM64 platform. +We find that the range [start1, end1) actually is joint from the range +[end1, end2), but it is considered as disjoint after the change, +so it needs more times of TLB sync, and spends more time on it. +So fix the boundary issue to avoid performance drop. + +Fixes: 862c3715de8f ("iommu: Switch gather->end to the inclusive end") +Signed-off-by: Xiang Chen +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/1616643504-120688-1-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + include/linux/iommu.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/iommu.h b/include/linux/iommu.h +index f11f5072af5d..e90c267e7f3e 100644 +--- a/include/linux/iommu.h ++++ b/include/linux/iommu.h +@@ -544,7 +544,7 @@ static inline void iommu_iotlb_gather_add_page(struct iommu_domain *domain, + * structure can be rewritten. + */ + if (gather->pgsize != size || +- end < gather->start || start > gather->end) { ++ end + 1 < gather->start || start > gather->end + 1) { + if (gather->pgsize) + iommu_iotlb_sync(domain, gather); + gather->pgsize = size; +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-don-t-set-then-clear-private-data-in-prq_.patch b/queue-5.10/iommu-vt-d-don-t-set-then-clear-private-data-in-prq_.patch new file mode 100644 index 00000000000..c4a71df77d0 --- /dev/null +++ b/queue-5.10/iommu-vt-d-don-t-set-then-clear-private-data-in-prq_.patch @@ -0,0 +1,51 @@ +From 0992c9a0b0fbafb17f2cafb7d8142ae5b545e1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 10:41:56 +0800 +Subject: iommu/vt-d: Don't set then clear private data in prq_event_thread() + +From: Lu Baolu + +[ Upstream commit 1d421058c815d54113d9afdf6db3f995c788cf0d ] + +The VT-d specification (section 7.6) requires that the value in the +Private Data field of a Page Group Response Descriptor must match +the value in the Private Data field of the respective Page Request +Descriptor. + +The private data field of a page group response descriptor is set then +immediately cleared in prq_event_thread(). This breaks the rule defined +by the VT-d specification. Fix it by moving clearing code up. + +Fixes: 5b438f4ba315d ("iommu/vt-d: Support page request in scalable mode") +Cc: Jacob Pan +Reviewed-by: Liu Yi L +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210320024156.640798-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/svm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c +index 5c95e9693bf5..d79639b5b8a9 100644 +--- a/drivers/iommu/intel/svm.c ++++ b/drivers/iommu/intel/svm.c +@@ -1071,12 +1071,12 @@ no_pasid: + QI_PGRP_RESP_TYPE; + resp.qw1 = QI_PGRP_IDX(req->prg_index) | + QI_PGRP_LPIG(req->lpig); ++ resp.qw2 = 0; ++ resp.qw3 = 0; + + if (req->priv_data_present) + memcpy(&resp.qw2, req->priv_data, + sizeof(req->priv_data)); +- resp.qw2 = 0; +- resp.qw3 = 0; + qi_submit_sync(iommu, &resp, 1, 0); + } + prq_advance: +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-invalidate-pasid-cache-when-root-context-.patch b/queue-5.10/iommu-vt-d-invalidate-pasid-cache-when-root-context-.patch new file mode 100644 index 00000000000..48d01c6c888 --- /dev/null +++ b/queue-5.10/iommu-vt-d-invalidate-pasid-cache-when-root-context-.patch @@ -0,0 +1,98 @@ +From 86b4cd7d197676add978068ff36acc0a9b762ead Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 10:54:13 +0800 +Subject: iommu/vt-d: Invalidate PASID cache when root/context entry changed + +From: Lu Baolu + +[ Upstream commit c0474a606ecb9326227b4d68059942f9db88a897 ] + +When the Intel IOMMU is operating in the scalable mode, some information +from the root and context table may be used to tag entries in the PASID +cache. Software should invalidate the PASID-cache when changing root or +context table entries. + +Suggested-by: Ashok Raj +Fixes: 7373a8cc38197 ("iommu/vt-d: Setup context and enable RID2PASID support") +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210320025415.641201-4-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 18 +++++++++--------- + include/linux/intel-iommu.h | 1 + + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 30c2b52f7ea2..db9bf5ac0722 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -1348,6 +1348,11 @@ static void iommu_set_root_entry(struct intel_iommu *iommu) + readl, (sts & DMA_GSTS_RTPS), sts); + + raw_spin_unlock_irqrestore(&iommu->register_lock, flag); ++ ++ iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL); ++ if (sm_supported(iommu)) ++ qi_flush_pasid_cache(iommu, 0, QI_PC_GLOBAL, 0); ++ iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); + } + + void iommu_flush_write_buffer(struct intel_iommu *iommu) +@@ -2521,6 +2526,10 @@ static void domain_context_clear_one(struct intel_iommu *iommu, u8 bus, u8 devfn + (((u16)bus) << 8) | devfn, + DMA_CCMD_MASK_NOBIT, + DMA_CCMD_DEVICE_INVL); ++ ++ if (sm_supported(iommu)) ++ qi_flush_pasid_cache(iommu, did_old, QI_PC_ALL_PASIDS, 0); ++ + iommu->flush.flush_iotlb(iommu, + did_old, + 0, +@@ -3387,8 +3396,6 @@ static int __init init_dmars(void) + register_pasid_allocator(iommu); + #endif + iommu_set_root_entry(iommu); +- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL); +- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); + } + + #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA +@@ -4166,12 +4173,7 @@ static int init_iommu_hw(void) + } + + iommu_flush_write_buffer(iommu); +- + iommu_set_root_entry(iommu); +- +- iommu->flush.flush_context(iommu, 0, 0, 0, +- DMA_CCMD_GLOBAL_INVL); +- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); + iommu_enable_translation(iommu); + iommu_disable_protect_mem_regions(iommu); + } +@@ -4499,8 +4501,6 @@ static int intel_iommu_add(struct dmar_drhd_unit *dmaru) + goto disable_iommu; + + iommu_set_root_entry(iommu); +- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL); +- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); + iommu_enable_translation(iommu); + + iommu_disable_protect_mem_regions(iommu); +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index ccaa057faf8c..c00ee3458a91 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -369,6 +369,7 @@ enum { + /* PASID cache invalidation granu */ + #define QI_PC_ALL_PASIDS 0 + #define QI_PC_PASID_SEL 1 ++#define QI_PC_GLOBAL 3 + + #define QI_EIOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK) + #define QI_EIOTLB_IH(ih) (((u64)ih) << 6) +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-preset-access-dirty-bits-for-iova-over-fl.patch b/queue-5.10/iommu-vt-d-preset-access-dirty-bits-for-iova-over-fl.patch new file mode 100644 index 00000000000..13312912d1e --- /dev/null +++ b/queue-5.10/iommu-vt-d-preset-access-dirty-bits-for-iova-over-fl.patch @@ -0,0 +1,82 @@ +From 6926ab65a568c8165eff68e2336dbe7081ce35b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 08:42:02 +0800 +Subject: iommu/vt-d: Preset Access/Dirty bits for IOVA over FL + +From: Lu Baolu + +[ Upstream commit a8ce9ebbecdfda3322bbcece6b3b25888217f8e3 ] + +The Access/Dirty bits in the first level page table entry will be set +whenever a page table entry was used for address translation or write +permission was successfully translated. This is always true when using +the first-level page table for kernel IOVA. Instead of wasting hardware +cycles to update the certain bits, it's better to set them up at the +beginning. + +Suggested-by: Ashok Raj +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210115004202.953965-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 17 ++++++++++++----- + include/linux/intel-iommu.h | 2 ++ + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 3295e5e162a4..8010c3895f8c 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -1028,8 +1028,11 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain, + + domain_flush_cache(domain, tmp_page, VTD_PAGE_SIZE); + pteval = ((uint64_t)virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE; +- if (domain_use_first_level(domain)) ++ if (domain_use_first_level(domain)) { + pteval |= DMA_FL_PTE_XD | DMA_FL_PTE_US; ++ if (domain->domain.type == IOMMU_DOMAIN_DMA) ++ pteval |= DMA_FL_PTE_ACCESS; ++ } + if (cmpxchg64(&pte->val, 0ULL, pteval)) + /* Someone else set it while we were thinking; use theirs. */ + free_pgtable_page(tmp_page); +@@ -2354,14 +2357,18 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + return -EINVAL; + + attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP); +- if (domain_use_first_level(domain)) ++ if (domain_use_first_level(domain)) { + attr |= DMA_FL_PTE_PRESENT | DMA_FL_PTE_XD | DMA_FL_PTE_US; + +- if (!sg) { +- sg_res = nr_pages; +- pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | attr; ++ if (domain->domain.type == IOMMU_DOMAIN_DMA) { ++ attr |= DMA_FL_PTE_ACCESS; ++ if (prot & DMA_PTE_WRITE) ++ attr |= DMA_FL_PTE_DIRTY; ++ } + } + ++ pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | attr; ++ + while (nr_pages > 0) { + uint64_t tmp; + +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 94522685a0d9..ccaa057faf8c 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -42,6 +42,8 @@ + + #define DMA_FL_PTE_PRESENT BIT_ULL(0) + #define DMA_FL_PTE_US BIT_ULL(2) ++#define DMA_FL_PTE_ACCESS BIT_ULL(5) ++#define DMA_FL_PTE_DIRTY BIT_ULL(6) + #define DMA_FL_PTE_XD BIT_ULL(63) + + #define ADDR_WIDTH_5LEVEL (57) +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-reject-unsupported-page-request-modes.patch b/queue-5.10/iommu-vt-d-reject-unsupported-page-request-modes.patch new file mode 100644 index 00000000000..ee6be26080e --- /dev/null +++ b/queue-5.10/iommu-vt-d-reject-unsupported-page-request-modes.patch @@ -0,0 +1,52 @@ +From 4bb873934b2f0b8464a1cd5893aede99491ee76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 02:13:59 -0800 +Subject: iommu/vt-d: Reject unsupported page request modes + +From: Jacob Pan + +[ Upstream commit 78a523fe73b81b4447beb2d6c78c9fafae24eebb ] + +When supervisor/privilige mode SVM is used, we bind init_mm.pgd with +a supervisor PASID. There should not be any page fault for init_mm. +Execution request with DMA read is also not supported. + +This patch checks PRQ descriptor for both unsupported configurations, +reject them both with invalid responses. + +Fixes: 1c4f88b7f1f92 ("iommu/vt-d: Shared virtual address in scalable mode") +Acked-by: Lu Baolu +Signed-off-by: Jacob Pan +Link: https://lore.kernel.org/r/1614680040-1989-4-git-send-email-jacob.jun.pan@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/svm.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c +index b200a3acc6ed..5c95e9693bf5 100644 +--- a/drivers/iommu/intel/svm.c ++++ b/drivers/iommu/intel/svm.c +@@ -959,7 +959,17 @@ static irqreturn_t prq_event_thread(int irq, void *d) + ((unsigned long long *)req)[1]); + goto no_pasid; + } +- ++ /* We shall not receive page request for supervisor SVM */ ++ if (req->pm_req && (req->rd_req | req->wr_req)) { ++ pr_err("Unexpected page request in Privilege Mode"); ++ /* No need to find the matching sdev as for bad_req */ ++ goto no_pasid; ++ } ++ /* DMA read with exec requeset is not supported. */ ++ if (req->exe_req && req->rd_req) { ++ pr_err("Execution request not supported\n"); ++ goto no_pasid; ++ } + if (!svm || svm->pasid != req->pasid) { + rcu_read_lock(); + svm = ioasid_find(NULL, req->pasid, NULL); +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-remove-wo-permissions-on-second-level-pag.patch b/queue-5.10/iommu-vt-d-remove-wo-permissions-on-second-level-pag.patch new file mode 100644 index 00000000000..d863df16ad0 --- /dev/null +++ b/queue-5.10/iommu-vt-d-remove-wo-permissions-on-second-level-pag.patch @@ -0,0 +1,46 @@ +From 1fad6b33a2e1cbbc74e40974d9c9cc6d3e66f4d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 10:54:12 +0800 +Subject: iommu/vt-d: Remove WO permissions on second-level paging entries + +From: Lu Baolu + +[ Upstream commit eea53c5816889ee8b64544fa2e9311a81184ff9c ] + +When the first level page table is used for IOVA translation, it only +supports Read-Only and Read-Write permissions. The Write-Only permission +is not supported as the PRESENT bit (implying Read permission) should +always set. When using second level, we still give separate permissions +that allows WriteOnly which seems inconsistent and awkward. We want to +have consistent behavior. After moving to 1st level, we don't want things +to work sometimes, and break if we use 2nd level for the same mappings. +Hence remove this configuration. + +Suggested-by: Ashok Raj +Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level") +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210320025415.641201-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 8010c3895f8c..30c2b52f7ea2 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2357,8 +2357,9 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + return -EINVAL; + + attr = prot & (DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP); ++ attr |= DMA_FL_PTE_PRESENT; + if (domain_use_first_level(domain)) { +- attr |= DMA_FL_PTE_PRESENT | DMA_FL_PTE_XD | DMA_FL_PTE_US; ++ attr |= DMA_FL_PTE_XD | DMA_FL_PTE_US; + + if (domain->domain.type == IOMMU_DOMAIN_DMA) { + attr |= DMA_FL_PTE_ACCESS; +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-report-right-snoop-capability-when-using-.patch b/queue-5.10/iommu-vt-d-report-right-snoop-capability-when-using-.patch new file mode 100644 index 00000000000..3e9287c09e4 --- /dev/null +++ b/queue-5.10/iommu-vt-d-report-right-snoop-capability-when-using-.patch @@ -0,0 +1,117 @@ +From 6760099b3f2a2aa143d17324a3a0a30f20aff2ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 10:11:45 +0800 +Subject: iommu/vt-d: Report right snoop capability when using FL for IOVA + +From: Lu Baolu + +[ Upstream commit 6c00612d0cba10f7d0917cf1f73c945003ed4cd7 ] + +The Intel VT-d driver checks wrong register to report snoop capablility +when using first level page table for GPA to HPA translation. This might +lead the IOMMU driver to say that it supports snooping control, but in +reality, it does not. Fix this by always setting PASID-table-entry.PGSNP +whenever a pasid entry is setting up for GPA to HPA translation so that +the IOMMU driver could report snoop capability as long as it runs in the +scalable mode. + +Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level") +Suggested-by: Rajesh Sankaran +Suggested-by: Kevin Tian +Suggested-by: Ashok Raj +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210330021145.13824-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 12 +++++++++++- + drivers/iommu/intel/pasid.c | 16 ++++++++++++++++ + drivers/iommu/intel/pasid.h | 1 + + 3 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 7e3db4c0324d..3295e5e162a4 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -656,7 +656,14 @@ static int domain_update_iommu_snooping(struct intel_iommu *skip) + rcu_read_lock(); + for_each_active_iommu(iommu, drhd) { + if (iommu != skip) { +- if (!ecap_sc_support(iommu->ecap)) { ++ /* ++ * If the hardware is operating in the scalable mode, ++ * the snooping control is always supported since we ++ * always set PASID-table-entry.PGSNP bit if the domain ++ * is managed outside (UNMANAGED). ++ */ ++ if (!sm_supported(iommu) && ++ !ecap_sc_support(iommu->ecap)) { + ret = 0; + break; + } +@@ -2599,6 +2606,9 @@ static int domain_setup_first_level(struct intel_iommu *iommu, + + flags |= (level == 5) ? PASID_FLAG_FL5LP : 0; + ++ if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED) ++ flags |= PASID_FLAG_PAGE_SNOOP; ++ + return intel_pasid_setup_first_level(iommu, dev, (pgd_t *)pgd, pasid, + domain->iommu_did[iommu->seq_id], + flags); +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index b92af83b79bd..ce4ef2d245e3 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -411,6 +411,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value) + pasid_set_bits(&pe->val[1], 1 << 23, value << 23); + } + ++/* ++ * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode ++ * PASID entry. ++ */ ++static inline void ++pasid_set_pgsnp(struct pasid_entry *pe) ++{ ++ pasid_set_bits(&pe->val[1], 1ULL << 24, 1ULL << 24); ++} ++ + /* + * Setup the First Level Page table Pointer field (Bit 140~191) + * of a scalable mode PASID entry. +@@ -579,6 +589,9 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu, + } + } + ++ if (flags & PASID_FLAG_PAGE_SNOOP) ++ pasid_set_pgsnp(pte); ++ + pasid_set_domain_id(pte, did); + pasid_set_address_width(pte, iommu->agaw); + pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap)); +@@ -657,6 +670,9 @@ int intel_pasid_setup_second_level(struct intel_iommu *iommu, + pasid_set_fault_enable(pte); + pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap)); + ++ if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED) ++ pasid_set_pgsnp(pte); ++ + /* + * Since it is a second level only translation setup, we should + * set SRE bit as well (addresses are expected to be GPAs). +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 444c0bec221a..086ebd697319 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -48,6 +48,7 @@ + */ + #define PASID_FLAG_SUPERVISOR_MODE BIT(0) + #define PASID_FLAG_NESTED BIT(1) ++#define PASID_FLAG_PAGE_SNOOP BIT(2) + + /* + * The PASID_FLAG_FL5LP flag Indicates using 5-level paging for first- +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-report-the-right-page-fault-address.patch b/queue-5.10/iommu-vt-d-report-the-right-page-fault-address.patch new file mode 100644 index 00000000000..7d251e0b53f --- /dev/null +++ b/queue-5.10/iommu-vt-d-report-the-right-page-fault-address.patch @@ -0,0 +1,38 @@ +From 4050052c0d6fd5d6e247271afc5243aec7948e2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 10:54:11 +0800 +Subject: iommu/vt-d: Report the right page fault address + +From: Lu Baolu + +[ Upstream commit 03d205094af45bca4f8e0498c461a893aa3ec6d9 ] + +The Address field of the Page Request Descriptor only keeps bit [63:12] +of the offending address. Convert it to a full address before reporting +it to device drivers. + +Fixes: eb8d93ea3c1d3 ("iommu/vt-d: Report page request faults for guest SVA") +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210320025415.641201-2-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c +index d79639b5b8a9..6168dec7cb40 100644 +--- a/drivers/iommu/intel/svm.c ++++ b/drivers/iommu/intel/svm.c +@@ -899,7 +899,7 @@ intel_svm_prq_report(struct device *dev, struct page_req_dsc *desc) + /* Fill in event data for device specific processing */ + memset(&event, 0, sizeof(struct iommu_fault_event)); + event.fault.type = IOMMU_FAULT_PAGE_REQ; +- event.fault.prm.addr = desc->addr; ++ event.fault.prm.addr = (u64)desc->addr << VTD_PAGE_SHIFT; + event.fault.prm.pasid = desc->pasid; + event.fault.prm.grpid = desc->prg_index; + event.fault.prm.perm = prq_to_iommu_prot(desc); +-- +2.30.2 + diff --git a/queue-5.10/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch b/queue-5.10/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch new file mode 100644 index 00000000000..7f00efc8c8b --- /dev/null +++ b/queue-5.10/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch @@ -0,0 +1,43 @@ +From 5e54cc145b965fd9424db9f8cb25e4b825d6c30d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 14:18:35 +0100 +Subject: irqchip/gic-v3: Fix OF_BAD_ADDR error handling + +From: Arnd Bergmann + +[ Upstream commit 8e13d96670a4c050d4883e6743a9e9858e5cfe10 ] + +When building with extra warnings enabled, clang points out a +mistake in the error handling: + +drivers/irqchip/irq-gic-v3-mbi.c:306:21: error: result of comparison of constant 18446744073709551615 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (mbi_phys_base == OF_BAD_ADDR) { + +Truncate the constant to the same type as the variable it gets compared +to, to shut make the check work and void the warning. + +Fixes: 505287525c24 ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller") +Signed-off-by: Arnd Bergmann +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210323131842.2773094-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-mbi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c +index 563a9b366294..e81e89a81cb5 100644 +--- a/drivers/irqchip/irq-gic-v3-mbi.c ++++ b/drivers/irqchip/irq-gic-v3-mbi.c +@@ -303,7 +303,7 @@ int __init mbi_init(struct fwnode_handle *fwnode, struct irq_domain *parent) + reg = of_get_property(np, "mbi-alias", NULL); + if (reg) { + mbi_phys_base = of_translate_address(np, reg); +- if (mbi_phys_base == OF_BAD_ADDR) { ++ if (mbi_phys_base == (phys_addr_t)OF_BAD_ADDR) { + ret = -ENXIO; + goto err_free_mbi; + } +-- +2.30.2 + diff --git a/queue-5.10/kfifo-fix-ternary-sign-extension-bugs.patch b/queue-5.10/kfifo-fix-ternary-sign-extension-bugs.patch new file mode 100644 index 00000000000..a3221784de0 --- /dev/null +++ b/queue-5.10/kfifo-fix-ternary-sign-extension-bugs.patch @@ -0,0 +1,120 @@ +From 23cf44107c68d8e0f838b4c90e3ace5c74edac87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:54:15 -0700 +Subject: kfifo: fix ternary sign extension bugs + +From: Dan Carpenter + +[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ] + +The intent with this code was to return negative error codes but instead +it returns positives. + +The problem is how type promotion works with ternary operations. These +functions return long, "ret" is an int and "copied" is a u32. The +negative error code is first cast to u32 so it becomes a high positive and +then cast to long where it's still a positive. + +We could fix this by declaring "ret" as a ssize_t but let's just get rid +of the ternaries instead. + +Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda +Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory") +Signed-off-by: Dan Carpenter +Cc: Stefani Seibold +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/kfifo/bytestream-example.c | 8 ++++++-- + samples/kfifo/inttype-example.c | 8 ++++++-- + samples/kfifo/record-example.c | 8 ++++++-- + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c +index c406f03ee551..5a90aa527877 100644 +--- a/samples/kfifo/bytestream-example.c ++++ b/samples/kfifo/bytestream-example.c +@@ -122,8 +122,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -138,8 +140,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct proc_ops fifo_proc_ops = { +diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c +index 78977fc4a23f..e5403d8c971a 100644 +--- a/samples/kfifo/inttype-example.c ++++ b/samples/kfifo/inttype-example.c +@@ -115,8 +115,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -131,8 +133,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct proc_ops fifo_proc_ops = { +diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c +index c507998a2617..f64f3d62d6c2 100644 +--- a/samples/kfifo/record-example.c ++++ b/samples/kfifo/record-example.c +@@ -129,8 +129,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -145,8 +147,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct proc_ops fifo_proc_ops = { +-- +2.30.2 + diff --git a/queue-5.10/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch b/queue-5.10/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch new file mode 100644 index 00000000000..3e2bfa29de3 --- /dev/null +++ b/queue-5.10/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch @@ -0,0 +1,211 @@ +From 5b691f7ee851bc6acbc7cba64304abaa996d6460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 15:48:57 +0100 +Subject: KVM: arm64: Initialize VCPU mdcr_el2 before loading it + +From: Alexandru Elisei + +[ Upstream commit 263d6287da1433aba11c5b4046388f2cdf49675c ] + +When a VCPU is created, the kvm_vcpu struct is initialized to zero in +kvm_vm_ioctl_create_vcpu(). On VHE systems, the first time +vcpu.arch.mdcr_el2 is loaded on hardware is in vcpu_load(), before it is +set to a sensible value in kvm_arm_setup_debug() later in the run loop. The +result is that KVM executes for a short time with MDCR_EL2 set to zero. + +This has several unintended consequences: + +* Setting MDCR_EL2.HPMN to 0 is constrained unpredictable according to ARM + DDI 0487G.a, page D13-3820. The behavior specified by the architecture + in this case is for the PE to behave as if MDCR_EL2.HPMN is set to a + value less than or equal to PMCR_EL0.N, which means that an unknown + number of counters are now disabled by MDCR_EL2.HPME, which is zero. + +* The host configuration for the other debug features controlled by + MDCR_EL2 is temporarily lost. This has been harmless so far, as Linux + doesn't use the other fields, but that might change in the future. + +Let's avoid both issues by initializing the VCPU's mdcr_el2 field in +kvm_vcpu_vcpu_first_run_init(), thus making sure that the MDCR_EL2 register +has a consistent value after each vcpu_load(). + +Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") +Signed-off-by: Alexandru Elisei +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210407144857.199746-3-alexandru.elisei@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/kvm_host.h | 1 + + arch/arm64/kvm/arm.c | 2 + + arch/arm64/kvm/debug.c | 88 +++++++++++++++++++++---------- + 3 files changed, 63 insertions(+), 28 deletions(-) + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index cc060c41adaa..912b83e784bb 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -601,6 +601,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {} + static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {} + + void kvm_arm_init_debug(void); ++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu); + void kvm_arm_setup_debug(struct kvm_vcpu *vcpu); + void kvm_arm_clear_debug(struct kvm_vcpu *vcpu); + void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu); +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index a1c2c955474e..5e5dd99e8cee 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -547,6 +547,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) + + vcpu->arch.has_run_once = true; + ++ kvm_arm_vcpu_init_debug(vcpu); ++ + if (likely(irqchip_in_kernel(kvm))) { + /* + * Map the VGIC hardware resources before running a vcpu the +diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c +index dbc890511631..2484b2cca74b 100644 +--- a/arch/arm64/kvm/debug.c ++++ b/arch/arm64/kvm/debug.c +@@ -68,6 +68,64 @@ void kvm_arm_init_debug(void) + __this_cpu_write(mdcr_el2, kvm_call_hyp_ret(__kvm_get_mdcr_el2)); + } + ++/** ++ * kvm_arm_setup_mdcr_el2 - configure vcpu mdcr_el2 value ++ * ++ * @vcpu: the vcpu pointer ++ * ++ * This ensures we will trap access to: ++ * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR) ++ * - Debug ROM Address (MDCR_EL2_TDRA) ++ * - OS related registers (MDCR_EL2_TDOSA) ++ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB) ++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF) ++ */ ++static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu) ++{ ++ /* ++ * This also clears MDCR_EL2_E2PB_MASK to disable guest access ++ * to the profiling buffer. ++ */ ++ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK; ++ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM | ++ MDCR_EL2_TPMS | ++ MDCR_EL2_TTRF | ++ MDCR_EL2_TPMCR | ++ MDCR_EL2_TDRA | ++ MDCR_EL2_TDOSA); ++ ++ /* Is the VM being debugged by userspace? */ ++ if (vcpu->guest_debug) ++ /* Route all software debug exceptions to EL2 */ ++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE; ++ ++ /* ++ * Trap debug register access when one of the following is true: ++ * - Userspace is using the hardware to debug the guest ++ * (KVM_GUESTDBG_USE_HW is set). ++ * - The guest is not using debug (KVM_ARM64_DEBUG_DIRTY is clear). ++ */ ++ if ((vcpu->guest_debug & KVM_GUESTDBG_USE_HW) || ++ !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY)) ++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA; ++ ++ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); ++} ++ ++/** ++ * kvm_arm_vcpu_init_debug - setup vcpu debug traps ++ * ++ * @vcpu: the vcpu pointer ++ * ++ * Set vcpu initial mdcr_el2 value. ++ */ ++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu) ++{ ++ preempt_disable(); ++ kvm_arm_setup_mdcr_el2(vcpu); ++ preempt_enable(); ++} ++ + /** + * kvm_arm_reset_debug_ptr - reset the debug ptr to point to the vcpu state + */ +@@ -83,13 +141,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) + * @vcpu: the vcpu pointer + * + * This is called before each entry into the hypervisor to setup any +- * debug related registers. Currently this just ensures we will trap +- * access to: +- * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR) +- * - Debug ROM Address (MDCR_EL2_TDRA) +- * - OS related registers (MDCR_EL2_TDOSA) +- * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB) +- * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF) ++ * debug related registers. + * + * Additionally, KVM only traps guest accesses to the debug registers if + * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY +@@ -101,28 +153,14 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) + + void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + { +- bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY); + unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2; + + trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug); + +- /* +- * This also clears MDCR_EL2_E2PB_MASK to disable guest access +- * to the profiling buffer. +- */ +- vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK; +- vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM | +- MDCR_EL2_TPMS | +- MDCR_EL2_TTRF | +- MDCR_EL2_TPMCR | +- MDCR_EL2_TDRA | +- MDCR_EL2_TDOSA); ++ kvm_arm_setup_mdcr_el2(vcpu); + + /* Is Guest debugging in effect? */ + if (vcpu->guest_debug) { +- /* Route all software debug exceptions to EL2 */ +- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE; +- + /* Save guest debug state */ + save_guest_debug_regs(vcpu); + +@@ -176,7 +214,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + + vcpu->arch.debug_ptr = &vcpu->arch.external_debug_state; + vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; +- trap_debug = true; + + trace_kvm_arm_set_regset("BKPTS", get_num_brps(), + &vcpu->arch.debug_ptr->dbg_bcr[0], +@@ -191,10 +228,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + BUG_ON(!vcpu->guest_debug && + vcpu->arch.debug_ptr != &vcpu->arch.vcpu_debug_state); + +- /* Trap debug register access */ +- if (trap_debug) +- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA; +- + /* If KDE or MDE are set, perform a full save/restore cycle. */ + if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE)) + vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; +@@ -203,7 +236,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2) + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + +- trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); + trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1)); + } + +-- +2.30.2 + diff --git a/queue-5.10/kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch b/queue-5.10/kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch new file mode 100644 index 00000000000..7d9c7820044 --- /dev/null +++ b/queue-5.10/kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch @@ -0,0 +1,54 @@ +From 029d73359cbe0f635c5b39e09850005ddb5c540a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 11:48:34 +1000 +Subject: KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit + +From: Nicholas Piggin + +[ Upstream commit 5088eb4092df12d701af8e0e92860b7186365279 ] + +The host CTRL (runlatch) value is not restored after guest exit. The +host CTRL should always be 1 except in CPU idle code, so this can result +in the host running with runlatch clear, and potentially switching to +a different vCPU which then runs with runlatch clear as well. + +This has little effect on P9 machines, CTRL is only responsible for some +PMU counter logic in the host and so other than corner cases of software +relying on that, or explicitly reading the runlatch value (Linux does +not appear to be affected but it's possible non-Linux guests could be), +there should be no execution correctness problem, though it could be +used as a covert channel between guests. + +There may be microcontrollers, firmware or monitoring tools that sample +the runlatch value out-of-band, however since the register is writable +by guests, these values would (should) not be relied upon for correct +operation of the host, so suboptimal performance or incorrect reporting +should be the worst problem. + +Fixes: 95a6432ce9038 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210412014845.1517916-2-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index e3b1839fc251..280f7992ae99 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -3697,7 +3697,10 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, + vcpu->arch.dec_expires = dec + tb; + vcpu->cpu = -1; + vcpu->arch.thread_cpu = -1; ++ /* Save guest CTRL register, set runlatch to 1 */ + vcpu->arch.ctrl = mfspr(SPRN_CTRLF); ++ if (!(vcpu->arch.ctrl & 1)) ++ mtspr(SPRN_CTRLT, vcpu->arch.ctrl | 1); + + vcpu->arch.iamr = mfspr(SPRN_IAMR); + vcpu->arch.pspb = mfspr(SPRN_PSPB); +-- +2.30.2 + diff --git a/queue-5.10/kvm-vmx-intercept-fs-gs_base-msr-accesses-for-32-bit.patch b/queue-5.10/kvm-vmx-intercept-fs-gs_base-msr-accesses-for-32-bit.patch new file mode 100644 index 00000000000..fd823908b18 --- /dev/null +++ b/queue-5.10/kvm-vmx-intercept-fs-gs_base-msr-accesses-for-32-bit.patch @@ -0,0 +1,80 @@ +From ee62e8f9c1fa43667b54ad4828aaedbaf22edcd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 19:38:31 -0700 +Subject: KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM + +From: Sean Christopherson + +[ Upstream commit dbdd096a5a74b94f6b786a47baef2085859b0dce ] + +Disable pass-through of the FS and GS base MSRs for 32-bit KVM. Intel's +SDM unequivocally states that the MSRs exist if and only if the CPU +supports x86-64. FS_BASE and GS_BASE are mostly a non-issue; a clever +guest could opportunistically use the MSRs without issue. KERNEL_GS_BASE +is a bigger problem, as a clever guest would subtly be broken if it were +migrated, as KVM disallows software access to the MSRs, and unlike the +direct variants, KERNEL_GS_BASE needs to be explicitly migrated as it's +not captured in the VMCS. + +Fixes: 25c5f225beda ("KVM: VMX: Enable MSR Bitmap feature") +Signed-off-by: Sean Christopherson +Message-Id: <20210422023831.3473491-1-seanjc@google.com> +[*NOT* for stable kernels. - Paolo] +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/nested.c | 2 ++ + arch/x86/kvm/vmx/vmx.c | 4 ++++ + 2 files changed, 6 insertions(+) + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index 44ab9df0b21b..e8882715735a 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -618,6 +618,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, + } + + /* KVM unconditionally exposes the FS/GS base MSRs to L1. */ ++#ifdef CONFIG_X86_64 + nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0, + MSR_FS_BASE, MSR_TYPE_RW); + +@@ -626,6 +627,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, + + nested_vmx_disable_intercept_for_msr(msr_bitmap_l1, msr_bitmap_l0, + MSR_KERNEL_GS_BASE, MSR_TYPE_RW); ++#endif + + /* + * Checking the L0->L1 bitmap is trying to verify two things: +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 8635413cc649..fca4f452827b 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -156,9 +156,11 @@ static u32 vmx_possible_passthrough_msrs[MAX_POSSIBLE_PASSTHROUGH_MSRS] = { + MSR_IA32_SPEC_CTRL, + MSR_IA32_PRED_CMD, + MSR_IA32_TSC, ++#ifdef CONFIG_X86_64 + MSR_FS_BASE, + MSR_GS_BASE, + MSR_KERNEL_GS_BASE, ++#endif + MSR_IA32_SYSENTER_CS, + MSR_IA32_SYSENTER_ESP, + MSR_IA32_SYSENTER_EIP, +@@ -6904,9 +6906,11 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu) + bitmap_fill(vmx->shadow_msr_intercept.write, MAX_POSSIBLE_PASSTHROUGH_MSRS); + + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_TSC, MSR_TYPE_R); ++#ifdef CONFIG_X86_64 + vmx_disable_intercept_for_msr(vcpu, MSR_FS_BASE, MSR_TYPE_RW); + vmx_disable_intercept_for_msr(vcpu, MSR_GS_BASE, MSR_TYPE_RW); + vmx_disable_intercept_for_msr(vcpu, MSR_KERNEL_GS_BASE, MSR_TYPE_RW); ++#endif + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW); + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW); + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW); +-- +2.30.2 + diff --git a/queue-5.10/kvm-x86-dump_vmcs-should-not-assume-guest_ia32_efer-.patch b/queue-5.10/kvm-x86-dump_vmcs-should-not-assume-guest_ia32_efer-.patch new file mode 100644 index 00000000000..380f9b1f249 --- /dev/null +++ b/queue-5.10/kvm-x86-dump_vmcs-should-not-assume-guest_ia32_efer-.patch @@ -0,0 +1,70 @@ +From 03436029ae2cc845f6aff787f6d21d86be69e6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 12:08:37 +0000 +Subject: KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid + +From: David Edmondson + +[ Upstream commit d9e46d344e62a0d56fd86a8289db5bed8a57c92e ] + +If the VM entry/exit controls for loading/saving MSR_EFER are either +not available (an older processor or explicitly disabled) or not +used (host and guest values are the same), reading GUEST_IA32_EFER +from the VMCS returns an inaccurate value. + +Because of this, in dump_vmcs() don't use GUEST_IA32_EFER to decide +whether to print the PDPTRs - always do so if the fields exist. + +Fixes: 4eb64dce8d0a ("KVM: x86: dump VMCS on invalid entry") +Signed-off-by: David Edmondson +Message-Id: <20210318120841.133123-2-david.edmondson@oracle.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/vmx.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index f8835cabf29f..8635413cc649 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -5779,7 +5779,6 @@ void dump_vmcs(void) + u32 vmentry_ctl, vmexit_ctl; + u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control; + unsigned long cr4; +- u64 efer; + + if (!dump_invalid_vmcs) { + pr_warn_ratelimited("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n"); +@@ -5791,7 +5790,6 @@ void dump_vmcs(void) + cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL); + pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL); + cr4 = vmcs_readl(GUEST_CR4); +- efer = vmcs_read64(GUEST_IA32_EFER); + secondary_exec_control = 0; + if (cpu_has_secondary_exec_ctrls()) + secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL); +@@ -5803,9 +5801,7 @@ void dump_vmcs(void) + pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n", + cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK)); + pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3)); +- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) && +- (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA)) +- { ++ if (cpu_has_vmx_ept()) { + pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n", + vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1)); + pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n", +@@ -5831,7 +5827,8 @@ void dump_vmcs(void) + if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) || + (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER))) + pr_err("EFER = 0x%016llx PAT = 0x%016llx\n", +- efer, vmcs_read64(GUEST_IA32_PAT)); ++ vmcs_read64(GUEST_IA32_EFER), ++ vmcs_read64(GUEST_IA32_PAT)); + pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n", + vmcs_read64(GUEST_IA32_DEBUGCTL), + vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS)); +-- +2.30.2 + diff --git a/queue-5.10/kvm-x86-mmu-retry-page-faults-that-hit-an-invalid-me.patch b/queue-5.10/kvm-x86-mmu-retry-page-faults-that-hit-an-invalid-me.patch new file mode 100644 index 00000000000..acbbc457db4 --- /dev/null +++ b/queue-5.10/kvm-x86-mmu-retry-page-faults-that-hit-an-invalid-me.patch @@ -0,0 +1,54 @@ +From bebec236de2be95e1655dd9ce62868effa2351ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 12:47:30 -0800 +Subject: KVM: x86/mmu: Retry page faults that hit an invalid memslot + +From: Sean Christopherson + +[ Upstream commit e0c378684b6545ad2d4403bb701d0ac4932b4e95 ] + +Retry page faults (re-enter the guest) that hit an invalid memslot +instead of treating the memslot as not existing, i.e. handling the +page fault as an MMIO access. When deleting a memslot, SPTEs aren't +zapped and the TLBs aren't flushed until after the memslot has been +marked invalid. + +Handling the invalid slot as MMIO means there's a small window where a +page fault could replace a valid SPTE with an MMIO SPTE. The legacy +MMU handles such a scenario cleanly, but the TDP MMU assumes such +behavior is impossible (see the BUG() in __handle_changed_spte()). +There's really no good reason why the legacy MMU should allow such a +scenario, and closing this hole allows for additional cleanups. + +Fixes: 2f2fad0897cb ("kvm: x86/mmu: Add functions to handle changed TDP SPTEs") +Cc: Ben Gardon +Signed-off-by: Sean Christopherson +Message-Id: <20210225204749.1512652-6-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/mmu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index 2d37068b7cd5..2f2576fd343e 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -3663,6 +3663,14 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn, + struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn); + bool async; + ++ /* ++ * Retry the page fault if the gfn hit a memslot that is being deleted ++ * or moved. This ensures any existing SPTEs for the old memslot will ++ * be zapped before KVM inserts a new MMIO SPTE for the gfn. ++ */ ++ if (slot && (slot->flags & KVM_MEMSLOT_INVALID)) ++ return true; ++ + /* Don't expose private memslots to L2. */ + if (is_guest_mode(vcpu) && !kvm_is_visible_memslot(slot)) { + *pfn = KVM_PFN_NOSLOT; +-- +2.30.2 + diff --git a/queue-5.10/libbpf-add-explicit-padding-to-bpf_xdp_set_link_opts.patch b/queue-5.10/libbpf-add-explicit-padding-to-bpf_xdp_set_link_opts.patch new file mode 100644 index 00000000000..8f4b43fd22a --- /dev/null +++ b/queue-5.10/libbpf-add-explicit-padding-to-bpf_xdp_set_link_opts.patch @@ -0,0 +1,45 @@ +From cc17aa997154381450a8e32d385fa2c74fc2209e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 13:09:17 -0800 +Subject: libbpf: Add explicit padding to bpf_xdp_set_link_opts + +From: Andrii Nakryiko + +[ Upstream commit dde7b3f5f2f458297aeccfd4783e53ab8ca046db ] + +Adding such anonymous padding fixes the issue with uninitialized portions of +bpf_xdp_set_link_opts when using LIBBPF_DECLARE_OPTS macro with inline field +initialization: + +DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts, .old_fd = -1); + +When such code is compiled in debug mode, compiler is generating code that +leaves padding bytes uninitialized, which triggers error inside libbpf APIs +that do strict zero initialization checks for OPTS structs. + +Adding anonymous padding field fixes the issue. + +Fixes: bd5ca3ef93cd ("libbpf: Add function to set link XDP fd while specifying old program") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210313210920.1959628-2-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h +index 6909ee81113a..57d10b779dea 100644 +--- a/tools/lib/bpf/libbpf.h ++++ b/tools/lib/bpf/libbpf.h +@@ -507,6 +507,7 @@ struct xdp_link_info { + struct bpf_xdp_set_link_opts { + size_t sz; + int old_fd; ++ size_t :0; + }; + #define bpf_xdp_set_link_opts__last_field old_fd + +-- +2.30.2 + diff --git a/queue-5.10/libbpf-add-explicit-padding-to-btf_dump_emit_type_de.patch b/queue-5.10/libbpf-add-explicit-padding-to-btf_dump_emit_type_de.patch new file mode 100644 index 00000000000..4adee70e9a2 --- /dev/null +++ b/queue-5.10/libbpf-add-explicit-padding-to-btf_dump_emit_type_de.patch @@ -0,0 +1,51 @@ +From 11b9d81e0c928392757cc854d4c2cfa88cc58a99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 19:21:17 +0000 +Subject: libbpf: Add explicit padding to btf_dump_emit_type_decl_opts + +From: KP Singh + +[ Upstream commit ea24b19562fe5f72c78319dbb347b701818956d9 ] + +Similar to +https://lore.kernel.org/bpf/20210313210920.1959628-2-andrii@kernel.org/ + +When DECLARE_LIBBPF_OPTS is used with inline field initialization, e.g: + + DECLARE_LIBBPF_OPTS(btf_dump_emit_type_decl_opts, opts, + .field_name = var_ident, + .indent_level = 2, + .strip_mods = strip_mods, + ); + +and compiled in debug mode, the compiler generates code which +leaves the padding uninitialized and triggers errors within libbpf APIs +which require strict zero initialization of OPTS structs. + +Adding anonymous padding field fixes the issue. + +Fixes: 9f81654eebe8 ("libbpf: Expose BTF-to-C type declaration emitting API") +Suggested-by: Andrii Nakryiko +Signed-off-by: KP Singh +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210319192117.2310658-1-kpsingh@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h +index 57247240a20a..9cabc8b620e3 100644 +--- a/tools/lib/bpf/btf.h ++++ b/tools/lib/bpf/btf.h +@@ -164,6 +164,7 @@ struct btf_dump_emit_type_decl_opts { + int indent_level; + /* strip all the const/volatile/restrict mods */ + bool strip_mods; ++ size_t :0; + }; + #define btf_dump_emit_type_decl_opts__last_field strip_mods + +-- +2.30.2 + diff --git a/queue-5.10/libbpf-initialize-the-bpf_seq_printf-parameters-arra.patch b/queue-5.10/libbpf-initialize-the-bpf_seq_printf-parameters-arra.patch new file mode 100644 index 00000000000..baaae3c5bf6 --- /dev/null +++ b/queue-5.10/libbpf-initialize-the-bpf_seq_printf-parameters-arra.patch @@ -0,0 +1,81 @@ +From fec3dcda4f7187840ec156b0f920337c494da8c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 17:52:41 +0200 +Subject: libbpf: Initialize the bpf_seq_printf parameters array field by field + +From: Florent Revest + +[ Upstream commit 83cd92b46484aa8f64cdc0bff8ac6940d1f78519 ] + +When initializing the __param array with a one liner, if all args are +const, the initial array value will be placed in the rodata section but +because libbpf does not support relocation in the rodata section, any +pointer in this array will stay NULL. + +Fixes: c09add2fbc5a ("tools/libbpf: Add bpf_iter support") +Signed-off-by: Florent Revest +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210419155243.1632274-5-revest@chromium.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/bpf_tracing.h | 40 +++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h +index f9ef37707888..1c2e91ee041d 100644 +--- a/tools/lib/bpf/bpf_tracing.h ++++ b/tools/lib/bpf/bpf_tracing.h +@@ -413,20 +413,38 @@ typeof(name(0)) name(struct pt_regs *ctx) \ + } \ + static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) + ++#define ___bpf_fill0(arr, p, x) do {} while (0) ++#define ___bpf_fill1(arr, p, x) arr[p] = x ++#define ___bpf_fill2(arr, p, x, args...) arr[p] = x; ___bpf_fill1(arr, p + 1, args) ++#define ___bpf_fill3(arr, p, x, args...) arr[p] = x; ___bpf_fill2(arr, p + 1, args) ++#define ___bpf_fill4(arr, p, x, args...) arr[p] = x; ___bpf_fill3(arr, p + 1, args) ++#define ___bpf_fill5(arr, p, x, args...) arr[p] = x; ___bpf_fill4(arr, p + 1, args) ++#define ___bpf_fill6(arr, p, x, args...) arr[p] = x; ___bpf_fill5(arr, p + 1, args) ++#define ___bpf_fill7(arr, p, x, args...) arr[p] = x; ___bpf_fill6(arr, p + 1, args) ++#define ___bpf_fill8(arr, p, x, args...) arr[p] = x; ___bpf_fill7(arr, p + 1, args) ++#define ___bpf_fill9(arr, p, x, args...) arr[p] = x; ___bpf_fill8(arr, p + 1, args) ++#define ___bpf_fill10(arr, p, x, args...) arr[p] = x; ___bpf_fill9(arr, p + 1, args) ++#define ___bpf_fill11(arr, p, x, args...) arr[p] = x; ___bpf_fill10(arr, p + 1, args) ++#define ___bpf_fill12(arr, p, x, args...) arr[p] = x; ___bpf_fill11(arr, p + 1, args) ++#define ___bpf_fill(arr, args...) \ ++ ___bpf_apply(___bpf_fill, ___bpf_narg(args))(arr, 0, args) ++ + /* + * BPF_SEQ_PRINTF to wrap bpf_seq_printf to-be-printed values + * in a structure. + */ +-#define BPF_SEQ_PRINTF(seq, fmt, args...) \ +- ({ \ +- _Pragma("GCC diagnostic push") \ +- _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ +- static const char ___fmt[] = fmt; \ +- unsigned long long ___param[] = { args }; \ +- _Pragma("GCC diagnostic pop") \ +- int ___ret = bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ +- ___param, sizeof(___param)); \ +- ___ret; \ +- }) ++#define BPF_SEQ_PRINTF(seq, fmt, args...) \ ++({ \ ++ static const char ___fmt[] = fmt; \ ++ unsigned long long ___param[___bpf_narg(args)]; \ ++ \ ++ _Pragma("GCC diagnostic push") \ ++ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ ++ ___bpf_fill(___param, args); \ ++ _Pragma("GCC diagnostic pop") \ ++ \ ++ bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ ++ ___param, sizeof(___param)); \ ++}) + + #endif +-- +2.30.2 + diff --git a/queue-5.10/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch b/queue-5.10/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch new file mode 100644 index 00000000000..cc6d486c937 --- /dev/null +++ b/queue-5.10/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch @@ -0,0 +1,48 @@ +From b8f84b4e639783a2fadda04920fd2d430c509160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:12:48 +0100 +Subject: liquidio: Fix unintented sign extension of a left shift of a u16 + +From: Colin Ian King + +[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ] + +The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port +(a u16) left 24 places. There are two subtle issues here, first the +shift gets promoted to an signed int and then sign extended to a u64. +If oct->pcie_port is 0x80 or more then the upper bits get sign extended +to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it +needs to be cast to a u64 for all the bits to not overflow. + +It is entirely possible that the u16 port value is never large enough +for this to fail, but it is useful to fix unintended overflows such +as this. + +Fix this by casting the port parameter to the macro to a u64 before +the shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 5bc67f587ba7 ("liquidio: CN23XX register definitions") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +index e6d4ad99cc38..3f1c189646f4 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +@@ -521,7 +521,7 @@ + #define CN23XX_BAR1_INDEX_OFFSET 3 + + #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \ +- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \ ++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \ + ((idx) << CN23XX_BAR1_INDEX_OFFSET)) + + /*############################ DPI #########################*/ +-- +2.30.2 + diff --git a/queue-5.10/m68k-add-missing-mmap_read_lock-to-sys_cacheflush.patch b/queue-5.10/m68k-add-missing-mmap_read_lock-to-sys_cacheflush.patch new file mode 100644 index 00000000000..4a47e7de74f --- /dev/null +++ b/queue-5.10/m68k-add-missing-mmap_read_lock-to-sys_cacheflush.patch @@ -0,0 +1,39 @@ +From 76005efe5b0935289936eca4590dc84bf2cc6b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 20:00:45 +0000 +Subject: m68k: Add missing mmap_read_lock() to sys_cacheflush() + +From: Liam Howlett + +[ Upstream commit f829b4b212a315b912cb23fd10aaf30534bb5ce9 ] + +When the superuser flushes the entire cache, the mmap_read_lock() is not +taken, but mmap_read_unlock() is called. Add the missing +mmap_read_lock() call. + +Fixes: cd2567b6850b1648 ("m68k: call find_vma with the mmap_sem held in sys_cacheflush()") +Signed-off-by: Liam R. Howlett +Reviewed-by: Matthew Wilcox (Oracle) +Link: https://lore.kernel.org/r/20210407200032.764445-1-Liam.Howlett@Oracle.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/sys_m68k.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/m68k/kernel/sys_m68k.c b/arch/m68k/kernel/sys_m68k.c +index 1c235d8f53f3..f55bdcb8e4f1 100644 +--- a/arch/m68k/kernel/sys_m68k.c ++++ b/arch/m68k/kernel/sys_m68k.c +@@ -388,6 +388,8 @@ sys_cacheflush (unsigned long addr, int scope, int cache, unsigned long len) + ret = -EPERM; + if (!capable(CAP_SYS_ADMIN)) + goto out; ++ ++ mmap_read_lock(current->mm); + } else { + struct vm_area_struct *vma; + +-- +2.30.2 + diff --git a/queue-5.10/m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch b/queue-5.10/m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch new file mode 100644 index 00000000000..bdc252047f4 --- /dev/null +++ b/queue-5.10/m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch @@ -0,0 +1,123 @@ +From 6040eaaf988712df8aec2f0651268d9b25527891 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 18:37:51 +1100 +Subject: m68k: mvme147,mvme16x: Don't wipe PCC timer config bits + +From: Finn Thain + +[ Upstream commit 43262178c043032e7c42d00de44c818ba05f9967 ] + +Don't clear the timer 1 configuration bits when clearing the interrupt flag +and counter overflow. As Michael reported, "This results in no timer +interrupts being delivered after the first. Initialization then hangs +in calibrate_delay as the jiffies counter is not updated." + +On mvme16x, enable the timer after requesting the irq, consistent with +mvme147. + +Cc: Michael Pavone +Fixes: 7529b90d051e ("m68k: mvme147: Handle timer counter overflow") +Fixes: 19999a8b8782 ("m68k: mvme16x: Handle timer counter overflow") +Reported-and-tested-by: Michael Pavone +Signed-off-by: Finn Thain +Link: https://lore.kernel.org/r/4fdaa113db089b8fb607f7dd818479f8cdcc4547.1617089871.git.fthain@telegraphics.com.au +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/mvme147hw.h | 3 +++ + arch/m68k/mvme147/config.c | 14 ++++++++------ + arch/m68k/mvme16x/config.c | 14 ++++++++------ + 3 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/arch/m68k/include/asm/mvme147hw.h b/arch/m68k/include/asm/mvme147hw.h +index 257b29184af9..e28eb1c0e0bf 100644 +--- a/arch/m68k/include/asm/mvme147hw.h ++++ b/arch/m68k/include/asm/mvme147hw.h +@@ -66,6 +66,9 @@ struct pcc_regs { + #define PCC_INT_ENAB 0x08 + + #define PCC_TIMER_INT_CLR 0x80 ++ ++#define PCC_TIMER_TIC_EN 0x01 ++#define PCC_TIMER_COC_EN 0x02 + #define PCC_TIMER_CLR_OVF 0x04 + + #define PCC_LEVEL_ABORT 0x07 +diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c +index 490700aa2212..aab7880e078d 100644 +--- a/arch/m68k/mvme147/config.c ++++ b/arch/m68k/mvme147/config.c +@@ -116,8 +116,10 @@ static irqreturn_t mvme147_timer_int (int irq, void *dev_id) + unsigned long flags; + + local_irq_save(flags); +- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR; +- m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF; ++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN | ++ PCC_TIMER_TIC_EN; ++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR | ++ PCC_LEVEL_TIMER1; + clk_total += PCC_TIMER_CYCLES; + timer_routine(0, NULL); + local_irq_restore(flags); +@@ -135,10 +137,10 @@ void mvme147_sched_init (irq_handler_t timer_routine) + /* Init the clock with a value */ + /* The clock counter increments until 0xFFFF then reloads */ + m147_pcc->t1_preload = PCC_TIMER_PRELOAD; +- m147_pcc->t1_cntrl = 0x0; /* clear timer */ +- m147_pcc->t1_cntrl = 0x3; /* start timer */ +- m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR; /* clear pending ints */ +- m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1; ++ m147_pcc->t1_cntrl = PCC_TIMER_CLR_OVF | PCC_TIMER_COC_EN | ++ PCC_TIMER_TIC_EN; ++ m147_pcc->t1_int_cntrl = PCC_INT_ENAB | PCC_TIMER_INT_CLR | ++ PCC_LEVEL_TIMER1; + + clocksource_register_hz(&mvme147_clk, PCC_TIMER_CLOCK_FREQ); + } +diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c +index 5b86d10e0f84..d43d128b7747 100644 +--- a/arch/m68k/mvme16x/config.c ++++ b/arch/m68k/mvme16x/config.c +@@ -367,6 +367,7 @@ static u32 clk_total; + #define PCCTOVR1_COC_EN 0x02 + #define PCCTOVR1_OVR_CLR 0x04 + ++#define PCCTIC1_INT_LEVEL 6 + #define PCCTIC1_INT_CLR 0x08 + #define PCCTIC1_INT_EN 0x10 + +@@ -376,8 +377,8 @@ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id) + unsigned long flags; + + local_irq_save(flags); +- out_8(PCCTIC1, in_8(PCCTIC1) | PCCTIC1_INT_CLR); +- out_8(PCCTOVR1, PCCTOVR1_OVR_CLR); ++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN); ++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL); + clk_total += PCC_TIMER_CYCLES; + timer_routine(0, NULL); + local_irq_restore(flags); +@@ -391,14 +392,15 @@ void mvme16x_sched_init (irq_handler_t timer_routine) + int irq; + + /* Using PCCchip2 or MC2 chip tick timer 1 */ +- out_be32(PCCTCNT1, 0); +- out_be32(PCCTCMP1, PCC_TIMER_CYCLES); +- out_8(PCCTOVR1, in_8(PCCTOVR1) | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN); +- out_8(PCCTIC1, PCCTIC1_INT_EN | 6); + if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, IRQF_TIMER, "timer", + timer_routine)) + panic ("Couldn't register timer int"); + ++ out_be32(PCCTCNT1, 0); ++ out_be32(PCCTCMP1, PCC_TIMER_CYCLES); ++ out_8(PCCTOVR1, PCCTOVR1_OVR_CLR | PCCTOVR1_TIC_EN | PCCTOVR1_COC_EN); ++ out_8(PCCTIC1, PCCTIC1_INT_EN | PCCTIC1_INT_CLR | PCCTIC1_INT_LEVEL); ++ + clocksource_register_hz(&mvme16x_clk, PCC_TIMER_CLOCK_FREQ); + + if (brdno == 0x0162 || brdno == 0x172) +-- +2.30.2 + diff --git a/queue-5.10/mac80211-bail-out-if-cipher-schemes-are-invalid.patch b/queue-5.10/mac80211-bail-out-if-cipher-schemes-are-invalid.patch new file mode 100644 index 00000000000..64e718f062c --- /dev/null +++ b/queue-5.10/mac80211-bail-out-if-cipher-schemes-are-invalid.patch @@ -0,0 +1,44 @@ +From 75f8717d42ab9f4628dfc302e47ceb73b1b76981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 14:31:50 +0200 +Subject: mac80211: bail out if cipher schemes are invalid + +From: Johannes Berg + +[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ] + +If any of the cipher schemes specified by the driver are invalid, bail +out and fail the registration rather than just warning. Otherwise, we +might later crash when we try to use the invalid cipher scheme, e.g. +if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd +have an out-of-bounds access in RX validation. + +Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support") +Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 19c093bb3876..73893025922f 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1150,8 +1150,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + if (local->hw.wiphy->max_scan_ie_len) + local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; + +- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, +- local->hw.n_cipher_schemes)); ++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, ++ local->hw.n_cipher_schemes))) { ++ result = -EINVAL; ++ goto fail_workqueue; ++ } + + result = ieee80211_init_cipher_suites(local); + if (result < 0) +-- +2.30.2 + diff --git a/queue-5.10/mailbox-sprd-introduce-refcnt-when-clients-requests-.patch b/queue-5.10/mailbox-sprd-introduce-refcnt-when-clients-requests-.patch new file mode 100644 index 00000000000..b7324ce4a48 --- /dev/null +++ b/queue-5.10/mailbox-sprd-introduce-refcnt-when-clients-requests-.patch @@ -0,0 +1,115 @@ +From ba1e3d1293d00e9d2b3ac421e677ada097e8df43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 14:15:35 +0800 +Subject: mailbox: sprd: Introduce refcnt when clients requests/free channels + +From: Orson Zhai + +[ Upstream commit 9468ab84032f96496e998cfa173cd1d0ac316bcd ] + +Unisoc mailbox has no way to be enabled/disabled for any single channel. +They can only be set to startup or shutdown as a whole device at same time. + +Add a variable to count references to avoid mailbox FIFO being reset +unexpectedly when clients are requesting or freeing channels. + +Also add a lock to dismiss possible conflicts from register r/w in +different startup or shutdown threads. And fix the crash problem when early +interrupts come from channel which has not been requested by client yet. + +Fixes: ca27fc26cd22 ("mailbox: sprd: Add Spreadtrum mailbox driver") +Signed-off-by: Orson Zhai +Reviewed-by: Baolin Wang +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/sprd-mailbox.c | 43 +++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 14 deletions(-) + +diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c +index 4c325301a2fe..94d9067dc8d0 100644 +--- a/drivers/mailbox/sprd-mailbox.c ++++ b/drivers/mailbox/sprd-mailbox.c +@@ -60,6 +60,8 @@ struct sprd_mbox_priv { + struct clk *clk; + u32 outbox_fifo_depth; + ++ struct mutex lock; ++ u32 refcnt; + struct mbox_chan chan[SPRD_MBOX_CHAN_MAX]; + }; + +@@ -115,7 +117,11 @@ static irqreturn_t sprd_mbox_outbox_isr(int irq, void *data) + id = readl(priv->outbox_base + SPRD_MBOX_ID); + + chan = &priv->chan[id]; +- mbox_chan_received_data(chan, (void *)msg); ++ if (chan->cl) ++ mbox_chan_received_data(chan, (void *)msg); ++ else ++ dev_warn_ratelimited(priv->dev, ++ "message's been dropped at ch[%d]\n", id); + + /* Trigger to update outbox FIFO pointer */ + writel(0x1, priv->outbox_base + SPRD_MBOX_TRIGGER); +@@ -215,18 +221,22 @@ static int sprd_mbox_startup(struct mbox_chan *chan) + struct sprd_mbox_priv *priv = to_sprd_mbox_priv(chan->mbox); + u32 val; + +- /* Select outbox FIFO mode and reset the outbox FIFO status */ +- writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); ++ mutex_lock(&priv->lock); ++ if (priv->refcnt++ == 0) { ++ /* Select outbox FIFO mode and reset the outbox FIFO status */ ++ writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST); + +- /* Enable inbox FIFO overflow and delivery interrupt */ +- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); +- writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); ++ /* Enable inbox FIFO overflow and delivery interrupt */ ++ val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK); ++ val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ); ++ writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK); + +- /* Enable outbox FIFO not empty interrupt */ +- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); +- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; +- writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ /* Enable outbox FIFO not empty interrupt */ ++ val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ; ++ writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ } ++ mutex_unlock(&priv->lock); + + return 0; + } +@@ -235,9 +245,13 @@ static void sprd_mbox_shutdown(struct mbox_chan *chan) + { + struct sprd_mbox_priv *priv = to_sprd_mbox_priv(chan->mbox); + +- /* Disable inbox & outbox interrupt */ +- writel(SPRD_INBOX_FIFO_IRQ_MASK, priv->inbox_base + SPRD_MBOX_IRQ_MSK); +- writel(SPRD_OUTBOX_FIFO_IRQ_MASK, priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ mutex_lock(&priv->lock); ++ if (--priv->refcnt == 0) { ++ /* Disable inbox & outbox interrupt */ ++ writel(SPRD_INBOX_FIFO_IRQ_MASK, priv->inbox_base + SPRD_MBOX_IRQ_MSK); ++ writel(SPRD_OUTBOX_FIFO_IRQ_MASK, priv->outbox_base + SPRD_MBOX_IRQ_MSK); ++ } ++ mutex_unlock(&priv->lock); + } + + static const struct mbox_chan_ops sprd_mbox_ops = { +@@ -266,6 +280,7 @@ static int sprd_mbox_probe(struct platform_device *pdev) + return -ENOMEM; + + priv->dev = dev; ++ mutex_init(&priv->lock); + + /* + * The Spreadtrum mailbox uses an inbox to send messages to the target +-- +2.30.2 + diff --git a/queue-5.10/media-aspeed-fix-clock-handling-logic.patch b/queue-5.10/media-aspeed-fix-clock-handling-logic.patch new file mode 100644 index 00000000000..193d588245f --- /dev/null +++ b/queue-5.10/media-aspeed-fix-clock-handling-logic.patch @@ -0,0 +1,111 @@ +From 93afdbb7a1d4cc7c3370c440c9ea1a31021c95e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Dec 2020 23:32:25 +0100 +Subject: media: aspeed: fix clock handling logic + +From: Jae Hyun Yoo + +[ Upstream commit 3536169f8531c2c5b153921dc7d1ac9fd570cda7 ] + +Video engine uses eclk and vclk for its clock sources and its reset +control is coupled with eclk so the current clock enabling sequence works +like below. + + Enable eclk + De-assert Video Engine reset + 10ms delay + Enable vclk + +It introduces improper reset on the Video Engine hardware and eventually +the hardware generates unexpected DMA memory transfers that can corrupt +memory region in random and sporadic patterns. This issue is observed +very rarely on some specific AST2500 SoCs but it causes a critical +kernel panic with making a various shape of signature so it's extremely +hard to debug. Moreover, the issue is observed even when the video +engine is not actively used because udevd turns on the video engine +hardware for a short time to make a query in every boot. + +To fix this issue, this commit changes the clock handling logic to make +the reset de-assertion triggered after enabling both eclk and vclk. Also, +it adds clk_unprepare call for a case when probe fails. + +clk: ast2600: fix reset settings for eclk and vclk +Video engine reset setting should be coupled with eclk to match it +with the setting for previous Aspeed SoCs which is defined in +clk-aspeed.c since all Aspeed SoCs are sharing a single video engine +driver. Also, reset bit 6 is defined as 'Video Engine' reset in +datasheet so it should be de-asserted when eclk is enabled. This +commit fixes the setting. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Signed-off-by: Jae Hyun Yoo +Reviewed-by: Joel Stanley +Reviewed-by: Eddie James +Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC") +Reviewed-by: Joel Stanley +Acked-by: Stephen Boyd +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-ast2600.c | 4 ++-- + drivers/media/platform/aspeed-video.c | 9 ++++++--- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c +index a55b37fc2c8b..bc3be5f3eae1 100644 +--- a/drivers/clk/clk-ast2600.c ++++ b/drivers/clk/clk-ast2600.c +@@ -61,10 +61,10 @@ static void __iomem *scu_g6_base; + static const struct aspeed_gate_data aspeed_g6_gates[] = { + /* clk rst name parent flags */ + [ASPEED_CLK_GATE_MCLK] = { 0, -1, "mclk-gate", "mpll", CLK_IS_CRITICAL }, /* SDRAM */ +- [ASPEED_CLK_GATE_ECLK] = { 1, -1, "eclk-gate", "eclk", 0 }, /* Video Engine */ ++ [ASPEED_CLK_GATE_ECLK] = { 1, 6, "eclk-gate", "eclk", 0 }, /* Video Engine */ + [ASPEED_CLK_GATE_GCLK] = { 2, 7, "gclk-gate", NULL, 0 }, /* 2D engine */ + /* vclk parent - dclk/d1clk/hclk/mclk */ +- [ASPEED_CLK_GATE_VCLK] = { 3, 6, "vclk-gate", NULL, 0 }, /* Video Capture */ ++ [ASPEED_CLK_GATE_VCLK] = { 3, -1, "vclk-gate", NULL, 0 }, /* Video Capture */ + [ASPEED_CLK_GATE_BCLK] = { 4, 8, "bclk-gate", "bclk", 0 }, /* PCIe/PCI */ + /* From dpll */ + [ASPEED_CLK_GATE_DCLK] = { 5, -1, "dclk-gate", NULL, CLK_IS_CRITICAL }, /* DAC */ +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index f2c4dadd6a0e..7bb6babdcade 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -514,8 +514,8 @@ static void aspeed_video_off(struct aspeed_video *video) + aspeed_video_write(video, VE_INTERRUPT_STATUS, 0xffffffff); + + /* Turn off the relevant clocks */ +- clk_disable(video->vclk); + clk_disable(video->eclk); ++ clk_disable(video->vclk); + + clear_bit(VIDEO_CLOCKS_ON, &video->flags); + } +@@ -526,8 +526,8 @@ static void aspeed_video_on(struct aspeed_video *video) + return; + + /* Turn on the relevant clocks */ +- clk_enable(video->eclk); + clk_enable(video->vclk); ++ clk_enable(video->eclk); + + set_bit(VIDEO_CLOCKS_ON, &video->flags); + } +@@ -1719,8 +1719,11 @@ static int aspeed_video_probe(struct platform_device *pdev) + return rc; + + rc = aspeed_video_setup_video(video); +- if (rc) ++ if (rc) { ++ clk_unprepare(video->vclk); ++ clk_unprepare(video->eclk); + return rc; ++ } + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.10/media-atomisp-fix-use-after-free-in-atomisp_alloc_cs.patch b/queue-5.10/media-atomisp-fix-use-after-free-in-atomisp_alloc_cs.patch new file mode 100644 index 00000000000..64131ec0d24 --- /dev/null +++ b/queue-5.10/media-atomisp-fix-use-after-free-in-atomisp_alloc_cs.patch @@ -0,0 +1,40 @@ +From 54bb64943517b122b2a3b1b36f7781d41d34d41b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 12:53:31 +0100 +Subject: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() + +From: Dan Carpenter + +[ Upstream commit ba11bbf303fafb33989e95473e409f6ab412b18d ] + +The "s3a_buf" is freed along with all the other items on the +"asd->s3a_stats" list. It leads to a double free and a use after free. + +Link: https://lore.kernel.org/linux-media/X9dSO3RGf7r0pq2k@mwanda +Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +index 2ae50decfc8b..9da82855552d 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -948,10 +948,8 @@ int atomisp_alloc_css_stat_bufs(struct atomisp_sub_device *asd, + dev_dbg(isp->dev, "allocating %d dis buffers\n", count); + while (count--) { + dis_buf = kzalloc(sizeof(struct atomisp_dis_buf), GFP_KERNEL); +- if (!dis_buf) { +- kfree(s3a_buf); ++ if (!dis_buf) + goto error; +- } + if (atomisp_css_allocate_stat_buffers( + asd, stream_id, NULL, dis_buf, NULL)) { + kfree(dis_buf); +-- +2.30.2 + diff --git a/queue-5.10/media-atomisp-fixed-error-handling-path.patch b/queue-5.10/media-atomisp-fixed-error-handling-path.patch new file mode 100644 index 00000000000..66e9d032254 --- /dev/null +++ b/queue-5.10/media-atomisp-fixed-error-handling-path.patch @@ -0,0 +1,89 @@ +From f433002db29e1cf8d25123e0e6f9c4a7ee6f9545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Sep 2020 17:08:04 +0200 +Subject: media: atomisp: Fixed error handling path + +From: Souptick Joarder + +[ Upstream commit 16a5dcf7fbc2f5cd10c1e6264262bfa3832fb7d5 ] + +Inside alloc_user_pages() based on flag value either pin_user_pages() +or get_user_pages_fast() will be called. However, these API might fail. + +But free_user_pages() called in error handling path doesn't bother +about return value and will try to unpin bo->pgnr pages, which is +incorrect. + +Fix this by passing the page_nr to free_user_pages(). If page_nr > 0 +pages will be unpinned based on bo->mem_type. This will also take care +of non error handling path. + +allocation") + +Link: https://lore.kernel.org/linux-media/1601219284-13275-1-git-send-email-jrdr.linux@gmail.com +Fixes: 14a638ab96c5 ("media: atomisp: use pin_user_pages() for memory +Signed-off-by: Souptick Joarder +Cc: John Hubbard +Cc: Ira Weiny +Reviewed-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/hmm/hmm_bo.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c +index f13af2329f48..0168f9839c90 100644 +--- a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c ++++ b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c +@@ -857,16 +857,17 @@ static void free_private_pages(struct hmm_buffer_object *bo, + kfree(bo->page_obj); + } + +-static void free_user_pages(struct hmm_buffer_object *bo) ++static void free_user_pages(struct hmm_buffer_object *bo, ++ unsigned int page_nr) + { + int i; + + hmm_mem_stat.usr_size -= bo->pgnr; + + if (bo->mem_type == HMM_BO_MEM_TYPE_PFN) { +- unpin_user_pages(bo->pages, bo->pgnr); ++ unpin_user_pages(bo->pages, page_nr); + } else { +- for (i = 0; i < bo->pgnr; i++) ++ for (i = 0; i < page_nr; i++) + put_page(bo->pages[i]); + } + kfree(bo->pages); +@@ -942,6 +943,8 @@ static int alloc_user_pages(struct hmm_buffer_object *bo, + dev_err(atomisp_dev, + "get_user_pages err: bo->pgnr = %d, pgnr actually pinned = %d.\n", + bo->pgnr, page_nr); ++ if (page_nr < 0) ++ page_nr = 0; + goto out_of_mem; + } + +@@ -954,7 +957,7 @@ static int alloc_user_pages(struct hmm_buffer_object *bo, + + out_of_mem: + +- free_user_pages(bo); ++ free_user_pages(bo, page_nr); + + return -ENOMEM; + } +@@ -1037,7 +1040,7 @@ void hmm_bo_free_pages(struct hmm_buffer_object *bo) + if (bo->type == HMM_BO_PRIVATE) + free_private_pages(bo, &dynamic_pool, &reserved_pool); + else if (bo->type == HMM_BO_USER) +- free_user_pages(bo); ++ free_user_pages(bo, bo->pgnr); + else + dev_err(atomisp_dev, "invalid buffer type.\n"); + mutex_unlock(&bo->mutex); +-- +2.30.2 + diff --git a/queue-5.10/media-cedrus-fix-h265-status-definitions.patch b/queue-5.10/media-cedrus-fix-h265-status-definitions.patch new file mode 100644 index 00000000000..f37bd6c47e6 --- /dev/null +++ b/queue-5.10/media-cedrus-fix-h265-status-definitions.patch @@ -0,0 +1,60 @@ +From 41faa88a2846469e287efbeb596104cf5d34be77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 17:43:49 +0200 +Subject: media: cedrus: Fix H265 status definitions + +From: Jernej Skrabec + +[ Upstream commit 147d211cc9b4d753148d1640a1758b25edfbf437 ] + +Some of the H265 status flags are wrong. Redefine them to corespond to +Allwinner CedarC open source userspace library. Only one of these flags +is actually used and new value also matches value used in libvdpau-sunxi +library, which is proven to be working. + +Note that wrong (old) value in right circumstances (in combination with +another H265 decoding bug) causes driver lock up. With this fix decoding +is still broken (green output) but at least driver doesn't lock up. + +Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support") +Signed-off-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../staging/media/sunxi/cedrus/cedrus_regs.h | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h +index 66b152f18d17..426387cf16ac 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h +@@ -443,16 +443,17 @@ + #define VE_DEC_H265_STATUS_STCD_BUSY BIT(21) + #define VE_DEC_H265_STATUS_WB_BUSY BIT(20) + #define VE_DEC_H265_STATUS_BS_DMA_BUSY BIT(19) +-#define VE_DEC_H265_STATUS_IQIT_BUSY BIT(18) ++#define VE_DEC_H265_STATUS_IT_BUSY BIT(18) + #define VE_DEC_H265_STATUS_INTER_BUSY BIT(17) + #define VE_DEC_H265_STATUS_MORE_DATA BIT(16) +-#define VE_DEC_H265_STATUS_VLD_BUSY BIT(14) +-#define VE_DEC_H265_STATUS_DEBLOCKING_BUSY BIT(13) +-#define VE_DEC_H265_STATUS_DEBLOCKING_DRAM_BUSY BIT(12) +-#define VE_DEC_H265_STATUS_INTRA_BUSY BIT(11) +-#define VE_DEC_H265_STATUS_SAO_BUSY BIT(10) +-#define VE_DEC_H265_STATUS_MVP_BUSY BIT(9) +-#define VE_DEC_H265_STATUS_SWDEC_BUSY BIT(8) ++#define VE_DEC_H265_STATUS_DBLK_BUSY BIT(15) ++#define VE_DEC_H265_STATUS_IREC_BUSY BIT(14) ++#define VE_DEC_H265_STATUS_INTRA_BUSY BIT(13) ++#define VE_DEC_H265_STATUS_MCRI_BUSY BIT(12) ++#define VE_DEC_H265_STATUS_IQIT_BUSY BIT(11) ++#define VE_DEC_H265_STATUS_MVP_BUSY BIT(10) ++#define VE_DEC_H265_STATUS_IS_BUSY BIT(9) ++#define VE_DEC_H265_STATUS_VLD_BUSY BIT(8) + #define VE_DEC_H265_STATUS_OVER_TIME BIT(3) + #define VE_DEC_H265_STATUS_VLD_DATA_REQ BIT(2) + #define VE_DEC_H265_STATUS_ERROR BIT(1) +-- +2.30.2 + diff --git a/queue-5.10/media-docs-fix-data-organization-of-media_bus_fmt_rg.patch b/queue-5.10/media-docs-fix-data-organization-of-media_bus_fmt_rg.patch new file mode 100644 index 00000000000..d4ccfb37e12 --- /dev/null +++ b/queue-5.10/media-docs-fix-data-organization-of-media_bus_fmt_rg.patch @@ -0,0 +1,41 @@ +From 5604228db42d5dc019823ce3bbeda6575b0410e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 06:53:47 +0100 +Subject: media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 + +From: Liu Ying + +[ Upstream commit c451ee146d449bbe39835fc3d9007b7f06332415 ] + +The media bus bit width of MEDIA_BUS_FMT_RGB101010_1X30 is 30. +So, 'Bit31' and 'Bit30' cells for the 'MEDIA_BUS_FMT_RGB101010_1X30' +row should be spaces instead of '0's. + +Fixes: 54f38fcae536 ("media: docs: move uAPI book to userspace-api/media") +Signed-off-by: Liu Ying +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + Documentation/userspace-api/media/v4l/subdev-formats.rst | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/userspace-api/media/v4l/subdev-formats.rst b/Documentation/userspace-api/media/v4l/subdev-formats.rst +index c9b7bb3ca089..eff6727c69d3 100644 +--- a/Documentation/userspace-api/media/v4l/subdev-formats.rst ++++ b/Documentation/userspace-api/media/v4l/subdev-formats.rst +@@ -1567,8 +1567,8 @@ The following tables list existing packed RGB formats. + - MEDIA_BUS_FMT_RGB101010_1X30 + - 0x1018 + - +- - 0 +- - 0 ++ - ++ - + - r\ :sub:`9` + - r\ :sub:`8` + - r\ :sub:`7` +-- +2.30.2 + diff --git a/queue-5.10/media-i2c-imx219-balance-runtime-pm-use-count.patch b/queue-5.10/media-i2c-imx219-balance-runtime-pm-use-count.patch new file mode 100644 index 00000000000..afbecaee1d0 --- /dev/null +++ b/queue-5.10/media-i2c-imx219-balance-runtime-pm-use-count.patch @@ -0,0 +1,134 @@ +From 10824241eac8d4a6c6d079c6a8fc704ff7dc208c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 10:52:05 +0100 +Subject: media: i2c: imx219: Balance runtime PM use-count + +From: Lad Prabhakar + +[ Upstream commit dd90caa0111e178b52b21e56364bc2244a3973b3 ] + +Move incrementing/decrementing runtime PM count to +imx219_start_streaming()/imx219_stop_streaming() functions respectively. + +This fixes an issue of unbalanced runtime PM count in resume callback +error path where streaming is stopped and runtime PM count is left +unbalanced. + +Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor") +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx219.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index 9520b5dc2bc7..4771d0ef2c46 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -1026,37 +1026,47 @@ static int imx219_start_streaming(struct imx219 *imx219) + const struct imx219_reg_list *reg_list; + int ret; + ++ ret = pm_runtime_get_sync(&client->dev); ++ if (ret < 0) { ++ pm_runtime_put_noidle(&client->dev); ++ return ret; ++ } ++ + /* Apply default values of current mode */ + reg_list = &imx219->mode->reg_list; + ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs); + if (ret) { + dev_err(&client->dev, "%s failed to set mode\n", __func__); +- return ret; ++ goto err_rpm_put; + } + + ret = imx219_set_framefmt(imx219); + if (ret) { + dev_err(&client->dev, "%s failed to set frame format: %d\n", + __func__, ret); +- return ret; ++ goto err_rpm_put; + } + + /* Apply customized values from user */ + ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler); + if (ret) +- return ret; ++ goto err_rpm_put; + + /* set stream on register */ + ret = imx219_write_reg(imx219, IMX219_REG_MODE_SELECT, + IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING); + if (ret) +- return ret; ++ goto err_rpm_put; + + /* vflip and hflip cannot change during streaming */ + __v4l2_ctrl_grab(imx219->vflip, true); + __v4l2_ctrl_grab(imx219->hflip, true); + + return 0; ++ ++err_rpm_put: ++ pm_runtime_put(&client->dev); ++ return ret; + } + + static void imx219_stop_streaming(struct imx219 *imx219) +@@ -1072,12 +1082,13 @@ static void imx219_stop_streaming(struct imx219 *imx219) + + __v4l2_ctrl_grab(imx219->vflip, false); + __v4l2_ctrl_grab(imx219->hflip, false); ++ ++ pm_runtime_put(&client->dev); + } + + static int imx219_set_stream(struct v4l2_subdev *sd, int enable) + { + struct imx219 *imx219 = to_imx219(sd); +- struct i2c_client *client = v4l2_get_subdevdata(sd); + int ret = 0; + + mutex_lock(&imx219->mutex); +@@ -1087,22 +1098,15 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable) + } + + if (enable) { +- ret = pm_runtime_get_sync(&client->dev); +- if (ret < 0) { +- pm_runtime_put_noidle(&client->dev); +- goto err_unlock; +- } +- + /* + * Apply default & customized values + * and then start streaming. + */ + ret = imx219_start_streaming(imx219); + if (ret) +- goto err_rpm_put; ++ goto err_unlock; + } else { + imx219_stop_streaming(imx219); +- pm_runtime_put(&client->dev); + } + + imx219->streaming = enable; +@@ -1111,8 +1115,6 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable) + + return ret; + +-err_rpm_put: +- pm_runtime_put(&client->dev); + err_unlock: + mutex_unlock(&imx219->mutex); + +-- +2.30.2 + diff --git a/queue-5.10/media-i2c-imx219-move-out-locking-unlocking-of-vflip.patch b/queue-5.10/media-i2c-imx219-move-out-locking-unlocking-of-vflip.patch new file mode 100644 index 00000000000..d64104fd1ad --- /dev/null +++ b/queue-5.10/media-i2c-imx219-move-out-locking-unlocking-of-vflip.patch @@ -0,0 +1,75 @@ +From 241bb7d926087043bec90c76177fae022352003e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 10:52:04 +0100 +Subject: media: i2c: imx219: Move out locking/unlocking of vflip and hflip + controls from imx219_set_stream + +From: Lad Prabhakar + +[ Upstream commit 745d4612d2c853c00abadbf69799c8aee7f99c39 ] + +Move out locking/unlocking of vflip and hflip controls from +imx219_set_stream() to the imx219_start_streaming()/ +imx219_stop_streaming() respectively. + +This fixes an issue in resume callback error path where streaming is +stopped and the controls are left in locked state. + +Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor") +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx219.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index 0ae66091a696..9520b5dc2bc7 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -1047,8 +1047,16 @@ static int imx219_start_streaming(struct imx219 *imx219) + return ret; + + /* set stream on register */ +- return imx219_write_reg(imx219, IMX219_REG_MODE_SELECT, +- IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING); ++ ret = imx219_write_reg(imx219, IMX219_REG_MODE_SELECT, ++ IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING); ++ if (ret) ++ return ret; ++ ++ /* vflip and hflip cannot change during streaming */ ++ __v4l2_ctrl_grab(imx219->vflip, true); ++ __v4l2_ctrl_grab(imx219->hflip, true); ++ ++ return 0; + } + + static void imx219_stop_streaming(struct imx219 *imx219) +@@ -1061,6 +1069,9 @@ static void imx219_stop_streaming(struct imx219 *imx219) + IMX219_REG_VALUE_08BIT, IMX219_MODE_STANDBY); + if (ret) + dev_err(&client->dev, "%s failed to set stream\n", __func__); ++ ++ __v4l2_ctrl_grab(imx219->vflip, false); ++ __v4l2_ctrl_grab(imx219->hflip, false); + } + + static int imx219_set_stream(struct v4l2_subdev *sd, int enable) +@@ -1096,10 +1107,6 @@ static int imx219_set_stream(struct v4l2_subdev *sd, int enable) + + imx219->streaming = enable; + +- /* vflip and hflip cannot change during streaming */ +- __v4l2_ctrl_grab(imx219->vflip, enable); +- __v4l2_ctrl_grab(imx219->hflip, enable); +- + mutex_unlock(&imx219->mutex); + + return ret; +-- +2.30.2 + diff --git a/queue-5.10/media-m88ds3103-fix-return-value-check-in-m88ds3103_.patch b/queue-5.10/media-m88ds3103-fix-return-value-check-in-m88ds3103_.patch new file mode 100644 index 00000000000..96d559128ba --- /dev/null +++ b/queue-5.10/media-m88ds3103-fix-return-value-check-in-m88ds3103_.patch @@ -0,0 +1,41 @@ +From 64d0cf40e1f40ab2476832ecaace023d7cd48847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 13:28:02 +0100 +Subject: media: m88ds3103: fix return value check in m88ds3103_probe() + +From: Wei Yongjun + +[ Upstream commit e61f9ea271933d987ab895c689fa37744f6fc27f ] + +In case of error, the function i2c_new_dummy_device() returns +ERR_PTR() and never returns NULL. The NULL test in the return +value check should be replaced with IS_ERR(). + +Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/m88ds3103.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c +index ad6d9d564a87..c120cffb52ad 100644 +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1904,8 +1904,8 @@ static int m88ds3103_probe(struct i2c_client *client, + + dev->dt_client = i2c_new_dummy_device(client->adapter, + dev->dt_addr); +- if (!dev->dt_client) { +- ret = -ENODEV; ++ if (IS_ERR(dev->dt_client)) { ++ ret = PTR_ERR(dev->dt_client); + goto err_kfree; + } + } +-- +2.30.2 + diff --git a/queue-5.10/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch b/queue-5.10/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch new file mode 100644 index 00000000000..8fc58fe6785 --- /dev/null +++ b/queue-5.10/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch @@ -0,0 +1,56 @@ +From aac7c42ae6bad6c8ada83010e1575fee17867bc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 14:16:28 +0200 +Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays + +From: Colin Ian King + +[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ] + +There a 3 array for-loops that don't check the upper bounds of the +index into arrays and this may lead to potential out-of-bounds +reads. Fix this by adding array size upper bounds checks to be +full safe. + +Addresses-Coverity: ("Out-of-bounds read") + +Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com +Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/m88rs6000t.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c +index b3505f402476..8647c50b66e5 100644 +--- a/drivers/media/tuners/m88rs6000t.c ++++ b/drivers/media/tuners/m88rs6000t.c +@@ -525,7 +525,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + PGA2_cri = PGA2_GC >> 2; + PGA2_crf = PGA2_GC & 0x03; + +- for (i = 0; i <= RF_GC; i++) ++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++) + RFG += RFGS[i]; + + if (RF_GC == 0) +@@ -537,12 +537,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + if (RF_GC == 3) + RFG += 100; + +- for (i = 0; i <= IF_GC; i++) ++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++) + IFG += IFGS[i]; + + TIAG = TIA_GC * TIA_GS; + +- for (i = 0; i <= BB_GC; i++) ++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++) + BBG += BBGS[i]; + + PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; +-- +2.30.2 + diff --git a/queue-5.10/media-next-staging-media-atomisp-fix-memory-leak-of-.patch b/queue-5.10/media-next-staging-media-atomisp-fix-memory-leak-of-.patch new file mode 100644 index 00000000000..69a753009c2 --- /dev/null +++ b/queue-5.10/media-next-staging-media-atomisp-fix-memory-leak-of-.patch @@ -0,0 +1,89 @@ +From 1bb8834696c72dff2ea847f5af6135b96775aa65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 18:58:52 +0200 +Subject: media: [next] staging: media: atomisp: fix memory leak of object + flash + +From: Colin Ian King + +[ Upstream commit 6045b01dd0e3cd3759eafe7f290ed04c957500b1 ] + +In the case where the call to lm3554_platform_data_func returns an +error there is a memory leak on the error return path of object +flash. Fix this by adding an error return path that will free +flash and rename labels fail2 to fail3 and fail1 to fail2. + +Link: https://lore.kernel.org/linux-media/20200902165852.201155-1-colin.king@canonical.com +Fixes: 9289cdf39992 ("staging: media: atomisp: Convert to GPIO descriptors") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/atomisp/i2c/atomisp-lm3554.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c +index 7ca7378b1859..0ab67b2aec67 100644 +--- a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c ++++ b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c +@@ -843,8 +843,10 @@ static int lm3554_probe(struct i2c_client *client) + return -ENOMEM; + + flash->pdata = lm3554_platform_data_func(client); +- if (IS_ERR(flash->pdata)) +- return PTR_ERR(flash->pdata); ++ if (IS_ERR(flash->pdata)) { ++ err = PTR_ERR(flash->pdata); ++ goto fail1; ++ } + + v4l2_i2c_subdev_init(&flash->sd, client, &lm3554_ops); + flash->sd.internal_ops = &lm3554_internal_ops; +@@ -856,7 +858,7 @@ static int lm3554_probe(struct i2c_client *client) + ARRAY_SIZE(lm3554_controls)); + if (ret) { + dev_err(&client->dev, "error initialize a ctrl_handler.\n"); +- goto fail2; ++ goto fail3; + } + + for (i = 0; i < ARRAY_SIZE(lm3554_controls); i++) +@@ -865,14 +867,14 @@ static int lm3554_probe(struct i2c_client *client) + + if (flash->ctrl_handler.error) { + dev_err(&client->dev, "ctrl_handler error.\n"); +- goto fail2; ++ goto fail3; + } + + flash->sd.ctrl_handler = &flash->ctrl_handler; + err = media_entity_pads_init(&flash->sd.entity, 0, NULL); + if (err) { + dev_err(&client->dev, "error initialize a media entity.\n"); +- goto fail1; ++ goto fail2; + } + + flash->sd.entity.function = MEDIA_ENT_F_FLASH; +@@ -884,14 +886,15 @@ static int lm3554_probe(struct i2c_client *client) + err = lm3554_gpio_init(client); + if (err) { + dev_err(&client->dev, "gpio request/direction_output fail"); +- goto fail2; ++ goto fail3; + } + return atomisp_register_i2c_module(&flash->sd, NULL, LED_FLASH); +-fail2: ++fail3: + media_entity_cleanup(&flash->sd.entity); + v4l2_ctrl_handler_free(&flash->ctrl_handler); +-fail1: ++fail2: + v4l2_device_unregister_subdev(&flash->sd); ++fail1: + kfree(flash); + + return err; +-- +2.30.2 + diff --git a/queue-5.10/media-omap4iss-return-error-code-when-omap4iss_get-f.patch b/queue-5.10/media-omap4iss-return-error-code-when-omap4iss_get-f.patch new file mode 100644 index 00000000000..cf70126ffb4 --- /dev/null +++ b/queue-5.10/media-omap4iss-return-error-code-when-omap4iss_get-f.patch @@ -0,0 +1,40 @@ +From fa9fd69104c69969630236ab3ede28c2b0d76f4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 03:50:41 +0100 +Subject: media: omap4iss: return error code when omap4iss_get() failed + +From: Yang Yingliang + +[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ] + +If omap4iss_get() failed, it need return error code in iss_probe(). + +Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/omap4iss/iss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c +index e06ea7ea1e50..3dac35f68238 100644 +--- a/drivers/staging/media/omap4iss/iss.c ++++ b/drivers/staging/media/omap4iss/iss.c +@@ -1236,8 +1236,10 @@ static int iss_probe(struct platform_device *pdev) + if (ret < 0) + goto error; + +- if (!omap4iss_get(iss)) ++ if (!omap4iss_get(iss)) { ++ ret = -EINVAL; + goto error; ++ } + + ret = iss_reset(iss); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-5.10/media-platform-sunxi-sun6i-csi-fix-error-return-code.patch b/queue-5.10/media-platform-sunxi-sun6i-csi-fix-error-return-code.patch new file mode 100644 index 00000000000..7d811f3d651 --- /dev/null +++ b/queue-5.10/media-platform-sunxi-sun6i-csi-fix-error-return-code.patch @@ -0,0 +1,44 @@ +From 5e3b9318a4a6acb93490bebe9f8db74e3dc2f08b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Mar 2021 15:15:28 +0100 +Subject: media: platform: sunxi: sun6i-csi: fix error return code of + sun6i_video_start_streaming() + +From: Jia-Ju Bai + +[ Upstream commit f3d384e36630e2a552d874e422835606d9cf230a ] + +When sun6i_video_remote_subdev() returns NULL to subdev, no error return +code of sun6i_video_start_streaming() is assigned. +To fix this bug, ret is assigned with -EINVAL in this case. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Fixes: 5cc7522d8965 ("media: sun6i: Add support for Allwinner CSI V3s") +Acked-by: Chen-Yu Tsai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c +index b55de9ab64d8..3181d0781b61 100644 +--- a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c ++++ b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c +@@ -151,8 +151,10 @@ static int sun6i_video_start_streaming(struct vb2_queue *vq, unsigned int count) + } + + subdev = sun6i_video_remote_subdev(video, NULL); +- if (!subdev) ++ if (!subdev) { ++ ret = -EINVAL; + goto stop_media_pipeline; ++ } + + config.pixelformat = video->fmt.fmt.pix.pixelformat; + config.code = video->mbus_code; +-- +2.30.2 + diff --git a/queue-5.10/media-rkisp1-rsz-crash-fix-when-setting-src-format.patch b/queue-5.10/media-rkisp1-rsz-crash-fix-when-setting-src-format.patch new file mode 100644 index 00000000000..6c6040a272e --- /dev/null +++ b/queue-5.10/media-rkisp1-rsz-crash-fix-when-setting-src-format.patch @@ -0,0 +1,56 @@ +From 45f8f42751b2ff00c7a447ff2a41cf6b2092ecba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 17:15:10 +0100 +Subject: media: rkisp1: rsz: crash fix when setting src format + +From: Dafna Hirschfeld + +[ Upstream commit cbe8373ca7e7cbb4b263b6bf222ccc19f5e119d2 ] + +When setting the source media bus code in the resizer, +we first check that the current media bus code in the +source is yuv encoded format. This is done by +retrieving the data from the formats list of the isp +entity. This cause a crash when the media bus code on the +source is YUYV8_1_5X8 which is not supported by the isp +entity. Instead we should test the sink format of the resizer +which is guaranteed to be supported by the isp entity. + +Fixes: 251b6eebb6c49 ("media: staging: rkisp1: rsz: Add support to more YUV encoded mbus codes on src pad") +Signed-off-by: Dafna Hirschfeld +Acked-by: Helen Koike +Tested-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkisp1/rkisp1-resizer.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c +index 1687d82e6c68..4dcc342ac2b2 100644 +--- a/drivers/staging/media/rkisp1/rkisp1-resizer.c ++++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c +@@ -520,14 +520,15 @@ static void rkisp1_rsz_set_src_fmt(struct rkisp1_resizer *rsz, + struct v4l2_mbus_framefmt *format, + unsigned int which) + { +- const struct rkisp1_isp_mbus_info *mbus_info; +- struct v4l2_mbus_framefmt *src_fmt; ++ const struct rkisp1_isp_mbus_info *sink_mbus_info; ++ struct v4l2_mbus_framefmt *src_fmt, *sink_fmt; + ++ sink_fmt = rkisp1_rsz_get_pad_fmt(rsz, cfg, RKISP1_RSZ_PAD_SINK, which); + src_fmt = rkisp1_rsz_get_pad_fmt(rsz, cfg, RKISP1_RSZ_PAD_SRC, which); +- mbus_info = rkisp1_isp_mbus_info_get(src_fmt->code); ++ sink_mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code); + + /* for YUV formats, userspace can change the mbus code on the src pad if it is supported */ +- if (mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV && ++ if (sink_mbus_info->pixel_enc == V4L2_PIXEL_ENC_YUV && + rkisp1_rsz_get_yuv_mbus_info(format->code)) + src_fmt->code = format->code; + +-- +2.30.2 + diff --git a/queue-5.10/media-saa7134-use-sg_dma_len-when-building-pgtable.patch b/queue-5.10/media-saa7134-use-sg_dma_len-when-building-pgtable.patch new file mode 100644 index 00000000000..0e342be8b2b --- /dev/null +++ b/queue-5.10/media-saa7134-use-sg_dma_len-when-building-pgtable.patch @@ -0,0 +1,41 @@ +From 8db4a2d070de4d97f389368d29d1f0651f663e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 19:30:18 +0100 +Subject: media: saa7134: use sg_dma_len when building pgtable + +From: Tasos Sahanidis + +[ Upstream commit 4e1cb753c04d74e06d7ca826ea0bcb02526af03e ] + +The new AMD IOMMU DMA implementation concatenates sglist entries under +certain conditions, and because saa7134 accessed the length member +directly, it did not support this scenario. + +This fixes IO_PAGE_FAULTs and choppy DMA audio by using the +sg_dma_len macro. + +Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c +index 391572a6ec76..efb757d5168a 100644 +--- a/drivers/media/pci/saa7134/saa7134-core.c ++++ b/drivers/media/pci/saa7134/saa7134-core.c +@@ -243,7 +243,7 @@ int saa7134_pgtable_build(struct pci_dev *pci, struct saa7134_pgtable *pt, + + ptr = pt->cpu + startpage; + for (i = 0; i < length; i++, list = sg_next(list)) { +- for (p = 0; p * 4096 < list->length; p++, ptr++) ++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr++) + *ptr = cpu_to_le32(sg_dma_address(list) + + list->offset + p * 4096); + } +-- +2.30.2 + diff --git a/queue-5.10/media-saa7146-use-sg_dma_len-when-building-pgtable.patch b/queue-5.10/media-saa7146-use-sg_dma_len-when-building-pgtable.patch new file mode 100644 index 00000000000..f4c9f2f4845 --- /dev/null +++ b/queue-5.10/media-saa7146-use-sg_dma_len-when-building-pgtable.patch @@ -0,0 +1,56 @@ +From 541303f8de2aa9168de4ec8e2d917d34048814d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 19:52:53 +0100 +Subject: media: saa7146: use sg_dma_len when building pgtable + +From: Tasos Sahanidis + +[ Upstream commit e56429b09d5e0802b86f84ec7c24025886c9f88b ] + +The new AMD IOMMU DMA implementation concatenates sglist entries under +certain conditions, and because saa7146 accessed the length member +directly, it did not support this scenario. + +This fixes IO_PAGE_FAULTs by using the sg_dma_len macro. + +Fixes: be62dbf554c5 ("iommu/amd: Convert AMD iommu driver to the dma-iommu api") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/saa7146/saa7146_core.c | 2 +- + drivers/media/common/saa7146/saa7146_video.c | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c +index 21fb16cc5ca1..e43edb0d76f4 100644 +--- a/drivers/media/common/saa7146/saa7146_core.c ++++ b/drivers/media/common/saa7146/saa7146_core.c +@@ -253,7 +253,7 @@ int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt + i, sg_dma_address(list), sg_dma_len(list), + list->offset); + */ +- for (p = 0; p * 4096 < list->length; p++, ptr++) { ++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr++) { + *ptr = cpu_to_le32(sg_dma_address(list) + p * 4096); + nr_pages++; + } +diff --git a/drivers/media/common/saa7146/saa7146_video.c b/drivers/media/common/saa7146/saa7146_video.c +index ccd15b4d4920..0d1be4042a40 100644 +--- a/drivers/media/common/saa7146/saa7146_video.c ++++ b/drivers/media/common/saa7146/saa7146_video.c +@@ -247,9 +247,8 @@ static int saa7146_pgtable_build(struct saa7146_dev *dev, struct saa7146_buf *bu + + /* walk all pages, copy all page addresses to ptr1 */ + for (i = 0; i < length; i++, list++) { +- for (p = 0; p * 4096 < list->length; p++, ptr1++) { ++ for (p = 0; p * 4096 < sg_dma_len(list); p++, ptr1++) + *ptr1 = cpu_to_le32(sg_dma_address(list) - list->offset); +- } + } + /* + ptr1 = pt1->cpu; +-- +2.30.2 + diff --git a/queue-5.10/media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch b/queue-5.10/media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch new file mode 100644 index 00000000000..c81ac98d7a7 --- /dev/null +++ b/queue-5.10/media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch @@ -0,0 +1,114 @@ +From 5542335ef68c02420a348d150acc47ce47cc09c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 12:27:40 +0100 +Subject: media: v4l2-ctrls.c: fix race condition in hdl->requests list + +From: Hans Verkuil + +[ Upstream commit be7e8af98f3af729aa9f08b1053f9533a5cceb91 ] + +When a request is re-inited it will release all control handler +objects that are still in the request. It does that by unbinding +and putting all those objects. When the object is unbound the +obj->req pointer is set to NULL, and the object's unbind op is +called. When the object it put the object's release op is called +to free the memory. + +For a request object that contains a control handler that means +that v4l2_ctrl_handler_free() is called in the release op. + +A control handler used in a request has a pointer to the main +control handler that is created by the driver and contains the +current state of all controls. If the device is unbound (due to +rmmod or a forced unbind), then that main handler is freed, again +by calling v4l2_ctrl_handler_free(), and any outstanding request +objects that refer to that main handler have to be unbound and put +as well. + +It does that by this test: + + if (!hdl->req_obj.req && !list_empty(&hdl->requests)) { + +I.e. the handler has no pointer to a request, so is the main +handler, and one or more request objects refer to this main +handler. + +However, this test is wrong since hdl->req_obj.req is actually +NULL when re-initing a request (the object unbind will set req to +NULL), and the only reason this seemingly worked is that the +requests list is typically empty since the request's unbind op +will remove the handler from the requests list. + +But if another thread is at the same time adding a new control +to a request, then there is a race condition where one thread +is removing a control handler object from the requests list and +another thread is adding one. The result is that hdl->requests +is no longer empty and the code thinks that a main handler is +being freed instead of a control handler that is part of a request. + +There are two bugs here: first the test for hdl->req_obj.req: this +should be hdl->req_obj.ops since only the main control handler will +have a NULL pointer there. + +The second is that adding or deleting request objects from the +requests list of the main handler isn't protected by taking the +main handler's lock. + +Signed-off-by: Hans Verkuil +Reported-by: John Cox +Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support") +Tested-by: John Cox +Reported-by: John Cox +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-ctrls.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 3d8c54b826e9..41f8410d08d6 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -2356,7 +2356,15 @@ void v4l2_ctrl_handler_free(struct v4l2_ctrl_handler *hdl) + if (hdl == NULL || hdl->buckets == NULL) + return; + +- if (!hdl->req_obj.req && !list_empty(&hdl->requests)) { ++ /* ++ * If the main handler is freed and it is used by handler objects in ++ * outstanding requests, then unbind and put those objects before ++ * freeing the main handler. ++ * ++ * The main handler can be identified by having a NULL ops pointer in ++ * the request object. ++ */ ++ if (!hdl->req_obj.ops && !list_empty(&hdl->requests)) { + struct v4l2_ctrl_handler *req, *next_req; + + list_for_each_entry_safe(req, next_req, &hdl->requests, requests) { +@@ -3402,8 +3410,8 @@ static void v4l2_ctrl_request_unbind(struct media_request_object *obj) + container_of(obj, struct v4l2_ctrl_handler, req_obj); + struct v4l2_ctrl_handler *main_hdl = obj->priv; + +- list_del_init(&hdl->requests); + mutex_lock(main_hdl->lock); ++ list_del_init(&hdl->requests); + if (hdl->request_is_queued) { + list_del_init(&hdl->requests_queued); + hdl->request_is_queued = false; +@@ -3462,8 +3470,11 @@ static int v4l2_ctrl_request_bind(struct media_request *req, + if (!ret) { + ret = media_request_object_bind(req, &req_ops, + from, false, &hdl->req_obj); +- if (!ret) ++ if (!ret) { ++ mutex_lock(from->lock); + list_add_tail(&hdl->requests, &from->requests); ++ mutex_unlock(from->lock); ++ } + } + return ret; + } +-- +2.30.2 + diff --git a/queue-5.10/media-venus-core-fix-some-resource-leaks-in-the-erro.patch b/queue-5.10/media-venus-core-fix-some-resource-leaks-in-the-erro.patch new file mode 100644 index 00000000000..6436276d605 --- /dev/null +++ b/queue-5.10/media-venus-core-fix-some-resource-leaks-in-the-erro.patch @@ -0,0 +1,57 @@ +From 0404f74943825c6161685abed251cf19cf8c6198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 21:22:34 +0100 +Subject: media: venus: core: Fix some resource leaks in the error path of + 'venus_probe()' + +From: Christophe JAILLET + +[ Upstream commit 5a465c5391a856a0c1e9554964d660676c35d1b2 ] + +If an error occurs after a successful 'of_icc_get()' call, it must be +undone. + +Use 'devm_of_icc_get()' instead of 'of_icc_get()' to avoid the leak. +Update the remove function accordingly and axe the now unneeded +'icc_put()' calls. + +Fixes: 32f0a6ddc8c9 ("media: venus: Use on-chip interconnect API") +Signed-off-by: Christophe JAILLET +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index d5bfd6fff85b..fd5993b3e674 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -195,11 +195,11 @@ static int venus_probe(struct platform_device *pdev) + if (IS_ERR(core->base)) + return PTR_ERR(core->base); + +- core->video_path = of_icc_get(dev, "video-mem"); ++ core->video_path = devm_of_icc_get(dev, "video-mem"); + if (IS_ERR(core->video_path)) + return PTR_ERR(core->video_path); + +- core->cpucfg_path = of_icc_get(dev, "cpu-cfg"); ++ core->cpucfg_path = devm_of_icc_get(dev, "cpu-cfg"); + if (IS_ERR(core->cpucfg_path)) + return PTR_ERR(core->cpucfg_path); + +@@ -334,9 +334,6 @@ static int venus_remove(struct platform_device *pdev) + + hfi_destroy(core); + +- icc_put(core->video_path); +- icc_put(core->cpucfg_path); +- + v4l2_device_unregister(&core->v4l2_dev); + mutex_destroy(&core->pm_lock); + mutex_destroy(&core->lock); +-- +2.30.2 + diff --git a/queue-5.10/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch b/queue-5.10/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch new file mode 100644 index 00000000000..750074289c7 --- /dev/null +++ b/queue-5.10/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch @@ -0,0 +1,41 @@ +From ef881c25f9b50f4f59c14caeb30228ef08276297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 16:43:27 +0100 +Subject: media: vivid: fix assignment of dev->fbuf_out_flags + +From: Colin Ian King + +[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ] + +Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise +mask and the following statement should be bit-wise or'ing in the new flag +bits but instead is making a direct assignment. Fix this by using the |= +operator rather than an assignment. + +Addresses-Coverity: ("Unused value") + +Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vivid/vivid-vid-out.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-vid-out.c b/drivers/media/test-drivers/vivid/vivid-vid-out.c +index ee3446e3217c..cd6c247547d6 100644 +--- a/drivers/media/test-drivers/vivid/vivid-vid-out.c ++++ b/drivers/media/test-drivers/vivid/vivid-vid-out.c +@@ -1025,7 +1025,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh, + return -EINVAL; + } + dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags); +- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags); ++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch b/queue-5.10/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch new file mode 100644 index 00000000000..68889236280 --- /dev/null +++ b/queue-5.10/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch @@ -0,0 +1,53 @@ +From b1bf18ea0788ecf0465e6bd8f2f9885bbc936043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 19:38:21 +0000 +Subject: memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] + +From: Colin Ian King + +[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ] + +Currently the array gpmc_cs is indexed by cs before it cs is range checked +and the pointer read from this out-of-index read is dereferenced. Fix this +by performing the range check on cs before the read and the following +pointer dereference. + +Addresses-Coverity: ("Negative array index read") +Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select") +Signed-off-by: Colin Ian King +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/omap-gpmc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index cfa730cfd145..f80c2ea39ca4 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1009,8 +1009,8 @@ EXPORT_SYMBOL(gpmc_cs_request); + + void gpmc_cs_free(int cs) + { +- struct gpmc_cs_data *gpmc = &gpmc_cs[cs]; +- struct resource *res = &gpmc->mem; ++ struct gpmc_cs_data *gpmc; ++ struct resource *res; + + spin_lock(&gpmc_mem_lock); + if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) { +@@ -1018,6 +1018,9 @@ void gpmc_cs_free(int cs) + spin_unlock(&gpmc_mem_lock); + return; + } ++ gpmc = &gpmc_cs[cs]; ++ res = &gpmc->mem; ++ + gpmc_cs_disable_mem(cs); + if (res->flags) + release_resource(res); +-- +2.30.2 + diff --git a/queue-5.10/memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch b/queue-5.10/memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch new file mode 100644 index 00000000000..f4b67419536 --- /dev/null +++ b/queue-5.10/memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch @@ -0,0 +1,37 @@ +From eb1eb64ffe12aebec30871418f6218cb7bee5696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 11:10:56 +0800 +Subject: memory: pl353: fix mask of ECC page_size config register + +From: gexueyuan + +[ Upstream commit 25dcca7fedcd4e31cb368ad846bfd738c0c6307c ] + +The mask for page size of ECC Configuration Register should be 0x3, +according to the datasheet of PL353 smc. + +Fixes: fee10bd22678 ("memory: pl353: Add driver for arm pl353 static memory controller") +Signed-off-by: gexueyuan +Link: https://lore.kernel.org/r/20210331031056.5326-1-gexueyuan@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/pl353-smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c +index 73bd3023202f..b42804b1801e 100644 +--- a/drivers/memory/pl353-smc.c ++++ b/drivers/memory/pl353-smc.c +@@ -63,7 +63,7 @@ + /* ECC memory config register specific constants */ + #define PL353_SMC_ECC_MEMCFG_MODE_MASK 0xC + #define PL353_SMC_ECC_MEMCFG_MODE_SHIFT 2 +-#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0xC ++#define PL353_SMC_ECC_MEMCFG_PGSIZE_MASK 0x3 + + #define PL353_SMC_DC_UPT_NAND_REGS ((4 << 23) | /* CS: NAND chip */ \ + (2 << 21)) /* UpdateRegs operation */ +-- +2.30.2 + diff --git a/queue-5.10/memory-renesas-rpc-if-fix-possible-null-pointer-dere.patch b/queue-5.10/memory-renesas-rpc-if-fix-possible-null-pointer-dere.patch new file mode 100644 index 00000000000..2988cbab2d3 --- /dev/null +++ b/queue-5.10/memory-renesas-rpc-if-fix-possible-null-pointer-dere.patch @@ -0,0 +1,42 @@ +From 3d10c676b11a078bb732d749758a8e6cb0d71e82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:43:57 +0200 +Subject: memory: renesas-rpc-if: fix possible NULL pointer dereference of + resource + +From: Krzysztof Kozlowski + +[ Upstream commit 59e27d7c94aa02da039b000d33c304c179395801 ] + +The platform_get_resource_byname() can return NULL which would be +immediately dereferenced by resource_size(). Instead dereference it +after validating the resource. + +Addresses-Coverity: Dereference null return value +Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210407154357.70200-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/renesas-rpc-if.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c +index da0fdb4c7595..1fe6c35b7503 100644 +--- a/drivers/memory/renesas-rpc-if.c ++++ b/drivers/memory/renesas-rpc-if.c +@@ -193,10 +193,10 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev) + } + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap"); +- rpc->size = resource_size(res); + rpc->dirmap = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(rpc->dirmap)) + rpc->dirmap = NULL; ++ rpc->size = resource_size(res); + + rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); + +-- +2.30.2 + diff --git a/queue-5.10/memory-samsung-exynos5422-dmc-handle-clk_set_parent-.patch b/queue-5.10/memory-samsung-exynos5422-dmc-handle-clk_set_parent-.patch new file mode 100644 index 00000000000..eb1cbd02851 --- /dev/null +++ b/queue-5.10/memory-samsung-exynos5422-dmc-handle-clk_set_parent-.patch @@ -0,0 +1,40 @@ +From 0cfe0d6a9ae2687564e8cc9aba7af39950e60815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:45:35 +0200 +Subject: memory: samsung: exynos5422-dmc: handle clk_set_parent() failure + +From: Krzysztof Kozlowski + +[ Upstream commit 132c17c3ff878c7beaba51bdd275d5cc654c0e33 ] + +clk_set_parent() can fail and ignoring such case could lead to invalid +clock setup for given frequency. + +Addresses-Coverity: Unchecked return value +Fixes: 6e7674c3c6df ("memory: Add DMC driver for Exynos5422") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Lukasz Luba +Link: https://lore.kernel.org/r/20210407154535.70756-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/samsung/exynos5422-dmc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/memory/samsung/exynos5422-dmc.c b/drivers/memory/samsung/exynos5422-dmc.c +index c5ee4121a4d2..3d230f07eaf2 100644 +--- a/drivers/memory/samsung/exynos5422-dmc.c ++++ b/drivers/memory/samsung/exynos5422-dmc.c +@@ -1298,7 +1298,9 @@ static int exynos5_dmc_init_clks(struct exynos5_dmc *dmc) + + dmc->curr_volt = target_volt; + +- clk_set_parent(dmc->mout_mx_mspll_ccore, dmc->mout_spll); ++ ret = clk_set_parent(dmc->mout_mx_mspll_ccore, dmc->mout_spll); ++ if (ret) ++ return ret; + + clk_prepare_enable(dmc->fout_bpll); + clk_prepare_enable(dmc->mout_bpll); +-- +2.30.2 + diff --git a/queue-5.10/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch b/queue-5.10/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch new file mode 100644 index 00000000000..bae59e014eb --- /dev/null +++ b/queue-5.10/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch @@ -0,0 +1,58 @@ +From 921cd0eb31254d23e1421e6066895b8822002c17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 18:51:35 +0100 +Subject: mfd: stm32-timers: Avoid clearing auto reload register + +From: Fabrice Gasnier + +[ Upstream commit 4917e498c6894ba077867aff78f82cffd5ffbb5c ] + +The ARR register is cleared unconditionally upon probing, after the maximum +value has been read. This initial condition is rather not intuitive, when +considering the counter child driver. It rather expects the maximum value +by default: +- The counter interface shows a zero value by default for 'ceiling' + attribute. +- Enabling the counter without any prior configuration makes it doesn't + count. + +The reset value of ARR register is the maximum. So Choice here +is to backup it, and restore it then, instead of clearing its value. +It also fixes the initial condition seen by the counter driver. + +Fixes: d0f949e220fd ("mfd: Add STM32 Timers driver") +Signed-off-by: Fabrice Gasnier +Acked-by: William Breathitt Gray +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stm32-timers.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/stm32-timers.c b/drivers/mfd/stm32-timers.c +index add603359124..44ed2fce0319 100644 +--- a/drivers/mfd/stm32-timers.c ++++ b/drivers/mfd/stm32-timers.c +@@ -158,13 +158,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = { + + static void stm32_timers_get_arr_size(struct stm32_timers *ddata) + { ++ u32 arr; ++ ++ /* Backup ARR to restore it after getting the maximum value */ ++ regmap_read(ddata->regmap, TIM_ARR, &arr); ++ + /* + * Only the available bits will be written so when readback + * we get the maximum value of auto reload register + */ + regmap_write(ddata->regmap, TIM_ARR, ~0L); + regmap_read(ddata->regmap, TIM_ARR, &ddata->max_arr); +- regmap_write(ddata->regmap, TIM_ARR, 0x0); ++ regmap_write(ddata->regmap, TIM_ARR, arr); + } + + static int stm32_timers_dma_probe(struct device *dev, +-- +2.30.2 + diff --git a/queue-5.10/mips-bmips-fix-syscon-reboot-nodes.patch b/queue-5.10/mips-bmips-fix-syscon-reboot-nodes.patch new file mode 100644 index 00000000000..ef06d025f20 --- /dev/null +++ b/queue-5.10/mips-bmips-fix-syscon-reboot-nodes.patch @@ -0,0 +1,96 @@ +From 0ee874a8bf3ca20e96686a1fa15898420e0ede5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 17:43:46 +0100 +Subject: mips: bmips: fix syscon-reboot nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit cde58b861a1d365568588adda59d42351c0c4ad3 ] + +Commit a23c4134955e added the clock controller nodes, incorrectly changing the +syscon-reboot nodes addresses. + +Fixes: a23c4134955e ("MIPS: BMIPS: add clock controller nodes") +Signed-off-by: Álvaro Fernández Rojas +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/brcm/bcm3368.dtsi | 2 +- + arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 +- + arch/mips/boot/dts/brcm/bcm6358.dtsi | 2 +- + arch/mips/boot/dts/brcm/bcm6362.dtsi | 2 +- + arch/mips/boot/dts/brcm/bcm6368.dtsi | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/mips/boot/dts/brcm/bcm3368.dtsi b/arch/mips/boot/dts/brcm/bcm3368.dtsi +index 69cbef472377..d4b2b430dad0 100644 +--- a/arch/mips/boot/dts/brcm/bcm3368.dtsi ++++ b/arch/mips/boot/dts/brcm/bcm3368.dtsi +@@ -59,7 +59,7 @@ + + periph_cntl: syscon@fff8c008 { + compatible = "syscon"; +- reg = <0xfff8c000 0x4>; ++ reg = <0xfff8c008 0x4>; + native-endian; + }; + +diff --git a/arch/mips/boot/dts/brcm/bcm63268.dtsi b/arch/mips/boot/dts/brcm/bcm63268.dtsi +index 5acb49b61867..365fa75cd9ac 100644 +--- a/arch/mips/boot/dts/brcm/bcm63268.dtsi ++++ b/arch/mips/boot/dts/brcm/bcm63268.dtsi +@@ -59,7 +59,7 @@ + + periph_cntl: syscon@10000008 { + compatible = "syscon"; +- reg = <0x10000000 0xc>; ++ reg = <0x10000008 0x4>; + native-endian; + }; + +diff --git a/arch/mips/boot/dts/brcm/bcm6358.dtsi b/arch/mips/boot/dts/brcm/bcm6358.dtsi +index f21176cac038..89a3107cad28 100644 +--- a/arch/mips/boot/dts/brcm/bcm6358.dtsi ++++ b/arch/mips/boot/dts/brcm/bcm6358.dtsi +@@ -59,7 +59,7 @@ + + periph_cntl: syscon@fffe0008 { + compatible = "syscon"; +- reg = <0xfffe0000 0x4>; ++ reg = <0xfffe0008 0x4>; + native-endian; + }; + +diff --git a/arch/mips/boot/dts/brcm/bcm6362.dtsi b/arch/mips/boot/dts/brcm/bcm6362.dtsi +index c98f9111e3c8..0b2adefd75ce 100644 +--- a/arch/mips/boot/dts/brcm/bcm6362.dtsi ++++ b/arch/mips/boot/dts/brcm/bcm6362.dtsi +@@ -59,7 +59,7 @@ + + periph_cntl: syscon@10000008 { + compatible = "syscon"; +- reg = <0x10000000 0xc>; ++ reg = <0x10000008 0x4>; + native-endian; + }; + +diff --git a/arch/mips/boot/dts/brcm/bcm6368.dtsi b/arch/mips/boot/dts/brcm/bcm6368.dtsi +index 449c167dd892..b84a3bfe8c51 100644 +--- a/arch/mips/boot/dts/brcm/bcm6368.dtsi ++++ b/arch/mips/boot/dts/brcm/bcm6368.dtsi +@@ -59,7 +59,7 @@ + + periph_cntl: syscon@100000008 { + compatible = "syscon"; +- reg = <0x10000000 0xc>; ++ reg = <0x10000008 0x4>; + native-endian; + }; + +-- +2.30.2 + diff --git a/queue-5.10/mips-bpf-enable-bpf_probe_read-str-on-mips-again.patch b/queue-5.10/mips-bpf-enable-bpf_probe_read-str-on-mips-again.patch new file mode 100644 index 00000000000..8140bd1a051 --- /dev/null +++ b/queue-5.10/mips-bpf-enable-bpf_probe_read-str-on-mips-again.patch @@ -0,0 +1,53 @@ +From f84d846bb6e8c24bf9ddbf5fbb9a823c23adce47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 20:50:01 +0800 +Subject: MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again + +From: Tiezhu Yang + +[ Upstream commit 66633abd0642f1e89d26e15f36fb13d3a1c535ff ] + +After commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to +archs where they work"), bpf_probe_read{, str}() functions were no longer +available on MIPS, so there exist some errors when running bpf program: + +root@linux:/home/loongson/bcc# python examples/tracing/task_switch.py +bpf: Failed to load program: Invalid argument +[...] +11: (85) call bpf_probe_read#4 +unknown func bpf_probe_read#4 +[...] +Exception: Failed to load BPF program count_sched: Invalid argument + +ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should be restricted to archs +with non-overlapping address ranges, but they can overlap in EVA mode +on MIPS, so select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE if !EVA in +arch/mips/Kconfig, otherwise the bpf old helper bpf_probe_read() will +not be available. + +This is similar with the commit d195b1d1d119 ("powerpc/bpf: Enable +bpf_probe_read{, str}() on powerpc again"). + +Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work") +Signed-off-by: Tiezhu Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 2000bb2b0220..1917ccd39256 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -6,6 +6,7 @@ config MIPS + select ARCH_BINFMT_ELF_STATE if MIPS_FP_SUPPORT + select ARCH_HAS_FORTIFY_SOURCE + select ARCH_HAS_KCOV ++ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE if !EVA + select ARCH_HAS_PTE_SPECIAL if !(32BIT && CPU_HAS_RIXI) + select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST + select ARCH_HAS_UBSAN_SANITIZE_ALL +-- +2.30.2 + diff --git a/queue-5.10/mips-fix-local_irq_-disable-enable-in-asmmacro.h.patch b/queue-5.10/mips-fix-local_irq_-disable-enable-in-asmmacro.h.patch new file mode 100644 index 00000000000..8c33b179e6e --- /dev/null +++ b/queue-5.10/mips-fix-local_irq_-disable-enable-in-asmmacro.h.patch @@ -0,0 +1,40 @@ +From c678fa94cd241cba49b7aa0ed8476ebd6cda9bf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 10:34:02 +0800 +Subject: MIPS: fix local_irq_{disable,enable} in asmmacro.h + +From: Huang Pei + +[ Upstream commit 05c4e2721d7af0df7bc1378a23712a0fd16947b5 ] + +commit ba9196d2e005 ("MIPS: Make DIEI support as a config option") +use CPU_HAS_DIEI to indicate whether di/ei is implemented correctly, +without this patch, "local_irq_disable" from entry.S in 3A1000 +(with buggy di/ei) lose protection of commit e97c5b609880 ("MIPS: +Make irqflags.h functions preempt-safe for non-mipsr2 cpus") + +Fixes: ba9196d2e005 ("MIPS: Make DIEI support as a config option") +Signed-off-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/asmmacro.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h +index 86f2323ebe6b..ca83ada7015f 100644 +--- a/arch/mips/include/asm/asmmacro.h ++++ b/arch/mips/include/asm/asmmacro.h +@@ -44,8 +44,7 @@ + .endm + #endif + +-#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR5) || \ +- defined(CONFIG_CPU_MIPSR6) ++#ifdef CONFIG_CPU_HAS_DIEI + .macro local_irq_enable reg=t0 + ei + irq_enable_hazard +-- +2.30.2 + diff --git a/queue-5.10/mips-loongson64-fix-bug-when-page_size-16kb.patch b/queue-5.10/mips-loongson64-fix-bug-when-page_size-16kb.patch new file mode 100644 index 00000000000..56786fa309a --- /dev/null +++ b/queue-5.10/mips-loongson64-fix-bug-when-page_size-16kb.patch @@ -0,0 +1,42 @@ +From 8cd20bb0b72f03aace857a8259470545aac0d3df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 11:24:51 +0800 +Subject: MIPS: loongson64: fix bug when PAGE_SIZE > 16KB + +From: Huang Pei + +[ Upstream commit 509d36a941a3466b78d4377913623d210b162458 ] + +When page size larger than 16KB, arguments "vaddr + size(16KB)" in +"ioremap_page_range(vaddr, vaddr + size,...)" called by +"add_legacy_isa_io" is not page-aligned. + +As loongson64 needs at least page size 16KB to get rid of cache alias, +and "vaddr" is 64KB-aligned, and 64KB is largest page size supported, +rounding "size" up to PAGE_SIZE is enough for all page size supported. + +Fixes: 6d0068ad15e4 ("MIPS: Loongson64: Process ISA Node in DeviceTree") +Signed-off-by: Huang Pei +Acked-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/loongson64/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/loongson64/init.c b/arch/mips/loongson64/init.c +index ed75f7971261..052cce6a8a99 100644 +--- a/arch/mips/loongson64/init.c ++++ b/arch/mips/loongson64/init.c +@@ -82,7 +82,7 @@ static int __init add_legacy_isa_io(struct fwnode_handle *fwnode, resource_size_ + return -ENOMEM; + + range->fwnode = fwnode; +- range->size = size; ++ range->size = size = round_up(size, PAGE_SIZE); + range->hw_start = hw_start; + range->flags = LOGIC_PIO_CPU_MMIO; + +-- +2.30.2 + diff --git a/queue-5.10/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch b/queue-5.10/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch new file mode 100644 index 00000000000..7e03d0d239d --- /dev/null +++ b/queue-5.10/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch @@ -0,0 +1,62 @@ +From 47f9d776282e7ca271634112fdf743d438fc9df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 20:12:37 -0700 +Subject: MIPS: pci-legacy: stop using of_pci_range_to_resource + +From: Ilya Lipnitskiy + +[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ] + +Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after +of_pci_range_to_resource() change"). + +Most MIPS platforms do not define PCI_IOBASE, nor implement +pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS +platforms. of_pci_range_to_resource passes the _start address_ of the IO +range into pci_address_to_pio, which then checks it against +IO_SPACE_LIMIT and fails, because for MIPS platforms that use +pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much +higher than 0xffff. + +In fact, pci-mt7621 in staging already works around this problem, see +commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set +resource limits") + +So just stop using of_pci_range_to_resource, which does not work for +MIPS. + +Fixes PCI errors like: + pci_bus 0000:00: root bus resource [io 0xffffffff] + +Fixes: 0b0b0893d49b ("of/pci: Fix the conversion of IO ranges into IO resources") +Signed-off-by: Ilya Lipnitskiy +Cc: Liviu Dudau +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pci-legacy.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index 39052de915f3..3a909194284a 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -166,8 +166,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) + res = hose->mem_resource; + break; + } +- if (res != NULL) +- of_pci_range_to_resource(&range, node, res); ++ if (res != NULL) { ++ res->name = node->full_name; ++ res->flags = range.flags; ++ res->start = range.cpu_addr; ++ res->end = range.cpu_addr + range.size - 1; ++ res->parent = res->child = res->sibling = NULL; ++ } + } + } + +-- +2.30.2 + diff --git a/queue-5.10/mm-memcontrol-slab-fix-obtain-a-reference-to-a-freei.patch b/queue-5.10/mm-memcontrol-slab-fix-obtain-a-reference-to-a-freei.patch new file mode 100644 index 00000000000..86dd1d7b3e3 --- /dev/null +++ b/queue-5.10/mm-memcontrol-slab-fix-obtain-a-reference-to-a-freei.patch @@ -0,0 +1,122 @@ +From 755c7bc291e043b21c439118576da593b2b3b12a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:56:39 -0700 +Subject: mm: memcontrol: slab: fix obtain a reference to a freeing memcg + +From: Muchun Song + +[ Upstream commit 9f38f03ae8d5f57371b71aa6b4275765b65454fd ] + +Patch series "Use obj_cgroup APIs to charge kmem pages", v5. + +Since Roman's series "The new cgroup slab memory controller" applied. +All slab objects are charged with the new APIs of obj_cgroup. The new +APIs introduce a struct obj_cgroup to charge slab objects. It prevents +long-living objects from pinning the original memory cgroup in the +memory. But there are still some corner objects (e.g. allocations +larger than order-1 page on SLUB) which are not charged with the new +APIs. Those objects (include the pages which are allocated from buddy +allocator directly) are charged as kmem pages which still hold a +reference to the memory cgroup. + +E.g. We know that the kernel stack is charged as kmem pages because the +size of the kernel stack can be greater than 2 pages (e.g. 16KB on +x86_64 or arm64). If we create a thread (suppose the thread stack is +charged to memory cgroup A) and then move it from memory cgroup A to +memory cgroup B. Because the kernel stack of the thread hold a +reference to the memory cgroup A. The thread can pin the memory cgroup +A in the memory even if we remove the cgroup A. If we want to see this +scenario by using the following script. We can see that the system has +added 500 dying cgroups (This is not a real world issue, just a script +to show that the large kmallocs are charged as kmem pages which can pin +the memory cgroup in the memory). + + #!/bin/bash + + cat /proc/cgroups | grep memory + + cd /sys/fs/cgroup/memory + echo 1 > memory.move_charge_at_immigrate + + for i in range{1..500} + do + mkdir kmem_test + echo $$ > kmem_test/cgroup.procs + sleep 3600 & + echo $$ > cgroup.procs + echo `cat kmem_test/cgroup.procs` > cgroup.procs + rmdir kmem_test + done + + cat /proc/cgroups | grep memory + +This patchset aims to make those kmem pages to drop the reference to +memory cgroup by using the APIs of obj_cgroup. Finally, we can see that +the number of the dying cgroups will not increase if we run the above test +script. + +This patch (of 7): + +The rcu_read_lock/unlock only can guarantee that the memcg will not be +freed, but it cannot guarantee the success of css_get (which is in the +refill_stock when cached memcg changed) to memcg. + + rcu_read_lock() + memcg = obj_cgroup_memcg(old) + __memcg_kmem_uncharge(memcg) + refill_stock(memcg) + if (stock->cached != memcg) + // css_get can change the ref counter from 0 back to 1. + css_get(&memcg->css) + rcu_read_unlock() + +This fix is very like the commit: + + eefbfa7fd678 ("mm: memcg/slab: fix use after free in obj_cgroup_charge") + +Fix this by holding a reference to the memcg which is passed to the +__memcg_kmem_uncharge() before calling __memcg_kmem_uncharge(). + +Link: https://lkml.kernel.org/r/20210319163821.20704-1-songmuchun@bytedance.com +Link: https://lkml.kernel.org/r/20210319163821.20704-2-songmuchun@bytedance.com +Fixes: 3de7d4f25a74 ("mm: memcg/slab: optimize objcg stock draining") +Signed-off-by: Muchun Song +Reviewed-by: Shakeel Butt +Acked-by: Roman Gushchin +Acked-by: Johannes Weiner +Cc: Michal Hocko +Cc: Vladimir Davydov +Cc: Xiongchun Duan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memcontrol.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index d72d2b90474a..8d9f5fa4c6d3 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3162,9 +3162,17 @@ static void drain_obj_stock(struct memcg_stock_pcp *stock) + unsigned int nr_bytes = stock->nr_bytes & (PAGE_SIZE - 1); + + if (nr_pages) { ++ struct mem_cgroup *memcg; ++ + rcu_read_lock(); +- __memcg_kmem_uncharge(obj_cgroup_memcg(old), nr_pages); ++retry: ++ memcg = obj_cgroup_memcg(old); ++ if (unlikely(!css_tryget(&memcg->css))) ++ goto retry; + rcu_read_unlock(); ++ ++ __memcg_kmem_uncharge(memcg, nr_pages); ++ css_put(&memcg->css); + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/mm-memory-failure-unnecessary-amount-of-unmapping.patch b/queue-5.10/mm-memory-failure-unnecessary-amount-of-unmapping.patch new file mode 100644 index 00000000000..47d2c67589c --- /dev/null +++ b/queue-5.10/mm-memory-failure-unnecessary-amount-of-unmapping.patch @@ -0,0 +1,42 @@ +From 0ffdd1c33a9a6f39315214c098ccbfeb63bc5cd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 23:02:19 -0700 +Subject: mm/memory-failure: unnecessary amount of unmapping + +From: Jane Chu + +[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ] + +It appears that unmap_mapping_range() actually takes a 'size' as its third +argument rather than a location, the current calling fashion causes +unnecessary amount of unmapping to occur. + +Link: https://lkml.kernel.org/r/20210420002821.2749748-1-jane.chu@oracle.com +Fixes: 6100e34b2526e ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages") +Signed-off-by: Jane Chu +Reviewed-by: Dan Williams +Reviewed-by: Naoya Horiguchi +Cc: Dave Jiang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 570a20b42561..2d7a667f8e60 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1293,7 +1293,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags, + * communicated in siginfo, see kill_proc() + */ + start = (page->index << PAGE_SHIFT) & ~(size - 1); +- unmap_mapping_range(page->mapping, start, start + size, 0); ++ unmap_mapping_range(page->mapping, start, size, 0); + } + kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags); + rc = 0; +-- +2.30.2 + diff --git a/queue-5.10/mm-sl-b.c-remove-ctor-argument-from-kmem_cache_flags.patch b/queue-5.10/mm-sl-b.c-remove-ctor-argument-from-kmem_cache_flags.patch new file mode 100644 index 00000000000..c4278f2503a --- /dev/null +++ b/queue-5.10/mm-sl-b.c-remove-ctor-argument-from-kmem_cache_flags.patch @@ -0,0 +1,126 @@ +From dcc9acb928e43cdf59913f8f19a88e33b099f941 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:00:58 -0800 +Subject: mm/sl?b.c: remove ctor argument from kmem_cache_flags + +From: Nikolay Borisov + +[ Upstream commit 3754000872188e3e4713d9d847fe3c615a47c220 ] + +This argument hasn't been used since e153362a50a3 ("slub: Remove objsize +check in kmem_cache_flags()") so simply remove it. + +Link: https://lkml.kernel.org/r/20210126095733.974665-1-nborisov@suse.com +Signed-off-by: Nikolay Borisov +Reviewed-by: Miaohe Lin +Reviewed-by: Vlastimil Babka +Acked-by: Christoph Lameter +Acked-by: David Rientjes +Cc: Pekka Enberg +Cc: Joonsoo Kim +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/slab.c | 3 +-- + mm/slab.h | 6 ++---- + mm/slab_common.c | 2 +- + mm/slub.c | 9 +++------ + 4 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/mm/slab.c b/mm/slab.c +index b1113561b98b..b2cc2cf7d8a3 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -1789,8 +1789,7 @@ static int __ref setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp) + } + + slab_flags_t kmem_cache_flags(unsigned int object_size, +- slab_flags_t flags, const char *name, +- void (*ctor)(void *)) ++ slab_flags_t flags, const char *name) + { + return flags; + } +diff --git a/mm/slab.h b/mm/slab.h +index f9977d6613d6..e258ffcfb0ef 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -110,8 +110,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, + slab_flags_t flags, void (*ctor)(void *)); + + slab_flags_t kmem_cache_flags(unsigned int object_size, +- slab_flags_t flags, const char *name, +- void (*ctor)(void *)); ++ slab_flags_t flags, const char *name); + #else + static inline struct kmem_cache * + __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, +@@ -119,8 +118,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, + { return NULL; } + + static inline slab_flags_t kmem_cache_flags(unsigned int object_size, +- slab_flags_t flags, const char *name, +- void (*ctor)(void *)) ++ slab_flags_t flags, const char *name) + { + return flags; + } +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 8d96679668b4..8f27ccf9f7f3 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -196,7 +196,7 @@ struct kmem_cache *find_mergeable(unsigned int size, unsigned int align, + size = ALIGN(size, sizeof(void *)); + align = calculate_alignment(flags, align, size); + size = ALIGN(size, align); +- flags = kmem_cache_flags(size, flags, name, NULL); ++ flags = kmem_cache_flags(size, flags, name); + + if (flags & SLAB_NEVER_MERGE) + return NULL; +diff --git a/mm/slub.c b/mm/slub.c +index fbc415c34009..05a501b67cd5 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1397,7 +1397,6 @@ __setup("slub_debug", setup_slub_debug); + * @object_size: the size of an object without meta data + * @flags: flags to set + * @name: name of the cache +- * @ctor: constructor function + * + * Debug option(s) are applied to @flags. In addition to the debug + * option(s), if a slab name (or multiple) is specified i.e. +@@ -1405,8 +1404,7 @@ __setup("slub_debug", setup_slub_debug); + * then only the select slabs will receive the debug option(s). + */ + slab_flags_t kmem_cache_flags(unsigned int object_size, +- slab_flags_t flags, const char *name, +- void (*ctor)(void *)) ++ slab_flags_t flags, const char *name) + { + char *iter; + size_t len; +@@ -1471,8 +1469,7 @@ static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n, + static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, + struct page *page) {} + slab_flags_t kmem_cache_flags(unsigned int object_size, +- slab_flags_t flags, const char *name, +- void (*ctor)(void *)) ++ slab_flags_t flags, const char *name) + { + return flags; + } +@@ -3782,7 +3779,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) + + static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags) + { +- s->flags = kmem_cache_flags(s->size, flags, s->name, s->ctor); ++ s->flags = kmem_cache_flags(s->size, flags, s->name); + #ifdef CONFIG_SLAB_FREELIST_HARDENED + s->random = get_random_long(); + #endif +-- +2.30.2 + diff --git a/queue-5.10/mm-slub-enable-slub_debug-static-key-when-creating-c.patch b/queue-5.10/mm-slub-enable-slub_debug-static-key-when-creating-c.patch new file mode 100644 index 00000000000..d55411aa203 --- /dev/null +++ b/queue-5.10/mm-slub-enable-slub_debug-static-key-when-creating-c.patch @@ -0,0 +1,75 @@ +From 689f91dbd37dff44ea786a3964d2b9f49cf87b00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:54:42 -0700 +Subject: mm, slub: enable slub_debug static key when creating cache with + explicit debug flags + +From: Vlastimil Babka + +[ Upstream commit 1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66 ] + +Commit ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()") +introduced a static key to optimize the case where no debugging is +enabled for any cache. The static key is enabled when slub_debug boot +parameter is passed, or CONFIG_SLUB_DEBUG_ON enabled. + +However, some caches might be created with one or more debugging flags +explicitly passed to kmem_cache_create(), and the commit missed this. +Thus the debugging functionality would not be actually performed for +these caches unless the static key gets enabled by boot param or config. + +This patch fixes it by checking for debugging flags passed to +kmem_cache_create() and enabling the static key accordingly. + +Note such explicit debugging flags should not be used outside of +debugging and testing as they will now enable the static key globally. +btrfs_init_cachep() creates a cache with SLAB_RED_ZONE but that's a +mistake that's being corrected [1]. rcu_torture_stats() creates a cache +with SLAB_STORE_USER, but that is a testing module so it's OK and will +start working as intended after this patch. + +Also note that in case of backports to kernels before v5.12 that don't +have 59450bbc12be ("mm, slab, slub: stop taking cpu hotplug lock"), +static_branch_enable_cpuslocked() should be used. + +[1] https://lore.kernel.org/linux-btrfs/20210315141824.26099-1-dsterba@suse.com/ + +Link: https://lkml.kernel.org/r/20210315153415.24404-1-vbabka@suse.cz +Fixes: ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()") +Signed-off-by: Vlastimil Babka +Reported-by: Oliver Glitta +Acked-by: David Rientjes +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: Joonsoo Kim +Cc: "Paul E. McKenney" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/slub.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/mm/slub.c b/mm/slub.c +index 05a501b67cd5..e4f7978d43c2 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -3779,6 +3779,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) + + static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags) + { ++#ifdef CONFIG_SLUB_DEBUG ++ /* ++ * If no slub_debug was enabled globally, the static key is not yet ++ * enabled by setup_slub_debug(). Enable it if the cache is being ++ * created with any of the debugging flags passed explicitly. ++ */ ++ if (flags & SLAB_DEBUG_FLAGS) ++ static_branch_enable(&slub_debug_enabled); ++#endif + s->flags = kmem_cache_flags(s->size, flags, s->name); + #ifdef CONFIG_SLAB_FREELIST_HARDENED + s->random = get_random_long(); +-- +2.30.2 + diff --git a/queue-5.10/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch b/queue-5.10/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch new file mode 100644 index 00000000000..edaf5f9f4b0 --- /dev/null +++ b/queue-5.10/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch @@ -0,0 +1,42 @@ +From 26fdb53abc88c48da25fd5382033de5e1b474729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:57:58 -0700 +Subject: mm/sparse: add the missing sparse_buffer_fini() in error branch + +From: Wang Wensheng + +[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ] + +sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a +WARN issue would be through the next time sparse_buffer_init() runs. + +Add the missing sparse_buffer_fini() in error branch. + +Link: https://lkml.kernel.org/r/20210325113155.118574-1-wangwensheng4@huawei.com +Fixes: 85c77f791390 ("mm/sparse: add new sparse_init_nid() and sparse_init()") +Signed-off-by: Wang Wensheng +Reviewed-by: David Hildenbrand +Reviewed-by: Oscar Salvador +Cc: Pavel Tatashin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/sparse.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mm/sparse.c b/mm/sparse.c +index 7bd23f9d6cef..33406ea2ecc4 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -547,6 +547,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin, + pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.", + __func__, nid); + pnum_begin = pnum; ++ sparse_buffer_fini(); + goto failed; + } + check_usemap_section_nr(nid, usage); +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7615-fix-memleak-when-mt7615_unregister_devic.patch b/queue-5.10/mt76-mt7615-fix-memleak-when-mt7615_unregister_devic.patch new file mode 100644 index 00000000000..c4c4a770b8a --- /dev/null +++ b/queue-5.10/mt76-mt7615-fix-memleak-when-mt7615_unregister_devic.patch @@ -0,0 +1,38 @@ +From 15baab7444d6a37879231468ee138dd070a918a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 13:34:56 +0800 +Subject: mt76: mt7615: fix memleak when mt7615_unregister_device() + +From: Ryder Lee + +[ Upstream commit 8ab31da7b89f71c4c2defcca989fab7b42f87d71 ] + +mt7615_tx_token_put() should get call before mt76_free_pending_txwi(). + +Fixes: a6275e934605 ("mt76: mt7615: reset token when mac_reset happens") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +index 7b81aef3684e..726e4781d9d9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +@@ -161,10 +161,9 @@ void mt7615_unregister_device(struct mt7615_dev *dev) + mt76_unregister_device(&dev->mt76); + if (mcu_running) + mt7615_mcu_exit(dev); +- mt7615_dma_cleanup(dev); + + mt7615_tx_token_put(dev); +- ++ mt7615_dma_cleanup(dev); + tasklet_disable(&dev->irq_tasklet); + + mt76_free_device(&dev->mt76); +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7615-fix-mib-stats-counter-reporting-to-mac80.patch b/queue-5.10/mt76-mt7615-fix-mib-stats-counter-reporting-to-mac80.patch new file mode 100644 index 00000000000..b5d8a46ea14 --- /dev/null +++ b/queue-5.10/mt76-mt7615-fix-mib-stats-counter-reporting-to-mac80.patch @@ -0,0 +1,117 @@ +From d6f274c1aee7f886631d79283e3199c8817eb830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 11:42:49 +0100 +Subject: mt76: mt7615: fix mib stats counter reporting to mac80211 + +From: Lorenzo Bianconi + +[ Upstream commit 2eb6f6c437745bce46bd7a8f3a22a732d5b9becb ] + +In order to properly report MIB counters to mac80211, resets stats in +mt7615_get_stats routine and hold mt76 mutex accessing MIB counters. +Sum up MIB counters in mt7615_mac_update_mib_stats routine. + +Fixes: c388d8584bc83 ("mt76: mt7615: add a get_stats() callback") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7615/mac.c | 26 ++++++------------- + .../net/wireless/mediatek/mt76/mt7615/main.c | 6 +++++ + .../wireless/mediatek/mt76/mt7615/mt7615.h | 10 +++---- + 3 files changed, 19 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index f479012ab52c..5795e44f8a52 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -1817,10 +1817,8 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy) + int i, aggr; + u32 val, val2; + +- memset(mib, 0, sizeof(*mib)); +- +- mib->fcs_err_cnt = mt76_get_field(dev, MT_MIB_SDR3(ext_phy), +- MT_MIB_SDR3_FCS_ERR_MASK); ++ mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(ext_phy), ++ MT_MIB_SDR3_FCS_ERR_MASK); + + val = mt76_get_field(dev, MT_MIB_SDR14(ext_phy), + MT_MIB_AMPDU_MPDU_COUNT); +@@ -1833,24 +1831,16 @@ mt7615_mac_update_mib_stats(struct mt7615_phy *phy) + aggr = ext_phy ? ARRAY_SIZE(dev->mt76.aggr_stats) / 2 : 0; + for (i = 0; i < 4; i++) { + val = mt76_rr(dev, MT_MIB_MB_SDR1(ext_phy, i)); +- +- val2 = FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val); +- if (val2 > mib->ack_fail_cnt) +- mib->ack_fail_cnt = val2; +- +- val2 = FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val); +- if (val2 > mib->ba_miss_cnt) +- mib->ba_miss_cnt = val2; ++ mib->ba_miss_cnt += FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val); ++ mib->ack_fail_cnt += FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, ++ val); + + val = mt76_rr(dev, MT_MIB_MB_SDR0(ext_phy, i)); +- val2 = FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val); +- if (val2 > mib->rts_retries_cnt) { +- mib->rts_cnt = FIELD_GET(MT_MIB_RTS_COUNT_MASK, val); +- mib->rts_retries_cnt = val2; +- } ++ mib->rts_cnt += FIELD_GET(MT_MIB_RTS_COUNT_MASK, val); ++ mib->rts_retries_cnt += FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, ++ val); + + val = mt76_rr(dev, MT_TX_AGG_CNT(ext_phy, i)); +- + dev->mt76.aggr_stats[aggr++] += val & 0xffff; + dev->mt76.aggr_stats[aggr++] += val >> 16; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index 3186b7b2ca48..88cdc2badeae 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -851,11 +851,17 @@ mt7615_get_stats(struct ieee80211_hw *hw, + struct mt7615_phy *phy = mt7615_hw_phy(hw); + struct mib_stats *mib = &phy->mib; + ++ mt7615_mutex_acquire(phy->dev); ++ + stats->dot11RTSSuccessCount = mib->rts_cnt; + stats->dot11RTSFailureCount = mib->rts_retries_cnt; + stats->dot11FCSErrorCount = mib->fcs_err_cnt; + stats->dot11ACKFailureCount = mib->ack_fail_cnt; + ++ memset(mib, 0, sizeof(*mib)); ++ ++ mt7615_mutex_release(phy->dev); ++ + return 0; + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +index 5b06294d654a..4cee76691786 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +@@ -161,11 +161,11 @@ struct mt7615_vif { + }; + + struct mib_stats { +- u16 ack_fail_cnt; +- u16 fcs_err_cnt; +- u16 rts_cnt; +- u16 rts_retries_cnt; +- u16 ba_miss_cnt; ++ u32 ack_fail_cnt; ++ u32 fcs_err_cnt; ++ u32 rts_cnt; ++ u32 rts_retries_cnt; ++ u32 ba_miss_cnt; + unsigned long aggr_per; + }; + +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7615-fix-tx-skb-dma-unmap.patch b/queue-5.10/mt76-mt7615-fix-tx-skb-dma-unmap.patch new file mode 100644 index 00000000000..46f1ad77041 --- /dev/null +++ b/queue-5.10/mt76-mt7615-fix-tx-skb-dma-unmap.patch @@ -0,0 +1,35 @@ +From 41527cd8ae95309c42e2ac3f70902acfe5ea65b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Feb 2021 18:42:15 +0100 +Subject: mt76: mt7615: fix tx skb dma unmap + +From: Felix Fietkau + +[ Upstream commit ebee7885bb12a8fe2c2f9bac87dbd87a05b645f9 ] + +The first pointer in the txp needs to be unmapped as well, otherwise it will +leak DMA mapping entries + +Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915") +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 8c66ad943b4d..f479012ab52c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -688,7 +688,7 @@ mt7615_txp_skb_unmap_fw(struct mt76_dev *dev, struct mt7615_fw_txp *txp) + { + int i; + +- for (i = 1; i < txp->nbuf; i++) ++ for (i = 0; i < txp->nbuf; i++) + dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]), + le16_to_cpu(txp->len[i]), DMA_TO_DEVICE); + } +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7663s-fix-the-possible-device-hang-in-high-tr.patch b/queue-5.10/mt76-mt7663s-fix-the-possible-device-hang-in-high-tr.patch new file mode 100644 index 00000000000..b6bab54d675 --- /dev/null +++ b/queue-5.10/mt76-mt7663s-fix-the-possible-device-hang-in-high-tr.patch @@ -0,0 +1,53 @@ +From 439eb56aa630e02f24280004cf686ca8e2231698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 21:25:23 +0800 +Subject: mt76: mt7663s: fix the possible device hang in high traffic + +From: Sean Wang + +[ Upstream commit 45247a85614b49b07b9dc59a4e6783b17e766ff2 ] + +Use the additional memory barrier to ensure the skb list up-to-date +between the skb producer and consumer to avoid the invalid skb content +written into sdio controller and then cause device hang due to mcu assert +caught by WR_TIMEOUT_INT. + +Fixes: 1522ff731f84 ("mt76: mt7663s: introduce sdio tx aggregation") +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 ++ + drivers/net/wireless/mediatek/mt76/sdio.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +index 2c269fee8555..d7d61a5b66a3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +@@ -201,6 +201,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, enum mt76_txq_id qid) + struct mt76_queue_entry *e = &q->entry[q->first]; + struct sk_buff *iter; + ++ smp_rmb(); ++ + if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) { + __skb_put_zero(e->skb, 4); + err = __mt7663s_xmit_queue(dev, e->skb->data, +diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c +index 9a4d95a2a707..439ea4158260 100644 +--- a/drivers/net/wireless/mediatek/mt76/sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/sdio.c +@@ -215,6 +215,9 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid, + + q->entry[q->head].skb = tx_info.skb; + q->entry[q->head].buf_sz = len; ++ ++ smp_wmb(); ++ + q->head = (q->head + 1) % q->ndesc; + q->queued++; + +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7663s-make-all-of-packets-4-bytes-aligned-in-.patch b/queue-5.10/mt76-mt7663s-make-all-of-packets-4-bytes-aligned-in-.patch new file mode 100644 index 00000000000..3ae75336c27 --- /dev/null +++ b/queue-5.10/mt76-mt7663s-make-all-of-packets-4-bytes-aligned-in-.patch @@ -0,0 +1,58 @@ +From 78f19b5c393ab3bb9cef71a6c5f080bafd0af6c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 21:25:22 +0800 +Subject: mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx + aggregation + +From: Sean Wang + +[ Upstream commit 455ae5aabcc72fed7e5c803d59d122415500dc08 ] + +Each packet should be padded with the additional zero to become 4-bytes +alignment in sdio tx aggregation. + +Fixes: 1522ff731f84 ("mt76: mt7663s: introduce sdio tx aggregation") +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +index 595519c58255..2c269fee8555 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c +@@ -195,6 +195,7 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, enum mt76_txq_id qid) + int err, nframes = 0, len = 0, pse_sz = 0, ple_sz = 0; + struct mt76_queue *q = dev->q_tx[qid]; + struct mt76_sdio *sdio = &dev->sdio; ++ u8 pad; + + while (q->first != q->head) { + struct mt76_queue_entry *e = &q->entry[q->first]; +@@ -210,7 +211,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, enum mt76_txq_id qid) + goto next; + } + +- if (len + e->skb->len + 4 > MT76S_XMIT_BUF_SZ) ++ pad = roundup(e->skb->len, 4) - e->skb->len; ++ if (len + e->skb->len + pad + 4 > MT76S_XMIT_BUF_SZ) + break; + + if (mt7663s_tx_pick_quota(sdio, qid, e->buf_sz, &pse_sz, +@@ -228,6 +230,11 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, enum mt76_txq_id qid) + len += iter->len; + nframes++; + } ++ ++ if (unlikely(pad)) { ++ memset(sdio->xmit_buf[qid] + len, 0, pad); ++ len += pad; ++ } + next: + q->first = (q->first + 1) % q->ndesc; + e->done = true; +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7915-fix-aggr-len-debugfs-node.patch b/queue-5.10/mt76-mt7915-fix-aggr-len-debugfs-node.patch new file mode 100644 index 00000000000..21688fc05aa --- /dev/null +++ b/queue-5.10/mt76-mt7915-fix-aggr-len-debugfs-node.patch @@ -0,0 +1,35 @@ +From f9ab8f173950a7d29bbac774bbf2c35e5d8c81e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 02:14:36 +0100 +Subject: mt76: mt7915: fix aggr len debugfs node + +From: Lorenzo Bianconi + +[ Upstream commit 9fb9d755fae20b5ad62ef8b4e9289e5baea2c6fc ] + +Similar to mt7921, fix 802.11 aggr len debugfs reporting for mt7915 driver. + +Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +index 8f2ad32ade18..e4d7eb33a9f4 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +@@ -124,7 +124,7 @@ mt7915_ampdu_stat_read_phy(struct mt7915_phy *phy, + range[i] = mt76_rr(dev, MT_MIB_ARNG(ext_phy, i)); + + for (i = 0; i < ARRAY_SIZE(bound); i++) +- bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i) + 1; ++ bound[i] = MT_MIB_ARNCR_RANGE(range[i / 4], i % 4) + 1; + + seq_printf(file, "\nPhy %d\n", ext_phy); + +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7915-fix-mib-stats-counter-reporting-to-mac80.patch b/queue-5.10/mt76-mt7915-fix-mib-stats-counter-reporting-to-mac80.patch new file mode 100644 index 00000000000..ec500a051f2 --- /dev/null +++ b/queue-5.10/mt76-mt7915-fix-mib-stats-counter-reporting-to-mac80.patch @@ -0,0 +1,128 @@ +From eac47e2fc6f0cf0d0a8501dd64a8d2f38a0f1e40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 22:00:36 +0800 +Subject: mt76: mt7915: fix mib stats counter reporting to mac80211 + +From: Ryder Lee + +[ Upstream commit 2b35050a321865859fd2f12a3c18ed7be27858c9 ] + +In order to properly report MIB counters to mac80211, resets stats in +mt7915_get_stats routine() and hold mt76 mutex accessing MIB counters. +Sum up MIB counters in mt7915_mac_update_mib_stats routine. + +Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7915/mac.c | 35 +++++++------------ + .../net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++ + .../wireless/mediatek/mt76/mt7915/mt7915.h | 10 +++--- + 3 files changed, 24 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index dd5793004989..1e14d7782841 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1277,39 +1277,30 @@ mt7915_mac_update_mib_stats(struct mt7915_phy *phy) + bool ext_phy = phy != &dev->phy; + int i, aggr0, aggr1; + +- memset(mib, 0, sizeof(*mib)); +- +- mib->fcs_err_cnt = mt76_get_field(dev, MT_MIB_SDR3(ext_phy), +- MT_MIB_SDR3_FCS_ERR_MASK); ++ mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(ext_phy), ++ MT_MIB_SDR3_FCS_ERR_MASK); + + aggr0 = ext_phy ? ARRAY_SIZE(dev->mt76.aggr_stats) / 2 : 0; + for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) { +- u32 val, val2; ++ u32 val; + + val = mt76_rr(dev, MT_MIB_MB_SDR1(ext_phy, i)); +- +- val2 = FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val); +- if (val2 > mib->ack_fail_cnt) +- mib->ack_fail_cnt = val2; +- +- val2 = FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val); +- if (val2 > mib->ba_miss_cnt) +- mib->ba_miss_cnt = val2; ++ mib->ba_miss_cnt += FIELD_GET(MT_MIB_BA_MISS_COUNT_MASK, val); ++ mib->ack_fail_cnt += ++ FIELD_GET(MT_MIB_ACK_FAIL_COUNT_MASK, val); + + val = mt76_rr(dev, MT_MIB_MB_SDR0(ext_phy, i)); +- val2 = FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val); +- if (val2 > mib->rts_retries_cnt) { +- mib->rts_cnt = FIELD_GET(MT_MIB_RTS_COUNT_MASK, val); +- mib->rts_retries_cnt = val2; +- } ++ mib->rts_cnt += FIELD_GET(MT_MIB_RTS_COUNT_MASK, val); ++ mib->rts_retries_cnt += ++ FIELD_GET(MT_MIB_RTS_RETRIES_COUNT_MASK, val); + + val = mt76_rr(dev, MT_TX_AGG_CNT(ext_phy, i)); +- val2 = mt76_rr(dev, MT_TX_AGG_CNT2(ext_phy, i)); +- + dev->mt76.aggr_stats[aggr0++] += val & 0xffff; + dev->mt76.aggr_stats[aggr0++] += val >> 16; +- dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff; +- dev->mt76.aggr_stats[aggr1++] += val2 >> 16; ++ ++ val = mt76_rr(dev, MT_TX_AGG_CNT2(ext_phy, i)); ++ dev->mt76.aggr_stats[aggr1++] += val & 0xffff; ++ dev->mt76.aggr_stats[aggr1++] += val >> 16; + } + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index c48158392057..e78d3efa3fdf 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -651,13 +651,19 @@ mt7915_get_stats(struct ieee80211_hw *hw, + struct ieee80211_low_level_stats *stats) + { + struct mt7915_phy *phy = mt7915_hw_phy(hw); ++ struct mt7915_dev *dev = mt7915_hw_dev(hw); + struct mib_stats *mib = &phy->mib; + ++ mutex_lock(&dev->mt76.mutex); + stats->dot11RTSSuccessCount = mib->rts_cnt; + stats->dot11RTSFailureCount = mib->rts_retries_cnt; + stats->dot11FCSErrorCount = mib->fcs_err_cnt; + stats->dot11ACKFailureCount = mib->ack_fail_cnt; + ++ memset(mib, 0, sizeof(*mib)); ++ ++ mutex_unlock(&dev->mt76.mutex); ++ + return 0; + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 4b8908fa7eda..c84110e34ede 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -99,11 +99,11 @@ struct mt7915_vif { + }; + + struct mib_stats { +- u16 ack_fail_cnt; +- u16 fcs_err_cnt; +- u16 rts_cnt; +- u16 rts_retries_cnt; +- u16 ba_miss_cnt; ++ u32 ack_fail_cnt; ++ u32 fcs_err_cnt; ++ u32 rts_cnt; ++ u32 rts_retries_cnt; ++ u32 ba_miss_cnt; + }; + + struct mt7915_phy { +-- +2.30.2 + diff --git a/queue-5.10/mt76-mt7915-fix-tx-skb-dma-unmap.patch b/queue-5.10/mt76-mt7915-fix-tx-skb-dma-unmap.patch new file mode 100644 index 00000000000..f2c071cbfe9 --- /dev/null +++ b/queue-5.10/mt76-mt7915-fix-tx-skb-dma-unmap.patch @@ -0,0 +1,36 @@ +From 125bd643f3a823b1144d6d6c7aa0345a53656386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Feb 2021 18:44:10 +0100 +Subject: mt76: mt7915: fix tx skb dma unmap + +From: Felix Fietkau + +[ Upstream commit 7dcf3c04f0aca746517a77433b33d40868ca4749 ] + +The first pointer in the txp needs to be unmapped as well, otherwise it will +leak DMA mapping entries + +Reported-by: Ben Greear +Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915") +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index 6f159d99a596..dd5793004989 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -856,7 +856,7 @@ void mt7915_txp_skb_unmap(struct mt76_dev *dev, + int i; + + txp = mt7915_txwi_to_txp(dev, t); +- for (i = 1; i < txp->nbuf; i++) ++ for (i = 0; i < txp->nbuf; i++) + dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]), + le16_to_cpu(txp->len[i]), DMA_TO_DEVICE); + } +-- +2.30.2 + diff --git a/queue-5.10/mt7601u-fix-always-true-expression.patch b/queue-5.10/mt7601u-fix-always-true-expression.patch new file mode 100644 index 00000000000..85cbe5ac6f3 --- /dev/null +++ b/queue-5.10/mt7601u-fix-always-true-expression.patch @@ -0,0 +1,47 @@ +From 8dfc6e1ba0e0414aea2ecd88bbb0ffb70957f2f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 18:32:41 +0000 +Subject: mt7601u: fix always true expression + +From: Colin Ian King + +[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ] + +Currently the expression ~nic_conf1 is always true because nic_conf1 +is a u16 and according to 6.5.3.3 of the C standard the ~ operator +promotes the u16 to an integer before flipping all the bits. Thus +the top 16 bits of the integer result are all set so the expression +is always true. If the intention was to flip all the bits of nic_conf1 +then casting the integer result back to a u16 is a suitabel fix. + +Interestingly static analyzers seem to thing a bitwise ! should be +used instead of ~ for this scenario, so I think the original intent +of the expression may need some extra consideration. + +Addresses-Coverity: ("Logical vs. bitwise operator") +Fixes: c869f77d6abb ("add mt7601u driver") +Signed-off-by: Colin Ian King +Acked-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +index c868582c5d22..aa3b64902cf9 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +@@ -99,7 +99,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) + { + u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1); + +- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); ++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); + } + + static void +-- +2.30.2 + diff --git a/queue-5.10/mtd-don-t-lock-when-recursively-deleting-partitions.patch b/queue-5.10/mtd-don-t-lock-when-recursively-deleting-partitions.patch new file mode 100644 index 00000000000..b400ce09a5e --- /dev/null +++ b/queue-5.10/mtd-don-t-lock-when-recursively-deleting-partitions.patch @@ -0,0 +1,38 @@ +From 20a8d9e61fc8c3d53d0dfd0b07a50708b1294620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 20:53:20 +0100 +Subject: mtd: don't lock when recursively deleting partitions + +From: David Bauer + +[ Upstream commit cb4543054c5c4fd33df960b41d7b483ebca8e786 ] + +When recursively deleting partitions, don't acquire the masters +partition lock twice. Otherwise the process ends up in a deadlocked +state. + +Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling") +Signed-off-by: David Bauer +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210217195320.893253-1-mail@david-bauer.net +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdpart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c +index c3575b686f79..95d47422bbf2 100644 +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -331,7 +331,7 @@ static int __del_mtd_partitions(struct mtd_info *mtd) + + list_for_each_entry_safe(child, next, &mtd->partitions, part.node) { + if (mtd_has_partitions(child)) +- del_mtd_partitions(child); ++ __del_mtd_partitions(child); + + pr_info("Deleting %s MTD partition\n", child->name); + ret = del_mtd_device(child); +-- +2.30.2 + diff --git a/queue-5.10/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch b/queue-5.10/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch new file mode 100644 index 00000000000..81bac319145 --- /dev/null +++ b/queue-5.10/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch @@ -0,0 +1,49 @@ +From 14972b45cfd3580f8f7712ff74686e2da8777d71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 18:57:56 +0530 +Subject: mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() + +From: Manivannan Sadhasivam + +[ Upstream commit 08608adb520e51403be7592c2214846fa440a23a ] + +There are chances that the parse_mtd_partitions() function will return +-EPROBE_DEFER in mtd_device_parse_register(). This might happen when +the dependency is not available for the parser. For instance, on SDX55 +the MTD_QCOMSMEM_PARTS parser depends on the QCOM_SMEM driver to parse +the partitions defined in the shared memory region. With the current +flow, the error returned from parse_mtd_partitions() will be discarded +in favor of trying to add the fallback partition. + +This will prevent the driver to end up in probe deferred pool and the +partitions won't be parsed even after the QCOM_SMEM driver is available. + +Fix this issue by bailing out of mtd_device_parse_register() when +-EPROBE_DEFER error is returned from parse_mtd_partitions() function and +propagate the error code to the driver core for probing later. + +Fixes: 5ac67ce36cfe ("mtd: move code adding (registering) partitions to the parse_mtd_partitions()") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index b07cbb0661fb..1c8c40728678 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -820,6 +820,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types, + + /* Prefer parsed partitions over driver-provided fallback */ + ret = parse_mtd_partitions(mtd, types, parser_data); ++ if (ret == -EPROBE_DEFER) ++ goto out; ++ + if (ret > 0) + ret = 0; + else if (nr_parts) +-- +2.30.2 + diff --git a/queue-5.10/mtd-maps-fix-error-return-code-of-physmap_flash_remo.patch b/queue-5.10/mtd-maps-fix-error-return-code-of-physmap_flash_remo.patch new file mode 100644 index 00000000000..7672de114ff --- /dev/null +++ b/queue-5.10/mtd-maps-fix-error-return-code-of-physmap_flash_remo.patch @@ -0,0 +1,42 @@ +From ee8b2326090e2778ee453ce9d4585f77e14b4aeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 19:44:46 -0800 +Subject: mtd: maps: fix error return code of physmap_flash_remove() + +From: Jia-Ju Bai + +[ Upstream commit 620b90d30c08684dc6ebee07c72755d997f9d1f6 ] + +When platform_get_drvdata() returns NULL to info, no error return code +of physmap_flash_remove() is assigned. +To fix this bug, err is assigned with -EINVAL in this case + +Fixes: 73566edf9b91 ("[MTD] Convert physmap to platform driver") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210308034446.3052-1-baijiaju1990@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/maps/physmap-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c +index 001ed5deb622..4f63b8430c71 100644 +--- a/drivers/mtd/maps/physmap-core.c ++++ b/drivers/mtd/maps/physmap-core.c +@@ -69,8 +69,10 @@ static int physmap_flash_remove(struct platform_device *dev) + int i, err = 0; + + info = platform_get_drvdata(dev); +- if (!info) ++ if (!info) { ++ err = -EINVAL; + goto out; ++ } + + if (info->cmtd) { + err = mtd_device_unregister(info->cmtd); +-- +2.30.2 + diff --git a/queue-5.10/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch b/queue-5.10/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch new file mode 100644 index 00000000000..cba7abaf1a8 --- /dev/null +++ b/queue-5.10/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch @@ -0,0 +1,48 @@ +From e0b678387513dfb2deedae0f5e1a2a8eeff15648 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 09:02:10 +0100 +Subject: mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit f5200c14242fb8fa4a9b93f7fd4064d237e58785 ] + +Hamming ECC doesn't cover the OOB data, so reading or writing OOB shall +always be done without ECC enabled. +This is a problem when adding JFFS2 cleanmarkers to erased blocks. If JFFS2 +clenmarkers are added to the OOB with ECC enabled, OOB bytes will be changed +from ff ff ff to 00 00 00, reporting incorrect ECC errors. + +Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller") +Signed-off-by: Álvaro Fernández Rojas +Acked-by: Brian Norris +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210224080210.23686-1-noltari@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index 2da39ab89286..909b14cc8e55 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -2688,6 +2688,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip) + + ret = brcmstb_choose_ecc_layout(host); + ++ /* If OOB is written with ECC enabled it will cause ECC errors */ ++ if (is_hamming_ecc(host->ctrl, &host->hwcfg)) { ++ chip->ecc.write_oob = brcmnand_write_oob_raw; ++ chip->ecc.read_oob = brcmnand_read_oob_raw; ++ } ++ + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.10/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch b/queue-5.10/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch new file mode 100644 index 00000000000..46fcd6b4b63 --- /dev/null +++ b/queue-5.10/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch @@ -0,0 +1,42 @@ +From 7bed4342f601bb60f3a56e3130036b5a9952dee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 18:58:49 +0300 +Subject: mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() + +From: Dan Carpenter + +[ Upstream commit e7a97528e3c787802d8c643d6ab2f428511bb047 ] + +If dma_request_channel() fails then the probe fails and it should +return a negative error code, but currently it returns success. + +fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support") +Signed-off-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/YCqaOZ83OvPOzLwh@mwanda +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsmc_nand.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index c88421a1c078..ce05dd4088e9 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -1078,11 +1078,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev) + host->read_dma_chan = dma_request_channel(mask, filter, NULL); + if (!host->read_dma_chan) { + dev_err(&pdev->dev, "Unable to get read dma channel\n"); ++ ret = -ENODEV; + goto disable_clk; + } + host->write_dma_chan = dma_request_channel(mask, filter, NULL); + if (!host->write_dma_chan) { + dev_err(&pdev->dev, "Unable to get write dma channel\n"); ++ ret = -ENODEV; + goto release_dma_read_chan; + } + } +-- +2.30.2 + diff --git a/queue-5.10/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch b/queue-5.10/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch new file mode 100644 index 00000000000..b6a55c3397c --- /dev/null +++ b/queue-5.10/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch @@ -0,0 +1,47 @@ +From 6944e5c15d6483bd44079766043f31651f154c7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 23:09:05 -0700 +Subject: mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init + +From: Lv Yunlong + +[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ] + +If the callee gpmi_alloc_dma_buffer() failed to alloc memory for +this->raw_buffer, gpmi_free_dma_buffer() will be called to free +this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL +and valid ptr. + +Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer() +is called again to free this->auxiliary_virt in err_out. This causes +a double free. + +As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's +error path, so it should return err directly instead of releasing the dma +buffer again. + +Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path") +Signed-off-by: Lv Yunlong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index 31a6210eb5d4..a6658567d55c 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -2447,7 +2447,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this) + this->bch_geometry.auxiliary_size = 128; + ret = gpmi_alloc_dma_buffer(this); + if (ret) +- goto err_out; ++ return ret; + + nand_controller_init(&this->base); + this->base.ops = &gpmi_nand_controller_ops; +-- +2.30.2 + diff --git a/queue-5.10/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch b/queue-5.10/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch new file mode 100644 index 00000000000..21550f4fa4c --- /dev/null +++ b/queue-5.10/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch @@ -0,0 +1,53 @@ +From 9e57aba9683aec267fa300177b2e14036ebdabeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 18:57:57 +0530 +Subject: mtd: rawnand: qcom: Return actual error code instead of -ENODEV + +From: Manivannan Sadhasivam + +[ Upstream commit 55fbb9ba4f06cb6aff32daca1e1910173c13ec51 ] + +In qcom_probe_nand_devices() function, the error code returned by +qcom_nand_host_init_and_register() is converted to -ENODEV in the case +of failure. This poses issue if -EPROBE_DEFER is returned when the +dependency is not available for a component like parser. + +So let's restructure the error handling logic a bit and return the +actual error code in case of qcom_nand_host_init_and_register() failure. + +Fixes: c76b78d8ec05 ("mtd: nand: Qualcomm NAND controller driver") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/qcom_nandc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c +index dfc17a28a06b..b99d2e9d1e2c 100644 +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -2874,7 +2874,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) + struct device *dev = nandc->dev; + struct device_node *dn = dev->of_node, *child; + struct qcom_nand_host *host; +- int ret; ++ int ret = -ENODEV; + + for_each_available_child_of_node(dn, child) { + host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL); +@@ -2892,10 +2892,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) + list_add_tail(&host->node, &nandc->host_list); + } + +- if (list_empty(&nandc->host_list)) +- return -ENODEV; +- +- return 0; ++ return ret; + } + + /* parse custom DT properties here */ +-- +2.30.2 + diff --git a/queue-5.10/mtd-require-write-permissions-for-locking-and-badblo.patch b/queue-5.10/mtd-require-write-permissions-for-locking-and-badblo.patch new file mode 100644 index 00000000000..f24eead8f28 --- /dev/null +++ b/queue-5.10/mtd-require-write-permissions-for-locking-and-badblo.patch @@ -0,0 +1,69 @@ +From 2460d0675032e23b1481d54ba40d786512c76c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:57:35 +0100 +Subject: mtd: require write permissions for locking and badblock ioctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Walle + +[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ] + +MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require +write permission. Depending on the hardware MEMLOCK might even be +write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK +is always write-once. + +MEMSETBADBLOCK modifies the bad block table. + +Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions") +Signed-off-by: Michael Walle +Reviewed-by: Greg Kroah-Hartman +Acked-by: Rafał Miłecki +Acked-by: Richard Weinberger +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdchar.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index b40f46a43fc6..69fb5dafa9ad 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -651,16 +651,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: +- case MEMLOCK: +- case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: +- case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: +- case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: +@@ -671,9 +667,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: ++ case MEMLOCK: ++ case MEMUNLOCK: ++ case MEMSETBADBLOCK: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: ++ case OTPLOCK: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; +-- +2.30.2 + diff --git a/queue-5.10/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch b/queue-5.10/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch new file mode 100644 index 00000000000..6179fea7313 --- /dev/null +++ b/queue-5.10/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch @@ -0,0 +1,43 @@ +From d5664710c8e793e636ec56096f0bf35fb0648d44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 11:26:27 -0700 +Subject: mwl8k: Fix a double Free in mwl8k_probe_hw + +From: Lv Yunlong + +[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ] + +In mwl8k_probe_hw, hw->priv->txq is freed at the first time by +dma_free_coherent() in the call chain: +if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i). + +Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed +at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent(). + +My patch set txq->txd to NULL after the first free to avoid the +double free. + +Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver") +Signed-off-by: Lv Yunlong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwl8k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index 23efd7075df6..27b7d4b779e0 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -1469,6 +1469,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) + txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL); + if (txq->skb == NULL) { + pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma); ++ txq->txd = NULL; + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-5.10/net-bridge-mcast-fix-broken-length-header-check-for-.patch b/queue-5.10/net-bridge-mcast-fix-broken-length-header-check-for-.patch new file mode 100644 index 00000000000..f4fc2c6bc36 --- /dev/null +++ b/queue-5.10/net-bridge-mcast-fix-broken-length-header-check-for-.patch @@ -0,0 +1,175 @@ +From 7494c9d1b0fe343387f081ca09c133f73ffba7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Apr 2021 17:27:35 +0200 +Subject: net: bridge: mcast: fix broken length + header check for MRDv6 Adv. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +[ Upstream commit 99014088156cd78867d19514a0bc771c4b86b93b ] + +The IPv6 Multicast Router Advertisements parsing has the following two +issues: + +For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD +messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes, +assuming MLDv2 Reports with at least one multicast address entry). +When ipv6_mc_check_mld_msg() tries to parse an Multicast Router +Advertisement its MLD length check will fail - and it will wrongly +return -EINVAL, even if we have a valid MRD Advertisement. With the +returned -EINVAL the bridge code will assume a broken packet and will +wrongly discard it, potentially leading to multicast packet loss towards +multicast routers. + +The second issue is the MRD header parsing in +br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header +immediately after the IPv6 header (IPv6 next header type). However +according to RFC4286, section 2 all MRD messages contain a Router Alert +option (just like MLD). So instead there is an IPv6 Hop-by-Hop option +for the Router Alert between the IPv6 and ICMPv6 header, again leading +to the bridge wrongly discarding Multicast Router Advertisements. + +To fix these two issues, introduce a new return value -ENODATA to +ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop +option which is not an MLD but potentially an MRD packet. This also +simplifies further parsing in the bridge code, as ipv6_mc_check_mld() +already fully checks the ICMPv6 header and hop-by-hop option. + +These issues were found and fixed with the help of the mrdisc tool +(https://github.com/troglobit/mrdisc). + +Fixes: 4b3087c7e37f ("bridge: Snoop Multicast Router Advertisements") +Signed-off-by: Linus Lüssing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/addrconf.h | 1 - + net/bridge/br_multicast.c | 33 ++++++++------------------------- + net/ipv6/mcast_snoop.c | 12 +++++++----- + 3 files changed, 15 insertions(+), 31 deletions(-) + +diff --git a/include/net/addrconf.h b/include/net/addrconf.h +index 18f783dcd55f..78ea3e332688 100644 +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -233,7 +233,6 @@ void ipv6_mc_unmap(struct inet6_dev *idev); + void ipv6_mc_remap(struct inet6_dev *idev); + void ipv6_mc_init_dev(struct inet6_dev *idev); + void ipv6_mc_destroy_dev(struct inet6_dev *idev); +-int ipv6_mc_check_icmpv6(struct sk_buff *skb); + int ipv6_mc_check_mld(struct sk_buff *skb); + void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp); + +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 54cb82a69056..5015ece7adf7 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -3070,25 +3070,14 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br, + } + + #if IS_ENABLED(CONFIG_IPV6) +-static int br_ip6_multicast_mrd_rcv(struct net_bridge *br, +- struct net_bridge_port *port, +- struct sk_buff *skb) ++static void br_ip6_multicast_mrd_rcv(struct net_bridge *br, ++ struct net_bridge_port *port, ++ struct sk_buff *skb) + { +- int ret; +- +- if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6) +- return -ENOMSG; +- +- ret = ipv6_mc_check_icmpv6(skb); +- if (ret < 0) +- return ret; +- + if (icmp6_hdr(skb)->icmp6_type != ICMPV6_MRDISC_ADV) +- return -ENOMSG; ++ return; + + br_multicast_mark_router(br, port); +- +- return 0; + } + + static int br_multicast_ipv6_rcv(struct net_bridge *br, +@@ -3102,18 +3091,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, + + err = ipv6_mc_check_mld(skb); + +- if (err == -ENOMSG) { ++ if (err == -ENOMSG || err == -ENODATA) { + if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr)) + BR_INPUT_SKB_CB(skb)->mrouters_only = 1; +- +- if (ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) { +- err = br_ip6_multicast_mrd_rcv(br, port, skb); +- +- if (err < 0 && err != -ENOMSG) { +- br_multicast_err_count(br, port, skb->protocol); +- return err; +- } +- } ++ if (err == -ENODATA && ++ ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr)) ++ br_ip6_multicast_mrd_rcv(br, port, skb); + + return 0; + } else if (err < 0) { +diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c +index d3d6b6a66e5f..04d5fcdfa6e0 100644 +--- a/net/ipv6/mcast_snoop.c ++++ b/net/ipv6/mcast_snoop.c +@@ -109,7 +109,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb) + struct mld_msg *mld; + + if (!ipv6_mc_may_pull(skb, len)) +- return -EINVAL; ++ return -ENODATA; + + mld = (struct mld_msg *)skb_transport_header(skb); + +@@ -122,7 +122,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb) + case ICMPV6_MGM_QUERY: + return ipv6_mc_check_mld_query(skb); + default: +- return -ENOMSG; ++ return -ENODATA; + } + } + +@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb) + return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo); + } + +-int ipv6_mc_check_icmpv6(struct sk_buff *skb) ++static int ipv6_mc_check_icmpv6(struct sk_buff *skb) + { + unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr); + unsigned int transport_len = ipv6_transport_len(skb); +@@ -150,7 +150,6 @@ int ipv6_mc_check_icmpv6(struct sk_buff *skb) + + return 0; + } +-EXPORT_SYMBOL(ipv6_mc_check_icmpv6); + + /** + * ipv6_mc_check_mld - checks whether this is a sane MLD packet +@@ -161,7 +160,10 @@ EXPORT_SYMBOL(ipv6_mc_check_icmpv6); + * + * -EINVAL: A broken packet was detected, i.e. it violates some internet + * standard +- * -ENOMSG: IP header validation succeeded but it is not an MLD packet. ++ * -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet ++ * with a hop-by-hop option. ++ * -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded ++ * but it is not an MLD packet. + * -ENOMEM: A memory allocation failure happened. + * + * Caller needs to set the skb network header and free any returned skb if it +-- +2.30.2 + diff --git a/queue-5.10/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch b/queue-5.10/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch new file mode 100644 index 00000000000..0a5d4fdfb6c --- /dev/null +++ b/queue-5.10/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch @@ -0,0 +1,48 @@ +From ecf8d9471c8f61e99d5faf8346ae109da172d724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 18:16:14 +0100 +Subject: net: davinci_emac: Fix incorrect masking of tx and rx error channel + +From: Colin Ian King + +[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ] + +The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) +are incorrect and always lead to a zero result. The mask values are +currently the incorrect post-right shifted values, fix this by setting +them to the currect values. + +(I double checked these against the TMS320TCI6482 data sheet, section +5.30, page 127 to ensure I had the correct mask values for the TXERRCH +and RXERRCH fields in the MACSTATUS register). + +Addresses-Coverity: ("Operands don't affect result") +Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index c7031e1960d4..03055c96f076 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -169,11 +169,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1"; + /* EMAC mac_status register */ + #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000) + #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) +-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000) + #define EMAC_MACSTATUS_TXERRCH_SHIFT (16) + #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000) + #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) +-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700) + #define EMAC_MACSTATUS_RXERRCH_SHIFT (8) + + /* EMAC RX register masks */ +-- +2.30.2 + diff --git a/queue-5.10/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch b/queue-5.10/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch new file mode 100644 index 00000000000..c70f4a35129 --- /dev/null +++ b/queue-5.10/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch @@ -0,0 +1,53 @@ +From f6e43a0014a204249734f25cc0cc5dd45826cc09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 09:06:25 -0700 +Subject: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send + +From: Lv Yunlong + +[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ] + +In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). +If some error happens in emac_tx_fill_tpd(), the skb will be freed via +dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). +But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). + +As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, +thus my patch assigns skb->len to 'len' before the possible free and +use 'len' instead of skb->len later. + +Fixes: b9b17debc69d2 ("net: emac: emac gigabit ethernet controller driver") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +index 117188e3c7de..87b8c032195d 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +@@ -1437,6 +1437,7 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt, + { + struct emac_tpd tpd; + u32 prod_idx; ++ int len; + + memset(&tpd, 0, sizeof(tpd)); + +@@ -1456,9 +1457,10 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt, + if (skb_network_offset(skb) != ETH_HLEN) + TPD_TYP_SET(&tpd, 1); + ++ len = skb->len; + emac_tx_fill_tpd(adpt, tx_q, skb, &tpd); + +- netdev_sent_queue(adpt->netdev, skb->len); ++ netdev_sent_queue(adpt->netdev, len); + + /* Make sure the are enough free descriptors to hold one + * maximum-sized SKB. We need one desc for each fragment, +-- +2.30.2 + diff --git a/queue-5.10/net-enetc-fix-link-error-again.patch b/queue-5.10/net-enetc-fix-link-error-again.patch new file mode 100644 index 00000000000..faefa6a3ff2 --- /dev/null +++ b/queue-5.10/net-enetc-fix-link-error-again.patch @@ -0,0 +1,47 @@ +From 48ab67853fb218a16595923bea09120032931c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 15:35:11 +0200 +Subject: net: enetc: fix link error again + +From: Arnd Bergmann + +[ Upstream commit 74c97ea3b61e4ce149444f904ee8d4fc7073505b ] + +A link time bug that I had fixed before has come back now that +another sub-module was added to the enetc driver: + +ERROR: modpost: "enetc_ierb_register_pf" [drivers/net/ethernet/freescale/enetc/fsl-enetc.ko] undefined! + +The problem is that the enetc Makefile is not actually used for +the ierb module if that is the only built-in driver in there +and everything else is a loadable module. + +Fix it by always entering the directory this time, regardless +of which symbols are configured. This should reliably fix the +problem and prevent it from coming back another time. + +Fixes: 112463ddbe82 ("net: dsa: felix: fix link error") +Fixes: e7d48e5fbf30 ("net: enetc: add a mini driver for the Integrated Endpoint Register Block") +Signed-off-by: Arnd Bergmann +Acked-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/Makefile | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/Makefile b/drivers/net/ethernet/freescale/Makefile +index 67c436400352..de7b31842233 100644 +--- a/drivers/net/ethernet/freescale/Makefile ++++ b/drivers/net/ethernet/freescale/Makefile +@@ -24,6 +24,4 @@ obj-$(CONFIG_FSL_DPAA_ETH) += dpaa/ + + obj-$(CONFIG_FSL_DPAA2_ETH) += dpaa2/ + +-obj-$(CONFIG_FSL_ENETC) += enetc/ +-obj-$(CONFIG_FSL_ENETC_MDIO) += enetc/ +-obj-$(CONFIG_FSL_ENETC_VF) += enetc/ ++obj-y += enetc/ +-- +2.30.2 + diff --git a/queue-5.10/net-ethernet-ixp4xx-set-the-dma-masks-explicitly.patch b/queue-5.10/net-ethernet-ixp4xx-set-the-dma-masks-explicitly.patch new file mode 100644 index 00000000000..8242cf4758d --- /dev/null +++ b/queue-5.10/net-ethernet-ixp4xx-set-the-dma-masks-explicitly.patch @@ -0,0 +1,51 @@ +From 66811d603c29d2f6ab4050816a24996e18be7b23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Apr 2021 20:28:53 +0200 +Subject: net: ethernet: ixp4xx: Set the DMA masks explicitly + +From: Linus Walleij + +[ Upstream commit 8d892d60941b00c86d2029c8a99db24ab4979673 ] + +The former fix only papered over the actual problem: the +ethernet core expects the netdev .dev member to have the +proper DMA masks set, or there will be BUG_ON() triggered +in kernel/dma/mapping.c. + +Fix this by simply copying dma_mask and dma_mask_coherent +from the parent device. + +Fixes: e45d0fad4a5f ("net: ethernet: ixp4xx: Use parent dev for DMA pool") +Signed-off-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xscale/ixp4xx_eth.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c +index 2e5202923510..403358f2c853 100644 +--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c ++++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c +@@ -1086,7 +1086,7 @@ static int init_queues(struct port *port) + int i; + + if (!ports_open) { +- dma_pool = dma_pool_create(DRV_NAME, port->netdev->dev.parent, ++ dma_pool = dma_pool_create(DRV_NAME, &port->netdev->dev, + POOL_ALLOC_SIZE, 32, 0); + if (!dma_pool) + return -ENOMEM; +@@ -1436,6 +1436,9 @@ static int ixp4xx_eth_probe(struct platform_device *pdev) + ndev->netdev_ops = &ixp4xx_netdev_ops; + ndev->ethtool_ops = &ixp4xx_ethtool_ops; + ndev->tx_queue_len = 100; ++ /* Inherit the DMA masks from the platform device */ ++ ndev->dev.dma_mask = dev->dma_mask; ++ ndev->dev.coherent_dma_mask = dev->coherent_dma_mask; + + netif_napi_add(ndev, &port->napi, eth_poll, NAPI_WEIGHT); + +-- +2.30.2 + diff --git a/queue-5.10/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch b/queue-5.10/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch new file mode 100644 index 00000000000..bd39b8a6217 --- /dev/null +++ b/queue-5.10/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch @@ -0,0 +1,57 @@ +From 32790fa9f90f3ecfc22fd85bbf1677e441a2538b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 00:49:45 +0100 +Subject: net: geneve: modify IP header check in geneve6_xmit_skb and + geneve_xmit_skb + +From: Phillip Potter + +[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ] + +Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb +to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes +two kernel selftest failures introduced by the commit introducing the +checks: +IPv4 over geneve6: PMTU exceptions +IPv4 over geneve6: PMTU exceptions - nexthop objects + +It does this by correctly accounting for the fact that IPv4 packets may +transit over geneve IPv6 tunnels (and vice versa), and still fixes the +uninit-value bug fixed by the original commit. + +Reported-by: kernel test robot +Fixes: 6628ddfec758 ("net: geneve: check skb is large enough for IPv4/IPv6 header") +Suggested-by: Sabrina Dubroca +Signed-off-by: Phillip Potter +Acked-by: Sabrina Dubroca +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 11864ac101b8..5ddb2dbb8572 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -890,7 +890,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 sport; + int err; + +- if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) ++ if (!pskb_inet_may_pull(skb)) + return -EINVAL; + + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); +@@ -987,7 +987,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 sport; + int err; + +- if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) ++ if (!pskb_inet_may_pull(skb)) + return -EINVAL; + + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); +-- +2.30.2 + diff --git a/queue-5.10/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch b/queue-5.10/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch new file mode 100644 index 00000000000..3a41774d6b4 --- /dev/null +++ b/queue-5.10/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch @@ -0,0 +1,44 @@ +From 1f99435dbbbc6f0bcb4c3b9bc2225604b775764b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Apr 2021 18:28:25 +0100 +Subject: net: hns3: Limiting the scope of vector_ring_chain variable + +From: Salil Mehta + +[ Upstream commit d392ecd1bc29ae15b0e284d5f732c2d36f244271 ] + +Limiting the scope of the variable vector_ring_chain to the block where it +is used. + +Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC") +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index a362516a3185..070bef303d18 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3526,7 +3526,6 @@ static void hns3_nic_set_cpumask(struct hns3_nic_priv *priv) + + static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) + { +- struct hnae3_ring_chain_node vector_ring_chain; + struct hnae3_handle *h = priv->ae_handle; + struct hns3_enet_tqp_vector *tqp_vector; + int ret; +@@ -3558,6 +3557,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) + } + + for (i = 0; i < priv->vector_num; i++) { ++ struct hnae3_ring_chain_node vector_ring_chain; ++ + tqp_vector = &priv->tqp_vector[i]; + + tqp_vector->rx_group.total_bytes = 0; +-- +2.30.2 + diff --git a/queue-5.10/net-lapbether-prevent-racing-when-checking-whether-t.patch b/queue-5.10/net-lapbether-prevent-racing-when-checking-whether-t.patch new file mode 100644 index 00000000000..d2816f4c51b --- /dev/null +++ b/queue-5.10/net-lapbether-prevent-racing-when-checking-whether-t.patch @@ -0,0 +1,140 @@ +From 1a9c69d59313736e3e7fb9ea63d183e5f4a9e416 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 23:23:09 -0800 +Subject: net: lapbether: Prevent racing when checking whether the netif is + running + +From: Xie He + +[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ] + +There are two "netif_running" checks in this driver. One is in +"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make +sure that the LAPB APIs called in these functions are called before +"lapb_unregister" is called by the "ndo_stop" function. + +However, these "netif_running" checks are unreliable, because it's +possible that immediately after "netif_running" returns true, "ndo_stop" +is called (which causes "lapb_unregister" to be called). + +This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can +reliably check and ensure the netif is running while doing their work. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Acked-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 605c01fb73f1..f6562a343cb4 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -51,6 +51,8 @@ struct lapbethdev { + struct list_head node; + struct net_device *ethdev; /* link to ethernet device */ + struct net_device *axdev; /* lapbeth device (lapb#) */ ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static LIST_HEAD(lapbeth_devices); +@@ -98,8 +100,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + rcu_read_lock(); + lapbeth = lapbeth_get_x25_dev(dev); + if (!lapbeth) +- goto drop_unlock; +- if (!netif_running(lapbeth->axdev)) ++ goto drop_unlock_rcu; ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop_unlock; + + len = skb->data[0] + skb->data[1] * 256; +@@ -114,11 +117,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + goto drop_unlock; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + rcu_read_unlock(); + return 0; + drop_unlock: + kfree_skb(skb); + goto out; ++drop_unlock_rcu: ++ rcu_read_unlock(); + drop: + kfree_skb(skb); + return 0; +@@ -148,13 +154,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb) + static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + +- /* +- * Just to be *really* sure not to send anything if the interface +- * is down, the ethernet device may have gone. +- */ +- if (!netif_running(dev)) ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -185,6 +189,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + goto drop; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + return NETDEV_TX_OK; + drop: + kfree_skb(skb); +@@ -276,6 +281,7 @@ static const struct lapb_register_struct lapbeth_callbacks = { + */ + static int lapbeth_open(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + + if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) { +@@ -283,13 +289,22 @@ static int lapbeth_open(struct net_device *dev) + return -ENODEV; + } + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = true; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + return 0; + } + + static int lapbeth_close(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = false; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + if ((err = lapb_unregister(dev)) != LAPB_OK) + pr_err("lapb_unregister error: %d\n", err); + +@@ -347,6 +362,9 @@ static int lapbeth_new_device(struct net_device *dev) + dev_hold(dev); + lapbeth->ethdev = dev; + ++ lapbeth->up = false; ++ spin_lock_init(&lapbeth->up_lock); ++ + rc = -EIO; + if (register_netdevice(ndev)) + goto fail; +-- +2.30.2 + diff --git a/queue-5.10/net-marvell-prestera-fix-port-event-handling-on-init.patch b/queue-5.10/net-marvell-prestera-fix-port-event-handling-on-init.patch new file mode 100644 index 00000000000..8c7428e2b9a --- /dev/null +++ b/queue-5.10/net-marvell-prestera-fix-port-event-handling-on-init.patch @@ -0,0 +1,98 @@ +From 295b400408894aa88ed989de1c37b45e0e6aa90b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 16:31:51 +0300 +Subject: net: marvell: prestera: fix port event handling on init + +From: Vadym Kochan + +[ Upstream commit 333980481b99edb24ebd5d1a53af70a15d9146de ] + +For some reason there might be a crash during ports creation if port +events are handling at the same time because fw may send initial +port event with down state. + +The crash points to cancel_delayed_work() which is called when port went +is down. Currently I did not find out the real cause of the issue, so +fixed it by cancel port stats work only if previous port's state was up +& runnig. + +The following is the crash which can be triggered: + +[ 28.311104] Unable to handle kernel paging request at virtual address +000071775f776600 +[ 28.319097] Mem abort info: +[ 28.321914] ESR = 0x96000004 +[ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits +[ 28.330350] SET = 0, FnV = 0 +[ 28.333430] EA = 0, S1PTW = 0 +[ 28.336597] Data abort info: +[ 28.339499] ISV = 0, ISS = 0x00000004 +[ 28.343362] CM = 0, WnR = 0 +[ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000 +[ 28.352842] [000071775f776600] pgd=0000000000000000, +p4d=0000000000000000 +[ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 28.365310] Modules linked in: prestera_pci(+) prestera +uio_pdrv_genirq +[ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted +5.11.0-rc4 #1 +[ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT) +[ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn +[prestera_pci] +[ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--) +[ 28.397468] pc : get_work_pool+0x48/0x60 +[ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0 +[ 28.406018] sp : ffff80001391bc60 +[ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000 +[ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88 +[ 28.420089] x25: 0000000000000000 x24: ffff000106119760 +[ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000 +[ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0 +[ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0 +[ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88 +[ 28.446898] x15: 0000000000000001 x14: 00000000000002ba +[ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4 +[ 28.457622] x11: 0000000000000030 x10: 000000000000000c +[ 28.462985] x9 : 000000000000000c x8 : 0000000000000030 +[ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758 +[ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60 +[ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060 +[ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8 +[ 28.489791] Call trace: +[ 28.492259] get_work_pool+0x48/0x60 +[ 28.495874] cancel_delayed_work+0x38/0xb0 +[ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera] +[ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera] +[ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci] +[ 28.516660] process_one_work+0x1e8/0x360 +[ 28.520710] worker_thread+0x44/0x480 +[ 28.524412] kthread+0x154/0x160 +[ 28.527670] ret_from_fork+0x10/0x38 +[ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020) +[ 28.537429] ---[ end trace 5eced933df3a080b ]--- + +Fixes: 501ef3066c89 ("net: marvell: prestera: Add driver for Prestera family ASIC devices") +Signed-off-by: Vadym Kochan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c +index da4b286d1337..feb69fcd908e 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c +@@ -436,7 +436,8 @@ static void prestera_port_handle_event(struct prestera_switch *sw, + netif_carrier_on(port->dev); + if (!delayed_work_pending(caching_dw)) + queue_delayed_work(prestera_wq, caching_dw, 0); +- } else { ++ } else if (netif_running(port->dev) && ++ netif_carrier_ok(port->dev)) { + netif_carrier_off(port->dev); + if (delayed_work_pending(caching_dw)) + cancel_delayed_work(caching_dw); +-- +2.30.2 + diff --git a/queue-5.10/net-mlx5-fix-bit-wise-and-with-zero.patch b/queue-5.10/net-mlx5-fix-bit-wise-and-with-zero.patch new file mode 100644 index 00000000000..d598d538ddb --- /dev/null +++ b/queue-5.10/net-mlx5-fix-bit-wise-and-with-zero.patch @@ -0,0 +1,39 @@ +From 06e1624fc6696050c5c1b24240609c8ab2104075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 17:53:46 +0100 +Subject: net/mlx5: Fix bit-wise and with zero + +From: Colin Ian King + +[ Upstream commit 82c3ba31c370b6001cbf90689e98da1fb6f26aef ] + +The bit-wise and of the action field with MLX5_ACCEL_ESP_ACTION_DECRYPT +is incorrect as MLX5_ACCEL_ESP_ACTION_DECRYPT is zero and not intended +to be a bit-flag. Fix this by using the == operator as was originally +intended. + +Addresses-Coverity: ("Logically dead code") +Fixes: 7dfee4b1d79e ("net/mlx5: IPsec, Refactor SA handle creation and destruction") +Signed-off-by: Colin Ian King +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +index cc67366495b0..bed154e9a1ef 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +@@ -850,7 +850,7 @@ mlx5_fpga_ipsec_release_sa_ctx(struct mlx5_fpga_ipsec_sa_ctx *sa_ctx) + return; + } + +- if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action & ++ if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action == + MLX5_ACCEL_ESP_ACTION_DECRYPT) + ida_simple_remove(&fipsec->halloc, sa_ctx->sa_handle); + +-- +2.30.2 + diff --git a/queue-5.10/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch b/queue-5.10/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch new file mode 100644 index 00000000000..9d184a899d1 --- /dev/null +++ b/queue-5.10/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch @@ -0,0 +1,41 @@ +From d3d187fd400714316b7f9b5e735397ba1ab9c346 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 09:22:58 -0700 +Subject: net:nfc:digital: Fix a double free in digital_tg_recv_dep_req + +From: Lv Yunlong + +[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ] + +In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). +If nfc_tm_data_received() failed, the callee will free the resp via +kfree_skb() and return error. But in the exit branch, the resp +will be freed again. + +My patch sets resp to NULL if nfc_tm_data_received() failed, to +avoid the double free. + +Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/digital_dep.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c +index 5971fb6f51cc..dc21b4141b0a 100644 +--- a/net/nfc/digital_dep.c ++++ b/net/nfc/digital_dep.c +@@ -1273,6 +1273,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, + } + + rc = nfc_tm_data_received(ddev->nfc_dev, resp); ++ if (rc) ++ resp = NULL; + + exit: + kfree_skb(ddev->chaining_skb); +-- +2.30.2 + diff --git a/queue-5.10/net-packet-make-packet_fanout.arr-size-configurable-.patch b/queue-5.10/net-packet-make-packet_fanout.arr-size-configurable-.patch new file mode 100644 index 00000000000..fc82519ab52 --- /dev/null +++ b/queue-5.10/net-packet-make-packet_fanout.arr-size-configurable-.patch @@ -0,0 +1,195 @@ +From 3f885eb4e7613c9922850a17d0a6a8e5790fff51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 13:07:40 -0500 +Subject: net/packet: make packet_fanout.arr size configurable up to 64K + +From: Tanner Love + +[ Upstream commit 9c661b0b85444e426d3f23250305eeb16f6ffe88 ] + +One use case of PACKET_FANOUT is lockless reception with one socket +per CPU. 256 is a practical limit on increasingly many machines. + +Increase PACKET_FANOUT_MAX to 64K. Expand setsockopt PACKET_FANOUT to +take an extra argument max_num_members. Also explicitly define a +fanout_args struct, instead of implicitly casting to an integer. This +documents the API and simplifies the control flow. + +If max_num_members is not specified or is set to 0, then 256 is used, +same as before. + +Signed-off-by: Tanner Love +Signed-off-by: Willem de Bruijn +Reviewed-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/uapi/linux/if_packet.h | 12 +++++++++++ + net/packet/af_packet.c | 37 +++++++++++++++++++++++----------- + net/packet/internal.h | 5 +++-- + 3 files changed, 40 insertions(+), 14 deletions(-) + +diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h +index 3d884d68eb30..c07caf7b40db 100644 +--- a/include/uapi/linux/if_packet.h ++++ b/include/uapi/linux/if_packet.h +@@ -2,6 +2,7 @@ + #ifndef __LINUX_IF_PACKET_H + #define __LINUX_IF_PACKET_H + ++#include + #include + + struct sockaddr_pkt { +@@ -296,6 +297,17 @@ struct packet_mreq { + unsigned char mr_address[8]; + }; + ++struct fanout_args { ++#if defined(__LITTLE_ENDIAN_BITFIELD) ++ __u16 id; ++ __u16 type_flags; ++#else ++ __u16 type_flags; ++ __u16 id; ++#endif ++ __u32 max_num_members; ++}; ++ + #define PACKET_MR_MULTICAST 0 + #define PACKET_MR_PROMISC 1 + #define PACKET_MR_ALLMULTI 2 +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index a0121e7c98b1..92501e5f9d49 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1636,13 +1636,15 @@ static bool fanout_find_new_id(struct sock *sk, u16 *new_id) + return false; + } + +-static int fanout_add(struct sock *sk, u16 id, u16 type_flags) ++static int fanout_add(struct sock *sk, struct fanout_args *args) + { + struct packet_rollover *rollover = NULL; + struct packet_sock *po = pkt_sk(sk); ++ u16 type_flags = args->type_flags; + struct packet_fanout *f, *match; + u8 type = type_flags & 0xff; + u8 flags = type_flags >> 8; ++ u16 id = args->id; + int err; + + switch (type) { +@@ -1700,11 +1702,21 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + } + } + err = -EINVAL; +- if (match && match->flags != flags) +- goto out; +- if (!match) { ++ if (match) { ++ if (match->flags != flags) ++ goto out; ++ if (args->max_num_members && ++ args->max_num_members != match->max_num_members) ++ goto out; ++ } else { ++ if (args->max_num_members > PACKET_FANOUT_MAX) ++ goto out; ++ if (!args->max_num_members) ++ /* legacy PACKET_FANOUT_MAX */ ++ args->max_num_members = 256; + err = -ENOMEM; +- match = kzalloc(sizeof(*match), GFP_KERNEL); ++ match = kvzalloc(struct_size(match, arr, args->max_num_members), ++ GFP_KERNEL); + if (!match) + goto out; + write_pnet(&match->net, sock_net(sk)); +@@ -1720,6 +1732,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + match->prot_hook.func = packet_rcv_fanout; + match->prot_hook.af_packet_priv = match; + match->prot_hook.id_match = match_fanout_group; ++ match->max_num_members = args->max_num_members; + list_add(&match->list, &fanout_list); + } + err = -EINVAL; +@@ -1730,7 +1743,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + match->prot_hook.type == po->prot_hook.type && + match->prot_hook.dev == po->prot_hook.dev) { + err = -ENOSPC; +- if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) { ++ if (refcount_read(&match->sk_ref) < match->max_num_members) { + __dev_remove_pack(&po->prot_hook); + po->fanout = match; + po->rollover = rollover; +@@ -1744,7 +1757,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + + if (err && !refcount_read(&match->sk_ref)) { + list_del(&match->list); +- kfree(match); ++ kvfree(match); + } + + out: +@@ -3075,7 +3088,7 @@ static int packet_release(struct socket *sock) + kfree(po->rollover); + if (f) { + fanout_release_data(f); +- kfree(f); ++ kvfree(f); + } + /* + * Now the socket is dead. No more input will appear. +@@ -3866,14 +3879,14 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + } + case PACKET_FANOUT: + { +- int val; ++ struct fanout_args args = { 0 }; + +- if (optlen != sizeof(val)) ++ if (optlen != sizeof(int) && optlen != sizeof(args)) + return -EINVAL; +- if (copy_from_sockptr(&val, optval, sizeof(val))) ++ if (copy_from_sockptr(&args, optval, optlen)) + return -EFAULT; + +- return fanout_add(sk, val & 0xffff, val >> 16); ++ return fanout_add(sk, &args); + } + case PACKET_FANOUT_DATA: + { +diff --git a/net/packet/internal.h b/net/packet/internal.h +index fd41ecb7f605..baafc3f3fa25 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -77,11 +77,12 @@ struct packet_ring_buffer { + }; + + extern struct mutex fanout_mutex; +-#define PACKET_FANOUT_MAX 256 ++#define PACKET_FANOUT_MAX (1 << 16) + + struct packet_fanout { + possible_net_t net; + unsigned int num_members; ++ u32 max_num_members; + u16 id; + u8 type; + u8 flags; +@@ -90,10 +91,10 @@ struct packet_fanout { + struct bpf_prog __rcu *bpf_prog; + }; + struct list_head list; +- struct sock *arr[PACKET_FANOUT_MAX]; + spinlock_t lock; + refcount_t sk_ref; + struct packet_type prot_hook ____cacheline_aligned_in_smp; ++ struct sock *arr[]; + }; + + struct packet_rollover { +-- +2.30.2 + diff --git a/queue-5.10/net-packet-remove-data-races-in-fanout-operations.patch b/queue-5.10/net-packet-remove-data-races-in-fanout-operations.patch new file mode 100644 index 00000000000..987d39c9d45 --- /dev/null +++ b/queue-5.10/net-packet-remove-data-races-in-fanout-operations.patch @@ -0,0 +1,99 @@ +From f83f2499a550b654208eb608977a2a3855a90a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 12:36:44 -0700 +Subject: net/packet: remove data races in fanout operations + +From: Eric Dumazet + +[ Upstream commit 94f633ea8ade8418634d152ad0931133338226f6 ] + +af_packet fanout uses RCU rules to ensure f->arr elements +are not dismantled before RCU grace period. + +However, it lacks rcu accessors to make sure KCSAN and other tools +wont detect data races. Stupid compilers could also play games. + +Fixes: dc99f600698d ("packet: Add fanout support.") +Signed-off-by: Eric Dumazet +Reported-by: "Gong, Sishuai" +Cc: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 15 +++++++++------ + net/packet/internal.h | 2 +- + 2 files changed, 10 insertions(+), 7 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 92501e5f9d49..449625c2ccc7 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1358,7 +1358,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f, + struct packet_sock *po, *po_next, *po_skip = NULL; + unsigned int i, j, room = ROOM_NONE; + +- po = pkt_sk(f->arr[idx]); ++ po = pkt_sk(rcu_dereference(f->arr[idx])); + + if (try_self) { + room = packet_rcv_has_room(po, skb); +@@ -1370,7 +1370,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f, + + i = j = min_t(int, po->rollover->sock, num - 1); + do { +- po_next = pkt_sk(f->arr[i]); ++ po_next = pkt_sk(rcu_dereference(f->arr[i])); + if (po_next != po_skip && !READ_ONCE(po_next->pressure) && + packet_rcv_has_room(po_next, skb) == ROOM_NORMAL) { + if (i != j) +@@ -1465,7 +1465,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, + if (fanout_has_flag(f, PACKET_FANOUT_FLAG_ROLLOVER)) + idx = fanout_demux_rollover(f, skb, idx, true, num); + +- po = pkt_sk(f->arr[idx]); ++ po = pkt_sk(rcu_dereference(f->arr[idx])); + return po->prot_hook.func(skb, dev, &po->prot_hook, orig_dev); + } + +@@ -1479,7 +1479,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po) + struct packet_fanout *f = po->fanout; + + spin_lock(&f->lock); +- f->arr[f->num_members] = sk; ++ rcu_assign_pointer(f->arr[f->num_members], sk); + smp_wmb(); + f->num_members++; + if (f->num_members == 1) +@@ -1494,11 +1494,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po) + + spin_lock(&f->lock); + for (i = 0; i < f->num_members; i++) { +- if (f->arr[i] == sk) ++ if (rcu_dereference_protected(f->arr[i], ++ lockdep_is_held(&f->lock)) == sk) + break; + } + BUG_ON(i >= f->num_members); +- f->arr[i] = f->arr[f->num_members - 1]; ++ rcu_assign_pointer(f->arr[i], ++ rcu_dereference_protected(f->arr[f->num_members - 1], ++ lockdep_is_held(&f->lock))); + f->num_members--; + if (f->num_members == 0) + __dev_remove_pack(&f->prot_hook); +diff --git a/net/packet/internal.h b/net/packet/internal.h +index baafc3f3fa25..7af1e9179385 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -94,7 +94,7 @@ struct packet_fanout { + spinlock_t lock; + refcount_t sk_ref; + struct packet_type prot_hook ____cacheline_aligned_in_smp; +- struct sock *arr[]; ++ struct sock __rcu *arr[]; + }; + + struct packet_rollover { +-- +2.30.2 + diff --git a/queue-5.10/net-phy-intel-xway-enable-integrated-led-functions.patch b/queue-5.10/net-phy-intel-xway-enable-integrated-led-functions.patch new file mode 100644 index 00000000000..42cabbf61cf --- /dev/null +++ b/queue-5.10/net-phy-intel-xway-enable-integrated-led-functions.patch @@ -0,0 +1,71 @@ +From 77b0b9d834ddd23e312a8504efe7335aab81c200 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 07:50:47 +0200 +Subject: net: phy: intel-xway: enable integrated led functions + +From: Martin Schiller + +[ Upstream commit 357a07c26697a770d39d28b6b111f978deb4017d ] + +The Intel xway phys offer the possibility to deactivate the integrated +LED function and to control the LEDs manually. +If this was set by the bootloader, it must be ensured that the +integrated LED function is enabled for all LEDs when loading the driver. + +Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +the LEDs were enabled by a soft-reset of the PHY (using +genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default +value (which is applied during a soft reset) instead of adding back +the soft reset. This brings back the default LED configuration while +still preventing an excessive amount of soft resets. + +Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/net/phy/intel-xway.c b/drivers/net/phy/intel-xway.c +index b7875b36097f..574a8bca1ec4 100644 +--- a/drivers/net/phy/intel-xway.c ++++ b/drivers/net/phy/intel-xway.c +@@ -11,6 +11,18 @@ + + #define XWAY_MDIO_IMASK 0x19 /* interrupt mask */ + #define XWAY_MDIO_ISTAT 0x1A /* interrupt status */ ++#define XWAY_MDIO_LED 0x1B /* led control */ ++ ++/* bit 15:12 are reserved */ ++#define XWAY_MDIO_LED_LED3_EN BIT(11) /* Enable the integrated function of LED3 */ ++#define XWAY_MDIO_LED_LED2_EN BIT(10) /* Enable the integrated function of LED2 */ ++#define XWAY_MDIO_LED_LED1_EN BIT(9) /* Enable the integrated function of LED1 */ ++#define XWAY_MDIO_LED_LED0_EN BIT(8) /* Enable the integrated function of LED0 */ ++/* bit 7:4 are reserved */ ++#define XWAY_MDIO_LED_LED3_DA BIT(3) /* Direct Access to LED3 */ ++#define XWAY_MDIO_LED_LED2_DA BIT(2) /* Direct Access to LED2 */ ++#define XWAY_MDIO_LED_LED1_DA BIT(1) /* Direct Access to LED1 */ ++#define XWAY_MDIO_LED_LED0_DA BIT(0) /* Direct Access to LED0 */ + + #define XWAY_MDIO_INIT_WOL BIT(15) /* Wake-On-LAN */ + #define XWAY_MDIO_INIT_MSRE BIT(14) +@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev) + /* Clear all pending interrupts */ + phy_read(phydev, XWAY_MDIO_ISTAT); + ++ /* Ensure that integrated led function is enabled for all leds */ ++ err = phy_write(phydev, XWAY_MDIO_LED, ++ XWAY_MDIO_LED_LED0_EN | ++ XWAY_MDIO_LED_LED1_EN | ++ XWAY_MDIO_LED_LED2_EN | ++ XWAY_MDIO_LED_LED3_EN); ++ if (err) ++ return err; ++ + phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH, + XWAY_MMD_LEDCH_NACS_NONE | + XWAY_MMD_LEDCH_SBF_F02HZ | +-- +2.30.2 + diff --git a/queue-5.10/net-phy-lan87xx-fix-access-to-wrong-register-of-lan8.patch b/queue-5.10/net-phy-lan87xx-fix-access-to-wrong-register-of-lan8.patch new file mode 100644 index 00000000000..d8b658a4cd0 --- /dev/null +++ b/queue-5.10/net-phy-lan87xx-fix-access-to-wrong-register-of-lan8.patch @@ -0,0 +1,59 @@ +From f1b3cde15e0bd7628ca9fa8fc92d8f5930883843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 11:45:36 +0200 +Subject: net: phy: lan87xx: fix access to wrong register of LAN87xx +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andre Edich + +[ Upstream commit fdb5cc6ab3b6a1c0122d3644a63ef9dc7a610d35 ] + +The function lan87xx_config_aneg_ext was introduced to configure +LAN95xxA but as well writes to undocumented register of LAN87xx. +This fix prevents that access. + +The function lan87xx_config_aneg_ext gets more suitable for the new +behavior name. + +Reported-by: MÃ¥ns RullgÃ¥rd +Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support") +Signed-off-by: Andre Edich +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/smsc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c +index 10722fed666d..caf7291ffaf8 100644 +--- a/drivers/net/phy/smsc.c ++++ b/drivers/net/phy/smsc.c +@@ -152,10 +152,13 @@ static int lan87xx_config_aneg(struct phy_device *phydev) + return genphy_config_aneg(phydev); + } + +-static int lan87xx_config_aneg_ext(struct phy_device *phydev) ++static int lan95xx_config_aneg_ext(struct phy_device *phydev) + { + int rc; + ++ if (phydev->phy_id != 0x0007c0f0) /* not (LAN9500A or LAN9505A) */ ++ return lan87xx_config_aneg(phydev); ++ + /* Extend Manual AutoMDIX timer */ + rc = phy_read(phydev, PHY_EDPD_CONFIG); + if (rc < 0) +@@ -408,7 +411,7 @@ static struct phy_driver smsc_phy_driver[] = { + .read_status = lan87xx_read_status, + .config_init = smsc_phy_config_init, + .soft_reset = smsc_phy_reset, +- .config_aneg = lan87xx_config_aneg_ext, ++ .config_aneg = lan95xx_config_aneg_ext, + + /* IRQ related */ + .ack_interrupt = smsc_phy_ack_interrupt, +-- +2.30.2 + diff --git a/queue-5.10/net-phy-marvell-fix-m88e1011_set_downshift.patch b/queue-5.10/net-phy-marvell-fix-m88e1011_set_downshift.patch new file mode 100644 index 00000000000..1df532c0744 --- /dev/null +++ b/queue-5.10/net-phy-marvell-fix-m88e1011_set_downshift.patch @@ -0,0 +1,72 @@ +From 0db7fe6b1ed4b9ee99bf0bdfdc70edfbf82715e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 13:46:43 +0300 +Subject: net: phy: marvell: fix m88e1011_set_downshift + +From: Maxim Kochetkov + +[ Upstream commit 990875b299b8612aeb85cb2e2751796f1add65ff ] + +Changing downshift params without software reset has no effect, +so call genphy_soft_reset() after change downshift params. + +As the datasheet says: +Changes to these bits are disruptive to the normal operation therefore, +any changes to these registers must be followed by software reset +to take effect. + +Fixes: 911af5e149bb ("net: phy: marvell: fix downshift function naming") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 823a89354466..8e2ef7d67bff 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -919,22 +919,28 @@ static int m88e1011_get_downshift(struct phy_device *phydev, u8 *data) + + static int m88e1011_set_downshift(struct phy_device *phydev, u8 cnt) + { +- int val; ++ int val, err; + + if (cnt > MII_M1011_PHY_SCR_DOWNSHIFT_MAX) + return -E2BIG; + +- if (!cnt) +- return phy_clear_bits(phydev, MII_M1011_PHY_SCR, +- MII_M1011_PHY_SCR_DOWNSHIFT_EN); ++ if (!cnt) { ++ err = phy_clear_bits(phydev, MII_M1011_PHY_SCR, ++ MII_M1011_PHY_SCR_DOWNSHIFT_EN); ++ } else { ++ val = MII_M1011_PHY_SCR_DOWNSHIFT_EN; ++ val |= FIELD_PREP(MII_M1011_PHY_SCR_DOWNSHIFT_MASK, cnt - 1); + +- val = MII_M1011_PHY_SCR_DOWNSHIFT_EN; +- val |= FIELD_PREP(MII_M1011_PHY_SCR_DOWNSHIFT_MASK, cnt - 1); ++ err = phy_modify(phydev, MII_M1011_PHY_SCR, ++ MII_M1011_PHY_SCR_DOWNSHIFT_EN | ++ MII_M1011_PHY_SCR_DOWNSHIFT_MASK, ++ val); ++ } + +- return phy_modify(phydev, MII_M1011_PHY_SCR, +- MII_M1011_PHY_SCR_DOWNSHIFT_EN | +- MII_M1011_PHY_SCR_DOWNSHIFT_MASK, +- val); ++ if (err < 0) ++ return err; ++ ++ return genphy_soft_reset(phydev); + } + + static int m88e1011_get_tunable(struct phy_device *phydev, +-- +2.30.2 + diff --git a/queue-5.10/net-phy-marvell-fix-m88e1111_set_downshift.patch b/queue-5.10/net-phy-marvell-fix-m88e1111_set_downshift.patch new file mode 100644 index 00000000000..2b4d3659ec8 --- /dev/null +++ b/queue-5.10/net-phy-marvell-fix-m88e1111_set_downshift.patch @@ -0,0 +1,72 @@ +From 6786bb1e1e37474f6a79261b01297fecb71bcd79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 13:46:44 +0300 +Subject: net: phy: marvell: fix m88e1111_set_downshift + +From: Maxim Kochetkov + +[ Upstream commit e7679c55a7249f1315256cfc672d53e84072e223 ] + +Changing downshift params without software reset has no effect, +so call genphy_soft_reset() after change downshift params. + +As the datasheet says: +Changes to these bits are disruptive to the normal operation therefore, +any changes to these registers must be followed by software reset +to take effect. + +Fixes: 5c6bc5199b5d ("net: phy: marvell: add downshift support for M88E1111") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 8e2ef7d67bff..91616182c311 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -861,22 +861,28 @@ static int m88e1111_get_downshift(struct phy_device *phydev, u8 *data) + + static int m88e1111_set_downshift(struct phy_device *phydev, u8 cnt) + { +- int val; ++ int val, err; + + if (cnt > MII_M1111_PHY_EXT_CR_DOWNSHIFT_MAX) + return -E2BIG; + +- if (!cnt) +- return phy_clear_bits(phydev, MII_M1111_PHY_EXT_CR, +- MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN); ++ if (!cnt) { ++ err = phy_clear_bits(phydev, MII_M1111_PHY_EXT_CR, ++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN); ++ } else { ++ val = MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN; ++ val |= FIELD_PREP(MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, cnt - 1); + +- val = MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN; +- val |= FIELD_PREP(MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, cnt - 1); ++ err = phy_modify(phydev, MII_M1111_PHY_EXT_CR, ++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | ++ MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, ++ val); ++ } + +- return phy_modify(phydev, MII_M1111_PHY_EXT_CR, +- MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | +- MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK, +- val); ++ if (err < 0) ++ return err; ++ ++ return genphy_soft_reset(phydev); + } + + static int m88e1111_get_tunable(struct phy_device *phydev, +-- +2.30.2 + diff --git a/queue-5.10/net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch b/queue-5.10/net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch new file mode 100644 index 00000000000..b987f527c3f --- /dev/null +++ b/queue-5.10/net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch @@ -0,0 +1,81 @@ +From 1b5d0e5e82e2d754ad3be2fe7606d018b977517f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 13:52:46 +0900 +Subject: net: renesas: ravb: Fix a stuck issue when a lot of frames are + received + +From: Yoshihiro Shimoda + +[ Upstream commit 5718458b092bf6bf4482c5df32affba3c3259517 ] + +When a lot of frames were received in the short term, the driver +caused a stuck of receiving until a new frame was received. For example, +the following command from other device could cause this issue. + + $ sudo ping -f -l 1000 -c 1000 + +The previous code always cleared the interrupt flag of RX but checks +the interrupt flags in ravb_poll(). So, ravb_poll() could not call +ravb_rx() in the next time until a new RX frame was received if +ravb_rx() returned true. To fix the issue, always calls ravb_rx() +regardless the interrupt flags condition. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 35 ++++++++---------------- + 1 file changed, 12 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index bd30505fbc57..f96eed67e1a2 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -911,31 +911,20 @@ static int ravb_poll(struct napi_struct *napi, int budget) + int q = napi - priv->napi; + int mask = BIT(q); + int quota = budget; +- u32 ris0, tis; + +- for (;;) { +- tis = ravb_read(ndev, TIS); +- ris0 = ravb_read(ndev, RIS0); +- if (!((ris0 & mask) || (tis & mask))) +- break; ++ /* Processing RX Descriptor Ring */ ++ /* Clear RX interrupt */ ++ ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0); ++ if (ravb_rx(ndev, "a, q)) ++ goto out; + +- /* Processing RX Descriptor Ring */ +- if (ris0 & mask) { +- /* Clear RX interrupt */ +- ravb_write(ndev, ~(mask | RIS0_RESERVED), RIS0); +- if (ravb_rx(ndev, "a, q)) +- goto out; +- } +- /* Processing TX Descriptor Ring */ +- if (tis & mask) { +- spin_lock_irqsave(&priv->lock, flags); +- /* Clear TX interrupt */ +- ravb_write(ndev, ~(mask | TIS_RESERVED), TIS); +- ravb_tx_free(ndev, q, true); +- netif_wake_subqueue(ndev, q); +- spin_unlock_irqrestore(&priv->lock, flags); +- } +- } ++ /* Processing RX Descriptor Ring */ ++ spin_lock_irqsave(&priv->lock, flags); ++ /* Clear TX interrupt */ ++ ravb_write(ndev, ~(mask | TIS_RESERVED), TIS); ++ ravb_tx_free(ndev, q, true); ++ netif_wake_subqueue(ndev, q); ++ spin_unlock_irqrestore(&priv->lock, flags); + + napi_complete(napi); + +-- +2.30.2 + diff --git a/queue-5.10/net-stmmac-fix-tso-and-tbs-feature-enabling-during-d.patch b/queue-5.10/net-stmmac-fix-tso-and-tbs-feature-enabling-during-d.patch new file mode 100644 index 00000000000..a0eba565b4a --- /dev/null +++ b/queue-5.10/net-stmmac-fix-tso-and-tbs-feature-enabling-during-d.patch @@ -0,0 +1,60 @@ +From 6479f3109e0bd28cb5d02cc02ec5790f62e5055d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 17:11:49 +0800 +Subject: net: stmmac: fix TSO and TBS feature enabling during driver open + +From: Ong Boon Leong + +[ Upstream commit 5e6038b88a5718910dd74b949946d9d9cee9a041 ] + +TSO and TBS cannot co-exist and current implementation requires two +fixes: + + 1) stmmac_open() does not need to call stmmac_enable_tbs() because + the MAC is reset in stmmac_init_dma_engine() anyway. + 2) Inside stmmac_hw_setup(), we should call stmmac_enable_tso() for + TX Q that is _not_ configured for TBS. + +Fixes: 579a25a854d4 ("net: stmmac: Initial support for TBS") +Signed-off-by: Ong Boon Leong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 6012eadae460..5b9478dffe10 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -2727,8 +2727,15 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp) + + /* Enable TSO */ + if (priv->tso) { +- for (chan = 0; chan < tx_cnt; chan++) ++ for (chan = 0; chan < tx_cnt; chan++) { ++ struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan]; ++ ++ /* TSO and TBS cannot co-exist */ ++ if (tx_q->tbs & STMMAC_TBS_AVAIL) ++ continue; ++ + stmmac_enable_tso(priv, priv->ioaddr, 1, chan); ++ } + } + + /* Enable Split Header */ +@@ -2820,9 +2827,8 @@ static int stmmac_open(struct net_device *dev) + struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan]; + int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en; + ++ /* Setup per-TXQ tbs flag before TX descriptor alloc */ + tx_q->tbs |= tbs_en ? STMMAC_TBS_AVAIL : 0; +- if (stmmac_enable_tbs(priv, priv->ioaddr, tbs_en, chan)) +- tx_q->tbs &= ~STMMAC_TBS_AVAIL; + } + + ret = alloc_dma_desc_resources(priv); +-- +2.30.2 + diff --git a/queue-5.10/net-thunderx-fix-unintentional-sign-extension-issue.patch b/queue-5.10/net-thunderx-fix-unintentional-sign-extension-issue.patch new file mode 100644 index 00000000000..de19b1ef815 --- /dev/null +++ b/queue-5.10/net-thunderx-fix-unintentional-sign-extension-issue.patch @@ -0,0 +1,42 @@ +From 00c5341d25332a1aae5cc80b238863841dad12cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:07:26 +0100 +Subject: net: thunderx: Fix unintentional sign extension issue + +From: Colin Ian King + +[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ] + +The shifting of the u8 integers rq->caching by 26 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that rq->caching is +greater than 0x1f then all then all the upper 32 bits of +the u64 end up as also being set because of the int +sign-extension. Fix this by casting the u8 values to a +u64 before the 26 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +index 7a141ce32e86..0ccd5b40ef5c 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, + mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG; + mbx.rq.qs_num = qs->vnic_id; + mbx.rq.rq_num = qidx; +- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) | ++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) | + (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | + (rq->cont_qs_rbdr_idx << 8) | + (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); +-- +2.30.2 + diff --git a/queue-5.10/net-tipc-fix-missing-destroy_workqueue-on-error-in-t.patch b/queue-5.10/net-tipc-fix-missing-destroy_workqueue-on-error-in-t.patch new file mode 100644 index 00000000000..cc13934e0f1 --- /dev/null +++ b/queue-5.10/net-tipc-fix-missing-destroy_workqueue-on-error-in-t.patch @@ -0,0 +1,38 @@ +From 1085131e670a1dcefe556f9646d38cdc267cb77d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 16:36:02 +0800 +Subject: net/tipc: fix missing destroy_workqueue() on error in + tipc_crypto_start() + +From: Yang Yingliang + +[ Upstream commit ac1db7acea67777be1ba86e36e058c479eab6508 ] + +Add the missing destroy_workqueue() before return from +tipc_crypto_start() in the error handling case. + +Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index 86eb6d679225..2301b66280de 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -1485,6 +1485,8 @@ int tipc_crypto_start(struct tipc_crypto **crypto, struct net *net, + /* Allocate statistic structure */ + c->stats = alloc_percpu_gfp(struct tipc_crypto_stats, GFP_ATOMIC); + if (!c->stats) { ++ if (c->wq) ++ destroy_workqueue(c->wq); + kfree_sensitive(c); + return -ENOMEM; + } +-- +2.30.2 + diff --git a/queue-5.10/netfilter-nft_payload-fix-c-vlan-offload-support.patch b/queue-5.10/netfilter-nft_payload-fix-c-vlan-offload-support.patch new file mode 100644 index 00000000000..49d3f95b891 --- /dev/null +++ b/queue-5.10/netfilter-nft_payload-fix-c-vlan-offload-support.patch @@ -0,0 +1,59 @@ +From cfebd80c7b07c5c2c2fd9ea07278d8fa5298f369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 14:11:39 +0200 +Subject: netfilter: nft_payload: fix C-VLAN offload support + +From: Pablo Neira Ayuso + +[ Upstream commit 14c20643ef9457679cc6934d77adc24296505214 ] + +- add another struct flow_dissector_key_vlan for C-VLAN +- update layer 3 dependency to allow to match on IPv4/IPv6 + +Fixes: 89d8fd44abfb ("netfilter: nft_payload: add C-VLAN offload support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables_offload.h | 1 + + net/netfilter/nft_payload.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h +index 1d34fe154fe0..b4d080061399 100644 +--- a/include/net/netfilter/nf_tables_offload.h ++++ b/include/net/netfilter/nf_tables_offload.h +@@ -45,6 +45,7 @@ struct nft_flow_key { + struct flow_dissector_key_ports tp; + struct flow_dissector_key_ip ip; + struct flow_dissector_key_vlan vlan; ++ struct flow_dissector_key_vlan cvlan; + struct flow_dissector_key_eth_addrs eth_addrs; + struct flow_dissector_key_meta meta; + } __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */ +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index 47d4e0e21651..e43863a1761f 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -241,7 +241,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, + if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16))) + return -EOPNOTSUPP; + +- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan, ++ NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan, + vlan_tci, sizeof(__be16), reg); + break; + case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) + +@@ -249,8 +249,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, + if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16))) + return -EOPNOTSUPP; + +- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan, ++ NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan, + vlan_tpid, sizeof(__be16), reg); ++ nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK); + break; + default: + return -EOPNOTSUPP; +-- +2.30.2 + diff --git a/queue-5.10/netfilter-nftables_offload-special-ethertype-handlin.patch b/queue-5.10/netfilter-nftables_offload-special-ethertype-handlin.patch new file mode 100644 index 00000000000..b3710d93233 --- /dev/null +++ b/queue-5.10/netfilter-nftables_offload-special-ethertype-handlin.patch @@ -0,0 +1,102 @@ +From 380a9399c0da59ec718c50bdf2927454e217c605 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 14:20:55 +0200 +Subject: netfilter: nftables_offload: special ethertype handling for VLAN + +From: Pablo Neira Ayuso + +[ Upstream commit 783003f3bb8a565326e89d18bbd948ad8ffc816a ] + +The nftables offload parser sets FLOW_DISSECTOR_KEY_BASIC .n_proto to the +ethertype field in the ethertype frame. However: + +- FLOW_DISSECTOR_KEY_BASIC .n_proto field always stores either IPv4 or IPv6 + ethertypes. +- FLOW_DISSECTOR_KEY_VLAN .vlan_tpid stores either the 802.1q and 802.1ad + ethertypes. Same as for FLOW_DISSECTOR_KEY_CVLAN. + +This function adjusts the flow dissector to handle two scenarios: + +1) FLOW_DISSECTOR_KEY_VLAN .vlan_tpid is set to 802.1q or 802.1ad. + Then, transfer: + - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid. + - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the + FLOW_DISSECTOR_KEY_CVLAN .tpid + - the original FLOW_DISSECTOR_KEY_CVLAN .tpid to the .n_proto field. + +2) .n_proto is set to 802.1q or 802.1ad. Then, transfer: + - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid. + - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the .n_proto field. + +Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_offload.c | 44 +++++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index 9ae14270c543..2b00f7f47693 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -45,6 +45,48 @@ void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow, + offsetof(struct nft_flow_key, control); + } + ++struct nft_offload_ethertype { ++ __be16 value; ++ __be16 mask; ++}; ++ ++static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx, ++ struct nft_flow_rule *flow) ++{ ++ struct nft_flow_match *match = &flow->match; ++ struct nft_offload_ethertype ethertype; ++ ++ if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL) && ++ match->key.basic.n_proto != htons(ETH_P_8021Q) && ++ match->key.basic.n_proto != htons(ETH_P_8021AD)) ++ return; ++ ++ ethertype.value = match->key.basic.n_proto; ++ ethertype.mask = match->mask.basic.n_proto; ++ ++ if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) && ++ (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) || ++ match->key.vlan.vlan_tpid == htons(ETH_P_8021AD))) { ++ match->key.basic.n_proto = match->key.cvlan.vlan_tpid; ++ match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid; ++ match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid; ++ match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid; ++ match->key.vlan.vlan_tpid = ethertype.value; ++ match->mask.vlan.vlan_tpid = ethertype.mask; ++ match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] = ++ offsetof(struct nft_flow_key, cvlan); ++ match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN); ++ } else { ++ match->key.basic.n_proto = match->key.vlan.vlan_tpid; ++ match->mask.basic.n_proto = match->mask.vlan.vlan_tpid; ++ match->key.vlan.vlan_tpid = ethertype.value; ++ match->mask.vlan.vlan_tpid = ethertype.mask; ++ match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN] = ++ offsetof(struct nft_flow_key, vlan); ++ match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_VLAN); ++ } ++} ++ + struct nft_flow_rule *nft_flow_rule_create(struct net *net, + const struct nft_rule *rule) + { +@@ -89,6 +131,8 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, + + expr = nft_expr_next(expr); + } ++ nft_flow_rule_transfer_vlan(ctx, flow); ++ + flow->proto = ctx->dep.l3num; + kfree(ctx); + +-- +2.30.2 + diff --git a/queue-5.10/netfilter-nftables_offload-vlan-id-needs-host-byteor.patch b/queue-5.10/netfilter-nftables_offload-vlan-id-needs-host-byteor.patch new file mode 100644 index 00000000000..07cc44a0c41 --- /dev/null +++ b/queue-5.10/netfilter-nftables_offload-vlan-id-needs-host-byteor.patch @@ -0,0 +1,156 @@ +From 6e1def176ee796b391e2ceacccbff7aad65211e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 14:20:15 +0200 +Subject: netfilter: nftables_offload: VLAN id needs host byteorder in flow + dissector + +From: Pablo Neira Ayuso + +[ Upstream commit ff4d90a89d3d4d9814e0a2696509a7d495be4163 ] + +The flow dissector representation expects the VLAN id in host byteorder. +Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp. + +Fixes: a82055af5959 ("netfilter: nft_payload: add VLAN offload support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables_offload.h | 11 +++++- + net/netfilter/nft_cmp.c | 41 +++++++++++++++++++++-- + net/netfilter/nft_payload.c | 10 +++--- + 3 files changed, 55 insertions(+), 7 deletions(-) + +diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h +index b4d080061399..434a6158852f 100644 +--- a/include/net/netfilter/nf_tables_offload.h ++++ b/include/net/netfilter/nf_tables_offload.h +@@ -4,11 +4,16 @@ + #include + #include + ++enum nft_offload_reg_flags { ++ NFT_OFFLOAD_F_NETWORK2HOST = (1 << 0), ++}; ++ + struct nft_offload_reg { + u32 key; + u32 len; + u32 base_offset; + u32 offset; ++ u32 flags; + struct nft_data data; + struct nft_data mask; + }; +@@ -72,13 +77,17 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rul + void nft_flow_rule_destroy(struct nft_flow_rule *flow); + int nft_flow_rule_offload_commit(struct net *net); + +-#define NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \ ++#define NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, __flags) \ + (__reg)->base_offset = \ + offsetof(struct nft_flow_key, __base); \ + (__reg)->offset = \ + offsetof(struct nft_flow_key, __base.__field); \ + (__reg)->len = __len; \ + (__reg)->key = __key; \ ++ (__reg)->flags = __flags; ++ ++#define NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \ ++ NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, 0) + + #define NFT_OFFLOAD_MATCH_EXACT(__key, __base, __field, __len, __reg) \ + NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \ +diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c +index 00e563a72d3d..1d42d06f5b64 100644 +--- a/net/netfilter/nft_cmp.c ++++ b/net/netfilter/nft_cmp.c +@@ -115,19 +115,56 @@ nla_put_failure: + return -1; + } + ++union nft_cmp_offload_data { ++ u16 val16; ++ u32 val32; ++ u64 val64; ++}; ++ ++static void nft_payload_n2h(union nft_cmp_offload_data *data, ++ const u8 *val, u32 len) ++{ ++ switch (len) { ++ case 2: ++ data->val16 = ntohs(*((u16 *)val)); ++ break; ++ case 4: ++ data->val32 = ntohl(*((u32 *)val)); ++ break; ++ case 8: ++ data->val64 = be64_to_cpu(*((u64 *)val)); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ break; ++ } ++} ++ + static int __nft_cmp_offload(struct nft_offload_ctx *ctx, + struct nft_flow_rule *flow, + const struct nft_cmp_expr *priv) + { + struct nft_offload_reg *reg = &ctx->regs[priv->sreg]; ++ union nft_cmp_offload_data _data, _datamask; + u8 *mask = (u8 *)&flow->match.mask; + u8 *key = (u8 *)&flow->match.key; ++ u8 *data, *datamask; + + if (priv->op != NFT_CMP_EQ || priv->len > reg->len) + return -EOPNOTSUPP; + +- memcpy(key + reg->offset, &priv->data, reg->len); +- memcpy(mask + reg->offset, ®->mask, reg->len); ++ if (reg->flags & NFT_OFFLOAD_F_NETWORK2HOST) { ++ nft_payload_n2h(&_data, (u8 *)&priv->data, reg->len); ++ nft_payload_n2h(&_datamask, (u8 *)®->mask, reg->len); ++ data = (u8 *)&_data; ++ datamask = (u8 *)&_datamask; ++ } else { ++ data = (u8 *)&priv->data; ++ datamask = (u8 *)®->mask; ++ } ++ ++ memcpy(key + reg->offset, data, reg->len); ++ memcpy(mask + reg->offset, datamask, reg->len); + + flow->match.dissector.used_keys |= BIT(reg->key); + flow->match.dissector.offset[reg->key] = reg->base_offset; +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index e43863a1761f..1ebee25de677 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -226,8 +226,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, + if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16))) + return -EOPNOTSUPP; + +- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan, +- vlan_tci, sizeof(__be16), reg); ++ NFT_OFFLOAD_MATCH_FLAGS(FLOW_DISSECTOR_KEY_VLAN, vlan, ++ vlan_tci, sizeof(__be16), reg, ++ NFT_OFFLOAD_F_NETWORK2HOST); + break; + case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto): + if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16))) +@@ -241,8 +242,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, + if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16))) + return -EOPNOTSUPP; + +- NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan, +- vlan_tci, sizeof(__be16), reg); ++ NFT_OFFLOAD_MATCH_FLAGS(FLOW_DISSECTOR_KEY_CVLAN, cvlan, ++ vlan_tci, sizeof(__be16), reg, ++ NFT_OFFLOAD_F_NETWORK2HOST); + break; + case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) + + sizeof(struct vlan_hdr): +-- +2.30.2 + diff --git a/queue-5.10/nfc-pn533-prevent-potential-memory-corruption.patch b/queue-5.10/nfc-pn533-prevent-potential-memory-corruption.patch new file mode 100644 index 00000000000..d423469882b --- /dev/null +++ b/queue-5.10/nfc-pn533-prevent-potential-memory-corruption.patch @@ -0,0 +1,39 @@ +From 91165dba85c1e71e802fab2b6f06ea039690264d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 14:44:42 +0300 +Subject: nfc: pn533: prevent potential memory corruption + +From: Dan Carpenter + +[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ] + +If the "type_a->nfcid_len" is too large then it would lead to memory +corruption in pn533_target_found_type_a() when we do: + + memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len); + +Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/pn533/pn533.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index f7464bd6d57c..18e3435ab8f3 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -706,6 +706,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a, + if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0) + return false; + ++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE) ++ return false; ++ + return true; + } + +-- +2.30.2 + diff --git a/queue-5.10/nfp-devlink-initialize-the-devlink-port-attribute-la.patch b/queue-5.10/nfp-devlink-initialize-the-devlink-port-attribute-la.patch new file mode 100644 index 00000000000..759bc68d293 --- /dev/null +++ b/queue-5.10/nfp-devlink-initialize-the-devlink-port-attribute-la.patch @@ -0,0 +1,38 @@ +From 71ffc2874b46441c624b509c4efb3089575bc729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 11:24:15 +0200 +Subject: nfp: devlink: initialize the devlink port attribute "lanes" + +From: Yinjun Zhang + +[ Upstream commit 90b669d65d99a3ee6965275269967cdee4da106e ] + +The number of lanes of devlink port should be correctly initialized +when registering the port, so that the input check when running +"devlink port split count " can pass. + +Fixes: a21cf0a8330b ("devlink: Add a new devlink port lanes attribute and pass to netlink") +Signed-off-by: Yinjun Zhang +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c +index 97d2b03208de..7a8187458724 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c +@@ -364,6 +364,7 @@ int nfp_devlink_port_register(struct nfp_app *app, struct nfp_port *port) + + attrs.split = eth_port.is_split; + attrs.splittable = !attrs.split; ++ attrs.lanes = eth_port.port_lanes; + attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL; + attrs.phys.port_number = eth_port.label_port; + attrs.phys.split_subport_number = eth_port.label_subport; +-- +2.30.2 + diff --git a/queue-5.10/nfsd-fix-sparse-warning-in-nfs4proc.c.patch b/queue-5.10/nfsd-fix-sparse-warning-in-nfs4proc.c.patch new file mode 100644 index 00000000000..c87aa7f8846 --- /dev/null +++ b/queue-5.10/nfsd-fix-sparse-warning-in-nfs4proc.c.patch @@ -0,0 +1,58 @@ +From 22749491715e1563fcb48fe08034d0e8dc3b4d1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 16:17:40 -0500 +Subject: NFSD: Fix sparse warning in nfs4proc.c + +From: Chuck Lever + +[ Upstream commit eb162e1772f85231dabc789fb4bfea63d2d9df79 ] + +linux/fs/nfsd/nfs4proc.c:1542:24: warning: incorrect type in assignment (different base types) +linux/fs/nfsd/nfs4proc.c:1542:24: expected restricted __be32 [assigned] [usertype] status +linux/fs/nfsd/nfs4proc.c:1542:24: got int + +Clean-up: The dup_copy_fields() function returns only zero, so make +it return void for now, and get rid of the return code check. + +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 2e68cea148e0..015d25a5cd03 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1425,7 +1425,7 @@ static __be32 nfsd4_do_copy(struct nfsd4_copy *copy, bool sync) + return status; + } + +-static int dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) ++static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) + { + dst->cp_src_pos = src->cp_src_pos; + dst->cp_dst_pos = src->cp_dst_pos; +@@ -1444,8 +1444,6 @@ static int dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) + memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); + memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); + dst->ss_mnt = src->ss_mnt; +- +- return 0; + } + + static void cleanup_async_copy(struct nfsd4_copy *copy) +@@ -1539,9 +1537,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + refcount_set(&async_copy->refcount, 1); + memcpy(©->cp_res.cb_stateid, ©->cp_stateid, + sizeof(copy->cp_stateid)); +- status = dup_copy_fields(copy, async_copy); +- if (status) +- goto out_err; ++ dup_copy_fields(copy, async_copy); + async_copy->copy_task = kthread_create(nfsd4_do_async_copy, + async_copy, "%s", "copy thread"); + if (IS_ERR(async_copy->copy_task)) +-- +2.30.2 + diff --git a/queue-5.10/nfsv4.2-fix-copy-stateid-copying-for-the-async-copy.patch b/queue-5.10/nfsv4.2-fix-copy-stateid-copying-for-the-async-copy.patch new file mode 100644 index 00000000000..383eb9b0084 --- /dev/null +++ b/queue-5.10/nfsv4.2-fix-copy-stateid-copying-for-the-async-copy.patch @@ -0,0 +1,40 @@ +From ce57cdfe405367077037ae35363c434a250cbb56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 15:03:59 -0400 +Subject: NFSv4.2: fix copy stateid copying for the async copy + +From: Olga Kornievskaia + +[ Upstream commit e739b12042b6b079a397a3c234f96c09d1de0b40 ] + +This patch fixes Dan Carpenter's report that the static checker +found a problem where memcpy() was copying into too small of a buffer. + +Reported-by: Dan Carpenter +Fixes: e0639dc5805a ("NFSD introduce async copy feature") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Chuck Lever +Reviewed-by: Dai Ngo +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 015d25a5cd03..00440337efc1 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1535,8 +1535,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + if (!nfs4_init_copy_state(nn, copy)) + goto out_err; + refcount_set(&async_copy->refcount, 1); +- memcpy(©->cp_res.cb_stateid, ©->cp_stateid, +- sizeof(copy->cp_stateid)); ++ memcpy(©->cp_res.cb_stateid, ©->cp_stateid.stid, ++ sizeof(copy->cp_res.cb_stateid)); + dup_copy_fields(copy, async_copy); + async_copy->copy_task = kthread_create(nfsd4_do_async_copy, + async_copy, "%s", "copy thread"); +-- +2.30.2 + diff --git a/queue-5.10/node-fix-device-cleanups-in-error-handling-code.patch b/queue-5.10/node-fix-device-cleanups-in-error-handling-code.patch new file mode 100644 index 00000000000..0ca6be43844 --- /dev/null +++ b/queue-5.10/node-fix-device-cleanups-in-error-handling-code.patch @@ -0,0 +1,92 @@ +From f3044d1be8bff840bca3e759d4e4fe4a082bb89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:01:57 +0300 +Subject: node: fix device cleanups in error handling code + +From: Dan Carpenter + +[ Upstream commit 4ce535ec0084f0d712317cb99d383cad3288e713 ] + +We can't use kfree() to free device managed resources so the kfree(dev) +is against the rules. + +It's easier to write this code if we open code the device_register() as +a device_initialize() and device_add(). That way if dev_set_name() set +name fails we can call put_device() and it will clean up correctly. + +Fixes: acc02a109b04 ("node: Add memory-side caching attributes") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YHA0JUra+F64+NpB@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 6ffa470e2984..21965de8538b 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -268,21 +268,20 @@ static void node_init_cache_dev(struct node *node) + if (!dev) + return; + ++ device_initialize(dev); + dev->parent = &node->dev; + dev->release = node_cache_release; + if (dev_set_name(dev, "memory_side_cache")) +- goto free_dev; ++ goto put_device; + +- if (device_register(dev)) +- goto free_name; ++ if (device_add(dev)) ++ goto put_device; + + pm_runtime_no_callbacks(dev); + node->cache_dev = dev; + return; +-free_name: +- kfree_const(dev->kobj.name); +-free_dev: +- kfree(dev); ++put_device: ++ put_device(dev); + } + + /** +@@ -319,25 +318,24 @@ void node_add_cache(unsigned int nid, struct node_cache_attrs *cache_attrs) + return; + + dev = &info->dev; ++ device_initialize(dev); + dev->parent = node->cache_dev; + dev->release = node_cacheinfo_release; + dev->groups = cache_groups; + if (dev_set_name(dev, "index%d", cache_attrs->level)) +- goto free_cache; ++ goto put_device; + + info->cache_attrs = *cache_attrs; +- if (device_register(dev)) { ++ if (device_add(dev)) { + dev_warn(&node->dev, "failed to add cache level:%d\n", + cache_attrs->level); +- goto free_name; ++ goto put_device; + } + pm_runtime_no_callbacks(dev); + list_add_tail(&info->node, &node->cache_attrs); + return; +-free_name: +- kfree_const(dev->kobj.name); +-free_cache: +- kfree(info); ++put_device: ++ put_device(dev); + } + + static void node_remove_caches(struct node *node) +-- +2.30.2 + diff --git a/queue-5.10/nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch b/queue-5.10/nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch new file mode 100644 index 00000000000..3db5c42c776 --- /dev/null +++ b/queue-5.10/nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch @@ -0,0 +1,39 @@ +From 8a755954328c05f3f6bb431c13078d4eb347607a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 20:12:55 +0200 +Subject: nvme-pci: don't simple map sgl when sgls are disabled + +From: Niklas Cassel + +[ Upstream commit e51183be1fa96dc6d3cd11b3c25a0f595807315e ] + +According to the module parameter description for sgl_threshold, +a value of 0 means that SGLs are disabled. + +If SGLs are disabled, we should respect that, even for the case +where the request is made up of a single physical segment. + +Fixes: 297910571f08 ("nvme-pci: optimize mapping single segment requests using SGLs") +Signed-off-by: Niklas Cassel +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 716039ea4450..c1f3446216c5 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -852,7 +852,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req, + return nvme_setup_prp_simple(dev, req, + &cmnd->rw, &bv); + +- if (iod->nvmeq->qid && ++ if (iod->nvmeq->qid && sgl_threshold && + dev->ctrl.sgls & ((1 << 0) | (1 << 1))) + return nvme_setup_sgl_simple(dev, req, + &cmnd->rw, &bv); +-- +2.30.2 + diff --git a/queue-5.10/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch b/queue-5.10/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch new file mode 100644 index 00000000000..bfa4a80d961 --- /dev/null +++ b/queue-5.10/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch @@ -0,0 +1,43 @@ +From 2ee5c663d79e16268bd31bb78f71eb59edcb850c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 16:29:01 +0100 +Subject: nvme: retrigger ANA log update if group descriptor isn't found + +From: Hannes Reinecke + +[ Upstream commit dd8f7fa908f66dd44abcd83cbb50410524b9f8ef ] + +If ANA is enabled but no ANA group descriptor is found when creating +a new namespace the ANA log is most likely out of date, so trigger +a re-read. The namespace will be tagged with the NS_ANA_PENDING flag +to exclude it from path selection until the ANA log has been re-read. + +Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems") +Reported-by: Martin George +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index e812a0d0fdb3..f750cf98ae26 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -667,6 +667,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id) + if (desc.state) { + /* found the group desc: update */ + nvme_update_ns_ana_state(&desc, ns); ++ } else { ++ /* group desc not found: trigger a re-read */ ++ set_bit(NVME_NS_ANA_PENDING, &ns->flags); ++ queue_work(nvme_wq, &ns->ctrl->ana_work); + } + } else { + ns->ana_state = NVME_ANA_OPTIMIZED; +-- +2.30.2 + diff --git a/queue-5.10/nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch b/queue-5.10/nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch new file mode 100644 index 00000000000..84dc3b5a881 --- /dev/null +++ b/queue-5.10/nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch @@ -0,0 +1,45 @@ +From c3023bfbfa2d339b6f1e4eea03a96754998acd1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Mar 2021 00:08:48 -0700 +Subject: nvme-tcp: block BH in sk state_change sk callback + +From: Sagi Grimberg + +[ Upstream commit 8b73b45d54a14588f86792869bfb23098ea254cb ] + +The TCP stack can run from process context for a long time +so we should disable BH here. + +Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 9444e5e2a95b..4cf81f3841ae 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -874,7 +874,7 @@ static void nvme_tcp_state_change(struct sock *sk) + { + struct nvme_tcp_queue *queue; + +- read_lock(&sk->sk_callback_lock); ++ read_lock_bh(&sk->sk_callback_lock); + queue = sk->sk_user_data; + if (!queue) + goto done; +@@ -895,7 +895,7 @@ static void nvme_tcp_state_change(struct sock *sk) + + queue->state_change(sk); + done: +- read_unlock(&sk->sk_callback_lock); ++ read_unlock_bh(&sk->sk_callback_lock); + } + + static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue) +-- +2.30.2 + diff --git a/queue-5.10/nvmet-tcp-fix-a-segmentation-fault-during-io-parsing.patch b/queue-5.10/nvmet-tcp-fix-a-segmentation-fault-during-io-parsing.patch new file mode 100644 index 00000000000..eb23f96bad6 --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-a-segmentation-fault-during-io-parsing.patch @@ -0,0 +1,103 @@ +From 11f7a0b96c287069b6627a5e7dcf66add1847bef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 17:13:14 +0800 +Subject: nvmet-tcp: fix a segmentation fault during io parsing error + +From: Elad Grupi + +[ Upstream commit bdaf13279192c60b2b1fc99badef53b494fec055 ] + +In case there is an io that contains inline data and it goes to +parsing error flow, command response will free command and iov +before clearing the data on the socket buffer. +This will delay the command response until receive flow is completed. + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Signed-off-by: Elad Grupi +Signed-off-by: Hou Pu +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 39 +++++++++++++++++++++++++++++++-------- + 1 file changed, 31 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 218fd766dc74..d958b5da9b88 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -525,11 +525,36 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req) + struct nvmet_tcp_cmd *cmd = + container_of(req, struct nvmet_tcp_cmd, req); + struct nvmet_tcp_queue *queue = cmd->queue; ++ struct nvme_sgl_desc *sgl; ++ u32 len; ++ ++ if (unlikely(cmd == queue->cmd)) { ++ sgl = &cmd->req.cmd->common.dptr.sgl; ++ len = le32_to_cpu(sgl->length); ++ ++ /* ++ * Wait for inline data before processing the response. ++ * Avoid using helpers, this might happen before ++ * nvmet_req_init is completed. ++ */ ++ if (queue->rcv_state == NVMET_TCP_RECV_PDU && ++ len && len < cmd->req.port->inline_data_size && ++ nvme_is_write(cmd->req.cmd)) ++ return; ++ } + + llist_add(&cmd->lentry, &queue->resp_list); + queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &cmd->queue->io_work); + } + ++static void nvmet_tcp_execute_request(struct nvmet_tcp_cmd *cmd) ++{ ++ if (unlikely(cmd->flags & NVMET_TCP_F_INIT_FAILED)) ++ nvmet_tcp_queue_response(&cmd->req); ++ else ++ cmd->req.execute(&cmd->req); ++} ++ + static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd) + { + u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue); +@@ -961,7 +986,7 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) + le32_to_cpu(req->cmd->common.dptr.sgl.length)); + + nvmet_tcp_handle_req_failure(queue, queue->cmd, req); +- return -EAGAIN; ++ return 0; + } + + ret = nvmet_tcp_map_data(queue->cmd); +@@ -1104,10 +1129,8 @@ static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue) + return 0; + } + +- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) && +- cmd->rbytes_done == cmd->req.transfer_len) { +- cmd->req.execute(&cmd->req); +- } ++ if (cmd->rbytes_done == cmd->req.transfer_len) ++ nvmet_tcp_execute_request(cmd); + + nvmet_prepare_receive_pdu(queue); + return 0; +@@ -1144,9 +1167,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue) + goto out; + } + +- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) && +- cmd->rbytes_done == cmd->req.transfer_len) +- cmd->req.execute(&cmd->req); ++ if (cmd->rbytes_done == cmd->req.transfer_len) ++ nvmet_tcp_execute_request(cmd); ++ + ret = 0; + out: + nvmet_prepare_receive_pdu(queue); +-- +2.30.2 + diff --git a/queue-5.10/nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch b/queue-5.10/nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch new file mode 100644 index 00000000000..2ae085b0a40 --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch @@ -0,0 +1,167 @@ +From 960d71b79c396afc9888a7b346fd573f8bebfc1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Mar 2021 00:08:49 -0700 +Subject: nvmet-tcp: fix incorrect locking in state_change sk callback + +From: Sagi Grimberg + +[ Upstream commit b5332a9f3f3d884a1b646ce155e664cc558c1722 ] + +We are not changing anything in the TCP connection state so +we should not take a write_lock but rather a read lock. + +This caused a deadlock when running nvmet-tcp and nvme-tcp +on the same system, where state_change callbacks on the +host and on the controller side have causal relationship +and made lockdep report on this with blktests: + +================================ +WARNING: inconsistent lock state +5.12.0-rc3 #1 Tainted: G I +-------------------------------- +inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-R} usage. +nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes: +ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp] +{IN-SOFTIRQ-W} state was registered at: + __lock_acquire+0x79b/0x18d0 + lock_acquire+0x1ca/0x480 + _raw_write_lock_bh+0x39/0x80 + nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp] + tcp_fin+0x2a8/0x780 + tcp_data_queue+0xf94/0x1f20 + tcp_rcv_established+0x6ba/0x1f00 + tcp_v4_do_rcv+0x502/0x760 + tcp_v4_rcv+0x257e/0x3430 + ip_protocol_deliver_rcu+0x69/0x6a0 + ip_local_deliver_finish+0x1e2/0x2f0 + ip_local_deliver+0x1a2/0x420 + ip_rcv+0x4fb/0x6b0 + __netif_receive_skb_one_core+0x162/0x1b0 + process_backlog+0x1ff/0x770 + __napi_poll.constprop.0+0xa9/0x5c0 + net_rx_action+0x7b3/0xb30 + __do_softirq+0x1f0/0x940 + do_softirq+0xa1/0xd0 + __local_bh_enable_ip+0xd8/0x100 + ip_finish_output2+0x6b7/0x18a0 + __ip_queue_xmit+0x706/0x1aa0 + __tcp_transmit_skb+0x2068/0x2e20 + tcp_write_xmit+0xc9e/0x2bb0 + __tcp_push_pending_frames+0x92/0x310 + inet_shutdown+0x158/0x300 + __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp] + nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp] + nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp] + nvme_do_delete_ctrl+0x100/0x10c [nvme_core] + nvme_sysfs_delete.cold+0x8/0xd [nvme_core] + kernfs_fop_write_iter+0x2c7/0x460 + new_sync_write+0x36c/0x610 + vfs_write+0x5c0/0x870 + ksys_write+0xf9/0x1d0 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae +irq event stamp: 10687 +hardirqs last enabled at (10687): [] _raw_spin_unlock_irqrestore+0x2d/0x40 +hardirqs last disabled at (10686): [] _raw_spin_lock_irqsave+0x68/0x90 +softirqs last enabled at (10684): [] __do_softirq+0x608/0x940 +softirqs last disabled at (10649): [] do_softirq+0xa1/0xd0 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(clock-AF_INET); + + lock(clock-AF_INET); + + *** DEADLOCK *** + +5 locks held by nvme/1324: + #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0 + #1: ffff8886e435c090 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460 + #2: ffff888104d90c38 (kn->active#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330 + #3: ffff8884634538d0 (&queue->queue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp] + #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300 + +stack backtrace: +CPU: 26 PID: 1324 Comm: nvme Tainted: G I 5.12.0-rc3 #1 +Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020 +Call Trace: + dump_stack+0x93/0xc2 + mark_lock_irq.cold+0x2c/0xb3 + ? verify_lock_unused+0x390/0x390 + ? stack_trace_consume_entry+0x160/0x160 + ? lock_downgrade+0x100/0x100 + ? save_trace+0x88/0x5e0 + ? _raw_spin_unlock_irqrestore+0x2d/0x40 + mark_lock+0x530/0x1470 + ? mark_lock_irq+0x1d10/0x1d10 + ? enqueue_timer+0x660/0x660 + mark_usage+0x215/0x2a0 + __lock_acquire+0x79b/0x18d0 + ? tcp_schedule_loss_probe.part.0+0x38c/0x520 + lock_acquire+0x1ca/0x480 + ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp] + ? rcu_read_unlock+0x40/0x40 + ? tcp_mtu_probe+0x1ae0/0x1ae0 + ? kmalloc_reserve+0xa0/0xa0 + ? sysfs_file_ops+0x170/0x170 + _raw_read_lock+0x3d/0xa0 + ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp] + nvme_tcp_state_change+0x21/0x150 [nvme_tcp] + ? sysfs_file_ops+0x170/0x170 + inet_shutdown+0x189/0x300 + __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp] + nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp] + nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp] + nvme_do_delete_ctrl+0x100/0x10c [nvme_core] + nvme_sysfs_delete.cold+0x8/0xd [nvme_core] + kernfs_fop_write_iter+0x2c7/0x460 + new_sync_write+0x36c/0x610 + ? new_sync_read+0x600/0x600 + ? lock_acquire+0x1ca/0x480 + ? rcu_read_unlock+0x40/0x40 + ? lock_is_held_type+0x9a/0x110 + vfs_write+0x5c0/0x870 + ksys_write+0xf9/0x1d0 + ? __ia32_sys_read+0xa0/0xa0 + ? lockdep_hardirqs_on_prepare.part.0+0x198/0x340 + ? syscall_enter_from_user_mode+0x27/0x70 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index d658c6e8263a..218fd766dc74 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1434,7 +1434,7 @@ static void nvmet_tcp_state_change(struct sock *sk) + { + struct nvmet_tcp_queue *queue; + +- write_lock_bh(&sk->sk_callback_lock); ++ read_lock_bh(&sk->sk_callback_lock); + queue = sk->sk_user_data; + if (!queue) + goto done; +@@ -1452,7 +1452,7 @@ static void nvmet_tcp_state_change(struct sock *sk) + queue->idx, sk->sk_state); + } + done: +- write_unlock_bh(&sk->sk_callback_lock); ++ read_unlock_bh(&sk->sk_callback_lock); + } + + static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue) +-- +2.30.2 + diff --git a/queue-5.10/of-overlay-fix-for_each_child.cocci-warnings.patch b/queue-5.10/of-overlay-fix-for_each_child.cocci-warnings.patch new file mode 100644 index 00000000000..a0e7c6e1844 --- /dev/null +++ b/queue-5.10/of-overlay-fix-for_each_child.cocci-warnings.patch @@ -0,0 +1,42 @@ +From 1cd22fc246aed8d1befad1ec7f7d2405a93536b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 19:21:39 +0100 +Subject: of: overlay: fix for_each_child.cocci warnings + +From: kernel test robot + +[ Upstream commit c4d74f0f978ed5ceee62cd3f6708081042e582a1 ] + +Function "for_each_child_of_node" should have of_node_put() before goto. + +Generated by: scripts/coccinelle/iterators/for_each_child.cocci + +Fixes: 82c2d81361ec ("coccinelle: iterators: Add for_each_child.cocci script") +CC: Sumera Priyadarsini +Reported-by: kernel test robot +Signed-off-by: kernel test robot +Signed-off-by: Julia Lawall +Reviewed-by: Frank Rowand +Tested-by: Frank Rowand +Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2103221918450.2918@hadrien +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/overlay.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index 50bbe0edf538..43a77d720008 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -796,6 +796,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, + if (!fragment->target) { + of_node_put(fragment->overlay); + ret = -EINVAL; ++ of_node_put(node); + goto err_free_fragments; + } + +-- +2.30.2 + diff --git a/queue-5.10/ovl-invalidate-readdir-cache-on-changes-to-dir-with-.patch b/queue-5.10/ovl-invalidate-readdir-cache-on-changes-to-dir-with-.patch new file mode 100644 index 00000000000..24118e94932 --- /dev/null +++ b/queue-5.10/ovl-invalidate-readdir-cache-on-changes-to-dir-with-.patch @@ -0,0 +1,172 @@ +From 9a1798e2abb1cb9d286a926465015a16a8a320d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Apr 2021 12:22:23 +0300 +Subject: ovl: invalidate readdir cache on changes to dir with origin + +From: Amir Goldstein + +[ Upstream commit 65cd913ec9d9d71529665924c81015b7ab7d9381 ] + +The test in ovl_dentry_version_inc() was out-dated and did not include +the case where readdir cache is used on a non-merge dir that has origin +xattr, indicating that it may contain leftover whiteouts. + +To make the code more robust, use the same helper ovl_dir_is_real() +to determine if readdir cache should be used and if readdir cache should +be invalidated. + +Fixes: b79e05aaa166 ("ovl: no direct iteration for dir with origin xattr") +Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxht70nODhNHNwGFMSqDyOKLXOKrY0H6g849os4BQ7cokA@mail.gmail.com/ +Cc: Chris Murphy +Signed-off-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/overlayfs.h | 30 +++++++++++++++++++++++++++--- + fs/overlayfs/readdir.c | 12 ------------ + fs/overlayfs/util.c | 31 +++++++++---------------------- + 3 files changed, 36 insertions(+), 37 deletions(-) + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 9f7af98ae200..e43dc68bd1b5 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -308,9 +308,6 @@ int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry, + enum ovl_xattr ox, const void *value, size_t size, + int xerr); + int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry); +-void ovl_set_flag(unsigned long flag, struct inode *inode); +-void ovl_clear_flag(unsigned long flag, struct inode *inode); +-bool ovl_test_flag(unsigned long flag, struct inode *inode); + bool ovl_inuse_trylock(struct dentry *dentry); + void ovl_inuse_unlock(struct dentry *dentry); + bool ovl_is_inuse(struct dentry *dentry); +@@ -324,6 +321,21 @@ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry, + int padding); + int ovl_sync_status(struct ovl_fs *ofs); + ++static inline void ovl_set_flag(unsigned long flag, struct inode *inode) ++{ ++ set_bit(flag, &OVL_I(inode)->flags); ++} ++ ++static inline void ovl_clear_flag(unsigned long flag, struct inode *inode) ++{ ++ clear_bit(flag, &OVL_I(inode)->flags); ++} ++ ++static inline bool ovl_test_flag(unsigned long flag, struct inode *inode) ++{ ++ return test_bit(flag, &OVL_I(inode)->flags); ++} ++ + static inline bool ovl_is_impuredir(struct super_block *sb, + struct dentry *dentry) + { +@@ -427,6 +439,18 @@ int ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, + struct dentry *dentry, int level); + int ovl_indexdir_cleanup(struct ovl_fs *ofs); + ++/* ++ * Can we iterate real dir directly? ++ * ++ * Non-merge dir may contain whiteouts from a time it was a merge upper, before ++ * lower dir was removed under it and possibly before it was rotated from upper ++ * to lower layer. ++ */ ++static inline bool ovl_dir_is_real(struct dentry *dir) ++{ ++ return !ovl_test_flag(OVL_WHITEOUTS, d_inode(dir)); ++} ++ + /* inode.c */ + int ovl_set_nlink_upper(struct dentry *dentry); + int ovl_set_nlink_lower(struct dentry *dentry); +diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c +index f404a78e6b60..cc1e80257064 100644 +--- a/fs/overlayfs/readdir.c ++++ b/fs/overlayfs/readdir.c +@@ -319,18 +319,6 @@ static inline int ovl_dir_read(struct path *realpath, + return err; + } + +-/* +- * Can we iterate real dir directly? +- * +- * Non-merge dir may contain whiteouts from a time it was a merge upper, before +- * lower dir was removed under it and possibly before it was rotated from upper +- * to lower layer. +- */ +-static bool ovl_dir_is_real(struct dentry *dir) +-{ +- return !ovl_test_flag(OVL_WHITEOUTS, d_inode(dir)); +-} +- + static void ovl_dir_reset(struct file *file) + { + struct ovl_dir_file *od = file->private_data; +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index 6e7b8c882045..e8b14d2c180c 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -419,18 +419,20 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) + } + } + +-static void ovl_dentry_version_inc(struct dentry *dentry, bool impurity) ++static void ovl_dir_version_inc(struct dentry *dentry, bool impurity) + { + struct inode *inode = d_inode(dentry); + + WARN_ON(!inode_is_locked(inode)); ++ WARN_ON(!d_is_dir(dentry)); + /* +- * Version is used by readdir code to keep cache consistent. For merge +- * dirs all changes need to be noted. For non-merge dirs, cache only +- * contains impure (ones which have been copied up and have origins) +- * entries, so only need to note changes to impure entries. ++ * Version is used by readdir code to keep cache consistent. ++ * For merge dirs (or dirs with origin) all changes need to be noted. ++ * For non-merge dirs, cache contains only impure entries (i.e. ones ++ * which have been copied up and have origins), so only need to note ++ * changes to impure entries. + */ +- if (OVL_TYPE_MERGE(ovl_path_type(dentry)) || impurity) ++ if (!ovl_dir_is_real(dentry) || impurity) + OVL_I(inode)->version++; + } + +@@ -439,7 +441,7 @@ void ovl_dir_modified(struct dentry *dentry, bool impurity) + /* Copy mtime/ctime */ + ovl_copyattr(d_inode(ovl_dentry_upper(dentry)), d_inode(dentry)); + +- ovl_dentry_version_inc(dentry, impurity); ++ ovl_dir_version_inc(dentry, impurity); + } + + u64 ovl_dentry_version_get(struct dentry *dentry) +@@ -634,21 +636,6 @@ int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry) + return err; + } + +-void ovl_set_flag(unsigned long flag, struct inode *inode) +-{ +- set_bit(flag, &OVL_I(inode)->flags); +-} +- +-void ovl_clear_flag(unsigned long flag, struct inode *inode) +-{ +- clear_bit(flag, &OVL_I(inode)->flags); +-} +- +-bool ovl_test_flag(unsigned long flag, struct inode *inode) +-{ +- return test_bit(flag, &OVL_I(inode)->flags); +-} +- + /** + * Caller must hold a reference to inode to prevent it from being freed while + * it is marked inuse. +-- +2.30.2 + diff --git a/queue-5.10/pata_arasan_cf-fix-irq-check.patch b/queue-5.10/pata_arasan_cf-fix-irq-check.patch new file mode 100644 index 00000000000..69b9645df24 --- /dev/null +++ b/queue-5.10/pata_arasan_cf-fix-irq-check.patch @@ -0,0 +1,56 @@ +From 5cf21c6712e90b2019cb80c3c5f3b4fd18011f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:50:24 +0300 +Subject: pata_arasan_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking code +to pass the positive IRQ #s to ata_host_activate(), propagate upstream +-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors +and IRQ0 (libata treats IRQ #0 as a polling mode anyway)... + +Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller") +Signed-off-by: Sergey Shtylyov +Acked-by: Viresh Kumar +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_arasan_cf.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index e9cf31f38450..63f39440a9b4 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -818,12 +818,19 @@ static int arasan_cf_probe(struct platform_device *pdev) + else + quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */ + +- /* if irq is 0, support only PIO */ +- acdev->irq = platform_get_irq(pdev, 0); +- if (acdev->irq) ++ /* ++ * If there's an error getting IRQ (or we do get IRQ0), ++ * support only PIO ++ */ ++ ret = platform_get_irq(pdev, 0); ++ if (ret > 0) { ++ acdev->irq = ret; + irq_handler = arasan_cf_interrupt; +- else ++ } else if (ret == -EPROBE_DEFER) { ++ return ret; ++ } else { + quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA; ++ } + + acdev->pbase = res->start; + acdev->vbase = devm_ioremap(&pdev->dev, res->start, +-- +2.30.2 + diff --git a/queue-5.10/pata_ipx4xx_cf-fix-irq-check.patch b/queue-5.10/pata_ipx4xx_cf-fix-irq-check.patch new file mode 100644 index 00000000000..284a923034d --- /dev/null +++ b/queue-5.10/pata_ipx4xx_cf-fix-irq-check.patch @@ -0,0 +1,45 @@ +From 804de751f5ef7c3e4c66cf07f18f3c8eed13d6f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:51:10 +0300 +Subject: pata_ipx4xx_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking +code to pass the positive IRQ #s to ata_host_activate(), propagate errors +upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code +treats 0 as an indication that polling should be used anyway... + +Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ixp4xx_cf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c +index d1644a8ef9fa..abc0e87ca1a8 100644 +--- a/drivers/ata/pata_ixp4xx_cf.c ++++ b/drivers/ata/pata_ixp4xx_cf.c +@@ -165,8 +165,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev) + return -ENOMEM; + + irq = platform_get_irq(pdev, 0); +- if (irq) ++ if (irq > 0) + irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING); ++ else if (irq < 0) ++ return irq; ++ else ++ return -EINVAL; + + /* Setup expansion bus chip selects */ + *data->cs0_cfg = data->cs0_bits; +-- +2.30.2 + diff --git a/queue-5.10/perf-amd-uncore-fix-sysfs-type-mismatch.patch b/queue-5.10/perf-amd-uncore-fix-sysfs-type-mismatch.patch new file mode 100644 index 00000000000..4dadfbd0499 --- /dev/null +++ b/queue-5.10/perf-amd-uncore-fix-sysfs-type-mismatch.patch @@ -0,0 +1,57 @@ +From 5bb7805dd424836e7be44df5ca46b45163f5452d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 17:11:12 -0700 +Subject: perf/amd/uncore: Fix sysfs type mismatch + +From: Nathan Chancellor + +[ Upstream commit 5deac80d4571dffb51f452f0027979d72259a1b9 ] + +dev_attr_show() calls the __uncore_*_show() functions via an indirect +call but their type does not currently match the type of the show() +member in 'struct device_attribute', resulting in a Control Flow +Integrity violation. + +$ cat /sys/devices/amd_l3/format/umask +config:8-15 + +$ dmesg | grep "CFI failure" +[ 1258.174653] CFI failure (target: __uncore_umask_show...): + +Update the type in the DEFINE_UNCORE_FORMAT_ATTR macro to match +'struct device_attribute' so that there is no more CFI violation. + +Fixes: 06f2c24584f3 ("perf/amd/uncore: Prepare to scale for more attributes that vary per family") +Signed-off-by: Nathan Chancellor +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415001112.3024673-2-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/uncore.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c +index 7f014d450bc2..582c0ffb5e98 100644 +--- a/arch/x86/events/amd/uncore.c ++++ b/arch/x86/events/amd/uncore.c +@@ -275,14 +275,14 @@ static struct attribute_group amd_uncore_attr_group = { + }; + + #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __uncore_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __uncore_##_var##_show, NULL) + + DEFINE_UNCORE_FORMAT_ATTR(event12, event, "config:0-7,32-35"); +-- +2.30.2 + diff --git a/queue-5.10/perf-beauty-fix-fsconfig-generator.patch b/queue-5.10/perf-beauty-fix-fsconfig-generator.patch new file mode 100644 index 00000000000..b172dc9b6c1 --- /dev/null +++ b/queue-5.10/perf-beauty-fix-fsconfig-generator.patch @@ -0,0 +1,87 @@ +From 269cab9cdf1ec1710f02470a4eeab10c873bfebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 21:27:23 +0300 +Subject: perf beauty: Fix fsconfig generator + +From: Vitaly Chikunov + +[ Upstream commit 2e1daee14e67fbf9b27280b974e2c680a22cabea ] + +After gnulib update sed stopped matching `[[:space:]]*+' as before, +causing the following compilation error: + + In file included from builtin-trace.c:719: + trace/beauty/generated/fsconfig_arrays.c:2:3: error: expected expression before ']' token + 2 | [] = "", + | ^ + trace/beauty/generated/fsconfig_arrays.c:2:3: error: array index in initializer not of integer type + trace/beauty/generated/fsconfig_arrays.c:2:3: note: (near initialization for 'fsconfig_cmds') + +Fix this by correcting the regular expression used in the generator. +Also, clean up the script by removing redundant egrep, xargs, and printf +invocations. + +Committer testing: + +Continues to work: + + $ cat tools/perf/trace/beauty/fsconfig.sh + #!/bin/sh + # SPDX-License-Identifier: LGPL-2.1 + + if [ $# -ne 1 ] ; then + linux_header_dir=tools/include/uapi/linux + else + linux_header_dir=$1 + fi + + linux_mount=${linux_header_dir}/mount.h + + printf "static const char *fsconfig_cmds[] = {\n" + ms='[[:space:]]*' + sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \ + ${linux_mount} + printf "};\n" + $ tools/perf/trace/beauty/fsconfig.sh + static const char *fsconfig_cmds[] = { + [0] = "SET_FLAG", + [1] = "SET_STRING", + [2] = "SET_BINARY", + [3] = "SET_PATH", + [4] = "SET_PATH_EMPTY", + [5] = "SET_FD", + [6] = "CMD_CREATE", + [7] = "CMD_RECONFIGURE", + }; + $ + +Fixes: d35293004a5e4 ("perf beauty: Add generator for fsconfig's 'cmd' arg values") +Signed-off-by: Vitaly Chikunov +Co-authored-by: Dmitry V. Levin +Tested-by: Arnaldo Carvalho de Melo +Link: http://lore.kernel.org/lkml/20210414182723.1670663-1-vt@altlinux.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/trace/beauty/fsconfig.sh | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/trace/beauty/fsconfig.sh b/tools/perf/trace/beauty/fsconfig.sh +index 83fb24df05c9..bc6ef7bb7a5f 100755 +--- a/tools/perf/trace/beauty/fsconfig.sh ++++ b/tools/perf/trace/beauty/fsconfig.sh +@@ -10,8 +10,7 @@ fi + linux_mount=${linux_header_dir}/mount.h + + printf "static const char *fsconfig_cmds[] = {\n" +-regex='^[[:space:]]*+FSCONFIG_([[:alnum:]_]+)[[:space:]]*=[[:space:]]*([[:digit:]]+)[[:space:]]*,[[:space:]]*.*' +-egrep $regex ${linux_mount} | \ +- sed -r "s/$regex/\2 \1/g" | \ +- xargs printf "\t[%s] = \"%s\",\n" ++ms='[[:space:]]*' ++sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \ ++ ${linux_mount} + printf "};\n" +-- +2.30.2 + diff --git a/queue-5.10/perf-jit-let-convert_timestamp-to-be-backwards-compa.patch b/queue-5.10/perf-jit-let-convert_timestamp-to-be-backwards-compa.patch new file mode 100644 index 00000000000..46ac1a855c8 --- /dev/null +++ b/queue-5.10/perf-jit-let-convert_timestamp-to-be-backwards-compa.patch @@ -0,0 +1,109 @@ +From 4b8923af2d9514662b1f93fa5380465debf09540 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 20:09:13 +0800 +Subject: perf jit: Let convert_timestamp() to be backwards-compatible + +From: Leo Yan + +[ Upstream commit aa616f5a8a2d22a179d5502ebd85045af66fa656 ] + +Commit d110162cafc80dad ("perf tsc: Support cap_user_time_short for +event TIME_CONV") supports the extended parameters for event TIME_CONV, +but it broke the backwards compatibility, so any perf data file with old +event format fails to convert timestamp. + +This patch introduces a helper event_contains() to check if an event +contains a specific member or not. For the backwards-compatibility, if +the event size confirms the extended parameters are supported in the +event TIME_CONV, then copies these parameters. + +Committer notes: + +To make this compiler backwards compatible add this patch: + + - struct perf_tsc_conversion tc = { 0 }; + + struct perf_tsc_conversion tc = { .time_shift = 0, }; + +Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV") +Signed-off-by: Leo Yan +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Gustavo A. R. Silva +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Steve MacLean +Cc: Yonatan Goldschmidt +Link: https://lore.kernel.org/r/20210428120915.7123-3-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 2 ++ + tools/perf/util/jitdump.c | 30 +++++++++++++++++++---------- + 2 files changed, 22 insertions(+), 10 deletions(-) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index baf64ea74e10..4a24b855d3ce 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -8,6 +8,8 @@ + #include + #include /* pid_t */ + ++#define event_contains(obj, mem) ((obj).header.size > offsetof(typeof(obj), mem)) ++ + struct perf_record_mmap { + struct perf_event_header header; + __u32 pid, tid; +diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c +index 055bab7a92b3..64d8f9ba8c03 100644 +--- a/tools/perf/util/jitdump.c ++++ b/tools/perf/util/jitdump.c +@@ -369,21 +369,31 @@ jit_inject_event(struct jit_buf_desc *jd, union perf_event *event) + + static uint64_t convert_timestamp(struct jit_buf_desc *jd, uint64_t timestamp) + { +- struct perf_tsc_conversion tc; ++ struct perf_tsc_conversion tc = { .time_shift = 0, }; ++ struct perf_record_time_conv *time_conv = &jd->session->time_conv; + + if (!jd->use_arch_timestamp) + return timestamp; + +- tc.time_shift = jd->session->time_conv.time_shift; +- tc.time_mult = jd->session->time_conv.time_mult; +- tc.time_zero = jd->session->time_conv.time_zero; +- tc.time_cycles = jd->session->time_conv.time_cycles; +- tc.time_mask = jd->session->time_conv.time_mask; +- tc.cap_user_time_zero = jd->session->time_conv.cap_user_time_zero; +- tc.cap_user_time_short = jd->session->time_conv.cap_user_time_short; ++ tc.time_shift = time_conv->time_shift; ++ tc.time_mult = time_conv->time_mult; ++ tc.time_zero = time_conv->time_zero; + +- if (!tc.cap_user_time_zero) +- return 0; ++ /* ++ * The event TIME_CONV was extended for the fields from "time_cycles" ++ * when supported cap_user_time_short, for backward compatibility, ++ * checks the event size and assigns these extended fields if these ++ * fields are contained in the event. ++ */ ++ if (event_contains(*time_conv, time_cycles)) { ++ tc.time_cycles = time_conv->time_cycles; ++ tc.time_mask = time_conv->time_mask; ++ tc.cap_user_time_zero = time_conv->cap_user_time_zero; ++ tc.cap_user_time_short = time_conv->cap_user_time_short; ++ ++ if (!tc.cap_user_time_zero) ++ return 0; ++ } + + return tsc_to_perf_time(timestamp, &tc); + } +-- +2.30.2 + diff --git a/queue-5.10/perf-session-add-swap-operation-for-event-time_conv.patch b/queue-5.10/perf-session-add-swap-operation-for-event-time_conv.patch new file mode 100644 index 00000000000..a6bf603fcda --- /dev/null +++ b/queue-5.10/perf-session-add-swap-operation-for-event-time_conv.patch @@ -0,0 +1,74 @@ +From b5a9f9292e6dac07c1f4f7cc4dc82df1f07a7fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 20:09:14 +0800 +Subject: perf session: Add swap operation for event TIME_CONV + +From: Leo Yan + +[ Upstream commit 050ffc449008eeeafc187dec337d9cf1518f89bc ] + +Since commit d110162cafc8 ("perf tsc: Support cap_user_time_short for +event TIME_CONV"), the event PERF_RECORD_TIME_CONV has extended the data +structure for clock parameters. + +To be backwards-compatible, this patch adds a dedicated swap operation +for the event PERF_RECORD_TIME_CONV, based on checking if the event +contains field "time_cycles", it can support both for the old and new +event formats. + +Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV") +Signed-off-by: Leo Yan +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Gustavo A. R. Silva +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Steve MacLean +Cc: Yonatan Goldschmidt +Link: https://lore.kernel.org/r/20210428120915.7123-4-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 22098fffac4f..63b619084b34 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -945,6 +945,19 @@ static void perf_event__stat_round_swap(union perf_event *event, + event->stat_round.time = bswap_64(event->stat_round.time); + } + ++static void perf_event__time_conv_swap(union perf_event *event, ++ bool sample_id_all __maybe_unused) ++{ ++ event->time_conv.time_shift = bswap_64(event->time_conv.time_shift); ++ event->time_conv.time_mult = bswap_64(event->time_conv.time_mult); ++ event->time_conv.time_zero = bswap_64(event->time_conv.time_zero); ++ ++ if (event_contains(event->time_conv, time_cycles)) { ++ event->time_conv.time_cycles = bswap_64(event->time_conv.time_cycles); ++ event->time_conv.time_mask = bswap_64(event->time_conv.time_mask); ++ } ++} ++ + typedef void (*perf_event__swap_op)(union perf_event *event, + bool sample_id_all); + +@@ -981,7 +994,7 @@ static perf_event__swap_op perf_event__swap_ops[] = { + [PERF_RECORD_STAT] = perf_event__stat_swap, + [PERF_RECORD_STAT_ROUND] = perf_event__stat_round_swap, + [PERF_RECORD_EVENT_UPDATE] = perf_event__event_update_swap, +- [PERF_RECORD_TIME_CONV] = perf_event__all64_swap, ++ [PERF_RECORD_TIME_CONV] = perf_event__time_conv_swap, + [PERF_RECORD_HEADER_MAX] = NULL, + }; + +-- +2.30.2 + diff --git a/queue-5.10/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch b/queue-5.10/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch new file mode 100644 index 00000000000..49f704c76b2 --- /dev/null +++ b/queue-5.10/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch @@ -0,0 +1,44 @@ +From fac1699d123dcdec0262239e6a8acd17aafef0f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 11:17:51 -0300 +Subject: perf symbols: Fix dso__fprintf_symbols_by_name() to return the number + of printed chars + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 210e4c89ef61432040c6cd828fefa441f4887186 ] + +The 'ret' variable was initialized to zero but then it was not updated +from the fprintf() return, fix it. + +Reported-by: Yang Li +cc: Alexander Shishkin +cc: Ingo Molnar +cc: Jiri Olsa +cc: Mark Rutland +cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Srikar Dronamraju +Fixes: 90f18e63fbd00513 ("perf symbols: List symbols in a dso in ascending name order") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol_fprintf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c +index 35c936ce33ef..2664fb65e47a 100644 +--- a/tools/perf/util/symbol_fprintf.c ++++ b/tools/perf/util/symbol_fprintf.c +@@ -68,7 +68,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso, + + for (nd = rb_first_cached(&dso->symbol_names); nd; nd = rb_next(nd)) { + pos = rb_entry(nd, struct symbol_name_rb_node, rb_node); +- fprintf(fp, "%s\n", pos->sym.name); ++ ret += fprintf(fp, "%s\n", pos->sym.name); + } + + return ret; +-- +2.30.2 + diff --git a/queue-5.10/perf-tools-change-fields-type-in-perf_record_time_co.patch b/queue-5.10/perf-tools-change-fields-type-in-perf_record_time_co.patch new file mode 100644 index 00000000000..979f5553637 --- /dev/null +++ b/queue-5.10/perf-tools-change-fields-type-in-perf_record_time_co.patch @@ -0,0 +1,58 @@ +From 20d374333cf984cded03b5241abc3e0b43f77d15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 20:09:12 +0800 +Subject: perf tools: Change fields type in perf_record_time_conv + +From: Leo Yan + +[ Upstream commit e1d380ea8b00db4bb14d1f513000d4b62aa9d3f0 ] + +C standard claims "An object declared as type _Bool is large enough to +store the values 0 and 1", bool type size can be 1 byte or larger than +1 byte. Thus it's uncertian for bool type size with different +compilers. + +This patch changes the bool type in structure perf_record_time_conv to +__u8 type, and pads extra bytes for 8-byte alignment; this can give +reliable structure size. + +Fixes: d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV") +Suggested-by: Adrian Hunter +Signed-off-by: Leo Yan +Acked-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Gustavo A. R. Silva +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Steve MacLean +Cc: Yonatan Goldschmidt +Link: https://lore.kernel.org/r/20210428120915.7123-2-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/include/perf/event.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index 988c539bedb6..baf64ea74e10 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -336,8 +336,9 @@ struct perf_record_time_conv { + __u64 time_zero; + __u64 time_cycles; + __u64 time_mask; +- bool cap_user_time_zero; +- bool cap_user_time_short; ++ __u8 cap_user_time_zero; ++ __u8 cap_user_time_short; ++ __u8 reserved[6]; /* For alignment */ + }; + + struct perf_record_header_feature { +-- +2.30.2 + diff --git a/queue-5.10/perf-vendor-events-amd-fix-broken-l2-cache-hits-from.patch b/queue-5.10/perf-vendor-events-amd-fix-broken-l2-cache-hits-from.patch new file mode 100644 index 00000000000..d07cde96596 --- /dev/null +++ b/queue-5.10/perf-vendor-events-amd-fix-broken-l2-cache-hits-from.patch @@ -0,0 +1,166 @@ +From 4e096c914d4c7b1bc1ce312a1bb37adfb39216ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 16:59:41 -0500 +Subject: perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Smita Koralahalli + +[ Upstream commit 86c2bc3da769124e3e856b6e9457be3667c30919 ] + +Commit 08ed77e414ab2342 ("perf vendor events amd: Add recommended events") +added the hits event "L2 Cache Hits from L2 HWPF" with the same metric +expression as the accesses event "L2 Cache Accesses from L2 HWPF": + +$ perf list --details +... + l2_cache_accesses_from_l2_hwpf + [L2 Cache Accesses from L2 HWPF] + [l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3] + l2_cache_hits_from_l2_hwpf + [L2 Cache Hits from L2 HWPF] + [l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3] +... + +This was wrong and led to counting hits the same as accesses. Section +2.1.15.2 "Performance Measurement" of "PPR for AMD Family 17h Model 31h +B0 - 55803 Rev 0.54 - Sep 12, 2019", documents the hits event with +EventCode 0x70 which is the same as l2_pf_hit_l2. + +Fix this, and massage the description for l2_pf_hit_l2 as the hits event +is now the duplicate of l2_pf_hit_l2. AMD recommends using the recommended +event over other events if the duplicate exists and maintain both for +consistency. Hence, l2_cache_hits_from_l2_hwpf should override +l2_pf_hit_l2. + +Before: + + # perf stat -M l2_cache_accesses_from_l2_hwpf,l2_cache_hits_from_l2_hwpf sleep 1 + + Performance counter stats for 'sleep 1': + + 1,436 l2_pf_miss_l2_l3 # 11114.00 l2_cache_accesses_from_l2_hwpf + # 11114.00 l2_cache_hits_from_l2_hwpf + 4,482 l2_pf_hit_l2 + 5,196 l2_pf_miss_l2_hit_l3 + + 1.001765339 seconds time elapsed + +After: + + # perf stat -M l2_cache_accesses_from_l2_hwpf sleep 1 + + Performance counter stats for 'sleep 1': + + 1,477 l2_pf_miss_l2_l3 # 10442.00 l2_cache_accesses_from_l2_hwpf + 3,978 l2_pf_hit_l2 + 4,987 l2_pf_miss_l2_hit_l3 + + 1.001491186 seconds time elapsed + + # perf stat -e l2_cache_hits_from_l2_hwpf sleep 1 + + Performance counter stats for 'sleep 1': + + 3,983 l2_cache_hits_from_l2_hwpf + + 1.001329970 seconds time elapsed + +Note the difference in performance counter values for the accesses +versus the hits after the fix, and the hits event now counting the same +as l2_pf_hit_l2. + +Fixes: 08ed77e414ab ("perf vendor events amd: Add recommended events") +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206537 +Reviewed-by: Robert Richter +Signed-off-by: Smita Koralahalli +Tested-by: Arnaldo Carvalho de Melo # On a 3900X +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kim Phillips +Cc: Mark Rutland +Cc: Martin LiÅ¡ka +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Vijay Thakkar +Cc: linux-perf-users@vger.kernel.org +Link: https://lore.kernel.org/r/20210406215944.113332-2-Smita.KoralahalliChannabasappa@amd.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/arch/x86/amdzen1/cache.json | 2 +- + tools/perf/pmu-events/arch/x86/amdzen1/recommended.json | 6 +++--- + tools/perf/pmu-events/arch/x86/amdzen2/cache.json | 2 +- + tools/perf/pmu-events/arch/x86/amdzen2/recommended.json | 6 +++--- + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/pmu-events/arch/x86/amdzen1/cache.json b/tools/perf/pmu-events/arch/x86/amdzen1/cache.json +index 4ea7ec4f496e..008f1683e540 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen1/cache.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen1/cache.json +@@ -275,7 +275,7 @@ + { + "EventName": "l2_pf_hit_l2", + "EventCode": "0x70", +- "BriefDescription": "L2 prefetch hit in L2.", ++ "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.", + "UMask": "0xff" + }, + { +diff --git a/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json b/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json +index 2cfe2d2f3bfd..3c954543d1ae 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen1/recommended.json +@@ -79,10 +79,10 @@ + "UMask": "0x70" + }, + { +- "MetricName": "l2_cache_hits_from_l2_hwpf", ++ "EventName": "l2_cache_hits_from_l2_hwpf", ++ "EventCode": "0x70", + "BriefDescription": "L2 Cache Hits from L2 HWPF", +- "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3", +- "MetricGroup": "l2_cache" ++ "UMask": "0xff" + }, + { + "EventName": "l3_accesses", +diff --git a/tools/perf/pmu-events/arch/x86/amdzen2/cache.json b/tools/perf/pmu-events/arch/x86/amdzen2/cache.json +index f61b982f83ca..8ba84a48188d 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen2/cache.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen2/cache.json +@@ -205,7 +205,7 @@ + { + "EventName": "l2_pf_hit_l2", + "EventCode": "0x70", +- "BriefDescription": "L2 prefetch hit in L2.", ++ "BriefDescription": "L2 prefetch hit in L2. Use l2_cache_hits_from_l2_hwpf instead.", + "UMask": "0xff" + }, + { +diff --git a/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json b/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json +index 2ef91e25e661..1c624cee9ef4 100644 +--- a/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json ++++ b/tools/perf/pmu-events/arch/x86/amdzen2/recommended.json +@@ -79,10 +79,10 @@ + "UMask": "0x70" + }, + { +- "MetricName": "l2_cache_hits_from_l2_hwpf", ++ "EventName": "l2_cache_hits_from_l2_hwpf", ++ "EventCode": "0x70", + "BriefDescription": "L2 Cache Hits from L2 HWPF", +- "MetricExpr": "l2_pf_hit_l2 + l2_pf_miss_l2_hit_l3 + l2_pf_miss_l2_l3", +- "MetricGroup": "l2_cache" ++ "UMask": "0xff" + }, + { + "EventName": "l3_accesses", +-- +2.30.2 + diff --git a/queue-5.10/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch b/queue-5.10/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch new file mode 100644 index 00000000000..bf82f14ad66 --- /dev/null +++ b/queue-5.10/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch @@ -0,0 +1,41 @@ +From a4753da6381e581fd20fd31f000bf81f314511d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 16:02:52 +0100 +Subject: phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, + unconditionally + +From: Geert Uytterhoeven + +[ Upstream commit 6cb17707aad869de163d7bf42c253caf501be4e2 ] + +Merely enabling CONFIG_COMPILE_TEST should not enable additional code. +To fix this, restrict the automatic enabling of ARMADA375_USBCLUSTER_PHY +to MACH_ARMADA_375, and ask the user in case of compile-testing. + +Fixes: eee47538ec1f2619 ("phy: add support for USB cluster on the Armada 375 SoC") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20210208150252.424706-1-geert+renesas@glider.be +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/marvell/Kconfig b/drivers/phy/marvell/Kconfig +index 8f6273c837ec..8ab9031c9894 100644 +--- a/drivers/phy/marvell/Kconfig ++++ b/drivers/phy/marvell/Kconfig +@@ -3,8 +3,8 @@ + # Phy drivers for Marvell platforms + # + config ARMADA375_USBCLUSTER_PHY +- def_bool y +- depends on MACH_ARMADA_375 || COMPILE_TEST ++ bool "Armada 375 USB cluster PHY support" if COMPILE_TEST ++ default y if MACH_ARMADA_375 + depends on OF && HAS_IOMEM + select GENERIC_PHY + +-- +2.30.2 + diff --git a/queue-5.10/phy-ti-j721e-wiz-delete-clk_div_sel-clk-provider-dur.patch b/queue-5.10/phy-ti-j721e-wiz-delete-clk_div_sel-clk-provider-dur.patch new file mode 100644 index 00000000000..aadf462c86c --- /dev/null +++ b/queue-5.10/phy-ti-j721e-wiz-delete-clk_div_sel-clk-provider-dur.patch @@ -0,0 +1,43 @@ +From cac0b51695190bbdf4fa69c5ca70120743455e03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 17:38:36 +0530 +Subject: phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup + +From: Kishon Vijay Abraham I + +[ Upstream commit 7e52a39f1942b771213678c56002ce90a2f126d2 ] + +commit 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module +present in TI J721E SoC") modeled both MUX clocks and DIVIDER clocks in +wiz. However during cleanup, it removed only the MUX clock provider. +Remove the DIVIDER clock provider here. + +Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC") +Signed-off-by: Kishon Vijay Abraham I +Link: https://lore.kernel.org/r/20210310120840.16447-3-kishon@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-j721e-wiz.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +index a75433b459dd..e28e25f98708 100644 +--- a/drivers/phy/ti/phy-j721e-wiz.c ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -615,6 +615,12 @@ static void wiz_clock_cleanup(struct wiz *wiz, struct device_node *node) + of_clk_del_provider(clk_node); + of_node_put(clk_node); + } ++ ++ for (i = 0; i < wiz->clk_div_sel_num; i++) { ++ clk_node = of_get_child_by_name(node, clk_div_sel[i].node_name); ++ of_clk_del_provider(clk_node); ++ of_node_put(clk_node); ++ } + } + + static int wiz_clock_init(struct wiz *wiz, struct device_node *node) +-- +2.30.2 + diff --git a/queue-5.10/pinctrl-pinctrl-single-fix-pcs_pin_dbg_show-when-bit.patch b/queue-5.10/pinctrl-pinctrl-single-fix-pcs_pin_dbg_show-when-bit.patch new file mode 100644 index 00000000000..923f9954577 --- /dev/null +++ b/queue-5.10/pinctrl-pinctrl-single-fix-pcs_pin_dbg_show-when-bit.patch @@ -0,0 +1,144 @@ +From a34e8de7ffd3f0d87da4b8919b5ebe6f700af2d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 17:21:33 +0200 +Subject: pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is + not zero + +From: Hanna Hawa + +[ Upstream commit bd85125ea88513f637a62a72e8949c579c5c0a87 ] + +A System Error (SError, followed by kernel panic) was detected when +trying to print the supported pins in a pinctrl device which supports +multiple pins per register. This change fixes the pcs_pin_dbg_show() in +pinctrl-single driver when bits_per_mux is not zero. In addition move +offset calculation and pin offset in register to common function. + +Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules") +Signed-off-by: Hanna Hawa +Reviewed-by: Andy Shevchenko +Reviewed-by: Tony Lindgren +Reviewed-by: Drew Fustini +Link: https://lore.kernel.org/r/20210319152133.28705-4-hhhawa@amazon.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 55 ++++++++++++++++++++------------ + 1 file changed, 35 insertions(+), 20 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 539543898c89..12cc4eb18637 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -270,20 +270,44 @@ static void __maybe_unused pcs_writel(unsigned val, void __iomem *reg) + writel(val, reg); + } + ++static unsigned int pcs_pin_reg_offset_get(struct pcs_device *pcs, ++ unsigned int pin) ++{ ++ unsigned int mux_bytes = pcs->width / BITS_PER_BYTE; ++ ++ if (pcs->bits_per_mux) { ++ unsigned int pin_offset_bytes; ++ ++ pin_offset_bytes = (pcs->bits_per_pin * pin) / BITS_PER_BYTE; ++ return (pin_offset_bytes / mux_bytes) * mux_bytes; ++ } ++ ++ return pin * mux_bytes; ++} ++ ++static unsigned int pcs_pin_shift_reg_get(struct pcs_device *pcs, ++ unsigned int pin) ++{ ++ return (pin % (pcs->width / pcs->bits_per_pin)) * pcs->bits_per_pin; ++} ++ + static void pcs_pin_dbg_show(struct pinctrl_dev *pctldev, + struct seq_file *s, + unsigned pin) + { + struct pcs_device *pcs; +- unsigned val, mux_bytes; ++ unsigned int val; + unsigned long offset; + size_t pa; + + pcs = pinctrl_dev_get_drvdata(pctldev); + +- mux_bytes = pcs->width / BITS_PER_BYTE; +- offset = pin * mux_bytes; ++ offset = pcs_pin_reg_offset_get(pcs, pin); + val = pcs->read(pcs->base + offset); ++ ++ if (pcs->bits_per_mux) ++ val &= pcs->fmask << pcs_pin_shift_reg_get(pcs, pin); ++ + pa = pcs->res->start + offset; + + seq_printf(s, "%zx %08x %s ", pa, val, DRIVER_NAME); +@@ -384,7 +408,6 @@ static int pcs_request_gpio(struct pinctrl_dev *pctldev, + struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev); + struct pcs_gpiofunc_range *frange = NULL; + struct list_head *pos, *tmp; +- int mux_bytes = 0; + unsigned data; + + /* If function mask is null, return directly. */ +@@ -392,29 +415,27 @@ static int pcs_request_gpio(struct pinctrl_dev *pctldev, + return -ENOTSUPP; + + list_for_each_safe(pos, tmp, &pcs->gpiofuncs) { ++ u32 offset; ++ + frange = list_entry(pos, struct pcs_gpiofunc_range, node); + if (pin >= frange->offset + frange->npins + || pin < frange->offset) + continue; +- mux_bytes = pcs->width / BITS_PER_BYTE; + +- if (pcs->bits_per_mux) { +- int byte_num, offset, pin_shift; ++ offset = pcs_pin_reg_offset_get(pcs, pin); + +- byte_num = (pcs->bits_per_pin * pin) / BITS_PER_BYTE; +- offset = (byte_num / mux_bytes) * mux_bytes; +- pin_shift = pin % (pcs->width / pcs->bits_per_pin) * +- pcs->bits_per_pin; ++ if (pcs->bits_per_mux) { ++ int pin_shift = pcs_pin_shift_reg_get(pcs, pin); + + data = pcs->read(pcs->base + offset); + data &= ~(pcs->fmask << pin_shift); + data |= frange->gpiofunc << pin_shift; + pcs->write(data, pcs->base + offset); + } else { +- data = pcs->read(pcs->base + pin * mux_bytes); ++ data = pcs->read(pcs->base + offset); + data &= ~pcs->fmask; + data |= frange->gpiofunc; +- pcs->write(data, pcs->base + pin * mux_bytes); ++ pcs->write(data, pcs->base + offset); + } + break; + } +@@ -726,14 +747,8 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs) + for (i = 0; i < pcs->desc.npins; i++) { + unsigned offset; + int res; +- int byte_num; + +- if (pcs->bits_per_mux) { +- byte_num = (pcs->bits_per_pin * i) / BITS_PER_BYTE; +- offset = (byte_num / mux_bytes) * mux_bytes; +- } else { +- offset = i * mux_bytes; +- } ++ offset = pcs_pin_reg_offset_get(pcs, i); + res = pcs_add_pin(pcs, offset); + if (res < 0) { + dev_err(pcs->dev, "error adding pins: %i\n", res); +-- +2.30.2 + diff --git a/queue-5.10/pinctrl-pinctrl-single-remove-unused-parameter.patch b/queue-5.10/pinctrl-pinctrl-single-remove-unused-parameter.patch new file mode 100644 index 00000000000..d1860588bce --- /dev/null +++ b/queue-5.10/pinctrl-pinctrl-single-remove-unused-parameter.patch @@ -0,0 +1,58 @@ +From d3b57fb2009744a096e4450bc076185f5fe4718a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 17:21:32 +0200 +Subject: pinctrl: pinctrl-single: remove unused parameter + +From: Hanna Hawa + +[ Upstream commit 8fa2ea202b13b6da81e26c399ff1d87488398453 ] + +Remove unused parameter 'pin_pos' from pcs_add_pin(). + +Signed-off-by: Hanna Hawa +Reviewed-by: Tony Lindgren +Reviewed-by: Drew Fustini +Link: https://lore.kernel.org/r/20210319152133.28705-3-hhhawa@amazon.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index f3cd7e296712..539543898c89 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -656,10 +656,8 @@ static const struct pinconf_ops pcs_pinconf_ops = { + * pcs_add_pin() - add a pin to the static per controller pin array + * @pcs: pcs driver instance + * @offset: register offset from base +- * @pin_pos: unused + */ +-static int pcs_add_pin(struct pcs_device *pcs, unsigned offset, +- unsigned pin_pos) ++static int pcs_add_pin(struct pcs_device *pcs, unsigned int offset) + { + struct pcs_soc_data *pcs_soc = &pcs->socdata; + struct pinctrl_pin_desc *pin; +@@ -729,16 +727,14 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs) + unsigned offset; + int res; + int byte_num; +- int pin_pos = 0; + + if (pcs->bits_per_mux) { + byte_num = (pcs->bits_per_pin * i) / BITS_PER_BYTE; + offset = (byte_num / mux_bytes) * mux_bytes; +- pin_pos = i % num_pins_in_register; + } else { + offset = i * mux_bytes; + } +- res = pcs_add_pin(pcs, offset, pin_pos); ++ res = pcs_add_pin(pcs, offset); + if (res < 0) { + dev_err(pcs->dev, "error adding pins: %i\n", res); + return res; +-- +2.30.2 + diff --git a/queue-5.10/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch b/queue-5.10/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch new file mode 100644 index 00000000000..8ae9d8c0562 --- /dev/null +++ b/queue-5.10/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch @@ -0,0 +1,74 @@ +From 4725e1640f9001ed5acea8ac94229407176c3da6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 15:30:06 +0200 +Subject: platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards + with critclk_systems DMI table + +From: Steffen Dirkwinkel + +[ Upstream commit d21e5abd3a005253eb033090aab2e43bce090d89 ] + +pmc_plt_clk* clocks are used for ethernet controllers, so need to stay +turned on. This adds the affected board family to critclk_systems DMI +table, so the clocks are marked as CLK_CRITICAL and not turned off. + +This replaces the previously listed boards with a match for the whole +device family CBxx63. CBxx63 matches only baytrail devices. +There are new affected boards that would otherwise need to be listed. +There are unaffected boards in the family, but having the clocks +turned on is not an issue. + +Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") +Reviewed-by: Andy Shevchenko +Signed-off-by: Steffen Dirkwinkel +Link: https://lore.kernel.org/r/20210412133006.397679-1-linux-kernel-dev@beckhoff.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/pmc_atom.c | 28 ++-------------------------- + 1 file changed, 2 insertions(+), 26 deletions(-) + +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index ca684ed760d1..a9d2a4b98e57 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -393,34 +393,10 @@ static const struct dmi_system_id critclk_systems[] = { + }, + { + /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB3163", ++ .ident = "Beckhoff Baytrail", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB3163"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB4063", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB4063"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB6263", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB6263"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB6363", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB6363"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"), + }, + }, + { +-- +2.30.2 + diff --git a/queue-5.10/pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch b/queue-5.10/pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch new file mode 100644 index 00000000000..1909d0b26eb --- /dev/null +++ b/queue-5.10/pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch @@ -0,0 +1,36 @@ +From d1b3bc0dafeb7941ac5f1afeb687ea40d3dd7de6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 15:20:08 +0800 +Subject: PM / devfreq: Use more accurate returned new_freq as resume_freq + +From: Dong Aisheng + +[ Upstream commit 62453f1ba5d5def9d58e140a50f3f168f028da38 ] + +Use the more accurate returned new_freq as resume_freq. +It's the same as how devfreq->previous_freq was updated. + +Fixes: 83f8ca45afbf0 ("PM / devfreq: add support for suspend/resume of a devfreq device") +Signed-off-by: Dong Aisheng +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/devfreq/devfreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 1db04cbcf227..98f03a02d112 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -377,7 +377,7 @@ static int devfreq_set_target(struct devfreq *devfreq, unsigned long new_freq, + devfreq->previous_freq = new_freq; + + if (devfreq->suspend_freq) +- devfreq->resume_freq = cur_freq; ++ devfreq->resume_freq = new_freq; + + return err; + } +-- +2.30.2 + diff --git a/queue-5.10/pm-hibernate-x86-use-crc32-instead-of-md5-for-hibern.patch b/queue-5.10/pm-hibernate-x86-use-crc32-instead-of-md5-for-hibern.patch new file mode 100644 index 00000000000..ca2f8ad2079 --- /dev/null +++ b/queue-5.10/pm-hibernate-x86-use-crc32-instead-of-md5-for-hibern.patch @@ -0,0 +1,192 @@ +From a4f3a443f7154a524128f8fd31130be0aa69d829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 08:57:39 -0400 +Subject: PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 + integrity check + +From: Chris von Recklinghausen + +[ Upstream commit f5d1499ae2096d7ea301023c4cc54e427300eb0a ] + +Hibernation fails on a system in fips mode because md5 is used for the e820 +integrity check and is not available. Use crc32 instead. + +The check is intended to detect whether the E820 memory map provided +by the firmware after cold boot unexpectedly differs from the one that +was in use when the hibernation image was created. In this case, the +hibernation image cannot be restored, as it may cover memory regions +that are no longer available to the OS. + +A non-cryptographic checksum such as CRC-32 is sufficient to detect such +inadvertent deviations. + +Fixes: 62a03defeabd ("PM / hibernate: Verify the consistent of e820 memory map by md5 digest") +Reviewed-by: Eric Biggers +Tested-by: Dexuan Cui +Reviewed-by: Dexuan Cui +Signed-off-by: Chris von Recklinghausen +[ rjw: Subject edit ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/e820.c | 4 +- + arch/x86/power/hibernate.c | 89 ++++++-------------------------------- + 2 files changed, 16 insertions(+), 77 deletions(-) + +diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c +index 22aad412f965..629c4994f165 100644 +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -31,8 +31,8 @@ + * - inform the user about the firmware's notion of memory layout + * via /sys/firmware/memmap + * +- * - the hibernation code uses it to generate a kernel-independent MD5 +- * fingerprint of the physical memory layout of a system. ++ * - the hibernation code uses it to generate a kernel-independent CRC32 ++ * checksum of the physical memory layout of a system. + * + * - 'e820_table_kexec': a slightly modified (by the kernel) firmware version + * passed to us by the bootloader - the major difference between +diff --git a/arch/x86/power/hibernate.c b/arch/x86/power/hibernate.c +index cd3914fc9f3d..e94e0050a583 100644 +--- a/arch/x86/power/hibernate.c ++++ b/arch/x86/power/hibernate.c +@@ -13,8 +13,8 @@ + #include + #include + #include +- +-#include ++#include ++#include + + #include + #include +@@ -54,95 +54,33 @@ int pfn_is_nosave(unsigned long pfn) + return pfn >= nosave_begin_pfn && pfn < nosave_end_pfn; + } + +- +-#define MD5_DIGEST_SIZE 16 +- + struct restore_data_record { + unsigned long jump_address; + unsigned long jump_address_phys; + unsigned long cr3; + unsigned long magic; +- u8 e820_digest[MD5_DIGEST_SIZE]; ++ unsigned long e820_checksum; + }; + +-#if IS_BUILTIN(CONFIG_CRYPTO_MD5) + /** +- * get_e820_md5 - calculate md5 according to given e820 table ++ * compute_e820_crc32 - calculate crc32 of a given e820 table + * + * @table: the e820 table to be calculated +- * @buf: the md5 result to be stored to ++ * ++ * Return: the resulting checksum + */ +-static int get_e820_md5(struct e820_table *table, void *buf) ++static inline u32 compute_e820_crc32(struct e820_table *table) + { +- struct crypto_shash *tfm; +- struct shash_desc *desc; +- int size; +- int ret = 0; +- +- tfm = crypto_alloc_shash("md5", 0, 0); +- if (IS_ERR(tfm)) +- return -ENOMEM; +- +- desc = kmalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm), +- GFP_KERNEL); +- if (!desc) { +- ret = -ENOMEM; +- goto free_tfm; +- } +- +- desc->tfm = tfm; +- +- size = offsetof(struct e820_table, entries) + ++ int size = offsetof(struct e820_table, entries) + + sizeof(struct e820_entry) * table->nr_entries; + +- if (crypto_shash_digest(desc, (u8 *)table, size, buf)) +- ret = -EINVAL; +- +- kfree_sensitive(desc); +- +-free_tfm: +- crypto_free_shash(tfm); +- return ret; +-} +- +-static int hibernation_e820_save(void *buf) +-{ +- return get_e820_md5(e820_table_firmware, buf); +-} +- +-static bool hibernation_e820_mismatch(void *buf) +-{ +- int ret; +- u8 result[MD5_DIGEST_SIZE]; +- +- memset(result, 0, MD5_DIGEST_SIZE); +- /* If there is no digest in suspend kernel, let it go. */ +- if (!memcmp(result, buf, MD5_DIGEST_SIZE)) +- return false; +- +- ret = get_e820_md5(e820_table_firmware, result); +- if (ret) +- return true; +- +- return memcmp(result, buf, MD5_DIGEST_SIZE) ? true : false; +-} +-#else +-static int hibernation_e820_save(void *buf) +-{ +- return 0; +-} +- +-static bool hibernation_e820_mismatch(void *buf) +-{ +- /* If md5 is not builtin for restore kernel, let it go. */ +- return false; ++ return ~crc32_le(~0, (unsigned char const *)table, size); + } +-#endif + + #ifdef CONFIG_X86_64 +-#define RESTORE_MAGIC 0x23456789ABCDEF01UL ++#define RESTORE_MAGIC 0x23456789ABCDEF02UL + #else +-#define RESTORE_MAGIC 0x12345678UL ++#define RESTORE_MAGIC 0x12345679UL + #endif + + /** +@@ -179,7 +117,8 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size) + */ + rdr->cr3 = restore_cr3 & ~CR3_PCID_MASK; + +- return hibernation_e820_save(rdr->e820_digest); ++ rdr->e820_checksum = compute_e820_crc32(e820_table_firmware); ++ return 0; + } + + /** +@@ -200,7 +139,7 @@ int arch_hibernation_header_restore(void *addr) + jump_address_phys = rdr->jump_address_phys; + restore_cr3 = rdr->cr3; + +- if (hibernation_e820_mismatch(rdr->e820_digest)) { ++ if (rdr->e820_checksum != compute_e820_crc32(e820_table_firmware)) { + pr_crit("Hibernate inconsistent memory map detected!\n"); + return -ENODEV; + } +-- +2.30.2 + diff --git a/queue-5.10/pm-runtime-replace-inline-function-pm_runtime_callba.patch b/queue-5.10/pm-runtime-replace-inline-function-pm_runtime_callba.patch new file mode 100644 index 00000000000..5c1e0b53f94 --- /dev/null +++ b/queue-5.10/pm-runtime-replace-inline-function-pm_runtime_callba.patch @@ -0,0 +1,36 @@ +From d3e8dbc62133dd972ba07bd2434ce2c5c899141f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 14:14:22 +0800 +Subject: PM: runtime: Replace inline function pm_runtime_callbacks_present() + +From: YueHaibing + +[ Upstream commit 953c1fd96b1a70bcbbfb10973c2126eba8d891c7 ] + +Commit 9a7875461fd0 ("PM: runtime: Replace pm_runtime_callbacks_present()") +forgot to change the inline version. + +Fixes: 9a7875461fd0 ("PM: runtime: Replace pm_runtime_callbacks_present()") +Signed-off-by: YueHaibing +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/pm_runtime.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h +index b492ae00cc90..6c08a085367b 100644 +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -265,7 +265,7 @@ static inline void pm_runtime_no_callbacks(struct device *dev) {} + static inline void pm_runtime_irq_safe(struct device *dev) {} + static inline bool pm_runtime_is_irq_safe(struct device *dev) { return false; } + +-static inline bool pm_runtime_callbacks_present(struct device *dev) { return false; } ++static inline bool pm_runtime_has_no_callbacks(struct device *dev) { return false; } + static inline void pm_runtime_mark_last_busy(struct device *dev) {} + static inline void __pm_runtime_use_autosuspend(struct device *dev, + bool use) {} +-- +2.30.2 + diff --git a/queue-5.10/power-supply-bq25980-move-props-from-battery-node.patch b/queue-5.10/power-supply-bq25980-move-props-from-battery-node.patch new file mode 100644 index 00000000000..8575c663e53 --- /dev/null +++ b/queue-5.10/power-supply-bq25980-move-props-from-battery-node.patch @@ -0,0 +1,92 @@ +From 8bf9de4a00168f79196223bc9268101ba710395f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 16:56:46 -0600 +Subject: power: supply: bq25980: Move props from battery node + +From: Ricardo Rivera-Matos + +[ Upstream commit 04722cec1436c732d39153ce6ae2ebf71ac3ade7 ] + +Currently POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT and +POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE are exposed on +the battery node and this is incorrect. + +This patch exposes both of them on the charger node rather +than the battery node. + +Fixes: 5069185fc18e ("power: supply: bq25980: Add support for the BQ259xx family") +Signed-off-by: Ricardo Rivera-Matos +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq25980_charger.c | 40 ++++++++------------------ + 1 file changed, 12 insertions(+), 28 deletions(-) + +diff --git a/drivers/power/supply/bq25980_charger.c b/drivers/power/supply/bq25980_charger.c +index c936f311eb4f..b94ecf814e43 100644 +--- a/drivers/power/supply/bq25980_charger.c ++++ b/drivers/power/supply/bq25980_charger.c +@@ -606,33 +606,6 @@ static int bq25980_get_state(struct bq25980_device *bq, + return 0; + } + +-static int bq25980_set_battery_property(struct power_supply *psy, +- enum power_supply_property psp, +- const union power_supply_propval *val) +-{ +- struct bq25980_device *bq = power_supply_get_drvdata(psy); +- int ret = 0; +- +- switch (psp) { +- case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: +- ret = bq25980_set_const_charge_curr(bq, val->intval); +- if (ret) +- return ret; +- break; +- +- case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE: +- ret = bq25980_set_const_charge_volt(bq, val->intval); +- if (ret) +- return ret; +- break; +- +- default: +- return -EINVAL; +- } +- +- return ret; +-} +- + static int bq25980_get_battery_property(struct power_supply *psy, + enum power_supply_property psp, + union power_supply_propval *val) +@@ -701,6 +674,18 @@ static int bq25980_set_charger_property(struct power_supply *psy, + return ret; + break; + ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: ++ ret = bq25980_set_const_charge_curr(bq, val->intval); ++ if (ret) ++ return ret; ++ break; ++ ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE: ++ ret = bq25980_set_const_charge_volt(bq, val->intval); ++ if (ret) ++ return ret; ++ break; ++ + default: + return -EINVAL; + } +@@ -922,7 +907,6 @@ static struct power_supply_desc bq25980_battery_desc = { + .name = "bq25980-battery", + .type = POWER_SUPPLY_TYPE_BATTERY, + .get_property = bq25980_get_battery_property, +- .set_property = bq25980_set_battery_property, + .properties = bq25980_battery_props, + .num_properties = ARRAY_SIZE(bq25980_battery_props), + .property_is_writeable = bq25980_property_is_writeable, +-- +2.30.2 + diff --git a/queue-5.10/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch b/queue-5.10/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch new file mode 100644 index 00000000000..0ef17dc2c65 --- /dev/null +++ b/queue-5.10/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch @@ -0,0 +1,47 @@ +From cad257291a62af88069d9981c90090d36b429a4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 17:24:03 +0000 +Subject: powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of + 'add') + +From: Christophe Leroy + +[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ] + + AS arch/powerpc/platforms/52xx/lite5200_sleep.o +arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages: +arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression + +In the following code, 'addi' is wrong, has to be 'add' + + /* local udelay in sram is needed */ + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ + addi r12, r13, r12 /* end */ + +Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S +index 11475c58ea43..afee8b1515a8 100644 +--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S ++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S +@@ -181,7 +181,7 @@ sram_code: + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ +- addi r12, r13, r12 /* end */ ++ add r12, r13, r12 /* end */ + 1: + mftb r13 /* current */ + cmp cr0, r13, r12 +-- +2.30.2 + diff --git a/queue-5.10/powerpc-64-fix-the-definition-of-the-fixmap-area.patch b/queue-5.10/powerpc-64-fix-the-definition-of-the-fixmap-area.patch new file mode 100644 index 00000000000..88a6c823015 --- /dev/null +++ b/queue-5.10/powerpc-64-fix-the-definition-of-the-fixmap-area.patch @@ -0,0 +1,127 @@ +From 14399b8d8c23bf0e85fe3c0e0a8903fc0fd2c2cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 13:32:48 +0000 +Subject: powerpc/64: Fix the definition of the fixmap area + +From: Christophe Leroy + +[ Upstream commit 9ccba66d4d2aff9a3909aa77d57ea8b7cc166f3c ] + +At the time being, the fixmap area is defined at the top of +the address space or just below KASAN. + +This definition is not valid for PPC64. + +For PPC64, use the top of the I/O space. + +Because of circular dependencies, it is not possible to include +asm/fixmap.h in asm/book3s/64/pgtable.h , so define a fixed size +AREA at the top of the I/O space for fixmap and ensure during +build that the size is big enough. + +Fixes: 265c3491c4bc ("powerpc: Add support for GENERIC_EARLY_IOREMAP") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/0d51620eacf036d683d1a3c41328f69adb601dc0.1618925560.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +++- + arch/powerpc/include/asm/fixmap.h | 9 +++++++++ + arch/powerpc/include/asm/nohash/64/pgtable.h | 5 ++++- + 3 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h +index cd3feeac6e87..4a3dca0271f1 100644 +--- a/arch/powerpc/include/asm/book3s/64/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h +@@ -7,6 +7,7 @@ + #ifndef __ASSEMBLY__ + #include + #include ++#include + #endif + + /* +@@ -323,7 +324,8 @@ extern unsigned long pci_io_base; + #define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE) + #define IOREMAP_BASE (PHB_IO_END) + #define IOREMAP_START (ioremap_bot) +-#define IOREMAP_END (KERN_IO_END) ++#define IOREMAP_END (KERN_IO_END - FIXADDR_SIZE) ++#define FIXADDR_SIZE SZ_32M + + /* Advertise special mapping type for AGP */ + #define HAVE_PAGE_AGP +diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h +index 6bfc87915d5d..591b2f4deed5 100644 +--- a/arch/powerpc/include/asm/fixmap.h ++++ b/arch/powerpc/include/asm/fixmap.h +@@ -23,12 +23,17 @@ + #include + #endif + ++#ifdef CONFIG_PPC64 ++#define FIXADDR_TOP (IOREMAP_END + FIXADDR_SIZE) ++#else ++#define FIXADDR_SIZE 0 + #ifdef CONFIG_KASAN + #include + #define FIXADDR_TOP (KASAN_SHADOW_START - PAGE_SIZE) + #else + #define FIXADDR_TOP ((unsigned long)(-PAGE_SIZE)) + #endif ++#endif + + /* + * Here we define all the compile-time 'special' virtual +@@ -50,6 +55,7 @@ + */ + enum fixed_addresses { + FIX_HOLE, ++#ifdef CONFIG_PPC32 + /* reserve the top 128K for early debugging purposes */ + FIX_EARLY_DEBUG_TOP = FIX_HOLE, + FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+(ALIGN(SZ_128K, PAGE_SIZE)/PAGE_SIZE)-1, +@@ -72,6 +78,7 @@ enum fixed_addresses { + FIX_IMMR_SIZE, + #endif + /* FIX_PCIE_MCFG, */ ++#endif /* CONFIG_PPC32 */ + __end_of_permanent_fixed_addresses, + + #define NR_FIX_BTMAPS (SZ_256K / PAGE_SIZE) +@@ -98,6 +105,8 @@ enum fixed_addresses { + static inline void __set_fixmap(enum fixed_addresses idx, + phys_addr_t phys, pgprot_t flags) + { ++ BUILD_BUG_ON(IS_ENABLED(CONFIG_PPC64) && __FIXADDR_SIZE > FIXADDR_SIZE); ++ + if (__builtin_constant_p(idx)) + BUILD_BUG_ON(idx >= __end_of_fixed_addresses); + else if (WARN_ON(idx >= __end_of_fixed_addresses)) +diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h +index 6cb8aa357191..57cd3892bfe0 100644 +--- a/arch/powerpc/include/asm/nohash/64/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/64/pgtable.h +@@ -6,6 +6,8 @@ + * the ppc64 non-hashed page table. + */ + ++#include ++ + #include + #include + #include +@@ -54,7 +56,8 @@ + #define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE) + #define IOREMAP_BASE (PHB_IO_END) + #define IOREMAP_START (ioremap_bot) +-#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE) ++#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE - FIXADDR_SIZE) ++#define FIXADDR_SIZE SZ_32M + + + /* +-- +2.30.2 + diff --git a/queue-5.10/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch b/queue-5.10/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch new file mode 100644 index 00000000000..9bc28d9d010 --- /dev/null +++ b/queue-5.10/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch @@ -0,0 +1,148 @@ +From e91ba5891122a06755f5e7e29d86cdb37b72b46b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 14:29:56 +1100 +Subject: powerpc/64s: Fix pte update for kernel memory on radix + +From: Jordan Niethe + +[ Upstream commit b8b2f37cf632434456182e9002d63cbc4cccc50c ] + +When adding a PTE a ptesync is needed to order the update of the PTE +with subsequent accesses otherwise a spurious fault may be raised. + +radix__set_pte_at() does not do this for performance gains. For +non-kernel memory this is not an issue as any faults of this kind are +corrected by the page fault handler. For kernel memory these faults +are not handled. The current solution is that there is a ptesync in +flush_cache_vmap() which should be called when mapping from the +vmalloc region. + +However, map_kernel_page() does not call flush_cache_vmap(). This is +troublesome in particular for code patching with Strict RWX on radix. +In do_patch_instruction() the page frame that contains the instruction +to be patched is mapped and then immediately patched. With no ordering +or synchronization between setting up the PTE and writing to the page +it is possible for faults. + +As the code patching is done using __put_user_asm_goto() the resulting +fault is obscured - but using a normal store instead it can be seen: + + BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c + Faulting instruction address: 0xc00000000008bd74 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV + Modules linked in: nop_module(PO+) [last unloaded: nop_module] + CPU: 4 PID: 757 Comm: sh Tainted: P O 5.10.0-rc5-01361-ge3c1b78c8440-dirty #43 + NIP: c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810 + REGS: c000000016f634a0 TRAP: 0300 Tainted: P O (5.10.0-rc5-01361-ge3c1b78c8440-dirty) + MSR: 9000000000009033 CR: 44002884 XER: 00000000 + CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1 + +This results in the kind of issue reported here: + https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/ + +Chris Riedl suggested a reliable way to reproduce the issue: + $ mount -t debugfs none /sys/kernel/debug + $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) & + +Turning ftrace on and off does a large amount of code patching which +in usually less then 5min will crash giving a trace like: + + ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000) + ------------[ ftrace bug ]------------ + ftrace failed to modify + [] napi_busy_loop+0xc/0x390 + actual: 11:3b:47:4b + Setting ftrace call site to call ftrace function + ftrace record flags: 80000001 + (1) + expected tramp: c00000000006c96c + ------------[ cut here ]------------ + WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8 + Modules linked in: nop_module(PO-) [last unloaded: nop_module] + CPU: 4 PID: 809 Comm: sh Tainted: P O 5.10.0-rc5-01360-gf878ccaf250a #1 + NIP: c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0 + REGS: c000000004c8b760 TRAP: 0700 Tainted: P O (5.10.0-rc5-01360-gf878ccaf250a) + MSR: 900000000282b033 CR: 28008848 XER: 20040000 + CFAR: c0000000001a9c98 IRQMASK: 0 + GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022 + GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8 + GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118 + GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000 + GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008 + GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8 + GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020 + GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0 + NIP ftrace_bug+0x28c/0x2e8 + LR ftrace_bug+0x288/0x2e8 + Call Trace: + ftrace_bug+0x288/0x2e8 (unreliable) + ftrace_modify_all_code+0x168/0x210 + arch_ftrace_update_code+0x18/0x30 + ftrace_run_update_code+0x44/0xc0 + ftrace_startup+0xf8/0x1c0 + register_ftrace_function+0x4c/0xc0 + function_trace_init+0x80/0xb0 + tracing_set_tracer+0x2a4/0x4f0 + tracing_set_trace_write+0xd4/0x130 + vfs_write+0xf0/0x330 + ksys_write+0x84/0x140 + system_call_exception+0x14c/0x230 + system_call_common+0xf0/0x27c + +To fix this when updating kernel memory PTEs using ptesync. + +Fixes: f1cb8f9beba8 ("powerpc/64s/radix: avoid ptesync after set_pte and ptep_set_access_flags") +Signed-off-by: Jordan Niethe +Reviewed-by: Nicholas Piggin +[mpe: Tidy up change log slightly] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210208032957.1232102-1-jniethe5@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++-- + arch/powerpc/mm/book3s64/radix_pgtable.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h +index c7813dc628fc..59cab558e2f0 100644 +--- a/arch/powerpc/include/asm/book3s/64/radix.h ++++ b/arch/powerpc/include/asm/book3s/64/radix.h +@@ -222,8 +222,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr, + * from ptesync, it should probably go into update_mmu_cache, rather + * than set_pte_at (which is used to set ptes unrelated to faults). + * +- * Spurious faults to vmalloc region are not tolerated, so there is +- * a ptesync in flush_cache_vmap. ++ * Spurious faults from the kernel memory are not tolerated, so there ++ * is a ptesync in flush_cache_vmap, and __map_kernel_page() follows ++ * the pte update sequence from ISA Book III 6.10 Translation Table ++ * Update Synchronization Requirements. + */ + } + +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index 3adcf730f478..1d5eec847b88 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -108,7 +108,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa, + + set_the_pte: + set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags)); +- smp_wmb(); ++ asm volatile("ptesync": : :"memory"); + return 0; + } + +@@ -168,7 +168,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa, + + set_the_pte: + set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags)); +- smp_wmb(); ++ asm volatile("ptesync": : :"memory"); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch b/queue-5.10/powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch new file mode 100644 index 00000000000..3c74f7206f1 --- /dev/null +++ b/queue-5.10/powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch @@ -0,0 +1,56 @@ +From 35fab735662880c102f79eb9f92342a4f23a72d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 12:50:14 -0700 +Subject: powerpc/fadump: Mark fadump_calculate_reserve_size as __init + +From: Nathan Chancellor + +[ Upstream commit fbced1546eaaab57a32e56c974ea8acf10c6abd8 ] + +If fadump_calculate_reserve_size() is not inlined, there is a modpost +warning: + +WARNING: modpost: vmlinux.o(.text+0x5196c): Section mismatch in +reference from the function fadump_calculate_reserve_size() to the +function .init.text:parse_crashkernel() +The function fadump_calculate_reserve_size() references +the function __init parse_crashkernel(). +This is often because fadump_calculate_reserve_size lacks a __init +annotation or the annotation of parse_crashkernel is wrong. + +fadump_calculate_reserve_size() calls parse_crashkernel(), which is +marked as __init and fadump_calculate_reserve_size() is called from +within fadump_reserve_mem(), which is also marked as __init. + +Mark fadump_calculate_reserve_size() as __init to fix the section +mismatch. Additionally, remove the inline keyword as it is not necessary +to inline this function; the compiler is still free to do so if it feels +it is worthwhile since commit 889b3c1245de ("compiler: remove +CONFIG_OPTIMIZE_INLINING entirely"). + +Fixes: 11550dc0a00b ("powerpc/fadump: reuse crashkernel parameter for fadump memory reservation") +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://github.com/ClangBuiltLinux/linux/issues/1300 +Link: https://lore.kernel.org/r/20210302195013.2626335-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/fadump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 8482739d42f3..eddf362caedc 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -292,7 +292,7 @@ static void fadump_show_config(void) + * that is required for a kernel to boot successfully. + * + */ +-static inline u64 fadump_calculate_reserve_size(void) ++static __init u64 fadump_calculate_reserve_size(void) + { + u64 base, size, bootmem_min; + int ret; +-- +2.30.2 + diff --git a/queue-5.10/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch b/queue-5.10/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch new file mode 100644 index 00000000000..9d085e83cde --- /dev/null +++ b/queue-5.10/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch @@ -0,0 +1,54 @@ +From 024ed8a8f5b5ed4a7dbded2333c8f2c8f3c2aecc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 09:49:00 +0000 +Subject: powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen Huang + +[ Upstream commit 4fe529449d85e78972fa327999961ecc83a0b6db ] + +When compiling the powerpc with the SMP disabled, it shows the issue: + +arch/powerpc/kernel/watchdog.c: In function ‘watchdog_smp_panic’: +arch/powerpc/kernel/watchdog.c:177:4: error: implicit declaration of function ‘smp_send_nmi_ipi’; did you mean ‘smp_send_stop’? [-Werror=implicit-function-declaration] + 177 | smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000); + | ^~~~~~~~~~~~~~~~ + | smp_send_stop +cc1: all warnings being treated as errors +make[2]: *** [scripts/Makefile.build:273: arch/powerpc/kernel/watchdog.o] Error 1 +make[1]: *** [scripts/Makefile.build:534: arch/powerpc/kernel] Error 2 +make: *** [Makefile:1980: arch/powerpc] Error 2 +make: *** Waiting for unfinished jobs.... + +We found that powerpc used ipi to implement hardlockup watchdog, so the +HAVE_HARDLOCKUP_DETECTOR_ARCH should depend on the SMP. + +Fixes: 2104180a5369 ("powerpc/64s: implement arch-specific hardlockup watchdog") +Reported-by: Hulk Robot +Signed-off-by: Chen Huang +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210327094900.938555-1-chenhuang5@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 31ed8083571f..5afa0ebd78ca 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -222,7 +222,7 @@ config PPC + select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS + select HAVE_MOD_ARCH_SPECIFIC + select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S) +- select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S) ++ select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP + select HAVE_OPROFILE + select HAVE_OPTPROBES if PPC64 + select HAVE_PERF_EVENTS +-- +2.30.2 + diff --git a/queue-5.10/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch b/queue-5.10/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch new file mode 100644 index 00000000000..5f1ba782c04 --- /dev/null +++ b/queue-5.10/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch @@ -0,0 +1,44 @@ +From b036e9a75c99cccb234865b35bcfcbbe482ca789 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 12:26:23 -0700 +Subject: powerpc: iommu: fix build when neither PCI or IBMVIO is set + +From: Randy Dunlap + +[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ] + +When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a +build error. The fault injection code is not useful in that kernel config, +so make the FAIL_IOMMU option depend on PCI || IBMVIO. + +Prevents this build error (warning escalated to error): +../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable] + 178 | static struct notifier_block fail_iommu_bus_notifier = { + +Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection") +Reported-by: kernel test robot +Suggested-by: Michael Ellerman +Signed-off-by: Randy Dunlap +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index b88900f4832f..52abca88b5b2 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -352,6 +352,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR + config FAIL_IOMMU + bool "Fault-injection capability for IOMMU" + depends on FAULT_INJECTION ++ depends on PCI || IBMVIO + help + Provide fault-injection capability for IOMMU. Each device can + be selectively enabled via the fail_iommu property. +-- +2.30.2 + diff --git a/queue-5.10/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch b/queue-5.10/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch new file mode 100644 index 00000000000..cd83b738f5d --- /dev/null +++ b/queue-5.10/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch @@ -0,0 +1,66 @@ +From 30b90ef693124861b53e3a941aa5b50cb2d933fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 12:16:01 -0400 +Subject: powerpc/perf: Fix PMU constraint check for EBB events + +From: Athira Rajeev + +[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ] + +The power PMU group constraints includes check for EBB events to make +sure all events in a group must agree on EBB. This will prevent +scheduling EBB and non-EBB events together. But in the existing check, +settings for constraint mask and value is interchanged. Patch fixes the +same. + +Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with +below in dmesg logs. This happens because EBB event gets enabled along +with a non-EBB cpu event. + + [35600.453346] cpu_event_pinne[41326]: illegal instruction (4) + at 10004a18 nip 10004a18 lr 100049f8 code 1 in + cpu_event_pinned_vs_ebb_test[10000000+10000] + +Test results after the patch: + + $ ./pmu/ebb/cpu_event_pinned_vs_ebb_test + test: cpu_event_pinned_vs_ebb + tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty + Binding to cpu 8 + EBB Handler is at 0x100050c8 + read error on event 0x7fffe6bd4040! + PM_RUN_INST_CMPL: result 9872 running/enabled 37930432 + success: cpu_event_pinned_vs_ebb + +This bug was hidden by other logic until commit 1908dc911792 (perf: +Tweak perf_event_attr::exclusive semantics). + +Fixes: 4df489991182 ("powerpc/perf: Add power8 EBB support") +Reported-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Athira Rajeev +[mpe: Mention commit 1908dc911792] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1617725761-1464-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/isa207-common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index e1a21d34c6e4..5e8eedda45d3 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -400,8 +400,8 @@ ebb_bhrb: + * EBB events are pinned & exclusive, so this should never actually + * hit, but we leave it as a fallback in case. + */ +- mask |= CNST_EBB_VAL(ebb); +- value |= CNST_EBB_MASK; ++ mask |= CNST_EBB_MASK; ++ value |= CNST_EBB_VAL(ebb); + + *maskp = mask; + *valp = value; +-- +2.30.2 + diff --git a/queue-5.10/powerpc-perf-fix-the-threshold-event-selection-for-m.patch b/queue-5.10/powerpc-perf-fix-the-threshold-event-selection-for-m.patch new file mode 100644 index 00000000000..cff4e4a3544 --- /dev/null +++ b/queue-5.10/powerpc-perf-fix-the-threshold-event-selection-for-m.patch @@ -0,0 +1,41 @@ +From fc02e609507947dd9f4e6d4187355c0ee718fb2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 01:40:15 -0500 +Subject: powerpc/perf: Fix the threshold event selection for memory events in + power10 + +From: Athira Rajeev + +[ Upstream commit 66d9b7492887d34c711bc05b36c22438acba51b4 ] + +Memory events (mem-loads and mem-stores) currently use the threshold +event selection as issue to finish. Power10 supports issue to complete +as part of thresholding which is more appropriate for mem-loads and +mem-stores. Hence fix the event code for memory events to use issue +to complete. + +Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support") +Signed-off-by: Athira Rajeev +Reviewed-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1614840015-1535-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/power10-events-list.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/perf/power10-events-list.h b/arch/powerpc/perf/power10-events-list.h +index 60c1b8111082..e66487804a59 100644 +--- a/arch/powerpc/perf/power10-events-list.h ++++ b/arch/powerpc/perf/power10-events-list.h +@@ -66,5 +66,5 @@ EVENT(PM_RUN_INST_CMPL_ALT, 0x00002); + * thresh end (TE) + */ + +-EVENT(MEM_LOADS, 0x34340401e0); +-EVENT(MEM_STORES, 0x343c0401e0); ++EVENT(MEM_LOADS, 0x35340401e0); ++EVENT(MEM_STORES, 0x353c0401e0); +-- +2.30.2 + diff --git a/queue-5.10/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch b/queue-5.10/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch new file mode 100644 index 00000000000..524e973979b --- /dev/null +++ b/queue-5.10/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch @@ -0,0 +1,60 @@ +From b94f7d8224a3909029689d15d45747153ea0e8c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 13:08:29 -0700 +Subject: powerpc/prom: Mark identical_pvr_fixup as __init + +From: Nathan Chancellor + +[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ] + +If identical_pvr_fixup() is not inlined, there are two modpost warnings: + +WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:of_get_flat_dt_prop() +The function identical_pvr_fixup() references +the function __init of_get_flat_dt_prop(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of of_get_flat_dt_prop is wrong. + +WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:identify_cpu() +The function identical_pvr_fixup() references +the function __init identify_cpu(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of identify_cpu is wrong. + +identical_pvr_fixup() calls two functions marked as __init and is only +called by a function marked as __init so it should be marked as __init +as well. At the same time, remove the inline keywork as it is not +necessary to inline this function. The compiler is still free to do so +if it feels it is worthwhile since commit 889b3c1245de ("compiler: +remove CONFIG_OPTIMIZE_INLINING entirely"). + +Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround") +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://github.com/ClangBuiltLinux/linux/issues/1316 +Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index c1545f22c077..7a14a094be8a 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -268,7 +268,7 @@ static struct feature_property { + }; + + #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU) +-static inline void identical_pvr_fixup(unsigned long node) ++static __init void identical_pvr_fixup(unsigned long node) + { + unsigned int pvr; + const char *model = of_get_flat_dt_prop(node, "model", NULL); +-- +2.30.2 + diff --git a/queue-5.10/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch b/queue-5.10/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch new file mode 100644 index 00000000000..6deecdacc71 --- /dev/null +++ b/queue-5.10/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch @@ -0,0 +1,51 @@ +From 4fa7ed695b6326b2e7533d4ccaac60527975931c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 12:24:35 -0600 +Subject: powerpc/pseries: extract host bridge from pci_bus prior to bus + removal + +From: Tyrel Datwyler + +[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ] + +The pci_bus->bridge reference may no longer be valid after +pci_bus_remove() resulting in passing a bad value to device_unregister() +for the associated bridge device. + +Store the host_bridge reference in a separate variable prior to +pci_bus_remove(). + +Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal") +Signed-off-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c +index f9ae17e8a0f4..a8f9140a24fa 100644 +--- a/arch/powerpc/platforms/pseries/pci_dlpar.c ++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c +@@ -50,6 +50,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic); + int remove_phb_dynamic(struct pci_controller *phb) + { + struct pci_bus *b = phb->bus; ++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge); + struct resource *res; + int rc, i; + +@@ -76,7 +77,8 @@ int remove_phb_dynamic(struct pci_controller *phb) + /* Remove the PCI bus and unregister the bridge device from sysfs */ + phb->bus = NULL; + pci_remove_bus(b); +- device_unregister(b->bridge); ++ host_bridge->bus = NULL; ++ device_unregister(&host_bridge->dev); + + /* Now release the IO resource */ + if (res->flags & IORESOURCE_IO) +-- +2.30.2 + diff --git a/queue-5.10/powerpc-pseries-only-register-vio-drivers-if-vio-bus.patch b/queue-5.10/powerpc-pseries-only-register-vio-drivers-if-vio-bus.patch new file mode 100644 index 00000000000..2202750860f --- /dev/null +++ b/queue-5.10/powerpc-pseries-only-register-vio-drivers-if-vio-bus.patch @@ -0,0 +1,60 @@ +From e13beda1163306667e00871d0a4d5ab3ac722e76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 12:09:38 +1100 +Subject: powerpc/pseries: Only register vio drivers if vio bus exists + +From: Michael Ellerman + +[ Upstream commit 11d92156f7a862091009d7655d19c1e7de37fc7a ] + +The vio bus is a fake bus, which we use on pseries LPARs (guests) to +discover devices provided by the hypervisor. There's no need or sense +in creating the vio bus on bare metal systems. + +Which is why commit 4336b9337824 ("powerpc/pseries: Make vio and +ibmebus initcalls pseries specific") made the initialisation of the +vio bus only happen in LPARs. + +However as a result of that commit we now see errors at boot on bare +metal systems: + + Driver 'hvc_console' was unable to register with bus_type 'vio' because the bus was not initialized. + Driver 'tpm_ibmvtpm' was unable to register with bus_type 'vio' because the bus was not initialized. + +This happens because those drivers are built-in, and are calling +vio_register_driver(). It in turn calls driver_register() with a +reference to vio_bus_type, but we haven't registered vio_bus_type with +the driver core. + +Fix it by also guarding vio_register_driver() with a check to see if +we are on pseries. + +Fixes: 4336b9337824 ("powerpc/pseries: Make vio and ibmebus initcalls pseries specific") +Reported-by: Paul Menzel +Signed-off-by: Michael Ellerman +Tested-by: Paul Menzel +Reviewed-by: Tyrel Datwyler +Link: https://lore.kernel.org/r/20210316010938.525657-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/vio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/vio.c b/arch/powerpc/platforms/pseries/vio.c +index b2797cfe4e2b..68276e05502b 100644 +--- a/arch/powerpc/platforms/pseries/vio.c ++++ b/arch/powerpc/platforms/pseries/vio.c +@@ -1286,6 +1286,10 @@ static int vio_bus_remove(struct device *dev) + int __vio_register_driver(struct vio_driver *viodrv, struct module *owner, + const char *mod_name) + { ++ // vio_bus_type is only initialised for pseries ++ if (!machine_is(pseries)) ++ return -ENODEV; ++ + pr_debug("%s: driver %s registering\n", __func__, viodrv->name); + + /* fill in 'struct driver' fields */ +-- +2.30.2 + diff --git a/queue-5.10/powerpc-smp-reintroduce-cpu_core_mask.patch b/queue-5.10/powerpc-smp-reintroduce-cpu_core_mask.patch new file mode 100644 index 00000000000..e13bc29e262 --- /dev/null +++ b/queue-5.10/powerpc-smp-reintroduce-cpu_core_mask.patch @@ -0,0 +1,148 @@ +From 93cd8f1f65013093151e8f7bd3e6fa35967c8154 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 17:39:32 +0530 +Subject: powerpc/smp: Reintroduce cpu_core_mask + +From: Srikar Dronamraju + +[ Upstream commit c47f892d7aa62765bf0689073f75990b4517a4cf ] + +Daniel reported that with Commit 4ca234a9cbd7 ("powerpc/smp: Stop +updating cpu_core_mask") QEMU was unable to set single NUMA node SMP +topologies such as: + -smp 8,maxcpus=8,cores=2,threads=2,sockets=2 + i.e he expected 2 sockets in one NUMA node. + +The above commit helped to reduce boot time on Large Systems for +example 4096 vCPU single socket QEMU instance. PAPR is silent on +having more than one socket within a NUMA node. + +cpu_core_mask and cpu_cpu_mask for any CPU would be same unless the +number of sockets is different from the number of NUMA nodes. + +One option is to reintroduce cpu_core_mask but use a slightly +different method to arrive at the cpu_core_mask. Previously each CPU's +chip-id would be compared with all other CPU's chip-id to verify if +both the CPUs were related at the chip level. Now if a CPU 'A' is +found related / (unrelated) to another CPU 'B', all the thread +siblings of 'A' and thread siblings of 'B' are automatically marked as +related / (unrelated). + +Also if a platform doesn't support ibm,chip-id property, i.e its +cpu_to_chip_id returns -1, cpu_core_map holds a copy of +cpu_cpu_mask(). + +Fixes: 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask") +Reported-by: Daniel Henrique Barboza +Signed-off-by: Srikar Dronamraju +Tested-by: Daniel Henrique Barboza +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210415120934.232271-2-srikar@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/smp.h | 5 +++++ + arch/powerpc/kernel/smp.c | 39 ++++++++++++++++++++++++++++------ + 2 files changed, 37 insertions(+), 7 deletions(-) + +diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h +index b2035b2f57ce..635bdf947105 100644 +--- a/arch/powerpc/include/asm/smp.h ++++ b/arch/powerpc/include/asm/smp.h +@@ -121,6 +121,11 @@ static inline struct cpumask *cpu_sibling_mask(int cpu) + return per_cpu(cpu_sibling_map, cpu); + } + ++static inline struct cpumask *cpu_core_mask(int cpu) ++{ ++ return per_cpu(cpu_core_map, cpu); ++} ++ + static inline struct cpumask *cpu_l2_cache_mask(int cpu) + { + return per_cpu(cpu_l2_cache_map, cpu); +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index 7d6cf75a7fd8..dd34ea674496 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -975,17 +975,12 @@ void __init smp_prepare_cpus(unsigned int max_cpus) + local_memory_node(numa_cpu_lookup_table[cpu])); + } + #endif +- /* +- * cpu_core_map is now more updated and exists only since +- * its been exported for long. It only will have a snapshot +- * of cpu_cpu_mask. +- */ +- cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu)); + } + + /* Init the cpumasks so the boot CPU is related to itself */ + cpumask_set_cpu(boot_cpuid, cpu_sibling_mask(boot_cpuid)); + cpumask_set_cpu(boot_cpuid, cpu_l2_cache_mask(boot_cpuid)); ++ cpumask_set_cpu(boot_cpuid, cpu_core_mask(boot_cpuid)); + + if (has_coregroup_support()) + cpumask_set_cpu(boot_cpuid, cpu_coregroup_mask(boot_cpuid)); +@@ -1304,6 +1299,9 @@ static void remove_cpu_from_masks(int cpu) + set_cpus_unrelated(cpu, i, cpu_smallcore_mask); + } + ++ for_each_cpu(i, cpu_core_mask(cpu)) ++ set_cpus_unrelated(cpu, i, cpu_core_mask); ++ + if (has_coregroup_support()) { + for_each_cpu(i, cpu_coregroup_mask(cpu)) + set_cpus_unrelated(cpu, i, cpu_coregroup_mask); +@@ -1364,8 +1362,11 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask) + + static void add_cpu_to_masks(int cpu) + { ++ struct cpumask *(*submask_fn)(int) = cpu_sibling_mask; + int first_thread = cpu_first_thread_sibling(cpu); ++ int chip_id = cpu_to_chip_id(cpu); + cpumask_var_t mask; ++ bool ret; + int i; + + /* +@@ -1381,12 +1382,36 @@ static void add_cpu_to_masks(int cpu) + add_cpu_to_smallcore_masks(cpu); + + /* In CPU-hotplug path, hence use GFP_ATOMIC */ +- alloc_cpumask_var_node(&mask, GFP_ATOMIC, cpu_to_node(cpu)); ++ ret = alloc_cpumask_var_node(&mask, GFP_ATOMIC, cpu_to_node(cpu)); + update_mask_by_l2(cpu, &mask); + + if (has_coregroup_support()) + update_coregroup_mask(cpu, &mask); + ++ if (chip_id == -1 || !ret) { ++ cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu)); ++ goto out; ++ } ++ ++ if (shared_caches) ++ submask_fn = cpu_l2_cache_mask; ++ ++ /* Update core_mask with all the CPUs that are part of submask */ ++ or_cpumasks_related(cpu, cpu, submask_fn, cpu_core_mask); ++ ++ /* Skip all CPUs already part of current CPU core mask */ ++ cpumask_andnot(mask, cpu_online_mask, cpu_core_mask(cpu)); ++ ++ for_each_cpu(i, mask) { ++ if (chip_id == cpu_to_chip_id(i)) { ++ or_cpumasks_related(cpu, i, submask_fn, cpu_core_mask); ++ cpumask_andnot(mask, mask, submask_fn(i)); ++ } else { ++ cpumask_andnot(mask, mask, cpu_core_mask(i)); ++ } ++ } ++ ++out: + free_cpumask_var(mask); + } + +-- +2.30.2 + diff --git a/queue-5.10/powerpc-xive-drop-check-on-irq_data-in-xive_core_deb.patch b/queue-5.10/powerpc-xive-drop-check-on-irq_data-in-xive_core_deb.patch new file mode 100644 index 00000000000..15d8328e343 --- /dev/null +++ b/queue-5.10/powerpc-xive-drop-check-on-irq_data-in-xive_core_deb.patch @@ -0,0 +1,68 @@ +From a73ddea207b5012ee408d659296230fd21b8562f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 16:45:10 +0200 +Subject: powerpc/xive: Drop check on irq_data in xive_core_debug_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Le Goater + +[ Upstream commit a74ce5926b20cd0e6d624a9b2527073a96dfed7f ] + +When looping on IRQ descriptor, irq_data is always valid. + +Fixes: 930914b7d528 ("powerpc/xive: Add a debugfs file to dump internal XIVE state") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Cédric Le Goater +Reviewed-by: Greg Kurz +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210331144514.892250-6-clg@kaod.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/xive/common.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index a80440af491a..5899ffb28c58 100644 +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -1606,6 +1606,8 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_data + u32 target; + u8 prio; + u32 lirq; ++ struct xive_irq_data *xd; ++ u64 val; + + if (!is_xive_irq(chip)) + return; +@@ -1619,17 +1621,14 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_data + seq_printf(m, "IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x ", + hw_irq, target, prio, lirq); + +- if (d) { +- struct xive_irq_data *xd = irq_data_get_irq_handler_data(d); +- u64 val = xive_esb_read(xd, XIVE_ESB_GET); +- +- seq_printf(m, "flags=%c%c%c PQ=%c%c", +- xd->flags & XIVE_IRQ_FLAG_STORE_EOI ? 'S' : ' ', +- xd->flags & XIVE_IRQ_FLAG_LSI ? 'L' : ' ', +- xd->flags & XIVE_IRQ_FLAG_H_INT_ESB ? 'H' : ' ', +- val & XIVE_ESB_VAL_P ? 'P' : '-', +- val & XIVE_ESB_VAL_Q ? 'Q' : '-'); +- } ++ xd = irq_data_get_irq_handler_data(d); ++ val = xive_esb_read(xd, XIVE_ESB_GET); ++ seq_printf(m, "flags=%c%c%c PQ=%c%c", ++ xd->flags & XIVE_IRQ_FLAG_STORE_EOI ? 'S' : ' ', ++ xd->flags & XIVE_IRQ_FLAG_LSI ? 'L' : ' ', ++ xd->flags & XIVE_IRQ_FLAG_H_INT_ESB ? 'H' : ' ', ++ val & XIVE_ESB_VAL_P ? 'P' : '-', ++ val & XIVE_ESB_VAL_Q ? 'Q' : '-'); + seq_puts(m, "\n"); + } + +-- +2.30.2 + diff --git a/queue-5.10/powerpc-xive-fix-xmon-command-dxi.patch b/queue-5.10/powerpc-xive-fix-xmon-command-dxi.patch new file mode 100644 index 00000000000..55a9147dc20 --- /dev/null +++ b/queue-5.10/powerpc-xive-fix-xmon-command-dxi.patch @@ -0,0 +1,78 @@ +From 44440d39d42647501538ab5ed8992dbbc93e71ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 16:45:12 +0200 +Subject: powerpc/xive: Fix xmon command "dxi" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cédric Le Goater + +[ Upstream commit 33e4bc5946432a4ac173fd08e8e30a13ab94d06d ] + +When under xmon, the "dxi" command dumps the state of the XIVE +interrupts. If an interrupt number is specified, only the state of +the associated XIVE interrupt is dumped. This form of the command +lacks an irq_data parameter which is nevertheless used by +xmon_xive_get_irq_config(), leading to an xmon crash. + +Fix that by doing a lookup in the system IRQ mapping to query the IRQ +descriptor data. Invalid interrupt numbers, or not belonging to the +XIVE IRQ domain, OPAL event interrupt number for instance, should be +caught by the previous query done at the firmware level. + +Fixes: 97ef27507793 ("powerpc/xive: Fix xmon support on the PowerNV platform") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Cédric Le Goater +Tested-by: Greg Kurz +Reviewed-by: Greg Kurz +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210331144514.892250-8-clg@kaod.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/xive/common.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c +index 5899ffb28c58..5b0f6b6278e3 100644 +--- a/arch/powerpc/sysdev/xive/common.c ++++ b/arch/powerpc/sysdev/xive/common.c +@@ -261,17 +261,20 @@ notrace void xmon_xive_do_dump(int cpu) + xmon_printf("\n"); + } + ++static struct irq_data *xive_get_irq_data(u32 hw_irq) ++{ ++ unsigned int irq = irq_find_mapping(xive_irq_domain, hw_irq); ++ ++ return irq ? irq_get_irq_data(irq) : NULL; ++} ++ + int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d) + { +- struct irq_chip *chip = irq_data_get_irq_chip(d); + int rc; + u32 target; + u8 prio; + u32 lirq; + +- if (!is_xive_irq(chip)) +- return -EINVAL; +- + rc = xive_ops->get_irq_config(hw_irq, &target, &prio, &lirq); + if (rc) { + xmon_printf("IRQ 0x%08x : no config rc=%d\n", hw_irq, rc); +@@ -281,6 +284,9 @@ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d) + xmon_printf("IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x ", + hw_irq, target, prio, lirq); + ++ if (!d) ++ d = xive_get_irq_data(hw_irq); ++ + if (d) { + struct xive_irq_data *xd = irq_data_get_irq_handler_data(d); + u64 val = xive_esb_read(xd, XIVE_ESB_GET); +-- +2.30.2 + diff --git a/queue-5.10/rcu-remove-spurious-instrumentation_end-in-rcu_nmi_e.patch b/queue-5.10/rcu-remove-spurious-instrumentation_end-in-rcu_nmi_e.patch new file mode 100644 index 00000000000..ea17bee9409 --- /dev/null +++ b/queue-5.10/rcu-remove-spurious-instrumentation_end-in-rcu_nmi_e.patch @@ -0,0 +1,40 @@ +From 9c6d2f7c3117da380dd98d8b0b11bbcfa5113d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jan 2021 09:08:59 +0800 +Subject: rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() + +From: Zhouyi Zhou + +[ Upstream commit 6494ccb93271bee596a12db32ff44867d5be2321 ] + +In rcu_nmi_enter(), there is an erroneous instrumentation_end() in the +second branch of the "if" statement. Oddly enough, "objtool check -f +vmlinux.o" fails to complain because it is unable to correctly cover +all cases. Instead, objtool visits the third branch first, which marks +following trace_rcu_dyntick() as visited. This commit therefore removes +the spurious instrumentation_end(). + +Fixes: 04b25a495bd6 ("rcu: Mark rcu_nmi_enter() call to rcu_cleanup_after_idle() noinstr") +Reported-by Neeraj Upadhyay +Signed-off-by: Zhouyi Zhou +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 8a5cc76ecac9..61e250cdd7c9 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -1019,7 +1019,6 @@ noinstr void rcu_nmi_enter(void) + } else if (!in_nmi()) { + instrumentation_begin(); + rcu_irq_enter_check_tick(); +- instrumentation_end(); + } else { + instrumentation_begin(); + } +-- +2.30.2 + diff --git a/queue-5.10/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch b/queue-5.10/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch new file mode 100644 index 00000000000..304b75ffba8 --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch @@ -0,0 +1,45 @@ +From e926486d2e9ab858bc996c50bbf9159b6ea690b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 07:06:14 -0700 +Subject: RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res + +From: Lv Yunlong + +[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ] + +In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside +bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via +pci_iounmap() in unmap_io error branch. After the callee returns err code, +bnxt_qplib_alloc_res calls +bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then +dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap(). + +My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by +pci_iounmap() in the first time, to avoid the double free. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Lv Yunlong +Reviewed-by: Leon Romanovsky +Acked-by: Devesh Sharma +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c +index fa7878336100..3ca47004b752 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res, + + unmap_io: + pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem); ++ dpit->dbr_bar_reg_iomem = NULL; + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-5.10/rdma-bnxt_re-fix-error-return-code-in-bnxt_qplib_cq_.patch b/queue-5.10/rdma-bnxt_re-fix-error-return-code-in-bnxt_qplib_cq_.patch new file mode 100644 index 00000000000..cf4277298a8 --- /dev/null +++ b/queue-5.10/rdma-bnxt_re-fix-error-return-code-in-bnxt_qplib_cq_.patch @@ -0,0 +1,38 @@ +From 8d4735376f907f6048e96dc225447c413ec313f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:37 +0000 +Subject: RDMA/bnxt_re: Fix error return code in + bnxt_qplib_cq_process_terminal() + +From: Wang Wensheng + +[ Upstream commit 22efb0a8d130c6379c1eb64cbace1542b27e37ff ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/20210408113137.97202-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 995d4633b0a1..d4d4959c2434 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -2784,6 +2784,7 @@ do_rq: + dev_err(&cq->hwq.pdev->dev, + "FP: CQ Processed terminal reported rq_cons_idx 0x%x exceeds max 0x%x\n", + cqe_cons, rq->max_wqe); ++ rc = -EINVAL; + goto done; + } + +-- +2.30.2 + diff --git a/queue-5.10/rdma-core-add-cm-to-restrack-after-successful-attach.patch b/queue-5.10/rdma-core-add-cm-to-restrack-after-successful-attach.patch new file mode 100644 index 00000000000..f6ef0ba34a2 --- /dev/null +++ b/queue-5.10/rdma-core-add-cm-to-restrack-after-successful-attach.patch @@ -0,0 +1,113 @@ +From 2c746b25c67a9c23da56fd743dc184d90c622bdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Apr 2021 16:55:54 +0300 +Subject: RDMA/core: Add CM to restrack after successful attachment to a device + +From: Shay Drory + +[ Upstream commit cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa ] + +The device attach triggers addition of CM_ID to the restrack DB. +However, when error occurs, we releasing this device, but defer CM_ID +release. This causes to the situation where restrack sees CM_ID that +is not valid anymore. + +As a solution, add the CM_ID to the resource tracking DB only after the +attachment is finished. + +Found by syzcaller: +infiniband syz0: added syz_tun +rdma_rxe: ignoring netdev event = 10 for syz_tun +infiniband syz0: set down +infiniband syz0: ib_query_port failed (-19) +restrack: ------------[ cut here ]------------ +infiniband syz0: BUG: RESTRACK detected leak of resources +restrack: User CM_ID object allocated by syz-executor716 is not freed +restrack: ------------[ cut here ]------------ + +Fixes: b09c4d701220 ("RDMA/restrack: Improve readability in task name management") +Link: https://lore.kernel.org/r/ab93e56ba831eac65c322b3256796fa1589ec0bb.1618753862.git.leonro@nvidia.com +Signed-off-by: Shay Drory +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index e3638f80e1d5..6af066a2c8c0 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -463,7 +463,6 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv, + id_priv->id.route.addr.dev_addr.transport = + rdma_node_get_transport(cma_dev->device->node_type); + list_add_tail(&id_priv->list, &cma_dev->id_list); +- rdma_restrack_add(&id_priv->res); + + trace_cm_id_attach(id_priv, cma_dev->device); + } +@@ -700,6 +699,7 @@ static int cma_ib_acquire_dev(struct rdma_id_private *id_priv, + mutex_lock(&lock); + cma_attach_to_dev(id_priv, listen_id_priv->cma_dev); + mutex_unlock(&lock); ++ rdma_restrack_add(&id_priv->res); + return 0; + } + +@@ -754,8 +754,10 @@ static int cma_iw_acquire_dev(struct rdma_id_private *id_priv, + } + + out: +- if (!ret) ++ if (!ret) { + cma_attach_to_dev(id_priv, cma_dev); ++ rdma_restrack_add(&id_priv->res); ++ } + + mutex_unlock(&lock); + return ret; +@@ -816,6 +818,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + + found: + cma_attach_to_dev(id_priv, cma_dev); ++ rdma_restrack_add(&id_priv->res); + mutex_unlock(&lock); + addr = (struct sockaddr_ib *)cma_src_addr(id_priv); + memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); +@@ -2529,6 +2532,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv, + rdma_addr_size(cma_src_addr(id_priv))); + + _cma_attach_to_dev(dev_id_priv, cma_dev); ++ rdma_restrack_add(&dev_id_priv->res); + cma_id_get(id_priv); + dev_id_priv->internal_id = 1; + dev_id_priv->afonly = id_priv->afonly; +@@ -3169,6 +3173,7 @@ port_found: + ib_addr_set_pkey(&id_priv->id.route.addr.dev_addr, pkey); + id_priv->id.port_num = p; + cma_attach_to_dev(id_priv, cma_dev); ++ rdma_restrack_add(&id_priv->res); + cma_set_loopback(cma_src_addr(id_priv)); + out: + mutex_unlock(&lock); +@@ -3201,6 +3206,7 @@ static void addr_handler(int status, struct sockaddr *src_addr, + if (status) + pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n", + status); ++ rdma_restrack_add(&id_priv->res); + } else if (status) { + pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status); + } +@@ -3812,6 +3818,8 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr) + if (ret) + goto err2; + ++ if (!cma_any_addr(addr)) ++ rdma_restrack_add(&id_priv->res); + return 0; + err2: + if (id_priv->cma_dev) +-- +2.30.2 + diff --git a/queue-5.10/rdma-core-fix-corrupted-sl-on-passive-side.patch b/queue-5.10/rdma-core-fix-corrupted-sl-on-passive-side.patch new file mode 100644 index 00000000000..b92a73bbad8 --- /dev/null +++ b/queue-5.10/rdma-core-fix-corrupted-sl-on-passive-side.patch @@ -0,0 +1,55 @@ +From be03e8adb04cbdadb86d105797f27e1eb504900b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 14:35:32 +0100 +Subject: RDMA/core: Fix corrupted SL on passive side +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 194f64a3cad3ab9e381e996a13089de3215d1887 ] + +On RoCE systems, a CM REQ contains a Primary Hop Limit > 1 and Primary +Subnet Local is zero. + +In cm_req_handler(), the cm_process_routed_req() function is called. Since +the Primary Subnet Local value is zero in the request, and since this is +RoCE (Primary Local LID is permissive), the following statement will be +executed: + + IBA_SET(CM_REQ_PRIMARY_SL, req_msg, wc->sl); + +This corrupts SL in req_msg if it was different from zero. In other words, +a request to setup a connection using an SL != zero, will not be honored, +and a connection using SL zero will be created instead. + +Fixed by not calling cm_process_routed_req() on RoCE systems, the +cm_process_route_req() is only for IB anyhow. + +Fixes: 3971c9f6dbf2 ("IB/cm: Add interim support for routed paths") +Link: https://lore.kernel.org/r/1616420132-31005-1-git-send-email-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index bbba0cd42c89..ee568bdf3c78 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -2137,7 +2137,8 @@ static int cm_req_handler(struct cm_work *work) + goto destroy; + } + +- cm_process_routed_req(req_msg, work->mad_recv_wc->wc); ++ if (cm_id_priv->av.ah_attr.type != RDMA_AH_ATTR_TYPE_ROCE) ++ cm_process_routed_req(req_msg, work->mad_recv_wc->wc); + + memset(&work->path[0], 0, sizeof(work->path[0])); + if (cm_req_has_alt_path(req_msg)) +-- +2.30.2 + diff --git a/queue-5.10/rdma-cxgb4-add-missing-qpid-increment.patch b/queue-5.10/rdma-cxgb4-add-missing-qpid-increment.patch new file mode 100644 index 00000000000..26f116b7088 --- /dev/null +++ b/queue-5.10/rdma-cxgb4-add-missing-qpid-increment.patch @@ -0,0 +1,39 @@ +From fd60139a654720c4a74b6c7f6793f675e403ca61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 20:44:22 +0530 +Subject: RDMA/cxgb4: add missing qpid increment + +From: Potnuri Bharat Teja + +[ Upstream commit 3a6684385928d00b29acac7658a5ae1f2a44494c ] + +missing qpid increment leads to skipping few qpids while allocating QP. +This eventually leads to adapter running out of qpids after establishing +fewer connections than it actually supports. +Current patch increments the qpid correctly. + +Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC") +Link: https://lore.kernel.org/r/20210415151422.9139-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c +index 5c95c789f302..e800e8e8bed5 100644 +--- a/drivers/infiniband/hw/cxgb4/resource.c ++++ b/drivers/infiniband/hw/cxgb4/resource.c +@@ -216,7 +216,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx) + goto out; + entry->qid = qid; + list_add_tail(&entry->entry, &uctx->cqids); +- for (i = qid; i & rdev->qpmask; i++) { ++ for (i = qid + 1; i & rdev->qpmask; i++) { + entry = kmalloc(sizeof(*entry), GFP_KERNEL); + if (!entry) + goto out; +-- +2.30.2 + diff --git a/queue-5.10/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch b/queue-5.10/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch new file mode 100644 index 00000000000..dbb894a677d --- /dev/null +++ b/queue-5.10/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch @@ -0,0 +1,58 @@ +From 1b560f55f7f4bdd9c20939861fdcbc7f99d6d1c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 19:21:04 -0500 +Subject: RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails + +From: Sindhu Devale + +[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ] + +When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk +entry in the PBLE info list. + +Fix it by adding the chunk entry to the PBLE info list only after +successful addition of SD in i40iw_hmc_sd_one. + +This fixes a static checker warning reported here: + https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/ + +Fixes: 9715830157be ("i40iw: add pble resource files") +Link: https://lore.kernel.org/r/20210416002104.323-1-shiraz.saleem@intel.com +Reported-by: Dan Carpenter +Signed-off-by: Sindhu Devale +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c +index 5f97643e22e5..ae7d227edad2 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c +@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n", + pble_rsrc->next_fpm_addr, chunk->size, chunk->size); + pble_rsrc->unallocated_pble -= (chunk->size >> 3); +- list_add(&chunk->list, &pble_rsrc->pinfo.clist); + sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ? + sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; +- if (sd_entry->valid) +- return 0; +- if (dev->is_pf) { ++ if (dev->is_pf && !sd_entry->valid) { + ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id, + sd_reg_val, idx->sd_idx, + sd_entry->entry_type, true); +@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + } + + sd_entry->valid = true; ++ list_add(&chunk->list, &pble_rsrc->pinfo.clist); + return 0; + error: + kfree(chunk); +-- +2.30.2 + diff --git a/queue-5.10/rdma-mlx5-fix-drop-packet-rule-in-egress-table.patch b/queue-5.10/rdma-mlx5-fix-drop-packet-rule-in-egress-table.patch new file mode 100644 index 00000000000..a5f13dd4c2f --- /dev/null +++ b/queue-5.10/rdma-mlx5-fix-drop-packet-rule-in-egress-table.patch @@ -0,0 +1,58 @@ +From b2a827192555bb209a6d2fc9da0dc909e3686ed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 15:51:23 +0200 +Subject: RDMA/mlx5: Fix drop packet rule in egress table + +From: Maor Gottlieb + +[ Upstream commit c73700806d4e430d182c2be069d230076818a99a ] + +Initial drop action support missed that drop action can be added to egress +flow tables as well. Add the missing support. + +This requires making sure that dest_type isn't set to PORT which in turn +exposes a possibility of passing dst while indicating number of dsts as +zero. Explicitly check for number of dsts and pass the appropriate +pointer. + +Fixes: f29de9eee782 ("RDMA/mlx5: Add support for drop action in DV steering") +Link: https://lore.kernel.org/r/20210318135123.680759-1-leon@kernel.org +Reviewed-by: Mark Bloch +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/fs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c +index 492cfe063bca..13d50b178166 100644 +--- a/drivers/infiniband/hw/mlx5/fs.c ++++ b/drivers/infiniband/hw/mlx5/fs.c +@@ -1528,8 +1528,8 @@ static struct mlx5_ib_flow_handler *raw_fs_rule_add( + dst_num++; + } + +- handler = _create_raw_flow_rule(dev, ft_prio, dst, fs_matcher, +- flow_context, flow_act, ++ handler = _create_raw_flow_rule(dev, ft_prio, dst_num ? dst : NULL, ++ fs_matcher, flow_context, flow_act, + cmd_in, inlen, dst_num); + + if (IS_ERR(handler)) { +@@ -1885,8 +1885,9 @@ static int get_dests(struct uverbs_attr_bundle *attrs, + else + *dest_id = mqp->raw_packet_qp.rq.tirn; + *dest_type = MLX5_FLOW_DESTINATION_TYPE_TIR; +- } else if (fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_EGRESS || +- fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_RDMA_TX) { ++ } else if ((fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_EGRESS || ++ fs_matcher->ns_type == MLX5_FLOW_NAMESPACE_RDMA_TX) && ++ !(*flags & MLX5_IB_ATTR_CREATE_FLOW_FLAGS_DROP)) { + *dest_type = MLX5_FLOW_DESTINATION_TYPE_PORT; + } + +-- +2.30.2 + diff --git a/queue-5.10/rdma-mlx5-fix-mlx5-rates-to-ib-rates-map.patch b/queue-5.10/rdma-mlx5-fix-mlx5-rates-to-ib-rates-map.patch new file mode 100644 index 00000000000..2442159f557 --- /dev/null +++ b/queue-5.10/rdma-mlx5-fix-mlx5-rates-to-ib-rates-map.patch @@ -0,0 +1,59 @@ +From 0693af6f109e7f2ed221949df1ed570dc248a2bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 14:45:17 +0200 +Subject: RDMA/mlx5: Fix mlx5 rates to IB rates map + +From: Mark Zhang + +[ Upstream commit 6fe6e568639859db960c8fcef19a2ece1c2d7eae ] + +Correct the map between mlx5 rates and corresponding ib rates, as they +don't always have a fixed offset between them. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Link: https://lore.kernel.org/r/20210304124517.1100608-4-leon@kernel.org +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 75caeec378bd..6d2715f65d78 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3079,6 +3079,19 @@ enum { + MLX5_PATH_FLAG_COUNTER = 1 << 2, + }; + ++static int mlx5_to_ib_rate_map(u8 rate) ++{ ++ static const int rates[] = { IB_RATE_PORT_CURRENT, IB_RATE_56_GBPS, ++ IB_RATE_25_GBPS, IB_RATE_100_GBPS, ++ IB_RATE_200_GBPS, IB_RATE_50_GBPS, ++ IB_RATE_400_GBPS }; ++ ++ if (rate < ARRAY_SIZE(rates)) ++ return rates[rate]; ++ ++ return rate - MLX5_STAT_RATE_OFFSET; ++} ++ + static int ib_to_mlx5_rate_map(u8 rate) + { + switch (rate) { +@@ -4420,7 +4433,7 @@ static void to_rdma_ah_attr(struct mlx5_ib_dev *ibdev, + rdma_ah_set_path_bits(ah_attr, MLX5_GET(ads, path, mlid)); + + static_rate = MLX5_GET(ads, path, stat_rate); +- rdma_ah_set_static_rate(ah_attr, static_rate ? static_rate - 5 : 0); ++ rdma_ah_set_static_rate(ah_attr, mlx5_to_ib_rate_map(static_rate)); + if (MLX5_GET(ads, path, grh) || + ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { + rdma_ah_set_grh(ah_attr, NULL, MLX5_GET(ads, path, flow_label), +-- +2.30.2 + diff --git a/queue-5.10/rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch b/queue-5.10/rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch new file mode 100644 index 00000000000..4a1ea668c72 --- /dev/null +++ b/queue-5.10/rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch @@ -0,0 +1,45 @@ +From 88e001b73345e481694465c676281d333e4e1210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:35 +0000 +Subject: RDMA/qedr: Fix error return code in qedr_iw_connect() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wang Wensheng + +[ Upstream commit 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 82af6d19d8d9 ("RDMA/qedr: Fix synchronization methods and memory leaks in qedr") +Link: https://lore.kernel.org/r/20210408113135.92165-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Acked-by: Michal Kalderon  +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c +index c4bc58736e48..1715fbe0719d 100644 +--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c ++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c +@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + memcpy(in_params.local_mac_addr, dev->ndev->dev_addr, ETH_ALEN); + + if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT, +- &qp->iwarp_cm_flags)) ++ &qp->iwarp_cm_flags)) { ++ rc = -ENODEV; + goto err; /* QP already being destroyed */ ++ } + + rc = dev->ops->iwarp_connect(dev->rdma_ctx, &in_params, &out_params); + if (rc) { +-- +2.30.2 + diff --git a/queue-5.10/rdma-rtrs-clt-destroy-sysfs-after-removing-session-f.patch b/queue-5.10/rdma-rtrs-clt-destroy-sysfs-after-removing-session-f.patch new file mode 100644 index 00000000000..4dbe86ef5bc --- /dev/null +++ b/queue-5.10/rdma-rtrs-clt-destroy-sysfs-after-removing-session-f.patch @@ -0,0 +1,61 @@ +From 432ac735a83e056e92a2273b9f24efed85ae5138 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 10:40:02 +0200 +Subject: RDMA/rtrs-clt: destroy sysfs after removing session from active list + +From: Gioh Kim + +[ Upstream commit 7f4a8592ff29f19c5a2ca549d0973821319afaad ] + +A session can be removed dynamically by sysfs interface "remove_path" that +eventually calls rtrs_clt_remove_path_from_sysfs function. The current +rtrs_clt_remove_path_from_sysfs first removes the sysfs interfaces and +frees sess->stats object. Second it removes the session from the active +list. + +Therefore some functions could access non-connected session and access the +freed sess->stats object even-if they check the session status before +accessing the session. + +For instance rtrs_clt_request and get_next_path_min_inflight check the +session status and try to send IO to the session. The session status +could be changed when they are trying to send IO but they could not catch +the change and update the statistics information in sess->stats object, +and generate use-after-free problem. +(see: "RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its +stats") + +This patch changes the rtrs_clt_remove_path_from_sysfs to remove the +session from the active session list and then destroy the sysfs +interfaces. + +Each function still should check the session status because closing or +error recovery paths can change the status. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Link: https://lore.kernel.org/r/20210412084002.33582-1-gi-oh.kim@ionos.com +Signed-off-by: Gioh Kim +Reviewed-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 6ff97fbf8756..7db550ba25d7 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -2803,8 +2803,8 @@ int rtrs_clt_remove_path_from_sysfs(struct rtrs_clt_sess *sess, + } while (!changed && old_state != RTRS_CLT_DEAD); + + if (likely(changed)) { +- rtrs_clt_destroy_sess_files(sess, sysfs_self); + rtrs_clt_remove_path_from_arr(sess); ++ rtrs_clt_destroy_sess_files(sess, sysfs_self); + kobject_put(&sess->kobj); + } + +-- +2.30.2 + diff --git a/queue-5.10/rdma-rxe-fix-a-bug-in-rxe_fill_ip_info.patch b/queue-5.10/rdma-rxe-fix-a-bug-in-rxe_fill_ip_info.patch new file mode 100644 index 00000000000..adbe7ed3928 --- /dev/null +++ b/queue-5.10/rdma-rxe-fix-a-bug-in-rxe_fill_ip_info.patch @@ -0,0 +1,40 @@ +From 460f206221b83dfb73ca0fff17d289c471ccb764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 22:59:53 -0500 +Subject: RDMA/rxe: Fix a bug in rxe_fill_ip_info() + +From: Bob Pearson + +[ Upstream commit 45062f441590810772959d8e1f2b24ba57ce1bd9 ] + +Fix a bug in rxe_fill_ip_info() which was attempting to convert from +RDMA_NETWORK_XXX to RXE_NETWORK_XXX. .._IPV6 should have mapped to .._IPV6 +not .._IPV4. + +Fixes: edebc8407b88 ("RDMA/rxe: Fix small problem in network_type patch") +Link: https://lore.kernel.org/r/20210421035952.4892-1-rpearson@hpe.com +Suggested-by: Frank Zago +Signed-off-by: Bob Pearson +Acked-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_av.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_av.c b/drivers/infiniband/sw/rxe/rxe_av.c +index df0d173d6acb..da2e867a1ed9 100644 +--- a/drivers/infiniband/sw/rxe/rxe_av.c ++++ b/drivers/infiniband/sw/rxe/rxe_av.c +@@ -88,7 +88,7 @@ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr) + type = RXE_NETWORK_TYPE_IPV4; + break; + case RDMA_NETWORK_IPV6: +- type = RXE_NETWORK_TYPE_IPV4; ++ type = RXE_NETWORK_TYPE_IPV6; + break; + default: + /* not reached - checked in rxe_av_chk_attr */ +-- +2.30.2 + diff --git a/queue-5.10/rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch b/queue-5.10/rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch new file mode 100644 index 00000000000..d79c807f16f --- /dev/null +++ b/queue-5.10/rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch @@ -0,0 +1,55 @@ +From 44e801a4038e994371e0f7f36f97c33b08d670ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Apr 2021 18:16:47 -0700 +Subject: RDMA/siw: Fix a use after free in siw_alloc_mr + +From: Lv Yunlong + +[ Upstream commit 3093ee182f01689b89e9f8797b321603e5de4f63 ] + +Our code analyzer reported a UAF. + +In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of +siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via +kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a +freed object. After, the execution continue up to the err_out branch of +siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr). + +My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} +section, to avoid the uaf. + +Fixes: 2251334dcac9 ("rdma/siw: application buffer management") +Link: https://lore.kernel.org/r/20210426011647.3561-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Lv Yunlong +Reviewed-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_mem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c +index 34a910cf0edb..61c17db70d65 100644 +--- a/drivers/infiniband/sw/siw/siw_mem.c ++++ b/drivers/infiniband/sw/siw/siw_mem.c +@@ -106,8 +106,6 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj, + mem->perms = rights & IWARP_ACCESS_MASK; + kref_init(&mem->ref); + +- mr->mem = mem; +- + get_random_bytes(&next, 4); + next &= 0x00ffffff; + +@@ -116,6 +114,8 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj, + kfree(mem); + return -ENOMEM; + } ++ ++ mr->mem = mem; + /* Set the STag index part */ + mem->stag = id << 8; + mr->base_mr.lkey = mr->base_mr.rkey = mem->stag; +-- +2.30.2 + diff --git a/queue-5.10/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch b/queue-5.10/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch new file mode 100644 index 00000000000..e2520e0ff69 --- /dev/null +++ b/queue-5.10/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch @@ -0,0 +1,38 @@ +From d3dc36ff97c7bcb9f3688139055c7b693cc2e434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:32 +0000 +Subject: RDMA/srpt: Fix error return code in srpt_cm_req_recv() + +From: Wang Wensheng + +[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: db7683d7deb2 ("IB/srpt: Fix login-related race conditions") +Link: https://lore.kernel.org/r/20210408113132.87250-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Reviewed-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 53a8becac827..07ecc7dc1822 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2378,6 +2378,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev, + pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n", + dev_name(&sdev->device->dev), port_num); + mutex_unlock(&sport->mutex); ++ ret = -EINVAL; + goto reject; + } + +-- +2.30.2 + diff --git a/queue-5.10/regmap-set-debugfs_name-to-null-after-it-is-freed.patch b/queue-5.10/regmap-set-debugfs_name-to-null-after-it-is-freed.patch new file mode 100644 index 00000000000..a1415664158 --- /dev/null +++ b/queue-5.10/regmap-set-debugfs_name-to-null-after-it-is-freed.patch @@ -0,0 +1,45 @@ +From e27a602cfa0026707c6777baf1910d8e9eb56e30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 10:17:37 +0800 +Subject: regmap: set debugfs_name to NULL after it is freed + +From: Meng Li + +[ Upstream commit e41a962f82e7afb5b1ee644f48ad0b3aee656268 ] + +There is a upstream commit cffa4b2122f5("regmap:debugfs: +Fix a memory leak when calling regmap_attach_dev") that +adds a if condition when create name for debugfs_name. +With below function invoking logical, debugfs_name is +freed in regmap_debugfs_exit(), but it is not created again +because of the if condition introduced by above commit. +regmap_reinit_cache() + regmap_debugfs_exit() + ... + regmap_debugfs_init() +So, set debugfs_name to NULL after it is freed. + +Fixes: cffa4b2122f5 ("regmap: debugfs: Fix a memory leak when calling regmap_attach_dev") +Signed-off-by: Meng Li +Link: https://lore.kernel.org/r/20210226021737.7690-1-Meng.Li@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index ff2ee87987c7..211a335a608d 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -660,6 +660,7 @@ void regmap_debugfs_exit(struct regmap *map) + regmap_debugfs_free_dump_cache(map); + mutex_unlock(&map->cache_lock); + kfree(map->debugfs_name); ++ map->debugfs_name = NULL; + } else { + struct regmap_debugfs_node *node, *tmp; + +-- +2.30.2 + diff --git a/queue-5.10/regulator-bd9576-fix-return-from-bd957x_probe.patch b/queue-5.10/regulator-bd9576-fix-return-from-bd957x_probe.patch new file mode 100644 index 00000000000..2c521f14766 --- /dev/null +++ b/queue-5.10/regulator-bd9576-fix-return-from-bd957x_probe.patch @@ -0,0 +1,68 @@ +From 8c99e8dfbde362279ced183cb31b0a0a5820df72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 10:42:52 +0300 +Subject: regulator: bd9576: Fix return from bd957x_probe() + +From: Dan Carpenter + +[ Upstream commit 320fcd6bbd2b500923db518902c2c640242d2b50 ] + +The probe() function returns an uninitialized variable in the success +path. There is no need for the "err" variable at all, just delete it. + +Fixes: b014e9fae7e7 ("regulator: Support ROHM BD9576MUF and BD9573MUF") +Signed-off-by: Dan Carpenter +Reviewed-by: Matti Vaittinen +Link: https://lore.kernel.org/r/YEsbfLJfEWtnRpoU@mwanda +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/bd9576-regulator.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/regulator/bd9576-regulator.c b/drivers/regulator/bd9576-regulator.c +index a8b5832a5a1b..204a2da054f5 100644 +--- a/drivers/regulator/bd9576-regulator.c ++++ b/drivers/regulator/bd9576-regulator.c +@@ -206,7 +206,7 @@ static int bd957x_probe(struct platform_device *pdev) + { + struct regmap *regmap; + struct regulator_config config = { 0 }; +- int i, err; ++ int i; + bool vout_mode, ddr_sel; + const struct bd957x_regulator_data *reg_data = &bd9576_regulators[0]; + unsigned int num_reg_data = ARRAY_SIZE(bd9576_regulators); +@@ -279,8 +279,7 @@ static int bd957x_probe(struct platform_device *pdev) + break; + default: + dev_err(&pdev->dev, "Unsupported chip type\n"); +- err = -EINVAL; +- goto err; ++ return -EINVAL; + } + + config.dev = pdev->dev.parent; +@@ -300,8 +299,7 @@ static int bd957x_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "failed to register %s regulator\n", + desc->name); +- err = PTR_ERR(rdev); +- goto err; ++ return PTR_ERR(rdev); + } + /* + * Clear the VOUT1 GPIO setting - rest of the regulators do not +@@ -310,8 +308,7 @@ static int bd957x_probe(struct platform_device *pdev) + config.ena_gpiod = NULL; + } + +-err: +- return err; ++ return 0; + } + + static const struct platform_device_id bd957x_pmic_id[] = { +-- +2.30.2 + diff --git a/queue-5.10/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch b/queue-5.10/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch new file mode 100644 index 00000000000..8bc6ce9746a --- /dev/null +++ b/queue-5.10/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch @@ -0,0 +1,830 @@ +From 94f7125a01e18ba585f8d95954fb3303b495ee6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 13:26:07 +0800 +Subject: rtlwifi: 8821ae: upgrade PHY and RF parameters + +From: Ping-Ke Shih + +[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ] + +The signal strength of 5G is quite low, so user can't connect to an AP far +away. New parameters with new format and its parser are updated by the commit +84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but +some parameters are missing. Use this commit to update to the novel parameters +that use new format. + +Fixes: 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser") +Signed-off-by: Ping-Ke Shih +Tested-by: Kai-Heng Feng +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210219052607.7323-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- + 1 file changed, 370 insertions(+), 130 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +index 85093b3e5373..ed72a2aeb6c8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +@@ -249,7 +249,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = { + 0x824, 0x00030FE0, + 0x828, 0x00000000, + 0x82C, 0x002081DD, +- 0x830, 0x2AAA8E24, ++ 0x830, 0x2AAAEEC8, + 0x834, 0x0037A706, + 0x838, 0x06489B44, + 0x83C, 0x0000095B, +@@ -324,10 +324,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = { + 0x9D8, 0x00000000, + 0x9DC, 0x00000000, + 0x9E0, 0x00005D00, +- 0x9E4, 0x00000002, ++ 0x9E4, 0x00000003, + 0x9E8, 0x00000001, + 0xA00, 0x00D047C8, +- 0xA04, 0x01FF000C, ++ 0xA04, 0x01FF800C, + 0xA08, 0x8C8A8300, + 0xA0C, 0x2E68000F, + 0xA10, 0x9500BB78, +@@ -1320,7 +1320,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x083, 0x00021800, + 0x084, 0x00028000, + 0x085, 0x00048000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x086, 0x0009483A, ++ 0xA0000000, 0x00000000, + 0x086, 0x00094838, ++ 0xB0000000, 0x00000000, + 0x087, 0x00044980, + 0x088, 0x00048000, + 0x089, 0x0000D480, +@@ -1409,36 +1413,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x03C, 0x000CA000, + 0x0EF, 0x00000000, + 0x0EF, 0x00001100, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF3, + 0x034, 0x00049DF0, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF3, + 0x034, 0x00049DF0, +- 0xFF0F0404, 0xCDEF, +- 0x034, 0x0004ADF3, +- 0x034, 0x00049DF0, +- 0xFF0F0200, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF5, + 0x034, 0x00049DF2, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004A0F3, ++ 0x034, 0x000490B1, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004A0F3, + 0x034, 0x000490B1, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004ADF5, ++ 0x034, 0x00049DF2, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004ADF3, ++ 0x034, 0x00049DF0, ++ 0xA0000000, 0x00000000, + 0x034, 0x0004ADF7, + 0x034, 0x00049DF3, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00048DED, +- 0x034, 0x00047DEA, +- 0x034, 0x00046DE7, +- 0x034, 0x00045CE9, +- 0x034, 0x00044CE6, +- 0x034, 0x000438C6, +- 0x034, 0x00042886, +- 0x034, 0x00041486, +- 0x034, 0x00040447, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00048DED, + 0x034, 0x00047DEA, + 0x034, 0x00046DE7, +@@ -1448,7 +1448,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042886, + 0x034, 0x00041486, + 0x034, 0x00040447, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00048DED, + 0x034, 0x00047DEA, + 0x034, 0x00046DE7, +@@ -1458,7 +1458,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042886, + 0x034, 0x00041486, + 0x034, 0x00040447, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000480AE, ++ 0x034, 0x000470AB, ++ 0x034, 0x0004608B, ++ 0x034, 0x00045069, ++ 0x034, 0x00044048, ++ 0x034, 0x00043045, ++ 0x034, 0x00042026, ++ 0x034, 0x00041023, ++ 0x034, 0x00040002, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000480AE, + 0x034, 0x000470AB, + 0x034, 0x0004608B, +@@ -1468,7 +1478,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042026, + 0x034, 0x00041023, + 0x034, 0x00040002, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00048DED, ++ 0x034, 0x00047DEA, ++ 0x034, 0x00046DE7, ++ 0x034, 0x00045CE9, ++ 0x034, 0x00044CE6, ++ 0x034, 0x000438C6, ++ 0x034, 0x00042886, ++ 0x034, 0x00041486, ++ 0x034, 0x00040447, ++ 0xA0000000, 0x00000000, + 0x034, 0x00048DEF, + 0x034, 0x00047DEC, + 0x034, 0x00046DE9, +@@ -1478,38 +1498,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x0004248A, + 0x034, 0x0004108D, + 0x034, 0x0004008A, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0200, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0002ADF4, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0002A0F3, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0002A0F3, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0002ADF4, ++ 0xA0000000, 0x00000000, + 0x034, 0x0002ADF7, +- 0xFF0F0200, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00029DF4, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF4, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF4, +- 0xFF0F0200, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF1, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000290F0, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000290F0, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00029DF1, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00029DF4, ++ 0xA0000000, 0x00000000, + 0x034, 0x00029DF2, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00028DF1, +- 0x034, 0x00027DEE, +- 0x034, 0x00026DEB, +- 0x034, 0x00025CEC, +- 0x034, 0x00024CE9, +- 0x034, 0x000238CA, +- 0x034, 0x00022889, +- 0x034, 0x00021489, +- 0x034, 0x0002044A, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00028DF1, + 0x034, 0x00027DEE, + 0x034, 0x00026DEB, +@@ -1519,7 +1537,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022889, + 0x034, 0x00021489, + 0x034, 0x0002044A, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00028DF1, + 0x034, 0x00027DEE, + 0x034, 0x00026DEB, +@@ -1529,7 +1547,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022889, + 0x034, 0x00021489, + 0x034, 0x0002044A, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000280AF, + 0x034, 0x000270AC, + 0x034, 0x0002608B, +@@ -1539,7 +1557,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022026, + 0x034, 0x00021023, + 0x034, 0x00020002, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000280AF, ++ 0x034, 0x000270AC, ++ 0x034, 0x0002608B, ++ 0x034, 0x00025069, ++ 0x034, 0x00024048, ++ 0x034, 0x00023045, ++ 0x034, 0x00022026, ++ 0x034, 0x00021023, ++ 0x034, 0x00020002, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00028DF1, ++ 0x034, 0x00027DEE, ++ 0x034, 0x00026DEB, ++ 0x034, 0x00025CEC, ++ 0x034, 0x00024CE9, ++ 0x034, 0x000238CA, ++ 0x034, 0x00022889, ++ 0x034, 0x00021489, ++ 0x034, 0x0002044A, ++ 0xA0000000, 0x00000000, + 0x034, 0x00028DEE, + 0x034, 0x00027DEB, + 0x034, 0x00026CCD, +@@ -1549,27 +1587,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022849, + 0x034, 0x00021449, + 0x034, 0x0002004D, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F02C0, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0000A0D7, ++ 0x034, 0x000090D3, ++ 0x034, 0x000080B1, ++ 0x034, 0x000070AE, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0000A0D7, + 0x034, 0x000090D3, + 0x034, 0x000080B1, + 0x034, 0x000070AE, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x034, 0x0000ADF7, + 0x034, 0x00009DF4, + 0x034, 0x00008DF1, + 0x034, 0x00007DEE, +- 0xFF0F02C0, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00006DEB, +- 0x034, 0x00005CEC, +- 0x034, 0x00004CE9, +- 0x034, 0x000038CA, +- 0x034, 0x00002889, +- 0x034, 0x00001489, +- 0x034, 0x0000044A, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00006DEB, + 0x034, 0x00005CEC, + 0x034, 0x00004CE9, +@@ -1577,7 +1612,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002889, + 0x034, 0x00001489, + 0x034, 0x0000044A, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00006DEB, + 0x034, 0x00005CEC, + 0x034, 0x00004CE9, +@@ -1585,7 +1620,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002889, + 0x034, 0x00001489, + 0x034, 0x0000044A, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0000608D, + 0x034, 0x0000506B, + 0x034, 0x0000404A, +@@ -1593,7 +1628,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002044, + 0x034, 0x00001025, + 0x034, 0x00000004, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0000608D, ++ 0x034, 0x0000506B, ++ 0x034, 0x0000404A, ++ 0x034, 0x00003047, ++ 0x034, 0x00002044, ++ 0x034, 0x00001025, ++ 0x034, 0x00000004, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00006DEB, ++ 0x034, 0x00005CEC, ++ 0x034, 0x00004CE9, ++ 0x034, 0x000038CA, ++ 0x034, 0x00002889, ++ 0x034, 0x00001489, ++ 0x034, 0x0000044A, ++ 0xA0000000, 0x00000000, + 0x034, 0x00006DCD, + 0x034, 0x00005CCD, + 0x034, 0x00004CCA, +@@ -1601,11 +1652,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002888, + 0x034, 0x00001488, + 0x034, 0x00000486, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000040, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1615,7 +1666,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1625,7 +1676,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000128, ++ 0x035, 0x00008128, ++ 0x035, 0x00010128, ++ 0x035, 0x000201C8, ++ 0x035, 0x000281C8, ++ 0x035, 0x000301C8, ++ 0x035, 0x000401C8, ++ 0x035, 0x000481C8, ++ 0x035, 0x000501C8, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000145, ++ 0x035, 0x00008145, ++ 0x035, 0x00010145, ++ 0x035, 0x00020196, ++ 0x035, 0x00028196, ++ 0x035, 0x00030196, ++ 0x035, 0x000401C7, ++ 0x035, 0x000481C7, ++ 0x035, 0x000501C7, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000128, ++ 0x035, 0x00008128, ++ 0x035, 0x00010128, ++ 0x035, 0x000201C8, ++ 0x035, 0x000281C8, ++ 0x035, 0x000301C8, ++ 0x035, 0x000401C8, ++ 0x035, 0x000481C8, ++ 0x035, 0x000501C8, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1635,7 +1716,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x035, 0x00000145, + 0x035, 0x00008145, + 0x035, 0x00010145, +@@ -1645,11 +1726,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x000401C7, + 0x035, 0x000481C7, + 0x035, 0x000501C7, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000010, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1675,7 +1756,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000063B5, ++ 0x036, 0x0000E3B5, ++ 0x036, 0x000163B5, ++ 0x036, 0x0001E3B5, ++ 0x036, 0x000263B5, ++ 0x036, 0x0002E3B5, ++ 0x036, 0x000363B5, ++ 0x036, 0x0003E3B5, ++ 0x036, 0x000463B5, ++ 0x036, 0x0004E3B5, ++ 0x036, 0x000563B5, ++ 0x036, 0x0005E3B5, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000056B3, ++ 0x036, 0x0000D6B3, ++ 0x036, 0x000156B3, ++ 0x036, 0x0001D6B3, ++ 0x036, 0x00026634, ++ 0x036, 0x0002E634, ++ 0x036, 0x00036634, ++ 0x036, 0x0003E634, ++ 0x036, 0x000467B4, ++ 0x036, 0x0004E7B4, ++ 0x036, 0x000567B4, ++ 0x036, 0x0005E7B4, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000063B5, ++ 0x036, 0x0000E3B5, ++ 0x036, 0x000163B5, ++ 0x036, 0x0001E3B5, ++ 0x036, 0x000263B5, ++ 0x036, 0x0002E3B5, ++ 0x036, 0x000363B5, ++ 0x036, 0x0003E3B5, ++ 0x036, 0x000463B5, ++ 0x036, 0x0004E3B5, ++ 0x036, 0x000563B5, ++ 0x036, 0x0005E3B5, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1688,7 +1808,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x036, 0x000056B3, + 0x036, 0x0000D6B3, + 0x036, 0x000156B3, +@@ -1701,103 +1821,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x0004E7B4, + 0x036, 0x000567B4, + 0x036, 0x0005E7B4, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x0EF, 0x00000008, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x000001B6, ++ 0x03C, 0x00000492, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x0000022A, ++ 0x03C, 0x00000594, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x000001B6, ++ 0x03C, 0x00000492, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x03C, 0x0000022A, + 0x03C, 0x00000594, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000820, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000820, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000800, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000800, ++ 0xA0000000, 0x00000000, + 0x03C, 0x00000900, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000002, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x008, 0x00002000, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x0DF, 0x000000C0, +- 0x01F, 0x00040064, +- 0xFF0F0104, 0xABCD, ++ 0x01F, 0x00000064, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xFF0F0404, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x058, 0x00081184, + 0x059, 0x0006016C, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EFD83, ++ 0x062, 0x00093FCC, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EAD53, ++ 0x062, 0x00093BC4, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EFD83, ++ 0x062, 0x00093FCC, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x061, 0x000EAD53, + 0x062, 0x00093BC4, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110EB, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0200, 0xCDEF, +- 0x063, 0x000710E9, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110EB, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110E9, ++ 0xA0000000, 0x00000000, + 0x063, 0x000714E9, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C27C, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C27C, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xFF0F0204, 0xCDEF, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C67C, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xFF0F0404, 0xCDEF, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x064, 0x0001C67C, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0200, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00091016, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00091016, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x065, 0x00093016, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x065, 0x00093015, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00093015, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00093016, ++ 0xA0000000, 0x00000000, + 0x065, 0x00091016, +- 0xFF0F0200, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x018, 0x00000006, + 0x0EF, 0x00002000, + 0x03B, 0x0003824B, +@@ -1895,9 +2074,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x0B4, 0x0001214C, + 0x0B7, 0x0003000C, + 0x01C, 0x000539D2, ++ 0x0C4, 0x000AFE00, + 0x018, 0x0001F12A, +- 0x0FE, 0x00000000, +- 0x0FE, 0x00000000, ++ 0xFFE, 0x00000000, ++ 0xFFE, 0x00000000, + 0x018, 0x0001712A, + + }; +@@ -2017,6 +2197,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = { + u32 RTL8812AE_MAC_1T_ARRAYLEN = ARRAY_SIZE(RTL8812AE_MAC_REG_ARRAY); + + u32 RTL8821AE_MAC_REG_ARRAY[] = { ++ 0x421, 0x0000000F, + 0x428, 0x0000000A, + 0x429, 0x00000010, + 0x430, 0x00000000, +@@ -2485,7 +2666,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0xA6360001, + 0x81C, 0xA5380001, + 0x81C, 0xA43A0001, +- 0x81C, 0xA33C0001, ++ 0x81C, 0x683C0001, + 0x81C, 0x673E0001, + 0x81C, 0x66400001, + 0x81C, 0x65420001, +@@ -2519,7 +2700,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x017A0001, + 0x81C, 0x017C0001, + 0x81C, 0x017E0001, +- 0xFF0F02C0, 0xABCD, ++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x81C, 0xFB000101, ++ 0x81C, 0xFA020101, ++ 0x81C, 0xF9040101, ++ 0x81C, 0xF8060101, ++ 0x81C, 0xF7080101, ++ 0x81C, 0xF60A0101, ++ 0x81C, 0xF50C0101, ++ 0x81C, 0xF40E0101, ++ 0x81C, 0xF3100101, ++ 0x81C, 0xF2120101, ++ 0x81C, 0xF1140101, ++ 0x81C, 0xF0160101, ++ 0x81C, 0xEF180101, ++ 0x81C, 0xEE1A0101, ++ 0x81C, 0xED1C0101, ++ 0x81C, 0xEC1E0101, ++ 0x81C, 0xEB200101, ++ 0x81C, 0xEA220101, ++ 0x81C, 0xE9240101, ++ 0x81C, 0xE8260101, ++ 0x81C, 0xE7280101, ++ 0x81C, 0xE62A0101, ++ 0x81C, 0xE52C0101, ++ 0x81C, 0xE42E0101, ++ 0x81C, 0xE3300101, ++ 0x81C, 0xA5320101, ++ 0x81C, 0xA4340101, ++ 0x81C, 0xA3360101, ++ 0x81C, 0x87380101, ++ 0x81C, 0x863A0101, ++ 0x81C, 0x853C0101, ++ 0x81C, 0x843E0101, ++ 0x81C, 0x69400101, ++ 0x81C, 0x68420101, ++ 0x81C, 0x67440101, ++ 0x81C, 0x66460101, ++ 0x81C, 0x49480101, ++ 0x81C, 0x484A0101, ++ 0x81C, 0x474C0101, ++ 0x81C, 0x2A4E0101, ++ 0x81C, 0x29500101, ++ 0x81C, 0x28520101, ++ 0x81C, 0x27540101, ++ 0x81C, 0x26560101, ++ 0x81C, 0x25580101, ++ 0x81C, 0x245A0101, ++ 0x81C, 0x235C0101, ++ 0x81C, 0x055E0101, ++ 0x81C, 0x04600101, ++ 0x81C, 0x03620101, ++ 0x81C, 0x02640101, ++ 0x81C, 0x01660101, ++ 0x81C, 0x01680101, ++ 0x81C, 0x016A0101, ++ 0x81C, 0x016C0101, ++ 0x81C, 0x016E0101, ++ 0x81C, 0x01700101, ++ 0x81C, 0x01720101, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x81C, 0xFB000101, + 0x81C, 0xFA020101, + 0x81C, 0xF9040101, +@@ -2578,7 +2818,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x016E0101, + 0x81C, 0x01700101, + 0x81C, 0x01720101, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x81C, 0xFF000101, + 0x81C, 0xFF020101, + 0x81C, 0xFE040101, +@@ -2637,7 +2877,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x046E0101, + 0x81C, 0x03700101, + 0x81C, 0x02720101, +- 0xFF0F02C0, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x81C, 0x01740101, + 0x81C, 0x01760101, + 0x81C, 0x01780101, +-- +2.30.2 + diff --git a/queue-5.10/rtw88-fix-an-error-code-in-rtw_debugfs_set_rsvd_page.patch b/queue-5.10/rtw88-fix-an-error-code-in-rtw_debugfs_set_rsvd_page.patch new file mode 100644 index 00000000000..894b50bde0f --- /dev/null +++ b/queue-5.10/rtw88-fix-an-error-code-in-rtw_debugfs_set_rsvd_page.patch @@ -0,0 +1,38 @@ +From 0f23290f045baddc74052726d52b3c85a6c8ef33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 12:23:37 +0300 +Subject: rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() + +From: Dan Carpenter + +[ Upstream commit c9eaee0c2ec6b1002044fb698cdfb5d9ef4ed28c ] + +The sscanf() function returns the number of matches (0 or 1 in this +case). It doesn't return error codes. We should return -EINVAL if the +string is invalid + +Fixes: c376c1fc87b7 ("rtw88: add h2c command in debugfs") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YE8nmatMDBDDWkjq@mwanda +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c +index efbba9caef3b..8bb6cc8ca74e 100644 +--- a/drivers/net/wireless/realtek/rtw88/debug.c ++++ b/drivers/net/wireless/realtek/rtw88/debug.c +@@ -270,7 +270,7 @@ static ssize_t rtw_debugfs_set_rsvd_page(struct file *filp, + + if (num != 2) { + rtw_warn(rtwdev, "invalid arguments\n"); +- return num; ++ return -EINVAL; + } + + debugfs_priv->rsvd_page.page_offset = offset; +-- +2.30.2 + diff --git a/queue-5.10/sata_mv-add-irq-checks.patch b/queue-5.10/sata_mv-add-irq-checks.patch new file mode 100644 index 00000000000..2a6c56aac63 --- /dev/null +++ b/queue-5.10/sata_mv-add-irq-checks.patch @@ -0,0 +1,47 @@ +From 0eadb026853dd76857010d23ebf92d90496d3a85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 00:13:49 +0300 +Subject: sata_mv: add IRQ checks + +From: Sergey Shtylyov + +[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ] + +The function mv_platform_probe() neglects to check the results of the +calls to platform_get_irq() and irq_of_parse_and_map() and blithely +passes them to ata_host_activate() -- while the latter only checks +for IRQ0 (treating it as a polling mode indicattion) and passes the +negative values to devm_request_irq() causing it to fail as it takes +unsigned values for the IRQ #... + +Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ +#s to ata_host_activate(), propagate upstream the negative error codes, +and override the IRQ0 with -EINVAL (as we don't want the polling mode). + +Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_mv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index 664ef658a955..b62446ea5f40 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -4097,6 +4097,10 @@ static int mv_platform_probe(struct platform_device *pdev) + n_ports = mv_platform_data->n_ports; + irq = platform_get_irq(pdev, 0); + } ++ if (irq < 0) ++ return irq; ++ if (!irq) ++ return -EINVAL; + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); + hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL); +-- +2.30.2 + diff --git a/queue-5.10/sched-debug-fix-cgroup_path-serialization.patch b/queue-5.10/sched-debug-fix-cgroup_path-serialization.patch new file mode 100644 index 00000000000..5118c0e6f16 --- /dev/null +++ b/queue-5.10/sched-debug-fix-cgroup_path-serialization.patch @@ -0,0 +1,158 @@ +From b805ca052815e3759db58c1af8c5971397b62baf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 15:54:26 -0400 +Subject: sched/debug: Fix cgroup_path[] serialization + +From: Waiman Long + +[ Upstream commit ad789f84c9a145f8a18744c0387cec22ec51651e ] + +The handling of sysrq key can be activated by echoing the key to +/proc/sysrq-trigger or via the magic key sequence typed into a terminal +that is connected to the system in some way (serial, USB or other mean). +In the former case, the handling is done in a user context. In the +latter case, it is likely to be in an interrupt context. + +Currently in print_cpu() of kernel/sched/debug.c, sched_debug_lock is +taken with interrupt disabled for the whole duration of the calls to +print_*_stats() and print_rq() which could last for the quite some time +if the information dump happens on the serial console. + +If the system has many cpus and the sched_debug_lock is somehow busy +(e.g. parallel sysrq-t), the system may hit a hard lockup panic +depending on the actually serial console implementation of the +system. + +The purpose of sched_debug_lock is to serialize the use of the global +cgroup_path[] buffer in print_cpu(). The rests of the printk calls don't +need serialization from sched_debug_lock. + +Calling printk() with interrupt disabled can still be problematic if +multiple instances are running. Allocating a stack buffer of PATH_MAX +bytes is not feasible because of the limited size of the kernel stack. + +The solution implemented in this patch is to allow only one caller at a +time to use the full size group_path[], while other simultaneous callers +will have to use shorter stack buffers with the possibility of path +name truncation. A "..." suffix will be printed if truncation may have +happened. The cgroup path name is provided for informational purpose +only, so occasional path name truncation should not be a big problem. + +Fixes: efe25c2c7b3a ("sched: Reinstate group names in /proc/sched_debug") +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415195426.6677-1-longman@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 42 +++++++++++++++++++++++++++++------------- + 1 file changed, 29 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 2357921580f9..6264584b51c2 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -8,8 +8,6 @@ + */ + #include "sched.h" + +-static DEFINE_SPINLOCK(sched_debug_lock); +- + /* + * This allows printing both to /proc/sched_debug and + * to the console +@@ -470,16 +468,37 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group + #endif + + #ifdef CONFIG_CGROUP_SCHED ++static DEFINE_SPINLOCK(sched_debug_lock); + static char group_path[PATH_MAX]; + +-static char *task_group_path(struct task_group *tg) ++static void task_group_path(struct task_group *tg, char *path, int plen) + { +- if (autogroup_path(tg, group_path, PATH_MAX)) +- return group_path; ++ if (autogroup_path(tg, path, plen)) ++ return; + +- cgroup_path(tg->css.cgroup, group_path, PATH_MAX); ++ cgroup_path(tg->css.cgroup, path, plen); ++} + +- return group_path; ++/* ++ * Only 1 SEQ_printf_task_group_path() caller can use the full length ++ * group_path[] for cgroup path. Other simultaneous callers will have ++ * to use a shorter stack buffer. A "..." suffix is appended at the end ++ * of the stack buffer so that it will show up in case the output length ++ * matches the given buffer size to indicate possible path name truncation. ++ */ ++#define SEQ_printf_task_group_path(m, tg, fmt...) \ ++{ \ ++ if (spin_trylock(&sched_debug_lock)) { \ ++ task_group_path(tg, group_path, sizeof(group_path)); \ ++ SEQ_printf(m, fmt, group_path); \ ++ spin_unlock(&sched_debug_lock); \ ++ } else { \ ++ char buf[128]; \ ++ char *bufend = buf + sizeof(buf) - 3; \ ++ task_group_path(tg, buf, bufend - buf); \ ++ strcpy(bufend - 1, "..."); \ ++ SEQ_printf(m, fmt, buf); \ ++ } \ + } + #endif + +@@ -506,7 +525,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p) + SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p)); + #endif + #ifdef CONFIG_CGROUP_SCHED +- SEQ_printf(m, " %s", task_group_path(task_group(p))); ++ SEQ_printf_task_group_path(m, task_group(p), " %s") + #endif + + SEQ_printf(m, "\n"); +@@ -543,7 +562,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) + + #ifdef CONFIG_FAIR_GROUP_SCHED + SEQ_printf(m, "\n"); +- SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg)); ++ SEQ_printf_task_group_path(m, cfs_rq->tg, "cfs_rq[%d]:%s\n", cpu); + #else + SEQ_printf(m, "\n"); + SEQ_printf(m, "cfs_rq[%d]:\n", cpu); +@@ -614,7 +633,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq) + { + #ifdef CONFIG_RT_GROUP_SCHED + SEQ_printf(m, "\n"); +- SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg)); ++ SEQ_printf_task_group_path(m, rt_rq->tg, "rt_rq[%d]:%s\n", cpu); + #else + SEQ_printf(m, "\n"); + SEQ_printf(m, "rt_rq[%d]:\n", cpu); +@@ -666,7 +685,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) + static void print_cpu(struct seq_file *m, int cpu) + { + struct rq *rq = cpu_rq(cpu); +- unsigned long flags; + + #ifdef CONFIG_X86 + { +@@ -717,13 +735,11 @@ do { \ + } + #undef P + +- spin_lock_irqsave(&sched_debug_lock, flags); + print_cfs_stats(m, cpu); + print_rt_stats(m, cpu); + print_dl_stats(m, cpu); + + print_rq(m, rq, cpu); +- spin_unlock_irqrestore(&sched_debug_lock, flags); + SEQ_printf(m, "\n"); + } + +-- +2.30.2 + diff --git a/queue-5.10/sched-fair-fix-shift-out-of-bounds-in-load_balance.patch b/queue-5.10/sched-fair-fix-shift-out-of-bounds-in-load_balance.patch new file mode 100644 index 00000000000..92095b1b8c1 --- /dev/null +++ b/queue-5.10/sched-fair-fix-shift-out-of-bounds-in-load_balance.patch @@ -0,0 +1,115 @@ +From fdeb49f1b35cf30875fd8d2a8ec2089881fb2429 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:56:56 +0000 +Subject: sched/fair: Fix shift-out-of-bounds in load_balance() + +From: Valentin Schneider + +[ Upstream commit 39a2a6eb5c9b66ea7c8055026303b3aa681b49a5 ] + +Syzbot reported a handful of occurrences where an sd->nr_balance_failed can +grow to much higher values than one would expect. + +A successful load_balance() resets it to 0; a failed one increments +it. Once it gets to sd->cache_nice_tries + 3, this *should* trigger an +active balance, which will either set it to sd->cache_nice_tries+1 or reset +it to 0. However, in case the to-be-active-balanced task is not allowed to +run on env->dst_cpu, then the increment is done without any further +modification. + +This could then be repeated ad nauseam, and would explain the absurdly high +values reported by syzbot (86, 149). VincentG noted there is value in +letting sd->cache_nice_tries grow, so the shift itself should be +fixed. That means preventing: + + """ + If the value of the right operand is negative or is greater than or equal + to the width of the promoted left operand, the behavior is undefined. + """ + +Thus we need to cap the shift exponent to + BITS_PER_TYPE(typeof(lefthand)) - 1. + +I had a look around for other similar cases via coccinelle: + + @expr@ + position pos; + expression E1; + expression E2; + @@ + ( + E1 >> E2@pos + | + E1 >> E2@pos + ) + + @cst depends on expr@ + position pos; + expression expr.E1; + constant cst; + @@ + ( + E1 >> cst@pos + | + E1 << cst@pos + ) + + @script:python depends on !cst@ + pos << expr.pos; + exp << expr.E2; + @@ + # Dirty hack to ignore constexpr + if exp.upper() != exp: + coccilib.report.print_report(pos[0], "Possible UB shift here") + +The only other match in kernel/sched is rq_clock_thermal() which employs +sched_thermal_decay_shift, and that exponent is already capped to 10, so +that one is fine. + +Fixes: 5a7f55590467 ("sched/fair: Relax constraint on task's load during load balance") +Reported-by: syzbot+d7581744d5fd27c9fbe1@syzkaller.appspotmail.com +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: http://lore.kernel.org/r/000000000000ffac1205b9a2112f@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 3 +-- + kernel/sched/sched.h | 7 +++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index a0239649c741..c80d1a039d19 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7735,8 +7735,7 @@ static int detach_tasks(struct lb_env *env) + * scheduler fails to find a good waiting task to + * migrate. + */ +- +- if ((load >> env->sd->nr_balance_failed) > env->imbalance) ++ if (shr_bound(load, env->sd->nr_balance_failed) > env->imbalance) + goto next; + + env->imbalance -= load; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index fac1b121d113..fdebfcbdfca9 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -205,6 +205,13 @@ static inline void update_avg(u64 *avg, u64 sample) + *avg += diff / 8; + } + ++/* ++ * Shifting a value by an exponent greater *or equal* to the size of said value ++ * is UB; cap at size-1. ++ */ ++#define shr_bound(val, shift) \ ++ (val >> min_t(typeof(shift), shift, BITS_PER_TYPE(typeof(val)) - 1)) ++ + /* + * !! For sched_setattr_nocheck() (kernel) only !! + * +-- +2.30.2 + diff --git a/queue-5.10/scsi-hisi_sas-fix-irq-checks.patch b/queue-5.10/scsi-hisi_sas-fix-irq-checks.patch new file mode 100644 index 00000000000..7d2f5a57dd3 --- /dev/null +++ b/queue-5.10/scsi-hisi_sas-fix-irq-checks.patch @@ -0,0 +1,58 @@ +From 8828206c601d2097591327746a204f6269472d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Apr 2021 23:43:55 +0300 +Subject: scsi: hisi_sas: Fix IRQ checks + +From: Sergey Shtylyov + +[ Upstream commit 6c11dc060427e07ca144eacaccd696106b361b06 ] + +Commit df2d8213d9e3 ("hisi_sas: use platform_get_irq()") failed to take +into account that irq_of_parse_and_map() and platform_get_irq() have a +different way of indicating an error: the former returns 0 and the latter +returns a negative error code. Fix up the IRQ checks! + +Link: https://lore.kernel.org/r/810f26d3-908b-1d6b-dc5c-40019726baca@omprussia.ru +Fixes: df2d8213d9e3 ("hisi_sas: use platform_get_irq()") +Acked-by: John Garry +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index 22eecc89d41b..6c2a97f80b12 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -1644,7 +1644,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + idx = i * HISI_SAS_PHY_INT_NR; + for (j = 0; j < HISI_SAS_PHY_INT_NR; j++, idx++) { + irq = platform_get_irq(pdev, idx); +- if (!irq) { ++ if (irq < 0) { + dev_err(dev, "irq init: fail map phy interrupt %d\n", + idx); + return -ENOENT; +@@ -1663,7 +1663,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + idx = hisi_hba->n_phy * HISI_SAS_PHY_INT_NR; + for (i = 0; i < hisi_hba->queue_count; i++, idx++) { + irq = platform_get_irq(pdev, idx); +- if (!irq) { ++ if (irq < 0) { + dev_err(dev, "irq init: could not map cq interrupt %d\n", + idx); + return -ENOENT; +@@ -1681,7 +1681,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + idx = (hisi_hba->n_phy * HISI_SAS_PHY_INT_NR) + hisi_hba->queue_count; + for (i = 0; i < HISI_SAS_FATAL_INT_NR; i++, idx++) { + irq = platform_get_irq(pdev, idx); +- if (!irq) { ++ if (irq < 0) { + dev_err(dev, "irq init: could not map fatal interrupt %d\n", + idx); + return -ENOENT; +-- +2.30.2 + diff --git a/queue-5.10/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch b/queue-5.10/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch new file mode 100644 index 00000000000..43a86fba91a --- /dev/null +++ b/queue-5.10/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch @@ -0,0 +1,132 @@ +From c381de7c39580ec0df248617c421636af8cb73a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 18:10:09 -0600 +Subject: scsi: ibmvfc: Fix invalid state machine BUG_ON() + +From: Brian King + +[ Upstream commit 15cfef8623a449d40d16541687afd58e78033be3 ] + +This fixes an issue hitting the BUG_ON() in ibmvfc_do_work(). When going +through a host action of IBMVFC_HOST_ACTION_RESET, we change the action to +IBMVFC_HOST_ACTION_TGT_DEL, then drop the host lock, and reset the CRQ, +which changes the host state to IBMVFC_NO_CRQ. If, prior to setting the +host state to IBMVFC_NO_CRQ, ibmvfc_init_host() is called, it can then end +up changing the host action to IBMVFC_HOST_ACTION_INIT. If we then change +the host state to IBMVFC_NO_CRQ, we will then hit the BUG_ON(). + +Make a couple of changes to avoid this. Leave the host action to be +IBMVFC_HOST_ACTION_RESET or IBMVFC_HOST_ACTION_REENABLE until after we drop +the host lock and reset or reenable the CRQ. Also harden the host state +machine to ensure we cannot leave the reset / reenable state until we've +finished processing the reset or reenable. + +Link: https://lore.kernel.org/r/20210413001009.902400-1-tyreld@linux.ibm.com +Fixes: 73ee5d867287 ("[SCSI] ibmvfc: Fix soft lockup on resume") +Signed-off-by: Brian King +[tyreld: added fixes tag] +Signed-off-by: Tyrel Datwyler +[mkp: fix comment checkpatch warnings] +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 57 ++++++++++++++++++++++------------ + 1 file changed, 38 insertions(+), 19 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 57c9a71fa33a..f6d6539c657f 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -532,8 +532,17 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost, + if (vhost->action == IBMVFC_HOST_ACTION_ALLOC_TGTS) + vhost->action = action; + break; ++ case IBMVFC_HOST_ACTION_REENABLE: ++ case IBMVFC_HOST_ACTION_RESET: ++ vhost->action = action; ++ break; + case IBMVFC_HOST_ACTION_INIT: + case IBMVFC_HOST_ACTION_TGT_DEL: ++ case IBMVFC_HOST_ACTION_LOGO: ++ case IBMVFC_HOST_ACTION_QUERY_TGTS: ++ case IBMVFC_HOST_ACTION_TGT_DEL_FAILED: ++ case IBMVFC_HOST_ACTION_NONE: ++ default: + switch (vhost->action) { + case IBMVFC_HOST_ACTION_RESET: + case IBMVFC_HOST_ACTION_REENABLE: +@@ -543,15 +552,6 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost, + break; + } + break; +- case IBMVFC_HOST_ACTION_LOGO: +- case IBMVFC_HOST_ACTION_QUERY_TGTS: +- case IBMVFC_HOST_ACTION_TGT_DEL_FAILED: +- case IBMVFC_HOST_ACTION_NONE: +- case IBMVFC_HOST_ACTION_RESET: +- case IBMVFC_HOST_ACTION_REENABLE: +- default: +- vhost->action = action; +- break; + } + } + +@@ -4658,26 +4658,45 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + case IBMVFC_HOST_ACTION_INIT_WAIT: + break; + case IBMVFC_HOST_ACTION_RESET: +- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + rc = ibmvfc_reset_crq(vhost); ++ + spin_lock_irqsave(vhost->host->host_lock, flags); +- if (rc == H_CLOSED) ++ if (!rc || rc == H_CLOSED) + vio_enable_interrupts(to_vio_dev(vhost->dev)); +- if (rc || (rc = ibmvfc_send_crq_init(vhost)) || +- (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) { +- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); +- dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc); ++ if (vhost->action == IBMVFC_HOST_ACTION_RESET) { ++ /* ++ * The only action we could have changed to would have ++ * been reenable, in which case, we skip the rest of ++ * this path and wait until we've done the re-enable ++ * before sending the crq init. ++ */ ++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; ++ ++ if (rc || (rc = ibmvfc_send_crq_init(vhost)) || ++ (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) { ++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); ++ dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc); ++ } + } + break; + case IBMVFC_HOST_ACTION_REENABLE: +- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + rc = ibmvfc_reenable_crq_queue(vhost); ++ + spin_lock_irqsave(vhost->host->host_lock, flags); +- if (rc || (rc = ibmvfc_send_crq_init(vhost))) { +- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); +- dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc); ++ if (vhost->action == IBMVFC_HOST_ACTION_REENABLE) { ++ /* ++ * The only action we could have changed to would have ++ * been reset, in which case, we skip the rest of this ++ * path and wait until we've done the reset before ++ * sending the crq init. ++ */ ++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; ++ if (rc || (rc = ibmvfc_send_crq_init(vhost))) { ++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); ++ dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc); ++ } + } + break; + case IBMVFC_HOST_ACTION_LOGO: +-- +2.30.2 + diff --git a/queue-5.10/scsi-jazz_esp-add-irq-check.patch b/queue-5.10/scsi-jazz_esp-add-irq-check.patch new file mode 100644 index 00000000000..585f0590c1d --- /dev/null +++ b/queue-5.10/scsi-jazz_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From 88b2cd23dcee87190466164d095300baa11738a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:43:23 +0300 +Subject: scsi: jazz_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru +Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/jazz_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c +index f0ed6863cc70..60a88a95a8e2 100644 +--- a/drivers/scsi/jazz_esp.c ++++ b/drivers/scsi/jazz_esp.c +@@ -143,7 +143,9 @@ static int esp_jazz_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp); + if (err < 0) + goto fail_unmap_command_block; +-- +2.30.2 + diff --git a/queue-5.10/scsi-pm80xx-fix-potential-infinite-loop.patch b/queue-5.10/scsi-pm80xx-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..cf6e7f3f8c7 --- /dev/null +++ b/queue-5.10/scsi-pm80xx-fix-potential-infinite-loop.patch @@ -0,0 +1,44 @@ +From f760becefa64a4de1d1322d764286c4b8048e056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 14:58:40 +0100 +Subject: scsi: pm80xx: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit 40fa7394a1ad5706e795823276f2e394cca145d0 ] + +The for-loop iterates with a u8 loop counter i and compares this with the +loop upper limit of pm8001_ha->max_q_num which is a u32 type. There is a +potential infinite loop if pm8001_ha->max_q_num is larger than the u8 loop +counter. Fix this by making the loop counter the same type as +pm8001_ha->max_q_num. + +[mkp: this is purely theoretical, max_q_num is currently limited to 64] + +Link: https://lore.kernel.org/r/20210407135840.494747-1-colin.king@canonical.com +Fixes: 65df7d1986a1 ("scsi: pm80xx: Fix chip initialization failure") +Addresses-Coverity: ("Infinite loop") +Reviewed-by: Johannes Thumshirn +Signed-off-by: Colin Ian King +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index c4705269e39f..355d1c5f2194 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -643,7 +643,7 @@ static void init_pci_device_addresses(struct pm8001_hba_info *pm8001_ha) + */ + static int pm8001_chip_init(struct pm8001_hba_info *pm8001_ha) + { +- u8 i = 0; ++ u32 i = 0; + u16 deviceid; + pci_read_config_word(pm8001_ha->pdev, PCI_DEVICE_ID, &deviceid); + /* 8081 controllers need BAR shift to access MPI space +-- +2.30.2 + diff --git a/queue-5.10/scsi-pm80xx-increase-timeout-for-pm80xx-mpi_uninit_c.patch b/queue-5.10/scsi-pm80xx-increase-timeout-for-pm80xx-mpi_uninit_c.patch new file mode 100644 index 00000000000..771cd47c28b --- /dev/null +++ b/queue-5.10/scsi-pm80xx-increase-timeout-for-pm80xx-mpi_uninit_c.patch @@ -0,0 +1,48 @@ +From e1adf6b9854a54849f2a6e20b5deca66a8328336 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 11:05:33 -0700 +Subject: scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() + +From: Igor Pylypiv + +[ Upstream commit 3f744a14f331f56703a9d74e86520db045f11831 ] + +The mpi_uninit_check() takes longer for inbound doorbell register to be +cleared. Increase the timeout substantially so that the driver does not +fail to load. + +Previously, the inbound doorbell wait time was mistakenly increased in the +mpi_init_check() instead of mpi_uninit_check(). It is okay to leave the +mpi_init_check() wait time as-is as these are timeout values and if there +is a failure, waiting longer is not an issue. + +Link: https://lore.kernel.org/r/20210406180534.1924345-2-ipylypiv@google.com +Fixes: e90e236250e9 ("scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check") +Reviewed-by: Vishakha Channapattan +Acked-by: Jack Wang +Signed-off-by: Igor Pylypiv +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 055f7649676e..27b354860a16 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -1488,9 +1488,9 @@ static int mpi_uninit_check(struct pm8001_hba_info *pm8001_ha) + + /* wait until Inbound DoorBell Clear Register toggled */ + if (IS_SPCV_12G(pm8001_ha->pdev)) { +- max_wait_count = 4 * 1000 * 1000;/* 4 sec */ ++ max_wait_count = 30 * 1000 * 1000; /* 30 sec */ + } else { +- max_wait_count = 2 * 1000 * 1000;/* 2 sec */ ++ max_wait_count = 15 * 1000 * 1000; /* 15 sec */ + } + do { + udelay(1); +-- +2.30.2 + diff --git a/queue-5.10/scsi-sni_53c710-add-irq-check.patch b/queue-5.10/scsi-sni_53c710-add-irq-check.patch new file mode 100644 index 00000000000..dba99e9ed4a --- /dev/null +++ b/queue-5.10/scsi-sni_53c710-add-irq-check.patch @@ -0,0 +1,49 @@ +From f3379c89143569dfd37b88c92136094c03ef6415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:45:12 +0300 +Subject: scsi: sni_53c710: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV +further below). Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru +Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sni_53c710.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c +index 9e2e196bc202..97c6f81b1d2a 100644 +--- a/drivers/scsi/sni_53c710.c ++++ b/drivers/scsi/sni_53c710.c +@@ -58,6 +58,7 @@ static int snirm710_probe(struct platform_device *dev) + struct NCR_700_Host_Parameters *hostdata; + struct Scsi_Host *host; + struct resource *res; ++ int rc; + + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (!res) +@@ -83,7 +84,9 @@ static int snirm710_probe(struct platform_device *dev) + goto out_kfree; + host->this_id = 7; + host->base = base; +- host->irq = platform_get_irq(dev, 0); ++ host->irq = rc = platform_get_irq(dev, 0); ++ if (rc < 0) ++ goto out_put_host; + if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) { + printk(KERN_ERR "snirm710: request_irq failed!\n"); + goto out_put_host; +-- +2.30.2 + diff --git a/queue-5.10/scsi-sun3x_esp-add-irq-check.patch b/queue-5.10/scsi-sun3x_esp-add-irq-check.patch new file mode 100644 index 00000000000..7d514f3f6a6 --- /dev/null +++ b/queue-5.10/scsi-sun3x_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From 2a98341e39ae9d1c0904e66fa95e6edd7e917c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:44:08 +0300 +Subject: scsi: sun3x_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru +Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sun3x_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c +index 7de82f2c9757..d3489ac7ab28 100644 +--- a/drivers/scsi/sun3x_esp.c ++++ b/drivers/scsi/sun3x_esp.c +@@ -206,7 +206,9 @@ static int esp_sun3x_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs_dma; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, + "SUN3X ESP", esp); + if (err < 0) +-- +2.30.2 + diff --git a/queue-5.10/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing.patch b/queue-5.10/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing.patch new file mode 100644 index 00000000000..90d5cb8ee3c --- /dev/null +++ b/queue-5.10/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing.patch @@ -0,0 +1,39 @@ +From ebba8038dd3956b3a3e2f0354784f192262a16f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 23:50:58 +0300 +Subject: scsi: ufs: ufshcd-pltfrm: Fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 339c9b63cc7ce779ce45c675bf709cb58b807fc3 ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENODEV, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Propagate the error code +upstream as it should have been done from the start... + +Link: https://lore.kernel.org/r/420364ca-614a-45e3-4e35-0e0653c7bc53@omprussia.ru +Fixes: 2953f850c3b8 ("[SCSI] ufs: use devres functions for ufshcd") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd-pltfrm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c +index 3db0af66c71c..24927cf485b4 100644 +--- a/drivers/scsi/ufs/ufshcd-pltfrm.c ++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c +@@ -377,7 +377,7 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, + + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +- err = -ENODEV; ++ err = irq; + goto out; + } + +-- +2.30.2 + diff --git a/queue-5.10/seccomp-fix-config-tests-for-seccomp_filters.patch b/queue-5.10/seccomp-fix-config-tests-for-seccomp_filters.patch new file mode 100644 index 00000000000..0589ca5078b --- /dev/null +++ b/queue-5.10/seccomp-fix-config-tests-for-seccomp_filters.patch @@ -0,0 +1,55 @@ +From 54dd367489dee1f3c67c053044bd961d209b34dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Mar 2021 15:52:19 +0000 +Subject: seccomp: Fix CONFIG tests for Seccomp_filters + +From: Kenta.Tada@sony.com + +[ Upstream commit 64bdc0244054f7d4bb621c8b4455e292f4e421bc ] + +Strictly speaking, seccomp filters are only used +when CONFIG_SECCOMP_FILTER. +This patch fixes the condition to enable "Seccomp_filters" +in /proc/$pid/status. + +Signed-off-by: Kenta Tada +Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status") +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/OSBPR01MB26772D245E2CF4F26B76A989F5669@OSBPR01MB2677.jpnprd01.prod.outlook.com +Signed-off-by: Sasha Levin +--- + fs/proc/array.c | 2 ++ + init/init_task.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/proc/array.c b/fs/proc/array.c +index 65ec2029fa80..18a4588c35be 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -341,8 +341,10 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) + seq_put_decimal_ull(m, "NoNewPrivs:\t", task_no_new_privs(p)); + #ifdef CONFIG_SECCOMP + seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode); ++#ifdef CONFIG_SECCOMP_FILTER + seq_put_decimal_ull(m, "\nSeccomp_filters:\t", + atomic_read(&p->seccomp.filter_count)); ++#endif + #endif + seq_puts(m, "\nSpeculation_Store_Bypass:\t"); + switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { +diff --git a/init/init_task.c b/init/init_task.c +index 16d14c2ebb55..5fa18ed59d33 100644 +--- a/init/init_task.c ++++ b/init/init_task.c +@@ -210,7 +210,7 @@ struct task_struct init_task + #ifdef CONFIG_SECURITY + .security = NULL, + #endif +-#ifdef CONFIG_SECCOMP ++#ifdef CONFIG_SECCOMP_FILTER + .seccomp = { .filter_count = ATOMIC_INIT(0) }, + #endif + }; +-- +2.30.2 + diff --git a/queue-5.10/security-keys-trusted-fix-tpm2-authorizations.patch b/queue-5.10/security-keys-trusted-fix-tpm2-authorizations.patch new file mode 100644 index 00000000000..a621c91defa --- /dev/null +++ b/queue-5.10/security-keys-trusted-fix-tpm2-authorizations.patch @@ -0,0 +1,138 @@ +From b3bd88b8360ccc54844b8c5ba85a9ed48955006a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 11:06:15 -0800 +Subject: security: keys: trusted: fix TPM2 authorizations + +From: James Bottomley + +[ Upstream commit de66514d934d70ce73c302ce0644b54970fc7196 ] + +In TPM 1.2 an authorization was a 20 byte number. The spec actually +recommended you to hash variable length passwords and use the sha1 +hash as the authorization. Because the spec doesn't require this +hashing, the current authorization for trusted keys is a 40 digit hex +number. For TPM 2.0 the spec allows the passing in of variable length +passwords and passphrases directly, so we should allow that in trusted +keys for ease of use. Update the 'blobauth' parameter to take this +into account, so we can now use plain text passwords for the keys. + +so before + +keyctl add trusted kmk "new 32 blobauth=f572d396fae9206628714fb2ce00f72e94f2258fkeyhandle=81000001" @u + +after we will accept both the old hex sha1 form as well as a new +directly supplied password: + +keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" @u + +Since a sha1 hex code must be exactly 40 bytes long and a direct +password must be 20 or less, we use the length as the discriminator +for which form is input. + +Note this is both and enhancement and a potential bug fix. The TPM +2.0 spec requires us to strip leading zeros, meaning empyty +authorization is a zero length HMAC whereas we're currently passing in +20 bytes of zeros. A lot of TPMs simply accept this as OK, but the +Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this patch +makes the Microsoft TPM emulator work with trusted keys. + +Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips") +Signed-off-by: James Bottomley +Reviewed-by: Jarkko Sakkinen +Tested-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + include/keys/trusted-type.h | 1 + + security/keys/trusted-keys/trusted_tpm1.c | 32 ++++++++++++++++++----- + security/keys/trusted-keys/trusted_tpm2.c | 10 ++++--- + 3 files changed, 33 insertions(+), 10 deletions(-) + +diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h +index a94c03a61d8f..b2ed3481c6a0 100644 +--- a/include/keys/trusted-type.h ++++ b/include/keys/trusted-type.h +@@ -30,6 +30,7 @@ struct trusted_key_options { + uint16_t keytype; + uint32_t keyhandle; + unsigned char keyauth[TPM_DIGEST_SIZE]; ++ uint32_t blobauth_len; + unsigned char blobauth[TPM_DIGEST_SIZE]; + uint32_t pcrinfo_len; + unsigned char pcrinfo[MAX_PCRINFO_SIZE]; +diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c +index 7a937c3c5283..230c0b27b77d 100644 +--- a/security/keys/trusted-keys/trusted_tpm1.c ++++ b/security/keys/trusted-keys/trusted_tpm1.c +@@ -791,13 +791,33 @@ static int getoptions(char *c, struct trusted_key_payload *pay, + return -EINVAL; + break; + case Opt_blobauth: +- if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE) +- return -EINVAL; +- res = hex2bin(opt->blobauth, args[0].from, +- SHA1_DIGEST_SIZE); +- if (res < 0) +- return -EINVAL; ++ /* ++ * TPM 1.2 authorizations are sha1 hashes passed in as ++ * hex strings. TPM 2.0 authorizations are simple ++ * passwords (although it can take a hash as well) ++ */ ++ opt->blobauth_len = strlen(args[0].from); ++ ++ if (opt->blobauth_len == 2 * TPM_DIGEST_SIZE) { ++ res = hex2bin(opt->blobauth, args[0].from, ++ TPM_DIGEST_SIZE); ++ if (res < 0) ++ return -EINVAL; ++ ++ opt->blobauth_len = TPM_DIGEST_SIZE; ++ break; ++ } ++ ++ if (tpm2 && opt->blobauth_len <= sizeof(opt->blobauth)) { ++ memcpy(opt->blobauth, args[0].from, ++ opt->blobauth_len); ++ break; ++ } ++ ++ return -EINVAL; ++ + break; ++ + case Opt_migratable: + if (*args[0].from == '0') + pay->migratable = 0; +diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c +index c87c4df8703d..4c19d3abddbe 100644 +--- a/security/keys/trusted-keys/trusted_tpm2.c ++++ b/security/keys/trusted-keys/trusted_tpm2.c +@@ -97,10 +97,12 @@ int tpm2_seal_trusted(struct tpm_chip *chip, + TPM_DIGEST_SIZE); + + /* sensitive */ +- tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1); ++ tpm_buf_append_u16(&buf, 4 + options->blobauth_len + payload->key_len + 1); ++ ++ tpm_buf_append_u16(&buf, options->blobauth_len); ++ if (options->blobauth_len) ++ tpm_buf_append(&buf, options->blobauth, options->blobauth_len); + +- tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE); +- tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE); + tpm_buf_append_u16(&buf, payload->key_len + 1); + tpm_buf_append(&buf, payload->key, payload->key_len); + tpm_buf_append_u8(&buf, payload->migratable); +@@ -265,7 +267,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + NULL /* nonce */, 0, + TPM2_SA_CONTINUE_SESSION, + options->blobauth /* hmac */, +- TPM_DIGEST_SIZE); ++ options->blobauth_len); + + rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); + if (rc > 0) +-- +2.30.2 + diff --git a/queue-5.10/selftests-bpf-fix-bpf_core_read_bitfield-macro.patch b/queue-5.10/selftests-bpf-fix-bpf_core_read_bitfield-macro.patch new file mode 100644 index 00000000000..a2ca66e91cb --- /dev/null +++ b/queue-5.10/selftests-bpf-fix-bpf_core_read_bitfield-macro.patch @@ -0,0 +1,179 @@ +From d3703f5abf0d029942e90733c1596bc77a817b18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 12:29:47 -0700 +Subject: selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro + +From: Andrii Nakryiko + +[ Upstream commit 0f20615d64ee2ad5e2a133a812382d0c4071589b ] + +Fix BPF_CORE_READ_BITFIELD() macro used for reading CO-RE-relocatable +bitfields. Missing breaks in a switch caused 8-byte reads always. This can +confuse libbpf because it does strict checks that memory load size corresponds +to the original size of the field, which in this case quite often would be +wrong. + +After fixing that, we run into another problem, which quite subtle, so worth +documenting here. The issue is in Clang optimization and CO-RE relocation +interactions. Without that asm volatile construct (also known as +barrier_var()), Clang will re-order BYTE_OFFSET and BYTE_SIZE relocations and +will apply BYTE_OFFSET 4 times for each switch case arm. This will result in +the same error from libbpf about mismatch of memory load size and original +field size. I.e., if we were reading u32, we'd still have *(u8 *), *(u16 *), +*(u32 *), and *(u64 *) memory loads, three of which will fail. Using +barrier_var() forces Clang to apply BYTE_OFFSET relocation first (and once) to +calculate p, after which value of p is used without relocation in each of +switch case arms, doing appropiately-sized memory load. + +Here's the list of relevant relocations and pieces of generated BPF code +before and after this patch for test_core_reloc_bitfields_direct selftests. + +BEFORE +===== + #45: core_reloc: insn #160 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32 + #46: core_reloc: insn #167 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 + #47: core_reloc: insn #174 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 + #48: core_reloc: insn #178 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 + #49: core_reloc: insn #182 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 + + 157: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll + 159: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1 + 160: b7 02 00 00 04 00 00 00 r2 = 4 +; BYTE_SIZE relocation here ^^^ + 161: 66 02 07 00 03 00 00 00 if w2 s> 3 goto +7 + 162: 16 02 0d 00 01 00 00 00 if w2 == 1 goto +13 + 163: 16 02 01 00 02 00 00 00 if w2 == 2 goto +1 + 164: 05 00 12 00 00 00 00 00 goto +18 + +0000000000000528 : + 165: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll + 167: 69 11 08 00 00 00 00 00 r1 = *(u16 *)(r1 + 8) +; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^ + 168: 05 00 0e 00 00 00 00 00 goto +14 + +0000000000000548 : + 169: 16 02 0a 00 04 00 00 00 if w2 == 4 goto +10 + 170: 16 02 01 00 08 00 00 00 if w2 == 8 goto +1 + 171: 05 00 0b 00 00 00 00 00 goto +11 + +0000000000000560 : + 172: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll + 174: 79 11 08 00 00 00 00 00 r1 = *(u64 *)(r1 + 8) +; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^ + 175: 05 00 07 00 00 00 00 00 goto +7 + +0000000000000580 : + 176: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll + 178: 71 11 08 00 00 00 00 00 r1 = *(u8 *)(r1 + 8) +; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^ + 179: 05 00 03 00 00 00 00 00 goto +3 + +00000000000005a0 : + 180: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll + 182: 61 11 08 00 00 00 00 00 r1 = *(u32 *)(r1 + 8) +; BYTE_OFFSET relo here w/ RIGHT size ^^^^^^^^^^^^^^^^ + +00000000000005b8 : + 183: 67 01 00 00 20 00 00 00 r1 <<= 32 + 184: b7 02 00 00 00 00 00 00 r2 = 0 + 185: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 + 186: c7 01 00 00 20 00 00 00 r1 s>>= 32 + 187: 05 00 01 00 00 00 00 00 goto +1 + +00000000000005e0 : + 188: 77 01 00 00 20 00 00 00 r1 >>= 32 + +AFTER +===== + + #30: core_reloc: insn #132 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 + #31: core_reloc: insn #134 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32 + + 129: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll + 131: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1 + 132: b7 01 00 00 08 00 00 00 r1 = 8 +; BYTE_OFFSET relo here ^^^ +; no size check for non-memory dereferencing instructions + 133: 0f 12 00 00 00 00 00 00 r2 += r1 + 134: b7 03 00 00 04 00 00 00 r3 = 4 +; BYTE_SIZE relocation here ^^^ + 135: 66 03 05 00 03 00 00 00 if w3 s> 3 goto +5 + 136: 16 03 09 00 01 00 00 00 if w3 == 1 goto +9 + 137: 16 03 01 00 02 00 00 00 if w3 == 2 goto +1 + 138: 05 00 0a 00 00 00 00 00 goto +10 + +0000000000000458 : + 139: 69 21 00 00 00 00 00 00 r1 = *(u16 *)(r2 + 0) +; NO CO-RE relocation here ^^^^^^^^^^^^^^^^ + 140: 05 00 08 00 00 00 00 00 goto +8 + +0000000000000468 : + 141: 16 03 06 00 04 00 00 00 if w3 == 4 goto +6 + 142: 16 03 01 00 08 00 00 00 if w3 == 8 goto +1 + 143: 05 00 05 00 00 00 00 00 goto +5 + +0000000000000480 : + 144: 79 21 00 00 00 00 00 00 r1 = *(u64 *)(r2 + 0) +; NO CO-RE relocation here ^^^^^^^^^^^^^^^^ + 145: 05 00 03 00 00 00 00 00 goto +3 + +0000000000000490 : + 146: 71 21 00 00 00 00 00 00 r1 = *(u8 *)(r2 + 0) +; NO CO-RE relocation here ^^^^^^^^^^^^^^^^ + 147: 05 00 01 00 00 00 00 00 goto +1 + +00000000000004a0 : + 148: 61 21 00 00 00 00 00 00 r1 = *(u32 *)(r2 + 0) +; NO CO-RE relocation here ^^^^^^^^^^^^^^^^ + +00000000000004a8 : + 149: 67 01 00 00 20 00 00 00 r1 <<= 32 + 150: b7 02 00 00 00 00 00 00 r2 = 0 + 151: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 + 152: c7 01 00 00 20 00 00 00 r1 s>>= 32 + 153: 05 00 01 00 00 00 00 00 goto +1 + +00000000000004d0 : + 154: 77 01 00 00 20 00 00 00 r1 >>= 323 + +Fixes: ee26dade0e3b ("libbpf: Add support for relocatable bitfields") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Lorenz Bauer +Link: https://lore.kernel.org/bpf/20210426192949.416837-4-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/bpf_core_read.h | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/bpf_core_read.h b/tools/lib/bpf/bpf_core_read.h +index bbcefb3ff5a5..4538ed762a20 100644 +--- a/tools/lib/bpf/bpf_core_read.h ++++ b/tools/lib/bpf/bpf_core_read.h +@@ -88,11 +88,19 @@ enum bpf_enum_value_kind { + const void *p = (const void *)s + __CORE_RELO(s, field, BYTE_OFFSET); \ + unsigned long long val; \ + \ ++ /* This is a so-called barrier_var() operation that makes specified \ ++ * variable "a black box" for optimizing compiler. \ ++ * It forces compiler to perform BYTE_OFFSET relocation on p and use \ ++ * its calculated value in the switch below, instead of applying \ ++ * the same relocation 4 times for each individual memory load. \ ++ */ \ ++ asm volatile("" : "=r"(p) : "0"(p)); \ ++ \ + switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ +- case 1: val = *(const unsigned char *)p; \ +- case 2: val = *(const unsigned short *)p; \ +- case 4: val = *(const unsigned int *)p; \ +- case 8: val = *(const unsigned long long *)p; \ ++ case 1: val = *(const unsigned char *)p; break; \ ++ case 2: val = *(const unsigned short *)p; break; \ ++ case 4: val = *(const unsigned int *)p; break; \ ++ case 8: val = *(const unsigned long long *)p; break; \ + } \ + val <<= __CORE_RELO(s, field, LSHIFT_U64); \ + if (__CORE_RELO(s, field, SIGNED)) \ +-- +2.30.2 + diff --git a/queue-5.10/selftests-bpf-fix-core_reloc-test-runner.patch b/queue-5.10/selftests-bpf-fix-core_reloc-test-runner.patch new file mode 100644 index 00000000000..dd1b95506fb --- /dev/null +++ b/queue-5.10/selftests-bpf-fix-core_reloc-test-runner.patch @@ -0,0 +1,94 @@ +From ed2e021372055d14cdd9b91b56eda9d556c6fe12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 12:29:49 -0700 +Subject: selftests/bpf: Fix core_reloc test runner + +From: Andrii Nakryiko + +[ Upstream commit bede0ebf0be87e9678103486a77f39e0334c6791 ] + +Fix failed tests checks in core_reloc test runner, which allowed failing tests +to pass quietly. Also add extra check to make sure that expected to fail test cases with +invalid names are caught as test failure anyway, as this is not an expected +failure mode. Also fix mislabeled probed vs direct bitfield test cases. + +Fixes: 124a892d1c41 ("selftests/bpf: Test TYPE_EXISTS and TYPE_SIZE CO-RE relocations") +Reported-by: Lorenz Bauer +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Lorenz Bauer +Link: https://lore.kernel.org/bpf/20210426192949.416837-6-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/core_reloc.c | 20 +++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +index e15c0903fa4d..8b641c306f26 100644 +--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c ++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +@@ -192,7 +192,7 @@ static int duration = 0; + + #define BITFIELDS_CASE(name, ...) { \ + BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_probed.o", \ +- "direct:", name), \ ++ "probed:", name), \ + .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ + .input_len = sizeof(struct core_reloc_##name), \ + .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \ +@@ -200,7 +200,7 @@ static int duration = 0; + .output_len = sizeof(struct core_reloc_bitfields_output), \ + }, { \ + BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_direct.o", \ +- "probed:", name), \ ++ "direct:", name), \ + .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ + .input_len = sizeof(struct core_reloc_##name), \ + .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \ +@@ -495,8 +495,7 @@ static struct core_reloc_test_case test_cases[] = { + ARRAYS_ERR_CASE(arrays___err_too_small), + ARRAYS_ERR_CASE(arrays___err_too_shallow), + ARRAYS_ERR_CASE(arrays___err_non_array), +- ARRAYS_ERR_CASE(arrays___err_wrong_val_type1), +- ARRAYS_ERR_CASE(arrays___err_wrong_val_type2), ++ ARRAYS_ERR_CASE(arrays___err_wrong_val_type), + ARRAYS_ERR_CASE(arrays___err_bad_zero_sz_arr), + + /* enum/ptr/int handling scenarios */ +@@ -811,13 +810,20 @@ void test_core_reloc(void) + "prog '%s' not found\n", probe_name)) + goto cleanup; + ++ ++ if (test_case->btf_src_file) { ++ err = access(test_case->btf_src_file, R_OK); ++ if (!ASSERT_OK(err, "btf_src_file")) ++ goto cleanup; ++ } ++ + load_attr.obj = obj; + load_attr.log_level = 0; + load_attr.target_btf_path = test_case->btf_src_file; + err = bpf_object__load_xattr(&load_attr); + if (err) { + if (!test_case->fails) +- CHECK(false, "obj_load", "failed to load prog '%s': %d\n", probe_name, err); ++ ASSERT_OK(err, "obj_load"); + goto cleanup; + } + +@@ -851,10 +857,8 @@ void test_core_reloc(void) + goto cleanup; + } + +- if (test_case->fails) { +- CHECK(false, "obj_load_fail", "should fail to load prog '%s'\n", probe_name); ++ if (!ASSERT_FALSE(test_case->fails, "obj_load_should_fail")) + goto cleanup; +- } + + equal = memcmp(data->out, test_case->output, + test_case->output_len) == 0; +-- +2.30.2 + diff --git a/queue-5.10/selftests-bpf-fix-field-existence-co-re-reloc-tests.patch b/queue-5.10/selftests-bpf-fix-field-existence-co-re-reloc-tests.patch new file mode 100644 index 00000000000..7f4723cd075 --- /dev/null +++ b/queue-5.10/selftests-bpf-fix-field-existence-co-re-reloc-tests.patch @@ -0,0 +1,200 @@ +From 6ddc9e3146a67838d5925e89cd75f34b215bd2fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 12:29:48 -0700 +Subject: selftests/bpf: Fix field existence CO-RE reloc tests + +From: Andrii Nakryiko + +[ Upstream commit 5a30eb23922b52f33222c6729b6b3ff1c37a6c66 ] + +Negative field existence cases for have a broken assumption that FIELD_EXISTS +CO-RE relo will fail for fields that match the name but have incompatible type +signature. That's not how CO-RE relocations generally behave. Types and fields +that match by name but not by expected type are treated as non-matching +candidates and are skipped. Error later is reported if no matching candidate +was found. That's what happens for most relocations, but existence relocations +(FIELD_EXISTS and TYPE_EXISTS) are more permissive and they are designed to +return 0 or 1, depending if a match is found. This allows to handle +name-conflicting but incompatible types in BPF code easily. Combined with +___flavor suffixes, it's possible to handle pretty much any structural type +changes in kernel within the compiled once BPF source code. + +So, long story short, negative field existence test cases are invalid in their +assumptions, so this patch reworks them into a single consolidated positive +case that doesn't match any of the fields. + +Fixes: c7566a69695c ("selftests/bpf: Add field existence CO-RE relocs tests") +Reported-by: Lorenz Bauer +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Lorenz Bauer +Link: https://lore.kernel.org/bpf/20210426192949.416837-5-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/core_reloc.c | 31 ++++++++++++------- + ...ore_reloc_existence___err_wrong_arr_kind.c | 3 -- + ...loc_existence___err_wrong_arr_value_type.c | 3 -- + ...ore_reloc_existence___err_wrong_int_kind.c | 3 -- + ..._core_reloc_existence___err_wrong_int_sz.c | 3 -- + ...ore_reloc_existence___err_wrong_int_type.c | 3 -- + ..._reloc_existence___err_wrong_struct_type.c | 3 -- + ..._core_reloc_existence___wrong_field_defs.c | 3 ++ + .../selftests/bpf/progs/core_reloc_types.h | 20 ++---------- + 9 files changed, 24 insertions(+), 48 deletions(-) + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c + delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c + create mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c + +diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +index 30e40ff4b0d8..e15c0903fa4d 100644 +--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c ++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c +@@ -185,11 +185,6 @@ static int duration = 0; + .bpf_obj_file = "test_core_reloc_existence.o", \ + .btf_src_file = "btf__core_reloc_" #name ".o" \ + +-#define FIELD_EXISTS_ERR_CASE(name) { \ +- FIELD_EXISTS_CASE_COMMON(name), \ +- .fails = true, \ +-} +- + #define BITFIELDS_CASE_COMMON(objfile, test_name_prefix, name) \ + .case_name = test_name_prefix#name, \ + .bpf_obj_file = objfile, \ +@@ -592,13 +587,25 @@ static struct core_reloc_test_case test_cases[] = { + }, + .output_len = sizeof(struct core_reloc_existence_output), + }, +- +- FIELD_EXISTS_ERR_CASE(existence__err_int_sz), +- FIELD_EXISTS_ERR_CASE(existence__err_int_type), +- FIELD_EXISTS_ERR_CASE(existence__err_int_kind), +- FIELD_EXISTS_ERR_CASE(existence__err_arr_kind), +- FIELD_EXISTS_ERR_CASE(existence__err_arr_value_type), +- FIELD_EXISTS_ERR_CASE(existence__err_struct_type), ++ { ++ FIELD_EXISTS_CASE_COMMON(existence___wrong_field_defs), ++ .input = STRUCT_TO_CHAR_PTR(core_reloc_existence___wrong_field_defs) { ++ }, ++ .input_len = sizeof(struct core_reloc_existence___wrong_field_defs), ++ .output = STRUCT_TO_CHAR_PTR(core_reloc_existence_output) { ++ .a_exists = 0, ++ .b_exists = 0, ++ .c_exists = 0, ++ .arr_exists = 0, ++ .s_exists = 0, ++ .a_value = 0xff000001u, ++ .b_value = 0xff000002u, ++ .c_value = 0xff000003u, ++ .arr_value = 0xff000004u, ++ .s_value = 0xff000005u, ++ }, ++ .output_len = sizeof(struct core_reloc_existence_output), ++ }, + + /* bitfield relocation checks */ + BITFIELDS_CASE(bitfields, { +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c +deleted file mode 100644 +index dd0ffa518f36..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_arr_kind x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c +deleted file mode 100644 +index bc83372088ad..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_arr_value_type x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c +deleted file mode 100644 +index 917bec41be08..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_int_kind x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c +deleted file mode 100644 +index 6ec7e6ec1c91..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_int_sz x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c +deleted file mode 100644 +index 7bbcacf2b0d1..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_int_type x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c +deleted file mode 100644 +index f384dd38ec70..000000000000 +--- a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c ++++ /dev/null +@@ -1,3 +0,0 @@ +-#include "core_reloc_types.h" +- +-void f(struct core_reloc_existence___err_wrong_struct_type x) {} +diff --git a/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c +new file mode 100644 +index 000000000000..d14b496190c3 +--- /dev/null ++++ b/tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c +@@ -0,0 +1,3 @@ ++#include "core_reloc_types.h" ++ ++void f(struct core_reloc_existence___wrong_field_defs x) {} +diff --git a/tools/testing/selftests/bpf/progs/core_reloc_types.h b/tools/testing/selftests/bpf/progs/core_reloc_types.h +index e6e616cb7bc9..af58ef9a28ca 100644 +--- a/tools/testing/selftests/bpf/progs/core_reloc_types.h ++++ b/tools/testing/selftests/bpf/progs/core_reloc_types.h +@@ -683,27 +683,11 @@ struct core_reloc_existence___minimal { + int a; + }; + +-struct core_reloc_existence___err_wrong_int_sz { +- short a; +-}; +- +-struct core_reloc_existence___err_wrong_int_type { ++struct core_reloc_existence___wrong_field_defs { ++ void *a; + int b[1]; +-}; +- +-struct core_reloc_existence___err_wrong_int_kind { + struct{ int x; } c; +-}; +- +-struct core_reloc_existence___err_wrong_arr_kind { + int arr; +-}; +- +-struct core_reloc_existence___err_wrong_arr_value_type { +- short arr[1]; +-}; +- +-struct core_reloc_existence___err_wrong_struct_type { + int s; + }; + +-- +2.30.2 + diff --git a/queue-5.10/selftests-bpf-re-generate-vmlinux.h-and-bpf-skeleton.patch b/queue-5.10/selftests-bpf-re-generate-vmlinux.h-and-bpf-skeleton.patch new file mode 100644 index 00000000000..face7fc02f1 --- /dev/null +++ b/queue-5.10/selftests-bpf-re-generate-vmlinux.h-and-bpf-skeleton.patch @@ -0,0 +1,49 @@ +From 2957b07a981235744ecaa6de760ec90d2e1d70f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 12:40:34 -0700 +Subject: selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool + changed + +From: Andrii Nakryiko + +[ Upstream commit cab62c37be057379a2a17b1b2eacd9dcba1e14dc ] + +Trigger vmlinux.h and BPF skeletons re-generation if detected that bpftool was +re-compiled. Otherwise full `make clean` is required to get updated skeletons, +if bpftool is modified. + +Fixes: acbd06206bbb ("selftests/bpf: Add vmlinux.h selftest exercising tracing of syscalls") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210318194036.3521577-11-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 9359377aeb35..b5322d60068c 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -196,7 +196,7 @@ $(BUILD_DIR)/libbpf $(BUILD_DIR)/bpftool $(BUILD_DIR)/resolve_btfids $(INCLUDE_D + $(call msg,MKDIR,,$@) + $(Q)mkdir -p $@ + +-$(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) | $(BPFTOOL) $(INCLUDE_DIR) ++$(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) | $(INCLUDE_DIR) + ifeq ($(VMLINUX_H),) + $(call msg,GEN,,$@) + $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@ +@@ -333,7 +333,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o: \ + + $(TRUNNER_BPF_SKELS): $(TRUNNER_OUTPUT)/%.skel.h: \ + $(TRUNNER_OUTPUT)/%.o \ +- | $(BPFTOOL) $(TRUNNER_OUTPUT) ++ $(BPFTOOL) \ ++ | $(TRUNNER_OUTPUT) + $$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@) + $(Q)$$(BPFTOOL) gen skeleton $$< > $$@ + endif +-- +2.30.2 + diff --git a/queue-5.10/selftests-fix-prepending-output-to-test_progs.patch b/queue-5.10/selftests-fix-prepending-output-to-test_progs.patch new file mode 100644 index 00000000000..4e5a27bbfd7 --- /dev/null +++ b/queue-5.10/selftests-fix-prepending-output-to-test_progs.patch @@ -0,0 +1,66 @@ +From bd517147d0537674e2bc025c741fe48ed7c4df34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 01:44:20 +0100 +Subject: selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) + +From: Ilya Leoshkevich + +[ Upstream commit cb4969e6f9f5ee12521aec764fa3d4bbd91bc797 ] + +Currently the following command produces an error message: + + linux# make kselftest TARGETS=bpf O=/mnt/linux-build + # selftests: bpf: test_libbpf.sh + # ./test_libbpf.sh: line 23: ./test_libbpf_open: No such file or directory + # test_libbpf: failed at file test_l4lb.o + # selftests: test_libbpf [FAILED] + +The error message might not affect the return code of make, therefore +one needs to grep make output in order to detect it. + +This is not the only instance of the same underlying problem; any test +with more than one element in $(TEST_PROGS) fails the same way. Another +example: + + linux# make O=/mnt/linux-build TARGETS=splice kselftest + [...] + # ./short_splice_read.sh: 15: ./splice_read: not found + # FAIL: /sys/module/test_module/sections/.init.text 2 + not ok 2 selftests: splice: short_splice_read.sh # exit=1 + +The current logic prepends $(OUTPUT) only to the first member of +$(TEST_PROGS). After that, run_one() does + + cd `dirname $TEST` + +For all tests except the first one, `dirname $TEST` is ., which means +they cannot access the files generated in $(OUTPUT). + +Fix by using $(addprefix) to prepend $(OUTPUT)/ to each member of +$(TEST_PROGS). + +Fixes: 1a940687e424 ("selftests: lib.mk: copy test scripts and test files for make O=dir run") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/lib.mk | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index a5ce26d548e4..be17462fe146 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -74,7 +74,8 @@ ifdef building_out_of_srctree + rsync -aq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \ + fi + @if [ "X$(TEST_PROGS)" != "X" ]; then \ +- $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(OUTPUT)/$(TEST_PROGS)) ; \ ++ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \ ++ $(addprefix $(OUTPUT)/,$(TEST_PROGS))) ; \ + else \ + $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS)); \ + fi +-- +2.30.2 + diff --git a/queue-5.10/selftests-mlxsw-remove-a-redundant-if-statement-in-t.patch b/queue-5.10/selftests-mlxsw-remove-a-redundant-if-statement-in-t.patch new file mode 100644 index 00000000000..6f552cb8b0f --- /dev/null +++ b/queue-5.10/selftests-mlxsw-remove-a-redundant-if-statement-in-t.patch @@ -0,0 +1,47 @@ +From 32563644574e2a2632affe118bd00730ceac53fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 14:19:45 +0200 +Subject: selftests: mlxsw: Remove a redundant if statement in tc_flower_scale + test + +From: Danielle Ratson + +[ Upstream commit 1f1c92139e36223b89d8140f2b72f75e79baf8bd ] + +Currently, the error return code of the failure condition is lost after +using an if statement, so the test doesn't fail when it should. + +Remove the if statement that separates the condition and the error code +check, so the test won't always pass. + +Fixes: abfce9e062021 ("selftests: mlxsw: Reduce running time using offload indication") +Reported-by: Ido Schimmel +Signed-off-by: Danielle Ratson +Reviewed-by: Petr Machata +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh +index cc0f07e72cf2..aa74be9f47c8 100644 +--- a/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh +@@ -98,11 +98,7 @@ __tc_flower_test() + jq -r '[ .[] | select(.kind == "flower") | + .options | .in_hw ]' | jq .[] | wc -l) + [[ $((offload_count - 1)) -eq $count ]] +- if [[ $should_fail -eq 0 ]]; then +- check_err $? "Offload mismatch" +- else +- check_err_fail $should_fail $? "Offload more than expacted" +- fi ++ check_err_fail $should_fail $? "Attempt to offload $count rules (actual result $((offload_count - 1)))" + } + + tc_flower_test() +-- +2.30.2 + diff --git a/queue-5.10/selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch b/queue-5.10/selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch new file mode 100644 index 00000000000..52d1eb128fb --- /dev/null +++ b/queue-5.10/selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch @@ -0,0 +1,46 @@ +From 47c43d0994d705af768006eed9309fc4ec80a820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 14:19:43 +0200 +Subject: selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static + +From: Petr Machata + +[ Upstream commit c8d0260cdd96fdccdef0509c4160e28a1012a5d7 ] + +The FDB roaming test installs a destination MAC address on the wrong +interface of an FDB database and tests whether the mirroring fails, because +packets are sent to the wrong port. The test by mistake installs the FDB +entry as local. This worked previously, because drivers were notified of +local FDB entries in the same way as of static entries. However that has +been fixed in the commit 6ab4c3117aec ("net: bridge: don't notify switchdev +for local FDB addresses"), and local entries are not notified anymore. As a +result, the HW is not reconfigured for the FDB roam, and mirroring keeps +working, failing the test. + +To fix the issue, mark the FDB entry as static. + +Fixes: 9c7c8a82442c ("selftests: forwarding: mirror_gre_vlan_bridge_1q: Add more tests") +Signed-off-by: Petr Machata +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh +index c02291e9841e..880e3ab9d088 100755 +--- a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh ++++ b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh +@@ -271,7 +271,7 @@ test_span_gre_fdb_roaming() + + while ((RET == 0)); do + bridge fdb del dev $swp3 $h3mac vlan 555 master 2>/dev/null +- bridge fdb add dev $swp2 $h3mac vlan 555 master ++ bridge fdb add dev $swp2 $h3mac vlan 555 master static + sleep 1 + fail_test_span_gre_dir $tundev ingress + +-- +2.30.2 + diff --git a/queue-5.10/serial-core-return-early-on-unsupported-ioctls.patch b/queue-5.10/serial-core-return-early-on-unsupported-ioctls.patch new file mode 100644 index 00000000000..ad3a6641e74 --- /dev/null +++ b/queue-5.10/serial-core-return-early-on-unsupported-ioctls.patch @@ -0,0 +1,60 @@ +From ac1bd3c6e7aa75c962f932cc00752df81d71e92b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:08 +0200 +Subject: serial: core: return early on unsupported ioctls + +From: Johan Hovold + +[ Upstream commit 79c5966cec7b148199386ef9933c31b999379065 ] + +Drivers can return -ENOIOCTLCMD when an ioctl is not recognised to tell +the upper layers to continue looking for a handler. + +This is not the case for the RS485 and ISO7816 ioctls whose handlers +should return -ENOTTY directly in case a serial driver does not +implement the corresponding methods. + +Fixes: a5f276f10ff7 ("serial_core: Handle TIOC[GS]RS485 ioctls.") +Fixes: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-9-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 828f9ad1be49..c6cbaccc19b0 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1306,7 +1306,7 @@ static int uart_set_rs485_config(struct uart_port *port, + unsigned long flags; + + if (!port->rs485_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user))) + return -EFAULT; +@@ -1330,7 +1330,7 @@ static int uart_get_iso7816_config(struct uart_port *port, + struct serial_iso7816 aux; + + if (!port->iso7816_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + spin_lock_irqsave(&port->lock, flags); + aux = port->iso7816; +@@ -1350,7 +1350,7 @@ static int uart_set_iso7816_config(struct uart_port *port, + unsigned long flags; + + if (!port->iso7816_config) +- return -ENOIOCTLCMD; ++ return -ENOTTY; + + if (copy_from_user(&iso7816, iso7816_user, sizeof(*iso7816_user))) + return -EFAULT; +-- +2.30.2 + diff --git a/queue-5.10/serial-omap-don-t-disable-rs485-if-rts-gpio-is-missi.patch b/queue-5.10/serial-omap-don-t-disable-rs485-if-rts-gpio-is-missi.patch new file mode 100644 index 00000000000..4690988692e --- /dev/null +++ b/queue-5.10/serial-omap-don-t-disable-rs485-if-rts-gpio-is-missi.patch @@ -0,0 +1,69 @@ +From 36341e8471650d56c394151420c4e431a04cf6ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 23:09:45 +0200 +Subject: serial: omap: don't disable rs485 if rts gpio is missing + +From: Dario Binacchi + +[ Upstream commit 45f6b6db53c80787b79044629b062dfcf2da71ec ] + +There are rs485 transceivers (e.g. MAX13487E/MAX13488E) which +automatically disable or enable the driver and receiver to keep the bus +in the correct state. +In these cases we don't need a GPIO for flow control. + +Fixes: 4a0ac0f55b18 ("OMAP: add RS485 support") +Signed-off-by: Dario Binacchi +Link: https://lore.kernel.org/r/20210415210945.25863-1-dariobin@libero.it +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/omap-serial.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c +index 76b94d0ff586..1583e93b2202 100644 +--- a/drivers/tty/serial/omap-serial.c ++++ b/drivers/tty/serial/omap-serial.c +@@ -302,7 +302,8 @@ static void serial_omap_stop_tx(struct uart_port *port) + serial_out(up, UART_OMAP_SCR, up->scr); + res = (port->rs485.flags & SER_RS485_RTS_AFTER_SEND) ? + 1 : 0; +- if (gpiod_get_value(up->rts_gpiod) != res) { ++ if (up->rts_gpiod && ++ gpiod_get_value(up->rts_gpiod) != res) { + if (port->rs485.delay_rts_after_send > 0) + mdelay( + port->rs485.delay_rts_after_send); +@@ -411,7 +412,7 @@ static void serial_omap_start_tx(struct uart_port *port) + + /* if rts not already enabled */ + res = (port->rs485.flags & SER_RS485_RTS_ON_SEND) ? 1 : 0; +- if (gpiod_get_value(up->rts_gpiod) != res) { ++ if (up->rts_gpiod && gpiod_get_value(up->rts_gpiod) != res) { + gpiod_set_value(up->rts_gpiod, res); + if (port->rs485.delay_rts_before_send > 0) + mdelay(port->rs485.delay_rts_before_send); +@@ -1407,18 +1408,13 @@ serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485) + /* store new config */ + port->rs485 = *rs485; + +- /* +- * Just as a precaution, only allow rs485 +- * to be enabled if the gpio pin is valid +- */ + if (up->rts_gpiod) { + /* enable / disable rts */ + val = (port->rs485.flags & SER_RS485_ENABLED) ? + SER_RS485_RTS_AFTER_SEND : SER_RS485_RTS_ON_SEND; + val = (port->rs485.flags & val) ? 1 : 0; + gpiod_set_value(up->rts_gpiod, val); +- } else +- port->rs485.flags &= ~SER_RS485_ENABLED; ++ } + + /* Enable interrupts */ + up->ier = mode; +-- +2.30.2 + diff --git a/queue-5.10/serial-omap-fix-rs485-half-duplex-filtering.patch b/queue-5.10/serial-omap-fix-rs485-half-duplex-filtering.patch new file mode 100644 index 00000000000..e831e4bf370 --- /dev/null +++ b/queue-5.10/serial-omap-fix-rs485-half-duplex-filtering.patch @@ -0,0 +1,126 @@ +From 211cbdce606733751261f830bc1654efda7c1e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Apr 2021 11:47:05 +0200 +Subject: serial: omap: fix rs485 half-duplex filtering + +From: Dario Binacchi + +[ Upstream commit e2a5e8448e7393e96ccde346c68764b40a52cc10 ] + +Data received during half-duplex transmission must be filtered. +If the target device responds quickly, emptying the FIFO at the end of +the transmission can erase not only the echo characters but also part of +the response message. +By keeping the receive interrupt enabled even during transmission, it +allows you to filter each echo character and only in a number equal to +those transmitted. +The issue was generated by a target device that started responding +240us later having received a request in communication at 115200bps. +Sometimes, some messages received by the target were missing some of the +first bytes. + +Fixes: 3a13884abea0 ("tty/serial: omap: empty the RX FIFO at the end of half-duplex TX") +Signed-off-by: Dario Binacchi +Link: https://lore.kernel.org/r/20210418094705.27014-1-dariobin@libero.it +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/omap-serial.c | 39 ++++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 15 deletions(-) + +diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c +index 1583e93b2202..84e8158088cd 100644 +--- a/drivers/tty/serial/omap-serial.c ++++ b/drivers/tty/serial/omap-serial.c +@@ -159,6 +159,8 @@ struct uart_omap_port { + u32 calc_latency; + struct work_struct qos_work; + bool is_suspending; ++ ++ unsigned int rs485_tx_filter_count; + }; + + #define to_uart_omap_port(p) ((container_of((p), struct uart_omap_port, port))) +@@ -329,19 +331,6 @@ static void serial_omap_stop_tx(struct uart_port *port) + serial_out(up, UART_IER, up->ier); + } + +- if ((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { +- /* +- * Empty the RX FIFO, we are not interested in anything +- * received during the half-duplex transmission. +- */ +- serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_RCVR); +- /* Re-enable RX interrupts */ +- up->ier |= UART_IER_RLSI | UART_IER_RDI; +- up->port.read_status_mask |= UART_LSR_DR; +- serial_out(up, UART_IER, up->ier); +- } +- + pm_runtime_mark_last_busy(up->dev); + pm_runtime_put_autosuspend(up->dev); + } +@@ -367,6 +356,10 @@ static void transmit_chars(struct uart_omap_port *up, unsigned int lsr) + serial_out(up, UART_TX, up->port.x_char); + up->port.icount.tx++; + up->port.x_char = 0; ++ if ((up->port.rs485.flags & SER_RS485_ENABLED) && ++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) ++ up->rs485_tx_filter_count++; ++ + return; + } + if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) { +@@ -378,6 +371,10 @@ static void transmit_chars(struct uart_omap_port *up, unsigned int lsr) + serial_out(up, UART_TX, xmit->buf[xmit->tail]); + xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1); + up->port.icount.tx++; ++ if ((up->port.rs485.flags & SER_RS485_ENABLED) && ++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) ++ up->rs485_tx_filter_count++; ++ + if (uart_circ_empty(xmit)) + break; + } while (--count > 0); +@@ -421,7 +418,7 @@ static void serial_omap_start_tx(struct uart_port *port) + + if ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) +- serial_omap_stop_rx(port); ++ up->rs485_tx_filter_count = 0; + + serial_omap_enable_ier_thri(up); + pm_runtime_mark_last_busy(up->dev); +@@ -492,8 +489,13 @@ static void serial_omap_rlsi(struct uart_omap_port *up, unsigned int lsr) + * Read one data character out to avoid stalling the receiver according + * to the table 23-246 of the omap4 TRM. + */ +- if (likely(lsr & UART_LSR_DR)) ++ if (likely(lsr & UART_LSR_DR)) { + serial_in(up, UART_RX); ++ if ((up->port.rs485.flags & SER_RS485_ENABLED) && ++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX) && ++ up->rs485_tx_filter_count) ++ up->rs485_tx_filter_count--; ++ } + + up->port.icount.rx++; + flag = TTY_NORMAL; +@@ -544,6 +546,13 @@ static void serial_omap_rdi(struct uart_omap_port *up, unsigned int lsr) + return; + + ch = serial_in(up, UART_RX); ++ if ((up->port.rs485.flags & SER_RS485_ENABLED) && ++ !(up->port.rs485.flags & SER_RS485_RX_DURING_TX) && ++ up->rs485_tx_filter_count) { ++ up->rs485_tx_filter_count--; ++ return; ++ } ++ + flag = TTY_NORMAL; + up->port.icount.rx++; + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-add-_usart-prefix-in-functions-name.patch b/queue-5.10/serial-stm32-add-_usart-prefix-in-functions-name.patch new file mode 100644 index 00000000000..22eae58026d --- /dev/null +++ b/queue-5.10/serial-stm32-add-_usart-prefix-in-functions-name.patch @@ -0,0 +1,1030 @@ +From 25345c17948b73dec101dc9a5df5e4233470fba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jan 2021 17:21:58 +0100 +Subject: serial: stm32: add "_usart" prefix in functions name + +From: Erwan Le Ray + +[ Upstream commit 56f9a76c27b51bc8e9bb938734e3de03819569ae ] + +Adds the prefix "_usart" in the name of stm32 usart functions in order to +ease the usage of kernel trace and tools, such as f-trace. +Allows to trace "stm32_usart_*" functions with f-trace. Without this patch, +all the driver functions needs to be added manually in f-trace filter. + +Signed-off-by: Erwan Le Ray +Signed-off-by: Valentin Caron +Link: https://lore.kernel.org/r/20210106162203.28854-4-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 348 ++++++++++++++++--------------- + 1 file changed, 177 insertions(+), 171 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index a0ef86d71317..717a97759928 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -34,15 +34,15 @@ + #include "serial_mctrl_gpio.h" + #include "stm32-usart.h" + +-static void stm32_stop_tx(struct uart_port *port); +-static void stm32_transmit_chars(struct uart_port *port); ++static void stm32_usart_stop_tx(struct uart_port *port); ++static void stm32_usart_transmit_chars(struct uart_port *port); + + static inline struct stm32_port *to_stm32_port(struct uart_port *port) + { + return container_of(port, struct stm32_port, port); + } + +-static void stm32_set_bits(struct uart_port *port, u32 reg, u32 bits) ++static void stm32_usart_set_bits(struct uart_port *port, u32 reg, u32 bits) + { + u32 val; + +@@ -51,7 +51,7 @@ static void stm32_set_bits(struct uart_port *port, u32 reg, u32 bits) + writel_relaxed(val, port->membase + reg); + } + +-static void stm32_clr_bits(struct uart_port *port, u32 reg, u32 bits) ++static void stm32_usart_clr_bits(struct uart_port *port, u32 reg, u32 bits) + { + u32 val; + +@@ -60,8 +60,8 @@ static void stm32_clr_bits(struct uart_port *port, u32 reg, u32 bits) + writel_relaxed(val, port->membase + reg); + } + +-static void stm32_config_reg_rs485(u32 *cr1, u32 *cr3, u32 delay_ADE, +- u32 delay_DDE, u32 baud) ++static void stm32_usart_config_reg_rs485(u32 *cr1, u32 *cr3, u32 delay_ADE, ++ u32 delay_DDE, u32 baud) + { + u32 rs485_deat_dedt; + u32 rs485_deat_dedt_max = (USART_CR1_DEAT_MASK >> USART_CR1_DEAT_SHIFT); +@@ -95,8 +95,8 @@ static void stm32_config_reg_rs485(u32 *cr1, u32 *cr3, u32 delay_ADE, + *cr1 |= rs485_deat_dedt; + } + +-static int stm32_config_rs485(struct uart_port *port, +- struct serial_rs485 *rs485conf) ++static int stm32_usart_config_rs485(struct uart_port *port, ++ struct serial_rs485 *rs485conf) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -104,7 +104,7 @@ static int stm32_config_rs485(struct uart_port *port, + u32 usartdiv, baud, cr1, cr3; + bool over8; + +- stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + + port->rs485 = *rs485conf; + +@@ -122,9 +122,10 @@ static int stm32_config_rs485(struct uart_port *port, + << USART_BRR_04_R_SHIFT; + + baud = DIV_ROUND_CLOSEST(port->uartclk, usartdiv); +- stm32_config_reg_rs485(&cr1, &cr3, +- rs485conf->delay_rts_before_send, +- rs485conf->delay_rts_after_send, baud); ++ stm32_usart_config_reg_rs485(&cr1, &cr3, ++ rs485conf->delay_rts_before_send, ++ rs485conf->delay_rts_after_send, ++ baud); + + if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { + cr3 &= ~USART_CR3_DEP; +@@ -137,18 +138,19 @@ static int stm32_config_rs485(struct uart_port *port, + writel_relaxed(cr3, port->membase + ofs->cr3); + writel_relaxed(cr1, port->membase + ofs->cr1); + } else { +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DEM | USART_CR3_DEP); +- stm32_clr_bits(port, ofs->cr1, +- USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK); ++ stm32_usart_clr_bits(port, ofs->cr3, ++ USART_CR3_DEM | USART_CR3_DEP); ++ stm32_usart_clr_bits(port, ofs->cr1, ++ USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK); + } + +- stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + + return 0; + } + +-static int stm32_init_rs485(struct uart_port *port, +- struct platform_device *pdev) ++static int stm32_usart_init_rs485(struct uart_port *port, ++ struct platform_device *pdev) + { + struct serial_rs485 *rs485conf = &port->rs485; + +@@ -162,8 +164,8 @@ static int stm32_init_rs485(struct uart_port *port, + return uart_get_rs485_mode(port); + } + +-static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res, +- bool threaded) ++static int stm32_usart_pending_rx(struct uart_port *port, u32 *sr, ++ int *last_res, bool threaded) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -186,8 +188,8 @@ static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res, + return 0; + } + +-static unsigned long stm32_get_char(struct uart_port *port, u32 *sr, +- int *last_res) ++static unsigned long stm32_usart_get_char(struct uart_port *port, u32 *sr, ++ int *last_res) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -206,7 +208,7 @@ static unsigned long stm32_get_char(struct uart_port *port, u32 *sr, + return c; + } + +-static void stm32_receive_chars(struct uart_port *port, bool threaded) ++static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + { + struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -218,7 +220,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) + pm_wakeup_event(tport->tty->dev, 0); + +- while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) { ++ while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res, ++ threaded)) { + sr |= USART_SR_DUMMY_RX; + flag = TTY_NORMAL; + +@@ -237,7 +240,7 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + writel_relaxed(sr & USART_SR_ERR_MASK, + port->membase + ofs->icr); + +- c = stm32_get_char(port, &sr, &stm32_port->last_res); ++ c = stm32_usart_get_char(port, &sr, &stm32_port->last_res); + port->icount.rx++; + if (sr & USART_SR_ERR_MASK) { + if (sr & USART_SR_ORE) { +@@ -277,20 +280,20 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + spin_lock(&port->lock); + } + +-static void stm32_tx_dma_complete(void *arg) ++static void stm32_usart_tx_dma_complete(void *arg) + { + struct uart_port *port = arg; + struct stm32_port *stm32port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32port->tx_dma_busy = false; + + /* Let's see if we have pending data to send */ +- stm32_transmit_chars(port); ++ stm32_usart_transmit_chars(port); + } + +-static void stm32_tx_interrupt_enable(struct uart_port *port) ++static void stm32_usart_tx_interrupt_enable(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -300,30 +303,30 @@ static void stm32_tx_interrupt_enable(struct uart_port *port) + * or TX empty irq when FIFO is disabled + */ + if (stm32_port->fifoen) +- stm32_set_bits(port, ofs->cr3, USART_CR3_TXFTIE); ++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_TXFTIE); + else +- stm32_set_bits(port, ofs->cr1, USART_CR1_TXEIE); ++ stm32_usart_set_bits(port, ofs->cr1, USART_CR1_TXEIE); + } + +-static void stm32_tx_interrupt_disable(struct uart_port *port) ++static void stm32_usart_tx_interrupt_disable(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + if (stm32_port->fifoen) +- stm32_clr_bits(port, ofs->cr3, USART_CR3_TXFTIE); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_TXFTIE); + else +- stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE); ++ stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_TXEIE); + } + +-static void stm32_transmit_chars_pio(struct uart_port *port) ++static void stm32_usart_transmit_chars_pio(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + struct circ_buf *xmit = &port->state->xmit; + + if (stm32_port->tx_dma_busy) { +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32_port->tx_dma_busy = false; + } + +@@ -338,12 +341,12 @@ static void stm32_transmit_chars_pio(struct uart_port *port) + + /* rely on TXE irq (mask or unmask) for sending remaining data */ + if (uart_circ_empty(xmit)) +- stm32_tx_interrupt_disable(port); ++ stm32_usart_tx_interrupt_disable(port); + else +- stm32_tx_interrupt_enable(port); ++ stm32_usart_tx_interrupt_enable(port); + } + +-static void stm32_transmit_chars_dma(struct uart_port *port) ++static void stm32_usart_transmit_chars_dma(struct uart_port *port) + { + struct stm32_port *stm32port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32port->info->ofs; +@@ -385,7 +388,7 @@ static void stm32_transmit_chars_dma(struct uart_port *port) + if (!desc) + goto fallback_err; + +- desc->callback = stm32_tx_dma_complete; ++ desc->callback = stm32_usart_tx_dma_complete; + desc->callback_param = port; + + /* Push current DMA TX transaction in the pending queue */ +@@ -398,7 +401,7 @@ static void stm32_transmit_chars_dma(struct uart_port *port) + /* Issue pending DMA TX requests */ + dma_async_issue_pending(stm32port->tx_ch); + +- stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_DMAT); + + xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1); + port->icount.tx += count; +@@ -406,10 +409,10 @@ static void stm32_transmit_chars_dma(struct uart_port *port) + + fallback_err: + for (i = count; i > 0; i--) +- stm32_transmit_chars_pio(port); ++ stm32_usart_transmit_chars_pio(port); + } + +-static void stm32_transmit_chars(struct uart_port *port) ++static void stm32_usart_transmit_chars(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -417,38 +420,38 @@ static void stm32_transmit_chars(struct uart_port *port) + + if (port->x_char) { + if (stm32_port->tx_dma_busy) +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + writel_relaxed(port->x_char, port->membase + ofs->tdr); + port->x_char = 0; + port->icount.tx++; + if (stm32_port->tx_dma_busy) +- stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_DMAT); + return; + } + + if (uart_circ_empty(xmit) || uart_tx_stopped(port)) { +- stm32_tx_interrupt_disable(port); ++ stm32_usart_tx_interrupt_disable(port); + return; + } + + if (ofs->icr == UNDEF_REG) +- stm32_clr_bits(port, ofs->isr, USART_SR_TC); ++ stm32_usart_clr_bits(port, ofs->isr, USART_SR_TC); + else + writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr); + + if (stm32_port->tx_ch) +- stm32_transmit_chars_dma(port); ++ stm32_usart_transmit_chars_dma(port); + else +- stm32_transmit_chars_pio(port); ++ stm32_usart_transmit_chars_pio(port); + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); + + if (uart_circ_empty(xmit)) +- stm32_tx_interrupt_disable(port); ++ stm32_usart_tx_interrupt_disable(port); + } + +-static irqreturn_t stm32_interrupt(int irq, void *ptr) ++static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + { + struct uart_port *port = ptr; + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -468,10 +471,10 @@ static irqreturn_t stm32_interrupt(int irq, void *ptr) + port->membase + ofs->icr); + + if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch)) +- stm32_receive_chars(port, false); ++ stm32_usart_receive_chars(port, false); + + if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch)) +- stm32_transmit_chars(port); ++ stm32_usart_transmit_chars(port); + + spin_unlock(&port->lock); + +@@ -481,7 +484,7 @@ static irqreturn_t stm32_interrupt(int irq, void *ptr) + return IRQ_HANDLED; + } + +-static irqreturn_t stm32_threaded_interrupt(int irq, void *ptr) ++static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) + { + struct uart_port *port = ptr; + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -489,14 +492,14 @@ static irqreturn_t stm32_threaded_interrupt(int irq, void *ptr) + spin_lock(&port->lock); + + if (stm32_port->rx_ch) +- stm32_receive_chars(port, true); ++ stm32_usart_receive_chars(port, true); + + spin_unlock(&port->lock); + + return IRQ_HANDLED; + } + +-static unsigned int stm32_tx_empty(struct uart_port *port) ++static unsigned int stm32_usart_tx_empty(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -504,20 +507,20 @@ static unsigned int stm32_tx_empty(struct uart_port *port) + return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE; + } + +-static void stm32_set_mctrl(struct uart_port *port, unsigned int mctrl) ++static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS)) +- stm32_set_bits(port, ofs->cr3, USART_CR3_RTSE); ++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_RTSE); + else +- stm32_clr_bits(port, ofs->cr3, USART_CR3_RTSE); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_RTSE); + + mctrl_gpio_set(stm32_port->gpios, mctrl); + } + +-static unsigned int stm32_get_mctrl(struct uart_port *port) ++static unsigned int stm32_usart_get_mctrl(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + unsigned int ret; +@@ -528,23 +531,23 @@ static unsigned int stm32_get_mctrl(struct uart_port *port) + return mctrl_gpio_get(stm32_port->gpios, &ret); + } + +-static void stm32_enable_ms(struct uart_port *port) ++static void stm32_usart_enable_ms(struct uart_port *port) + { + mctrl_gpio_enable_ms(to_stm32_port(port)->gpios); + } + +-static void stm32_disable_ms(struct uart_port *port) ++static void stm32_usart_disable_ms(struct uart_port *port) + { + mctrl_gpio_disable_ms(to_stm32_port(port)->gpios); + } + + /* Transmit stop */ +-static void stm32_stop_tx(struct uart_port *port) ++static void stm32_usart_stop_tx(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct serial_rs485 *rs485conf = &port->rs485; + +- stm32_tx_interrupt_disable(port); ++ stm32_usart_tx_interrupt_disable(port); + + if (rs485conf->flags & SER_RS485_ENABLED) { + if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { +@@ -558,7 +561,7 @@ static void stm32_stop_tx(struct uart_port *port) + } + + /* There are probably characters waiting to be transmitted. */ +-static void stm32_start_tx(struct uart_port *port) ++static void stm32_usart_start_tx(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct serial_rs485 *rs485conf = &port->rs485; +@@ -577,56 +580,56 @@ static void stm32_start_tx(struct uart_port *port) + } + } + +- stm32_transmit_chars(port); ++ stm32_usart_transmit_chars(port); + } + + /* Throttle the remote when input buffer is about to overflow. */ +-static void stm32_throttle(struct uart_port *port) ++static void stm32_usart_throttle(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); +- stm32_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); ++ stm32_usart_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); + if (stm32_port->cr3_irq) +- stm32_clr_bits(port, ofs->cr3, stm32_port->cr3_irq); ++ stm32_usart_clr_bits(port, ofs->cr3, stm32_port->cr3_irq); + + spin_unlock_irqrestore(&port->lock, flags); + } + + /* Unthrottle the remote, the input buffer can now accept data. */ +-static void stm32_unthrottle(struct uart_port *port) ++static void stm32_usart_unthrottle(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); +- stm32_set_bits(port, ofs->cr1, stm32_port->cr1_irq); ++ stm32_usart_set_bits(port, ofs->cr1, stm32_port->cr1_irq); + if (stm32_port->cr3_irq) +- stm32_set_bits(port, ofs->cr3, stm32_port->cr3_irq); ++ stm32_usart_set_bits(port, ofs->cr3, stm32_port->cr3_irq); + + spin_unlock_irqrestore(&port->lock, flags); + } + + /* Receive stop */ +-static void stm32_stop_rx(struct uart_port *port) ++static void stm32_usart_stop_rx(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + +- stm32_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); ++ stm32_usart_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); + if (stm32_port->cr3_irq) +- stm32_clr_bits(port, ofs->cr3, stm32_port->cr3_irq); ++ stm32_usart_clr_bits(port, ofs->cr3, stm32_port->cr3_irq); + } + + /* Handle breaks - ignored by us */ +-static void stm32_break_ctl(struct uart_port *port, int break_state) ++static void stm32_usart_break_ctl(struct uart_port *port, int break_state) + { + } + +-static int stm32_startup(struct uart_port *port) ++static int stm32_usart_startup(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -634,15 +637,15 @@ static int stm32_startup(struct uart_port *port) + u32 val; + int ret; + +- ret = request_threaded_irq(port->irq, stm32_interrupt, +- stm32_threaded_interrupt, ++ ret = request_threaded_irq(port->irq, stm32_usart_interrupt, ++ stm32_usart_threaded_interrupt, + IRQF_NO_SUSPEND, name, port); + if (ret) + return ret; + + /* RX FIFO Flush */ + if (ofs->rqr != UNDEF_REG) +- stm32_set_bits(port, ofs->rqr, USART_RQR_RXFRQ); ++ stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ); + + /* Tx and RX FIFO configuration */ + if (stm32_port->fifoen) { +@@ -657,12 +660,12 @@ static int stm32_startup(struct uart_port *port) + val = stm32_port->cr1_irq | USART_CR1_RE; + if (stm32_port->fifoen) + val |= USART_CR1_FIFOEN; +- stm32_set_bits(port, ofs->cr1, val); ++ stm32_usart_set_bits(port, ofs->cr1, val); + + return 0; + } + +-static void stm32_shutdown(struct uart_port *port) ++static void stm32_usart_shutdown(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -671,7 +674,7 @@ static void stm32_shutdown(struct uart_port *port) + int ret; + + /* Disable modem control interrupts */ +- stm32_disable_ms(port); ++ stm32_usart_disable_ms(port); + + val = USART_CR1_TXEIE | USART_CR1_TE; + val |= stm32_port->cr1_irq | USART_CR1_RE; +@@ -686,12 +689,12 @@ static void stm32_shutdown(struct uart_port *port) + if (ret) + dev_err(port->dev, "transmission complete not set\n"); + +- stm32_clr_bits(port, ofs->cr1, val); ++ stm32_usart_clr_bits(port, ofs->cr1, val); + + free_irq(port->irq, port); + } + +-static unsigned int stm32_get_databits(struct ktermios *termios) ++static unsigned int stm32_usart_get_databits(struct ktermios *termios) + { + unsigned int bits; + +@@ -721,8 +724,9 @@ static unsigned int stm32_get_databits(struct ktermios *termios) + return bits; + } + +-static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, +- struct ktermios *old) ++static void stm32_usart_set_termios(struct uart_port *port, ++ struct ktermios *termios, ++ struct ktermios *old) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -746,8 +750,8 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + + /* flush RX & TX FIFO */ + if (ofs->rqr != UNDEF_REG) +- stm32_set_bits(port, ofs->rqr, +- USART_RQR_TXFRQ | USART_RQR_RXFRQ); ++ stm32_usart_set_bits(port, ofs->rqr, ++ USART_RQR_TXFRQ | USART_RQR_RXFRQ); + + cr1 = USART_CR1_TE | USART_CR1_RE; + if (stm32_port->fifoen) +@@ -760,7 +764,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + if (cflag & CSTOPB) + cr2 |= USART_CR2_STOP_2B; + +- bits = stm32_get_databits(termios); ++ bits = stm32_usart_get_databits(termios); + stm32_port->rdr_mask = (BIT(bits) - 1); + + if (cflag & PARENB) { +@@ -813,9 +817,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + + /* Handle modem control interrupts */ + if (UART_ENABLE_MS(port, termios->c_cflag)) +- stm32_enable_ms(port); ++ stm32_usart_enable_ms(port); + else +- stm32_disable_ms(port); ++ stm32_usart_disable_ms(port); + + usartdiv = DIV_ROUND_CLOSEST(port->uartclk, baud); + +@@ -828,11 +832,11 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + if (usartdiv < 16) { + oversampling = 8; + cr1 |= USART_CR1_OVER8; +- stm32_set_bits(port, ofs->cr1, USART_CR1_OVER8); ++ stm32_usart_set_bits(port, ofs->cr1, USART_CR1_OVER8); + } else { + oversampling = 16; + cr1 &= ~USART_CR1_OVER8; +- stm32_clr_bits(port, ofs->cr1, USART_CR1_OVER8); ++ stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_OVER8); + } + + mantissa = (usartdiv / oversampling) << USART_BRR_DIV_M_SHIFT; +@@ -869,9 +873,10 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + cr3 |= USART_CR3_DMAR; + + if (rs485conf->flags & SER_RS485_ENABLED) { +- stm32_config_reg_rs485(&cr1, &cr3, +- rs485conf->delay_rts_before_send, +- rs485conf->delay_rts_after_send, baud); ++ stm32_usart_config_reg_rs485(&cr1, &cr3, ++ rs485conf->delay_rts_before_send, ++ rs485conf->delay_rts_after_send, ++ baud); + if (rs485conf->flags & SER_RS485_RTS_ON_SEND) { + cr3 &= ~USART_CR3_DEP; + rs485conf->flags &= ~SER_RS485_RTS_AFTER_SEND; +@@ -889,39 +894,39 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + writel_relaxed(cr2, port->membase + ofs->cr2); + writel_relaxed(cr1, port->membase + ofs->cr1); + +- stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + spin_unlock_irqrestore(&port->lock, flags); + } + +-static const char *stm32_type(struct uart_port *port) ++static const char *stm32_usart_type(struct uart_port *port) + { + return (port->type == PORT_STM32) ? DRIVER_NAME : NULL; + } + +-static void stm32_release_port(struct uart_port *port) ++static void stm32_usart_release_port(struct uart_port *port) + { + } + +-static int stm32_request_port(struct uart_port *port) ++static int stm32_usart_request_port(struct uart_port *port) + { + return 0; + } + +-static void stm32_config_port(struct uart_port *port, int flags) ++static void stm32_usart_config_port(struct uart_port *port, int flags) + { + if (flags & UART_CONFIG_TYPE) + port->type = PORT_STM32; + } + + static int +-stm32_verify_port(struct uart_port *port, struct serial_struct *ser) ++stm32_usart_verify_port(struct uart_port *port, struct serial_struct *ser) + { + /* No user changeable parameters */ + return -EINVAL; + } + +-static void stm32_pm(struct uart_port *port, unsigned int state, +- unsigned int oldstate) ++static void stm32_usart_pm(struct uart_port *port, unsigned int state, ++ unsigned int oldstate) + { + struct stm32_port *stm32port = container_of(port, + struct stm32_port, port); +@@ -935,7 +940,7 @@ static void stm32_pm(struct uart_port *port, unsigned int state, + break; + case UART_PM_STATE_OFF: + spin_lock_irqsave(&port->lock, flags); +- stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + spin_unlock_irqrestore(&port->lock, flags); + pm_runtime_put_sync(port->dev); + break; +@@ -943,29 +948,29 @@ static void stm32_pm(struct uart_port *port, unsigned int state, + } + + static const struct uart_ops stm32_uart_ops = { +- .tx_empty = stm32_tx_empty, +- .set_mctrl = stm32_set_mctrl, +- .get_mctrl = stm32_get_mctrl, +- .stop_tx = stm32_stop_tx, +- .start_tx = stm32_start_tx, +- .throttle = stm32_throttle, +- .unthrottle = stm32_unthrottle, +- .stop_rx = stm32_stop_rx, +- .enable_ms = stm32_enable_ms, +- .break_ctl = stm32_break_ctl, +- .startup = stm32_startup, +- .shutdown = stm32_shutdown, +- .set_termios = stm32_set_termios, +- .pm = stm32_pm, +- .type = stm32_type, +- .release_port = stm32_release_port, +- .request_port = stm32_request_port, +- .config_port = stm32_config_port, +- .verify_port = stm32_verify_port, ++ .tx_empty = stm32_usart_tx_empty, ++ .set_mctrl = stm32_usart_set_mctrl, ++ .get_mctrl = stm32_usart_get_mctrl, ++ .stop_tx = stm32_usart_stop_tx, ++ .start_tx = stm32_usart_start_tx, ++ .throttle = stm32_usart_throttle, ++ .unthrottle = stm32_usart_unthrottle, ++ .stop_rx = stm32_usart_stop_rx, ++ .enable_ms = stm32_usart_enable_ms, ++ .break_ctl = stm32_usart_break_ctl, ++ .startup = stm32_usart_startup, ++ .shutdown = stm32_usart_shutdown, ++ .set_termios = stm32_usart_set_termios, ++ .pm = stm32_usart_pm, ++ .type = stm32_usart_type, ++ .release_port = stm32_usart_release_port, ++ .request_port = stm32_usart_request_port, ++ .config_port = stm32_usart_config_port, ++ .verify_port = stm32_usart_verify_port, + }; + +-static int stm32_init_port(struct stm32_port *stm32port, +- struct platform_device *pdev) ++static int stm32_usart_init_port(struct stm32_port *stm32port, ++ struct platform_device *pdev) + { + struct uart_port *port = &stm32port->port; + struct resource *res; +@@ -982,9 +987,9 @@ static int stm32_init_port(struct stm32_port *stm32port, + port->fifosize = stm32port->info->cfg.fifosize; + port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_STM32_CONSOLE); + port->irq = ret; +- port->rs485_config = stm32_config_rs485; ++ port->rs485_config = stm32_usart_config_rs485; + +- ret = stm32_init_rs485(port, pdev); ++ ret = stm32_usart_init_rs485(port, pdev); + if (ret) + return ret; + +@@ -1043,7 +1048,7 @@ err_clk: + return ret; + } + +-static struct stm32_port *stm32_of_get_stm32_port(struct platform_device *pdev) ++static struct stm32_port *stm32_usart_of_get_port(struct platform_device *pdev) + { + struct device_node *np = pdev->dev.of_node; + int id; +@@ -1081,8 +1086,8 @@ static const struct of_device_id stm32_match[] = { + MODULE_DEVICE_TABLE(of, stm32_match); + #endif + +-static int stm32_of_dma_rx_probe(struct stm32_port *stm32port, +- struct platform_device *pdev) ++static int stm32_usart_of_dma_rx_probe(struct stm32_port *stm32port, ++ struct platform_device *pdev) + { + struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + struct uart_port *port = &stm32port->port; +@@ -1156,8 +1161,8 @@ alloc_err: + return ret; + } + +-static int stm32_of_dma_tx_probe(struct stm32_port *stm32port, +- struct platform_device *pdev) ++static int stm32_usart_of_dma_tx_probe(struct stm32_port *stm32port, ++ struct platform_device *pdev) + { + struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + struct uart_port *port = &stm32port->port; +@@ -1207,13 +1212,13 @@ alloc_err: + return ret; + } + +-static int stm32_serial_probe(struct platform_device *pdev) ++static int stm32_usart_serial_probe(struct platform_device *pdev) + { + const struct of_device_id *match; + struct stm32_port *stm32port; + int ret; + +- stm32port = stm32_of_get_stm32_port(pdev); ++ stm32port = stm32_usart_of_get_port(pdev); + if (!stm32port) + return -ENODEV; + +@@ -1223,7 +1228,7 @@ static int stm32_serial_probe(struct platform_device *pdev) + else + return -EINVAL; + +- ret = stm32_init_port(stm32port, pdev); ++ ret = stm32_usart_init_port(stm32port, pdev); + if (ret) + return ret; + +@@ -1244,11 +1249,11 @@ static int stm32_serial_probe(struct platform_device *pdev) + if (ret) + goto err_wirq; + +- ret = stm32_of_dma_rx_probe(stm32port, pdev); ++ ret = stm32_usart_of_dma_rx_probe(stm32port, pdev); + if (ret) + dev_info(&pdev->dev, "interrupt mode used for rx (no dma)\n"); + +- ret = stm32_of_dma_tx_probe(stm32port, pdev); ++ ret = stm32_usart_of_dma_tx_probe(stm32port, pdev); + if (ret) + dev_info(&pdev->dev, "interrupt mode used for tx (no dma)\n"); + +@@ -1275,7 +1280,7 @@ err_uninit: + return ret; + } + +-static int stm32_serial_remove(struct platform_device *pdev) ++static int stm32_usart_serial_remove(struct platform_device *pdev) + { + struct uart_port *port = platform_get_drvdata(pdev); + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -1284,7 +1289,7 @@ static int stm32_serial_remove(struct platform_device *pdev) + + pm_runtime_get_sync(&pdev->dev); + +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAR); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAR); + + if (stm32_port->rx_ch) + dma_release_channel(stm32_port->rx_ch); +@@ -1294,7 +1299,7 @@ static int stm32_serial_remove(struct platform_device *pdev) + RX_BUF_L, stm32_port->rx_buf, + stm32_port->rx_dma_buf); + +- stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + + if (stm32_port->tx_ch) + dma_release_channel(stm32_port->tx_ch); +@@ -1320,7 +1325,7 @@ static int stm32_serial_remove(struct platform_device *pdev) + } + + #ifdef CONFIG_SERIAL_STM32_CONSOLE +-static void stm32_console_putchar(struct uart_port *port, int ch) ++static void stm32_usart_console_putchar(struct uart_port *port, int ch) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -1331,8 +1336,8 @@ static void stm32_console_putchar(struct uart_port *port, int ch) + writel_relaxed(ch, port->membase + ofs->tdr); + } + +-static void stm32_console_write(struct console *co, const char *s, +- unsigned int cnt) ++static void stm32_usart_console_write(struct console *co, const char *s, ++ unsigned int cnt) + { + struct uart_port *port = &stm32_ports[co->index].port; + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -1356,7 +1361,7 @@ static void stm32_console_write(struct console *co, const char *s, + new_cr1 |= USART_CR1_TE | BIT(cfg->uart_enable_bit); + writel_relaxed(new_cr1, port->membase + ofs->cr1); + +- uart_console_write(port, s, cnt, stm32_console_putchar); ++ uart_console_write(port, s, cnt, stm32_usart_console_putchar); + + /* Restore interrupt state */ + writel_relaxed(old_cr1, port->membase + ofs->cr1); +@@ -1366,7 +1371,7 @@ static void stm32_console_write(struct console *co, const char *s, + local_irq_restore(flags); + } + +-static int stm32_console_setup(struct console *co, char *options) ++static int stm32_usart_console_setup(struct console *co, char *options) + { + struct stm32_port *stm32port; + int baud = 9600; +@@ -1397,8 +1402,8 @@ static int stm32_console_setup(struct console *co, char *options) + static struct console stm32_console = { + .name = STM32_SERIAL_NAME, + .device = uart_console_device, +- .write = stm32_console_write, +- .setup = stm32_console_setup, ++ .write = stm32_usart_console_write, ++ .setup = stm32_usart_console_setup, + .flags = CON_PRINTBUFFER, + .index = -1, + .data = &stm32_usart_driver, +@@ -1419,8 +1424,8 @@ static struct uart_driver stm32_usart_driver = { + .cons = STM32_SERIAL_CONSOLE, + }; + +-static void __maybe_unused stm32_serial_enable_wakeup(struct uart_port *port, +- bool enable) ++static void __maybe_unused stm32_usart_serial_en_wakeup(struct uart_port *port, ++ bool enable) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -1431,29 +1436,29 @@ static void __maybe_unused stm32_serial_enable_wakeup(struct uart_port *port, + return; + + if (enable) { +- stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); +- stm32_set_bits(port, ofs->cr1, USART_CR1_UESM); ++ stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_set_bits(port, ofs->cr1, USART_CR1_UESM); + val = readl_relaxed(port->membase + ofs->cr3); + val &= ~USART_CR3_WUS_MASK; + /* Enable Wake up interrupt from low power on start bit */ + val |= USART_CR3_WUS_START_BIT | USART_CR3_WUFIE; + writel_relaxed(val, port->membase + ofs->cr3); +- stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + } else { +- stm32_clr_bits(port, ofs->cr1, USART_CR1_UESM); ++ stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_UESM); + } + } + +-static int __maybe_unused stm32_serial_suspend(struct device *dev) ++static int __maybe_unused stm32_usart_serial_suspend(struct device *dev) + { + struct uart_port *port = dev_get_drvdata(dev); + + uart_suspend_port(&stm32_usart_driver, port); + + if (device_may_wakeup(dev)) +- stm32_serial_enable_wakeup(port, true); ++ stm32_usart_serial_en_wakeup(port, true); + else +- stm32_serial_enable_wakeup(port, false); ++ stm32_usart_serial_en_wakeup(port, false); + + /* + * When "no_console_suspend" is enabled, keep the pinctrl default state +@@ -1471,19 +1476,19 @@ static int __maybe_unused stm32_serial_suspend(struct device *dev) + return 0; + } + +-static int __maybe_unused stm32_serial_resume(struct device *dev) ++static int __maybe_unused stm32_usart_serial_resume(struct device *dev) + { + struct uart_port *port = dev_get_drvdata(dev); + + pinctrl_pm_select_default_state(dev); + + if (device_may_wakeup(dev)) +- stm32_serial_enable_wakeup(port, false); ++ stm32_usart_serial_en_wakeup(port, false); + + return uart_resume_port(&stm32_usart_driver, port); + } + +-static int __maybe_unused stm32_serial_runtime_suspend(struct device *dev) ++static int __maybe_unused stm32_usart_runtime_suspend(struct device *dev) + { + struct uart_port *port = dev_get_drvdata(dev); + struct stm32_port *stm32port = container_of(port, +@@ -1494,7 +1499,7 @@ static int __maybe_unused stm32_serial_runtime_suspend(struct device *dev) + return 0; + } + +-static int __maybe_unused stm32_serial_runtime_resume(struct device *dev) ++static int __maybe_unused stm32_usart_runtime_resume(struct device *dev) + { + struct uart_port *port = dev_get_drvdata(dev); + struct stm32_port *stm32port = container_of(port, +@@ -1504,14 +1509,15 @@ static int __maybe_unused stm32_serial_runtime_resume(struct device *dev) + } + + static const struct dev_pm_ops stm32_serial_pm_ops = { +- SET_RUNTIME_PM_OPS(stm32_serial_runtime_suspend, +- stm32_serial_runtime_resume, NULL) +- SET_SYSTEM_SLEEP_PM_OPS(stm32_serial_suspend, stm32_serial_resume) ++ SET_RUNTIME_PM_OPS(stm32_usart_runtime_suspend, ++ stm32_usart_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(stm32_usart_serial_suspend, ++ stm32_usart_serial_resume) + }; + + static struct platform_driver stm32_serial_driver = { +- .probe = stm32_serial_probe, +- .remove = stm32_serial_remove, ++ .probe = stm32_usart_serial_probe, ++ .remove = stm32_usart_serial_remove, + .driver = { + .name = DRIVER_NAME, + .pm = &stm32_serial_pm_ops, +@@ -1519,7 +1525,7 @@ static struct platform_driver stm32_serial_driver = { + }, + }; + +-static int __init usart_init(void) ++static int __init stm32_usart_init(void) + { + static char banner[] __initdata = "STM32 USART driver initialized"; + int ret; +@@ -1537,14 +1543,14 @@ static int __init usart_init(void) + return ret; + } + +-static void __exit usart_exit(void) ++static void __exit stm32_usart_exit(void) + { + platform_driver_unregister(&stm32_serial_driver); + uart_unregister_driver(&stm32_usart_driver); + } + +-module_init(usart_init); +-module_exit(usart_exit); ++module_init(stm32_usart_init); ++module_exit(stm32_usart_exit); + + MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_DESCRIPTION("STMicroelectronics STM32 serial port driver"); +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-add-fifo-flush-when-port-is-closed.patch b/queue-5.10/serial-stm32-add-fifo-flush-when-port-is-closed.patch new file mode 100644 index 00000000000..0641f0ce416 --- /dev/null +++ b/queue-5.10/serial-stm32-add-fifo-flush-when-port-is-closed.patch @@ -0,0 +1,45 @@ +From df161186f5b446c5f3e8c2763f6fd84766f84bef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:06 +0100 +Subject: serial: stm32: add FIFO flush when port is closed + +From: Erwan Le Ray + +[ Upstream commit 9f77d19207a0e8ba814c8ceb22e90ce7cb2aef64 ] + +Transmission complete error is sent when ISR_TC is not set. If port closure +is requested despite data in TDR / TX FIFO has not been sent (because of +flow control), ISR_TC is not set and error message is sent on port closure +but also when a new port is opened. + +Flush the data when port is closed, so the error isn't printed twice upon +next port opening. + +Fixes: 64c32eab6603 ("serial: stm32: Add support of TC bit status check") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-12-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 6788fb3af6cb..cb8c2bece6d6 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -689,6 +689,11 @@ static void stm32_usart_shutdown(struct uart_port *port) + if (ret) + dev_err(port->dev, "transmission complete not set\n"); + ++ /* flush RX & TX FIFO */ ++ if (ofs->rqr != UNDEF_REG) ++ writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ, ++ port->membase + ofs->rqr); ++ + stm32_usart_clr_bits(port, ofs->cr1, val); + + free_irq(port->irq, port); +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-call-stm32_transmit_chars-locked.patch b/queue-5.10/serial-stm32-call-stm32_transmit_chars-locked.patch new file mode 100644 index 00000000000..f1a433199b0 --- /dev/null +++ b/queue-5.10/serial-stm32-call-stm32_transmit_chars-locked.patch @@ -0,0 +1,45 @@ +From d2355fda2385d5e87c8f154ce77c504cbaba485b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:04 +0100 +Subject: serial: stm32: call stm32_transmit_chars locked + +From: Erwan Le Ray + +[ Upstream commit f16b90c2d9db3e6ac719d1946b9d335ca4ab33f3 ] + +stm32_transmit_chars should be called under lock also in tx DMA callback. + +Fixes: 3489187204eb ("serial: stm32: adding dma support") +Signed-off-by: Erwan Le Ray +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20210304162308.8984-10-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index c2d87a8a8fe5..a6295897c537 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -290,13 +290,16 @@ static void stm32_usart_tx_dma_complete(void *arg) + struct uart_port *port = arg; + struct stm32_port *stm32port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ unsigned long flags; + + dmaengine_terminate_async(stm32port->tx_ch); + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32port->tx_dma_busy = false; + + /* Let's see if we have pending data to send */ ++ spin_lock_irqsave(&port->lock, flags); + stm32_usart_transmit_chars(port); ++ spin_unlock_irqrestore(&port->lock, flags); + } + + static void stm32_usart_tx_interrupt_enable(struct uart_port *port) +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-a-deadlock-condition-with-wakeup-ev.patch b/queue-5.10/serial-stm32-fix-a-deadlock-condition-with-wakeup-ev.patch new file mode 100644 index 00000000000..91467e45ec3 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-a-deadlock-condition-with-wakeup-ev.patch @@ -0,0 +1,119 @@ +From 2e4bfdadccd7771de53e30cd1b3b1148898d97d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:00 +0100 +Subject: serial: stm32: fix a deadlock condition with wakeup event + +From: Erwan Le Ray + +[ Upstream commit ad7676812437a00a4c6be155fc17926069f99084 ] + +Deadlock issue is seen when enabling CONFIG_PROVE_LOCKING=Y, and uart +console as wakeup source. Deadlock occurs when resuming from low power +mode if system is waked up via usart console. +The deadlock is triggered 100% when also disabling console suspend prior +to go to suspend. + +Simplified call stack, deadlock condition: +- stm32_console_write <-- spin_lock already held +- print_circular_bug +- pm_wakeup_dev_event <-- triggers lockdep as seen above +- stm32_receive_chars +- stm32_interrupt <-- wakeup via uart console, takes the lock + +So, revisit spin_lock in stm32-usart driver: +- there is no need to hold the lock to access ICR (atomic clear of status + flags) +- only hold the lock inside stm32_receive_chars() routine (no need to + call pm_wakeup_dev_event with lock held) +- keep stm32_transmit_chars() routine called with lock held + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20210304162308.8984-6-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 91a33ec4dbb4..5ae3841a4a08 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -213,13 +213,18 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- unsigned long c; ++ unsigned long c, flags; + u32 sr; + char flag; + + if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) + pm_wakeup_event(tport->tty->dev, 0); + ++ if (threaded) ++ spin_lock_irqsave(&port->lock, flags); ++ else ++ spin_lock(&port->lock); ++ + while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res, + threaded)) { + sr |= USART_SR_DUMMY_RX; +@@ -275,9 +280,12 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + uart_insert_char(port, sr, USART_SR_ORE, c, flag); + } + +- spin_unlock(&port->lock); ++ if (threaded) ++ spin_unlock_irqrestore(&port->lock, flags); ++ else ++ spin_unlock(&port->lock); ++ + tty_flip_buffer_push(tport); +- spin_lock(&port->lock); + } + + static void stm32_usart_tx_dma_complete(void *arg) +@@ -458,8 +466,6 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + u32 sr; + +- spin_lock(&port->lock); +- + sr = readl_relaxed(port->membase + ofs->isr); + + if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG) +@@ -473,10 +479,11 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch)) + stm32_usart_receive_chars(port, false); + +- if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch)) ++ if ((sr & USART_SR_TXE) && !(stm32_port->tx_ch)) { ++ spin_lock(&port->lock); + stm32_usart_transmit_chars(port); +- +- spin_unlock(&port->lock); ++ spin_unlock(&port->lock); ++ } + + if (stm32_port->rx_ch) + return IRQ_WAKE_THREAD; +@@ -489,13 +496,9 @@ static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) + struct uart_port *port = ptr; + struct stm32_port *stm32_port = to_stm32_port(port); + +- spin_lock(&port->lock); +- + if (stm32_port->rx_ch) + stm32_usart_receive_chars(port, true); + +- spin_unlock(&port->lock); +- + return IRQ_HANDLED; + } + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-a-deadlock-in-set_termios.patch b/queue-5.10/serial-stm32-fix-a-deadlock-in-set_termios.patch new file mode 100644 index 00000000000..e31c648a308 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-a-deadlock-in-set_termios.patch @@ -0,0 +1,72 @@ +From 89e9ea96cecba53860a2f0636e0d3539a784ba5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:02 +0100 +Subject: serial: stm32: fix a deadlock in set_termios + +From: Erwan Le Ray + +[ Upstream commit 436c97936001776f16153771ee887f125443e974 ] + +CTS/RTS GPIOs support that has been added recently to STM32 UART driver has +introduced scheduled code in a set_termios part protected by a spin lock. +This generates a potential deadlock scenario: + +Chain exists of: +&irq_desc_lock_class --> console_owner --> &port_lock_key + +Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- +lock(&port_lock_key); + lock(console_owner); + lock(&port_lock_key); +lock(&irq_desc_lock_class); + +*** DEADLOCK *** +4 locks held by stty/766: + +Move the scheduled code after the spinlock. + +Fixes: 6cf61b9bd7cc ("tty: serial: Add modem control gpio support for STM32 UART") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-8-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 85e9a4d4e91d..44522ddc7e6d 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -827,12 +827,6 @@ static void stm32_usart_set_termios(struct uart_port *port, + cr3 |= USART_CR3_CTSE | USART_CR3_RTSE; + } + +- /* Handle modem control interrupts */ +- if (UART_ENABLE_MS(port, termios->c_cflag)) +- stm32_usart_enable_ms(port); +- else +- stm32_usart_disable_ms(port); +- + usartdiv = DIV_ROUND_CLOSEST(port->uartclk, baud); + + /* +@@ -914,6 +908,12 @@ static void stm32_usart_set_termios(struct uart_port *port, + + stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + spin_unlock_irqrestore(&port->lock, flags); ++ ++ /* Handle modem control interrupts */ ++ if (UART_ENABLE_MS(port, termios->c_cflag)) ++ stm32_usart_enable_ms(port); ++ else ++ stm32_usart_disable_ms(port); + } + + static const char *stm32_usart_type(struct uart_port *port) +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-code-cleaning-warnings-and-checks.patch b/queue-5.10/serial-stm32-fix-code-cleaning-warnings-and-checks.patch new file mode 100644 index 00000000000..17979055858 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-code-cleaning-warnings-and-checks.patch @@ -0,0 +1,149 @@ +From 99ba150af946b961fa5636a25c77c6b1a481da52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jan 2021 17:21:57 +0100 +Subject: serial: stm32: fix code cleaning warnings and checks + +From: Erwan Le Ray + +[ Upstream commit 92fc00238675a15cc48f09694949f0c0012e0ff4 ] + +Fixes checkpatch --strict warnings and checks: +- checkpatch --strict "Unnecessary parentheses" +- checkpatch --strict "Blank lines aren't necessary before a close brace +- checkpatch --strict "Alignment should match open parenthesis" +- checkpatch --strict "Please don't use multiple blank lines" +- checkpatch --strict "Comparison to NULL could be written ..." +- visual check code ordering warning + +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210106162203.28854-3-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 33 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 18 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 6248304a001f..a0ef86d71317 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -176,8 +176,7 @@ static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res, + status = dmaengine_tx_status(stm32_port->rx_ch, + stm32_port->rx_ch->cookie, + &state); +- if ((status == DMA_IN_PROGRESS) && +- (*last_res != state.residue)) ++ if (status == DMA_IN_PROGRESS && (*last_res != state.residue)) + return 1; + else + return 0; +@@ -464,7 +463,7 @@ static irqreturn_t stm32_interrupt(int irq, void *ptr) + writel_relaxed(USART_ICR_RTOCF, + port->membase + ofs->icr); + +- if ((sr & USART_SR_WUF) && (ofs->icr != UNDEF_REG)) ++ if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) + writel_relaxed(USART_ICR_WUCF, + port->membase + ofs->icr); + +@@ -620,7 +619,6 @@ static void stm32_stop_rx(struct uart_port *port) + stm32_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); + if (stm32_port->cr3_irq) + stm32_clr_bits(port, ofs->cr3, stm32_port->cr3_irq); +- + } + + /* Handle breaks - ignored by us */ +@@ -724,7 +722,7 @@ static unsigned int stm32_get_databits(struct ktermios *termios) + } + + static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, +- struct ktermios *old) ++ struct ktermios *old) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +@@ -923,7 +921,7 @@ stm32_verify_port(struct uart_port *port, struct serial_struct *ser) + } + + static void stm32_pm(struct uart_port *port, unsigned int state, +- unsigned int oldstate) ++ unsigned int oldstate) + { + struct stm32_port *stm32port = container_of(port, + struct stm32_port, port); +@@ -973,18 +971,17 @@ static int stm32_init_port(struct stm32_port *stm32port, + struct resource *res; + int ret; + ++ ret = platform_get_irq(pdev, 0); ++ if (ret <= 0) ++ return ret ? : -ENODEV; ++ + port->iotype = UPIO_MEM; + port->flags = UPF_BOOT_AUTOCONF; + port->ops = &stm32_uart_ops; + port->dev = &pdev->dev; + port->fifosize = stm32port->info->cfg.fifosize; + port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_STM32_CONSOLE); +- +- ret = platform_get_irq(pdev, 0); +- if (ret <= 0) +- return ret ? : -ENODEV; + port->irq = ret; +- + port->rs485_config = stm32_config_rs485; + + ret = stm32_init_rs485(port, pdev); +@@ -1101,8 +1098,8 @@ static int stm32_of_dma_rx_probe(struct stm32_port *stm32port, + return -ENODEV; + } + stm32port->rx_buf = dma_alloc_coherent(&pdev->dev, RX_BUF_L, +- &stm32port->rx_dma_buf, +- GFP_KERNEL); ++ &stm32port->rx_dma_buf, ++ GFP_KERNEL); + if (!stm32port->rx_buf) { + ret = -ENOMEM; + goto alloc_err; +@@ -1177,8 +1174,8 @@ static int stm32_of_dma_tx_probe(struct stm32_port *stm32port, + return -ENODEV; + } + stm32port->tx_buf = dma_alloc_coherent(&pdev->dev, TX_BUF_L, +- &stm32port->tx_dma_buf, +- GFP_KERNEL); ++ &stm32port->tx_dma_buf, ++ GFP_KERNEL); + if (!stm32port->tx_buf) { + ret = -ENOMEM; + goto alloc_err; +@@ -1322,7 +1319,6 @@ static int stm32_serial_remove(struct platform_device *pdev) + return err; + } + +- + #ifdef CONFIG_SERIAL_STM32_CONSOLE + static void stm32_console_putchar(struct uart_port *port, int ch) + { +@@ -1335,7 +1331,8 @@ static void stm32_console_putchar(struct uart_port *port, int ch) + writel_relaxed(ch, port->membase + ofs->tdr); + } + +-static void stm32_console_write(struct console *co, const char *s, unsigned cnt) ++static void stm32_console_write(struct console *co, const char *s, ++ unsigned int cnt) + { + struct uart_port *port = &stm32_ports[co->index].port; + struct stm32_port *stm32_port = to_stm32_port(port); +@@ -1388,7 +1385,7 @@ static int stm32_console_setup(struct console *co, char *options) + * this to be called during the uart port registration when the + * driver gets probed and the port should be mapped at that point. + */ +- if (stm32port->port.mapbase == 0 || stm32port->port.membase == NULL) ++ if (stm32port->port.mapbase == 0 || !stm32port->port.membase) + return -ENXIO; + + if (options) +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-fifo-flush-in-startup-and-set_termi.patch b/queue-5.10/serial-stm32-fix-fifo-flush-in-startup-and-set_termi.patch new file mode 100644 index 00000000000..8e0538f2449 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-fifo-flush-in-startup-and-set_termi.patch @@ -0,0 +1,51 @@ +From 7b9988780753e40ea4f90957b698e4c82f780990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:05 +0100 +Subject: serial: stm32: fix FIFO flush in startup and set_termios + +From: Erwan Le Ray + +[ Upstream commit 315e2d8a125ad77a1bc28f621162713f3e7aef48 ] + +Fifo flush set USART_RQR register by calling stm32_usart_set_bits +routine (Read/Modify/Write). USART_RQR register is a write only +register. So, read before write isn't correct / relevant to flush +the FIFOs. +Replace stm32_usart_set_bits call by writel_relaxed. + +Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-11-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index a6295897c537..6788fb3af6cb 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -656,7 +656,7 @@ static int stm32_usart_startup(struct uart_port *port) + + /* RX FIFO Flush */ + if (ofs->rqr != UNDEF_REG) +- stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ); ++ writel_relaxed(USART_RQR_RXFRQ, port->membase + ofs->rqr); + + /* RX enabling */ + val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit); +@@ -760,8 +760,8 @@ static void stm32_usart_set_termios(struct uart_port *port, + + /* flush RX & TX FIFO */ + if (ofs->rqr != UNDEF_REG) +- stm32_usart_set_bits(port, ofs->rqr, +- USART_RQR_TXFRQ | USART_RQR_RXFRQ); ++ writel_relaxed(USART_RQR_TXFRQ | USART_RQR_RXFRQ, ++ port->membase + ofs->rqr); + + cr1 = USART_CR1_TE | USART_CR1_RE; + if (stm32_port->fifoen) +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-incorrect-characters-on-console.patch b/queue-5.10/serial-stm32-fix-incorrect-characters-on-console.patch new file mode 100644 index 00000000000..8c1b1977bce --- /dev/null +++ b/queue-5.10/serial-stm32-fix-incorrect-characters-on-console.patch @@ -0,0 +1,59 @@ +From 4e9e988d0e131d0bd928f4f34a09bd3403818c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:22:58 +0100 +Subject: serial: stm32: fix incorrect characters on console + +From: Erwan Le Ray + +[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ] + +Incorrect characters are observed on console during boot. This issue occurs +when init/main.c is modifying termios settings to open /dev/console on the +rootfs. + +This patch adds a waiting loop in set_termios to wait for TX shift register +empty (and TX FIFO if any) before stopping serial port. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 909a0d991ba1..70155e0c3b02 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -736,8 +736,9 @@ static void stm32_usart_set_termios(struct uart_port *port, + unsigned int baud, bits; + u32 usartdiv, mantissa, fraction, oversampling; + tcflag_t cflag = termios->c_cflag; +- u32 cr1, cr2, cr3; ++ u32 cr1, cr2, cr3, isr; + unsigned long flags; ++ int ret; + + if (!stm32_port->hw_flow_control) + cflag &= ~CRTSCTS; +@@ -746,6 +747,15 @@ static void stm32_usart_set_termios(struct uart_port *port, + + spin_lock_irqsave(&port->lock, flags); + ++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, ++ isr, ++ (isr & USART_SR_TC), ++ 10, 100000); ++ ++ /* Send the TC error message only when ISR_TC is not set. */ ++ if (ret) ++ dev_err(port->dev, "Transmission is not complete\n"); ++ + /* Stop serial port and reset value */ + writel_relaxed(0, port->membase + ofs->cr1); + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-probe-and-remove-order-for-dma.patch b/queue-5.10/serial-stm32-fix-probe-and-remove-order-for-dma.patch new file mode 100644 index 00000000000..4435c8b6f54 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-probe-and-remove-order-for-dma.patch @@ -0,0 +1,139 @@ +From bc13776b9cd6d17d57e66218abacb0448b3cbdd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:22:56 +0100 +Subject: serial: stm32: fix probe and remove order for dma + +From: Erwan Le Ray + +[ Upstream commit 87fd0741d6dcf63ebdb14050c2b921ae14c7f307 ] + +The probe and remove orders are wrong as the uart_port is registered +before saving device data in the probe, and unregistered after DMA +resource deallocation in the remove. uart_port registering should be +done at the end of probe and unregistering should be done at the begin of +remove to avoid resource allocation issues. + +Fix probe and remove orders. This enforce resource allocation occur at +proper time. +Terminate both DMA rx and tx transfers before removing device. + +Move pm_runtime after uart_remove_one_port() call in remove() to keep the +probe error path. + +Fixes: 3489187204eb ("serial: stm32: adding dma support") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-2-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 57 ++++++++++++++++++++++++-------- + 1 file changed, 44 insertions(+), 13 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 717a97759928..dd029696893a 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -1245,10 +1245,6 @@ static int stm32_usart_serial_probe(struct platform_device *pdev) + device_set_wakeup_enable(&pdev->dev, false); + } + +- ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port); +- if (ret) +- goto err_wirq; +- + ret = stm32_usart_of_dma_rx_probe(stm32port, pdev); + if (ret) + dev_info(&pdev->dev, "interrupt mode used for rx (no dma)\n"); +@@ -1262,11 +1258,40 @@ static int stm32_usart_serial_probe(struct platform_device *pdev) + pm_runtime_get_noresume(&pdev->dev); + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); ++ ++ ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port); ++ if (ret) ++ goto err_port; ++ + pm_runtime_put_sync(&pdev->dev); + + return 0; + +-err_wirq: ++err_port: ++ pm_runtime_disable(&pdev->dev); ++ pm_runtime_set_suspended(&pdev->dev); ++ pm_runtime_put_noidle(&pdev->dev); ++ ++ if (stm32port->rx_ch) { ++ dmaengine_terminate_async(stm32port->rx_ch); ++ dma_release_channel(stm32port->rx_ch); ++ } ++ ++ if (stm32port->rx_dma_buf) ++ dma_free_coherent(&pdev->dev, ++ RX_BUF_L, stm32port->rx_buf, ++ stm32port->rx_dma_buf); ++ ++ if (stm32port->tx_ch) { ++ dmaengine_terminate_async(stm32port->tx_ch); ++ dma_release_channel(stm32port->tx_ch); ++ } ++ ++ if (stm32port->tx_dma_buf) ++ dma_free_coherent(&pdev->dev, ++ TX_BUF_L, stm32port->tx_buf, ++ stm32port->tx_dma_buf); ++ + if (stm32port->wakeirq > 0) + dev_pm_clear_wake_irq(&pdev->dev); + +@@ -1288,11 +1313,20 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + int err; + + pm_runtime_get_sync(&pdev->dev); ++ err = uart_remove_one_port(&stm32_usart_driver, port); ++ if (err) ++ return(err); ++ ++ pm_runtime_disable(&pdev->dev); ++ pm_runtime_set_suspended(&pdev->dev); ++ pm_runtime_put_noidle(&pdev->dev); + + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAR); + +- if (stm32_port->rx_ch) ++ if (stm32_port->rx_ch) { ++ dmaengine_terminate_async(stm32_port->rx_ch); + dma_release_channel(stm32_port->rx_ch); ++ } + + if (stm32_port->rx_dma_buf) + dma_free_coherent(&pdev->dev, +@@ -1301,8 +1335,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + +- if (stm32_port->tx_ch) ++ if (stm32_port->tx_ch) { ++ dmaengine_terminate_async(stm32_port->tx_ch); + dma_release_channel(stm32_port->tx_ch); ++ } + + if (stm32_port->tx_dma_buf) + dma_free_coherent(&pdev->dev, +@@ -1316,12 +1352,7 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + + clk_disable_unprepare(stm32_port->clk); + +- err = uart_remove_one_port(&stm32_usart_driver, port); +- +- pm_runtime_disable(&pdev->dev); +- pm_runtime_put_noidle(&pdev->dev); +- +- return err; ++ return 0; + } + + #ifdef CONFIG_SERIAL_STM32_CONSOLE +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-startup-by-enabling-usart-for-recep.patch b/queue-5.10/serial-stm32-fix-startup-by-enabling-usart-for-recep.patch new file mode 100644 index 00000000000..12ee7715dd7 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-startup-by-enabling-usart-for-recep.patch @@ -0,0 +1,47 @@ +From 88f045a8659c67b2e54eacf54d2ffb7cb2afd1a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:22:57 +0100 +Subject: serial: stm32: fix startup by enabling usart for reception + +From: Erwan Le Ray + +[ Upstream commit f4518a8a75f5be1a121b0c95ad9c6b1eb27d920e ] + +RX is configured, but usart is not enabled in startup function. +Kernel documentation specifies that startup should enable the port for +reception. +Fix the startup by enabling usart for reception. + +Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-3-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 1f7fe285bb1f..909a0d991ba1 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -633,6 +633,7 @@ static int stm32_usart_startup(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + const char *name = to_platform_device(port->dev)->name; + u32 val; + int ret; +@@ -657,7 +658,7 @@ static int stm32_usart_startup(struct uart_port *port) + } + + /* RX FIFO enabling */ +- val = stm32_port->cr1_irq | USART_CR1_RE; ++ val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit); + if (stm32_port->fifoen) + val |= USART_CR1_FIFOEN; + stm32_usart_set_bits(port, ofs->cr1, val); +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-tx-and-rx-fifo-thresholds.patch b/queue-5.10/serial-stm32-fix-tx-and-rx-fifo-thresholds.patch new file mode 100644 index 00000000000..d71ac28bf84 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-tx-and-rx-fifo-thresholds.patch @@ -0,0 +1,74 @@ +From a2e0568a1704d54666befc82bcefdd2a30de5535 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:22:59 +0100 +Subject: serial: stm32: fix TX and RX FIFO thresholds + +From: Erwan Le Ray + +[ Upstream commit 25a8e7611da5513b388165661b17173c26e12c04 ] + +TX and RX FIFO thresholds may be cleared after suspend/resume, depending +on the low power mode. + +Those configurations (done in startup) are not effective for UART console, +as: +- the reference manual indicates that FIFOEN bit can only be written when + the USART is disabled (UE=0) +- a set_termios (where UE is set) is requested firstly for console + enabling, before the startup. + +Fixes: 84872dc448fe ("serial: stm32: add RX and TX FIFO flush") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-5-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 23 +++++++++-------------- + 1 file changed, 9 insertions(+), 14 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 70155e0c3b02..91a33ec4dbb4 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -648,19 +648,8 @@ static int stm32_usart_startup(struct uart_port *port) + if (ofs->rqr != UNDEF_REG) + stm32_usart_set_bits(port, ofs->rqr, USART_RQR_RXFRQ); + +- /* Tx and RX FIFO configuration */ +- if (stm32_port->fifoen) { +- val = readl_relaxed(port->membase + ofs->cr3); +- val &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK); +- val |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT; +- val |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT; +- writel_relaxed(val, port->membase + ofs->cr3); +- } +- +- /* RX FIFO enabling */ ++ /* RX enabling */ + val = stm32_port->cr1_irq | USART_CR1_RE | BIT(cfg->uart_enable_bit); +- if (stm32_port->fifoen) +- val |= USART_CR1_FIFOEN; + stm32_usart_set_bits(port, ofs->cr1, val); + + return 0; +@@ -768,9 +757,15 @@ static void stm32_usart_set_termios(struct uart_port *port, + if (stm32_port->fifoen) + cr1 |= USART_CR1_FIFOEN; + cr2 = 0; ++ ++ /* Tx and RX FIFO configuration */ + cr3 = readl_relaxed(port->membase + ofs->cr3); +- cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTCFG_MASK | USART_CR3_RXFTIE +- | USART_CR3_TXFTCFG_MASK; ++ cr3 &= USART_CR3_TXFTIE | USART_CR3_RXFTIE; ++ if (stm32_port->fifoen) { ++ cr3 &= ~(USART_CR3_TXFTCFG_MASK | USART_CR3_RXFTCFG_MASK); ++ cr3 |= USART_CR3_TXFTCFG_HALF << USART_CR3_TXFTCFG_SHIFT; ++ cr3 |= USART_CR3_RXFTCFG_HALF << USART_CR3_RXFTCFG_SHIFT; ++ } + + if (cflag & CSTOPB) + cr2 |= USART_CR2_STOP_2B; +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-tx-dma-completion-release-channel.patch b/queue-5.10/serial-stm32-fix-tx-dma-completion-release-channel.patch new file mode 100644 index 00000000000..f0fc43f67a5 --- /dev/null +++ b/queue-5.10/serial-stm32-fix-tx-dma-completion-release-channel.patch @@ -0,0 +1,35 @@ +From 7916456408067c408b9b8c708e066fe6f8458ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:03 +0100 +Subject: serial: stm32: fix tx dma completion, release channel + +From: Erwan Le Ray + +[ Upstream commit fb4f2e04ac13e7c400e6b86afbbd314a5a2a7e8d ] + +This patch add a proper release of dma channels when completing dma tx. + +Fixes: 3489187204eb ("serial: stm32: adding dma support") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-9-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 44522ddc7e6d..c2d87a8a8fe5 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -291,6 +291,7 @@ static void stm32_usart_tx_dma_complete(void *arg) + struct stm32_port *stm32port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + ++ dmaengine_terminate_async(stm32port->tx_ch); + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32port->tx_dma_busy = false; + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-tx_empty-condition.patch b/queue-5.10/serial-stm32-fix-tx_empty-condition.patch new file mode 100644 index 00000000000..95079f70d0f --- /dev/null +++ b/queue-5.10/serial-stm32-fix-tx_empty-condition.patch @@ -0,0 +1,61 @@ +From 8dceb90012956e38569c61a5b89ebf2418400ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:07 +0100 +Subject: serial: stm32: fix tx_empty condition + +From: Erwan Le Ray + +[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ] + +In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of +TXE) to check transmission data register has been transmitted independently +of the FIFO mode. TC indicates that both transmit register and shift +register are empty. When shift register is empty, tx_empty should return +TIOCSER_TEMT instead of TC value. + +Cleans the USART_CR_TC TCCF register define (transmission complete clear +flag) as it is duplicate of USART_ICR_TCCF. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 ++++- + drivers/tty/serial/stm32-usart.h | 3 --- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index cb8c2bece6d6..2cf9fc915510 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -514,7 +514,10 @@ static unsigned int stm32_usart_tx_empty(struct uart_port *port) + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + +- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE; ++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC) ++ return TIOCSER_TEMT; ++ ++ return 0; + } + + static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl) +diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h +index cb4f327c46db..94b568aa46bb 100644 +--- a/drivers/tty/serial/stm32-usart.h ++++ b/drivers/tty/serial/stm32-usart.h +@@ -127,9 +127,6 @@ struct stm32_usart_info stm32h7_info = { + /* Dummy bits */ + #define USART_SR_DUMMY_RX BIT(16) + +-/* USART_ICR (F7) */ +-#define USART_CR_TC BIT(6) +- + /* USART_DR */ + #define USART_DR_MASK GENMASK(8, 0) + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-wake-up-flag-handling.patch b/queue-5.10/serial-stm32-fix-wake-up-flag-handling.patch new file mode 100644 index 00000000000..1d02b95148f --- /dev/null +++ b/queue-5.10/serial-stm32-fix-wake-up-flag-handling.patch @@ -0,0 +1,116 @@ +From 6f5759aef5ad17af003ceb5ac1f96d61a053d9ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:01 +0100 +Subject: serial: stm32: fix wake-up flag handling + +From: Erwan Le Ray + +[ Upstream commit 12761869f0efa524348e2ae31827fd52eebf3f0d ] + +This patch fixes several issue with wake-up handling: +- the WUF irq is handled several times at wake-up +- the USART is disabled / enabled at suspend to set wake-up flag. +It can cause glitches during RX. + +This patch fix those issues: +- clear wake-up flag and disable wake-up irq in WUF irq handling +- enable wake-up from low power on start bit detection at port +configuration +- Unmask the wake-up flag irq at suspend and mask it at resume + +In addition, pm_wakeup_event handling is moved from receice_chars to WUF +irq handling. + +Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-7-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++++++------------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 5ae3841a4a08..85e9a4d4e91d 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -217,9 +217,6 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + u32 sr; + char flag; + +- if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) +- pm_wakeup_event(tport->tty->dev, 0); +- + if (threaded) + spin_lock_irqsave(&port->lock, flags); + else +@@ -462,6 +459,7 @@ static void stm32_usart_transmit_chars(struct uart_port *port) + static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + { + struct uart_port *port = ptr; ++ struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + u32 sr; +@@ -472,9 +470,14 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + writel_relaxed(USART_ICR_RTOCF, + port->membase + ofs->icr); + +- if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) ++ if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) { ++ /* Clear wake up flag and disable wake up interrupt */ + writel_relaxed(USART_ICR_WUCF, + port->membase + ofs->icr); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE); ++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ pm_wakeup_event(tport->tty->dev, 0); ++ } + + if ((sr & USART_SR_RXNE) && !(stm32_port->rx_ch)) + stm32_usart_receive_chars(port, false); +@@ -899,6 +902,12 @@ static void stm32_usart_set_termios(struct uart_port *port, + cr1 &= ~(USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK); + } + ++ /* Configure wake up from low power on start bit detection */ ++ if (stm32_port->wakeirq > 0) { ++ cr3 &= ~USART_CR3_WUS_MASK; ++ cr3 |= USART_CR3_WUS_START_BIT; ++ } ++ + writel_relaxed(cr3, port->membase + ofs->cr3); + writel_relaxed(cr2, port->membase + ofs->cr2); + writel_relaxed(cr1, port->membase + ofs->cr1); +@@ -1466,23 +1475,20 @@ static void __maybe_unused stm32_usart_serial_en_wakeup(struct uart_port *port, + { + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- const struct stm32_usart_config *cfg = &stm32_port->info->cfg; +- u32 val; + + if (stm32_port->wakeirq <= 0) + return; + ++ /* ++ * Enable low-power wake-up and wake-up irq if argument is set to ++ * "enable", disable low-power wake-up and wake-up irq otherwise ++ */ + if (enable) { +- stm32_usart_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); + stm32_usart_set_bits(port, ofs->cr1, USART_CR1_UESM); +- val = readl_relaxed(port->membase + ofs->cr3); +- val &= ~USART_CR3_WUS_MASK; +- /* Enable Wake up interrupt from low power on start bit */ +- val |= USART_CR3_WUS_START_BIT | USART_CR3_WUFIE; +- writel_relaxed(val, port->membase + ofs->cr3); +- stm32_usart_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit)); ++ stm32_usart_set_bits(port, ofs->cr3, USART_CR3_WUFIE); + } else { + stm32_usart_clr_bits(port, ofs->cr1, USART_CR1_UESM); ++ stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE); + } + } + +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-use-of_device_get_match_data.patch b/queue-5.10/serial-stm32-use-of_device_get_match_data.patch new file mode 100644 index 00000000000..7f6796fa0be --- /dev/null +++ b/queue-5.10/serial-stm32-use-of_device_get_match_data.patch @@ -0,0 +1,322 @@ +From 31c14b6c7fd298ca4d08736fa5336a231cb44f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jan 2021 19:44:25 -0800 +Subject: serial: stm32: Use of_device_get_match_data() + +From: Stephen Boyd + +[ Upstream commit d825f0bea20f49a8f413a6acd7c4100ea55edf6d ] + +This driver casts away the constness of struct stm32_usart_info that is +pointed to by the of match table. Use of_device_get_match_data() instead +of of_match_device() here and push the const throughout the code so that +we don't cast away const. This nicely avoids referencing the match table +when it is undefined with configurations where CONFIG_OF=n and fixes the +const issues. + +Signed-off-by: Stephen Boyd +Acked-by: Greg Kroah-Hartman +Cc: Arnd Bergmann +Cc: Geert Uytterhoeven +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: Maxime Coquelin +Cc: Alexandre Torgue +Cc: Rob Herring +Cc: Frank Rowand +Cc: +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20210123034428.2841052-4-swboyd@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 71 +++++++++++++++----------------- + drivers/tty/serial/stm32-usart.h | 2 +- + 2 files changed, 35 insertions(+), 38 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index dd029696893a..1f7fe285bb1f 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -99,8 +99,8 @@ static int stm32_usart_config_rs485(struct uart_port *port, + struct serial_rs485 *rs485conf) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + u32 usartdiv, baud, cr1, cr3; + bool over8; + +@@ -168,7 +168,7 @@ static int stm32_usart_pending_rx(struct uart_port *port, u32 *sr, + int *last_res, bool threaded) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + enum dma_status status; + struct dma_tx_state state; + +@@ -192,7 +192,7 @@ static unsigned long stm32_usart_get_char(struct uart_port *port, u32 *sr, + int *last_res) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long c; + + if (stm32_port->rx_ch) { +@@ -212,7 +212,7 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + { + struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long c; + u32 sr; + char flag; +@@ -284,7 +284,7 @@ static void stm32_usart_tx_dma_complete(void *arg) + { + struct uart_port *port = arg; + struct stm32_port *stm32port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32port->tx_dma_busy = false; +@@ -296,7 +296,7 @@ static void stm32_usart_tx_dma_complete(void *arg) + static void stm32_usart_tx_interrupt_enable(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + /* + * Enables TX FIFO threashold irq when FIFO is enabled, +@@ -311,7 +311,7 @@ static void stm32_usart_tx_interrupt_enable(struct uart_port *port) + static void stm32_usart_tx_interrupt_disable(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + if (stm32_port->fifoen) + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_TXFTIE); +@@ -322,7 +322,7 @@ static void stm32_usart_tx_interrupt_disable(struct uart_port *port) + static void stm32_usart_transmit_chars_pio(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + struct circ_buf *xmit = &port->state->xmit; + + if (stm32_port->tx_dma_busy) { +@@ -349,7 +349,7 @@ static void stm32_usart_transmit_chars_pio(struct uart_port *port) + static void stm32_usart_transmit_chars_dma(struct uart_port *port) + { + struct stm32_port *stm32port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + struct circ_buf *xmit = &port->state->xmit; + struct dma_async_tx_descriptor *desc = NULL; + unsigned int count, i; +@@ -415,7 +415,7 @@ fallback_err: + static void stm32_usart_transmit_chars(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + struct circ_buf *xmit = &port->state->xmit; + + if (port->x_char) { +@@ -455,7 +455,7 @@ static irqreturn_t stm32_usart_interrupt(int irq, void *ptr) + { + struct uart_port *port = ptr; + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + u32 sr; + + spin_lock(&port->lock); +@@ -502,7 +502,7 @@ static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) + static unsigned int stm32_usart_tx_empty(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE; + } +@@ -510,7 +510,7 @@ static unsigned int stm32_usart_tx_empty(struct uart_port *port) + static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS)) + stm32_usart_set_bits(port, ofs->cr3, USART_CR3_RTSE); +@@ -587,7 +587,7 @@ static void stm32_usart_start_tx(struct uart_port *port) + static void stm32_usart_throttle(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); +@@ -602,7 +602,7 @@ static void stm32_usart_throttle(struct uart_port *port) + static void stm32_usart_unthrottle(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); +@@ -617,7 +617,7 @@ static void stm32_usart_unthrottle(struct uart_port *port) + static void stm32_usart_stop_rx(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + stm32_usart_clr_bits(port, ofs->cr1, stm32_port->cr1_irq); + if (stm32_port->cr3_irq) +@@ -632,7 +632,7 @@ static void stm32_usart_break_ctl(struct uart_port *port, int break_state) + static int stm32_usart_startup(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + const char *name = to_platform_device(port->dev)->name; + u32 val; + int ret; +@@ -668,8 +668,8 @@ static int stm32_usart_startup(struct uart_port *port) + static void stm32_usart_shutdown(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + u32 val, isr; + int ret; + +@@ -729,8 +729,8 @@ static void stm32_usart_set_termios(struct uart_port *port, + struct ktermios *old) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + struct serial_rs485 *rs485conf = &port->rs485; + unsigned int baud, bits; + u32 usartdiv, mantissa, fraction, oversampling; +@@ -930,8 +930,8 @@ static void stm32_usart_pm(struct uart_port *port, unsigned int state, + { + struct stm32_port *stm32port = container_of(port, + struct stm32_port, port); +- struct stm32_usart_offsets *ofs = &stm32port->info->ofs; +- struct stm32_usart_config *cfg = &stm32port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32port->info->cfg; + unsigned long flags = 0; + + switch (state) { +@@ -1089,7 +1089,7 @@ MODULE_DEVICE_TABLE(of, stm32_match); + static int stm32_usart_of_dma_rx_probe(struct stm32_port *stm32port, + struct platform_device *pdev) + { +- struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + struct uart_port *port = &stm32port->port; + struct device *dev = &pdev->dev; + struct dma_slave_config config; +@@ -1164,7 +1164,7 @@ alloc_err: + static int stm32_usart_of_dma_tx_probe(struct stm32_port *stm32port, + struct platform_device *pdev) + { +- struct stm32_usart_offsets *ofs = &stm32port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32port->info->ofs; + struct uart_port *port = &stm32port->port; + struct device *dev = &pdev->dev; + struct dma_slave_config config; +@@ -1214,7 +1214,6 @@ alloc_err: + + static int stm32_usart_serial_probe(struct platform_device *pdev) + { +- const struct of_device_id *match; + struct stm32_port *stm32port; + int ret; + +@@ -1222,10 +1221,8 @@ static int stm32_usart_serial_probe(struct platform_device *pdev) + if (!stm32port) + return -ENODEV; + +- match = of_match_device(stm32_match, &pdev->dev); +- if (match && match->data) +- stm32port->info = (struct stm32_usart_info *)match->data; +- else ++ stm32port->info = of_device_get_match_data(&pdev->dev); ++ if (!stm32port->info) + return -EINVAL; + + ret = stm32_usart_init_port(stm32port, pdev); +@@ -1309,7 +1306,7 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + { + struct uart_port *port = platform_get_drvdata(pdev); + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + int err; + + pm_runtime_get_sync(&pdev->dev); +@@ -1359,7 +1356,7 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + static void stm32_usart_console_putchar(struct uart_port *port, int ch) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + + while (!(readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE)) + cpu_relax(); +@@ -1372,8 +1369,8 @@ static void stm32_usart_console_write(struct console *co, const char *s, + { + struct uart_port *port = &stm32_ports[co->index].port; + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + unsigned long flags; + u32 old_cr1, new_cr1; + int locked = 1; +@@ -1459,8 +1456,8 @@ static void __maybe_unused stm32_usart_serial_en_wakeup(struct uart_port *port, + bool enable) + { + struct stm32_port *stm32_port = to_stm32_port(port); +- struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; ++ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; ++ const struct stm32_usart_config *cfg = &stm32_port->info->cfg; + u32 val; + + if (stm32_port->wakeirq <= 0) +diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h +index d4c916e78d40..cb4f327c46db 100644 +--- a/drivers/tty/serial/stm32-usart.h ++++ b/drivers/tty/serial/stm32-usart.h +@@ -259,7 +259,7 @@ struct stm32_usart_info stm32h7_info = { + struct stm32_port { + struct uart_port port; + struct clk *clk; +- struct stm32_usart_info *info; ++ const struct stm32_usart_info *info; + struct dma_chan *rx_ch; /* dma rx channel */ + dma_addr_t rx_dma_buf; /* dma rx buffer bus address */ + unsigned char *rx_buf; /* dma rx buffer cpu address */ +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 4db1a297d00..962481e32ee 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -108,3 +108,415 @@ ovl-fix-missing-revert_creds-on-error-path.patch revert-drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch revert-tools-power-turbostat-adjust-for-temperature-offset.patch +firmware-xilinx-fix-dereferencing-freed-memory.patch +firmware-xilinx-add-a-blank-line-after-function-decl.patch +firmware-xilinx-remove-zynqmp_pm_get_eemi_ops-in-is_.patch +fpga-fpga-mgr-xilinx-spi-fix-error-messages-on-eprob.patch +crypto-sun8i-ss-fix-result-memory-leak-on-error-path.patch +memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch +arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch +arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch-27655 +arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-29838 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3210 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-12139 +arm-dts-s5pv210-correct-fuel-gauge-interrupt-trigger.patch +arm-dts-renesas-add-mmc-aliases-into-r-car-gen2-boar.patch +arm64-dts-renesas-add-mmc-aliases-into-board-dts-fil.patch +x86-platform-uv-set-section-block-size-for-hubless-a.patch +serial-stm32-fix-code-cleaning-warnings-and-checks.patch +serial-stm32-add-_usart-prefix-in-functions-name.patch +serial-stm32-fix-probe-and-remove-order-for-dma.patch +serial-stm32-use-of_device_get_match_data.patch +serial-stm32-fix-startup-by-enabling-usart-for-recep.patch +serial-stm32-fix-incorrect-characters-on-console.patch +serial-stm32-fix-tx-and-rx-fifo-thresholds.patch +serial-stm32-fix-a-deadlock-condition-with-wakeup-ev.patch +serial-stm32-fix-wake-up-flag-handling.patch +serial-stm32-fix-a-deadlock-in-set_termios.patch +serial-stm32-fix-tx-dma-completion-release-channel.patch +serial-stm32-call-stm32_transmit_chars-locked.patch +serial-stm32-fix-fifo-flush-in-startup-and-set_termi.patch +serial-stm32-add-fifo-flush-when-port-is-closed.patch +serial-stm32-fix-tx_empty-condition.patch +usb-typec-tcpci-check-role_control-while-interpretin.patch +usb-typec-tps6598x-fix-return-value-check-in-tps6598.patch +usb-typec-stusb160x-fix-return-value-check-in-stusb1.patch +regmap-set-debugfs_name-to-null-after-it-is-freed.patch +spi-rockchip-avoid-objtool-warning.patch +mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch +mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch +mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch +mtd-rawnand-qcom-return-actual-error-code-instead-of.patch +mtd-don-t-lock-when-recursively-deleting-partitions.patch +mtd-maps-fix-error-return-code-of-physmap_flash_remo.patch +arm-dts-stm32-fix-usart-2-3-pinconf-to-wake-up-with-.patch +arm64-dts-qcom-sm8250-fix-level-triggered-pmu-interr.patch +arm64-dts-qcom-sm8250-fix-timer-interrupt-to-specify.patch +arm64-dts-qcom-sdm845-fix-number-of-pins-in-gpio-ran.patch +arm64-dts-qcom-sm8150-fix-number-of-pins-in-gpio-ran.patch +arm64-dts-qcom-sm8250-fix-number-of-pins-in-gpio-ran.patch +arm64-dts-qcom-db845c-fix-correct-powerdown-pin-for-.patch +crypto-sun8i-ss-fix-memory-leak-of-object-d-when-dma.patch +spi-stm32-drop-devres-version-of-spi_register_master.patch +regulator-bd9576-fix-return-from-bd957x_probe.patch +arm64-dts-renesas-r8a77980-fix-vin4-7-endpoint-bindi.patch +spi-stm32-fix-use-after-free-on-unbind.patch +x86-microcode-check-for-offline-cpus-before-requesti.patch +devtmpfs-fix-placement-of-complete-call.patch +usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch +usb-gadget-pch_udc-check-if-driver-is-present-before.patch +usb-gadget-pch_udc-check-for-dma-mapping-error.patch +usb-gadget-pch_udc-initialize-device-pointer-before-.patch +usb-gadget-pch_udc-provide-a-gpio-line-used-on-intel.patch +crypto-ccp-fix-command-queuing-to-tee-ring-buffer.patch +crypto-qat-don-t-release-uninitialized-resources.patch +crypto-qat-adf_status_pf_running-should-be-set-after.patch +fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch +fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch +fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch +fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch +fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch +fotg210-udc-complete-out-requests-on-short-packets.patch +usb-gadget-s3c-fix-incorrect-resources-releasing.patch +usb-gadget-s3c-fix-the-error-handling-path-in-s3c241.patch +dt-bindings-serial-stm32-use-type-object-instead-of-.patch +mtd-require-write-permissions-for-locking-and-badblo.patch +arm64-dts-renesas-r8a779a0-fix-pmu-interrupt.patch +bus-qcom-put-child-node-before-return.patch +soundwire-bus-fix-device-found-flag-correctly.patch +phy-ti-j721e-wiz-delete-clk_div_sel-clk-provider-dur.patch +phy-marvell-armada375_usbcluster_phy-should-not-defa.patch +arm64-dts-mediatek-fix-reset-gpio-level-on-pumpkin.patch +nfsd-fix-sparse-warning-in-nfs4proc.c.patch +nfsv4.2-fix-copy-stateid-copying-for-the-async-copy.patch +crypto-poly1305-fix-poly1305_core_setkey-declaration.patch +crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch +usb-gadget-aspeed-fix-dma-map-failure.patch +usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch +drivers-nvmem-fix-voltage-settings-for-qti-qfprom-ef.patch +driver-core-platform-declare-early_platform_cleanup-.patch +memory-pl353-fix-mask-of-ecc-page_size-config-regist.patch +soundwire-stream-fix-memory-leak-in-stream-config-er.patch +m68k-mvme147-mvme16x-don-t-wipe-pcc-timer-config-bit.patch +firmware-qcom_scm-make-__qcom_scm_is_call_available-.patch +firmware-qcom_scm-reduce-locking-section-for-__get_c.patch +firmware-qcom_scm-workaround-lack-of-is-available-ca.patch +iio-adc-kconfig-make-ad9467-depend-on-adi_axi_adc-sy.patch +mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch +irqchip-gic-v3-fix-of_bad_addr-error-handling.patch +staging-comedi-tests-ni_routes_test-fix-compilation-.patch +staging-rtl8192u-fix-potential-infinite-loop.patch +staging-fwserial-fix-tiocsserial-implementation.patch +staging-fwserial-fix-tiocgserial-implementation.patch +staging-greybus-uart-fix-unprivileged-tioccserial.patch +soc-qcom-pdr-fix-error-return-code-in-pdr_register_l.patch +pm-devfreq-use-more-accurate-returned-new_freq-as-re.patch +clocksource-drivers-timer-ti-dm-fix-posted-mode-stat.patch +clocksource-drivers-timer-ti-dm-add-missing-set_stat.patch +clocksource-drivers-ingenic_ost-fix-return-value-che.patch +spi-fix-use-after-free-with-devm_spi_alloc_.patch +spi-fsl-add-missing-iounmap-on-error-in-of_fsl_spi_p.patch +soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch +soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch +pm-runtime-replace-inline-function-pm_runtime_callba.patch +cpuidle-fix-arm_qcom_spm_cpuidle-configuration.patch +acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch +crypto-allwinner-add-missing-crypto_-prefix.patch +crypto-sun8i-ss-fix-memory-leak-of-pad.patch +crypto-sa2ul-fix-memory-leak-of-rxd.patch +crypto-qat-fix-a-double-free-in-adf_create_ring.patch +cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch +clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch +cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch +clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch +clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch +cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch +cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch +spi-spi-zynqmp-gqspi-use-wait_for_completion_timeout.patch +spi-spi-zynqmp-gqspi-add-mutex-locking-for-exec_op.patch +spi-spi-zynqmp-gqspi-transmit-dummy-circles-by-using.patch +spi-spi-zynqmp-gqspi-fix-incorrect-operating-mode-in.patch +spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch +usb-gadget-r8a66597-add-missing-null-check-on-return.patch +usb-cdc-acm-fix-unprivileged-tioccserial.patch +usb-cdc-acm-fix-tiocgserial-implementation.patch +tty-actually-undefine-superseded-async-flags.patch +tty-fix-return-value-for-unsupported-ioctls.patch +tty-remove-dead-termiox-code.patch +tty-fix-return-value-for-unsupported-termiox-ioctls.patch +serial-core-return-early-on-unsupported-ioctls.patch +firmware-qcom-scm-fix-qcom_scm-configuration.patch +node-fix-device-cleanups-in-error-handling-code.patch +crypto-chelsio-read-rxchannel-id-from-firmware.patch +usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch +m68k-add-missing-mmap_read_lock-to-sys_cacheflush.patch +spi-spi-zynqmp-gqspi-fix-missing-unlock-on-error-in-.patch +memory-renesas-rpc-if-fix-possible-null-pointer-dere.patch +memory-samsung-exynos5422-dmc-handle-clk_set_parent-.patch +security-keys-trusted-fix-tpm2-authorizations.patch +platform-x86-pmc_atom-match-all-beckhoff-automation-.patch +arm-dts-aspeed-rainier-fix-humidity-sensor-bus-addre.patch +drivers-hv-vmbus-use-after-free-in-__vmbus_open.patch +spi-spi-zynqmp-gqspi-fix-clk_enable-disable-imbalanc.patch +spi-spi-zynqmp-gqspi-fix-hang-issue-when-suspend-res.patch +spi-spi-zynqmp-gqspi-fix-use-after-free-in-zynqmp_qs.patch +spi-spi-zynqmp-gqspi-return-enomem-if-dma_map_single.patch +x86-platform-uv-fix-kexec-build-failure.patch +hwmon-pmbus-pxe1610-don-t-bail-out-when-not-all-page.patch +drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch +pm-hibernate-x86-use-crc32-instead-of-md5-for-hibern.patch +usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch +usb-dwc2-fix-hibernation-between-host-and-device-mod.patch +ttyprintk-add-tty-hangup-callback.patch +serial-omap-don-t-disable-rs485-if-rts-gpio-is-missi.patch +serial-omap-fix-rs485-half-duplex-filtering.patch +xen-blkback-fix-compatibility-bug-with-single-page-r.patch +soc-aspeed-fix-a-ternary-sign-expansion-bug.patch +drm-tilcdc-send-vblank-event-when-disabling-crtc.patch +drm-stm-fix-bus_flags-handling.patch +drm-amd-display-fix-off-by-one-in-hdmi_14_process_tr.patch +drm-mcde-panel-inverse-misunderstood-flag.patch +sched-fair-fix-shift-out-of-bounds-in-load_balance.patch +afs-fix-updating-of-i_mode-due-to-3rd-party-change.patch +rcu-remove-spurious-instrumentation_end-in-rcu_nmi_e.patch +media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch +media-saa7134-use-sg_dma_len-when-building-pgtable.patch +media-saa7146-use-sg_dma_len-when-building-pgtable.patch +media-omap4iss-return-error-code-when-omap4iss_get-f.patch +media-rkisp1-rsz-crash-fix-when-setting-src-format.patch +media-aspeed-fix-clock-handling-logic.patch +drm-probe-helper-check-epoch-counter-in-output_poll_.patch +media-venus-core-fix-some-resource-leaks-in-the-erro.patch +media-platform-sunxi-sun6i-csi-fix-error-return-code.patch +media-m88ds3103-fix-return-value-check-in-m88ds3103_.patch +media-docs-fix-data-organization-of-media_bus_fmt_rg.patch +media-next-staging-media-atomisp-fix-memory-leak-of-.patch +media-atomisp-fixed-error-handling-path.patch +media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch +media-atomisp-fix-use-after-free-in-atomisp_alloc_cs.patch +drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch +of-overlay-fix-for_each_child.cocci-warnings.patch +x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch +selftests-fix-prepending-output-to-test_progs.patch +pata_arasan_cf-fix-irq-check.patch +pata_ipx4xx_cf-fix-irq-check.patch +sata_mv-add-irq-checks.patch +ata-libahci_platform-fix-irq-check.patch +seccomp-fix-config-tests-for-seccomp_filters.patch +nvme-tcp-block-bh-in-sk-state_change-sk-callback.patch +nvmet-tcp-fix-incorrect-locking-in-state_change-sk-c.patch +clk-imx-fix-reparenting-of-uarts-not-associated-with.patch +power-supply-bq25980-move-props-from-battery-node.patch +nvme-retrigger-ana-log-update-if-group-descriptor-is.patch +media-i2c-imx219-move-out-locking-unlocking-of-vflip.patch +media-i2c-imx219-balance-runtime-pm-use-count.patch +media-v4l2-ctrls.c-fix-race-condition-in-hdl-request.patch +vfio-fsl-mc-re-order-vfio_fsl_mc_probe.patch +vfio-pci-move-vga-and-vf-initialization-to-functions.patch +vfio-pci-re-order-vfio_pci_probe.patch +vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch +clk-zynqmp-move-zynqmp_pll_set_mode-out-of-round_rat.patch +clk-zynqmp-pll-add-set_pll_mode-to-check-condition-i.patch +drm-xlnx-zynqmp-fix-a-memset-in-zynqmp_dp_train.patch +clk-qcom-a53-pll-add-missing-module_device_table.patch +clk-qcom-apss-ipq-pll-add-missing-module_device_tabl.patch +drm-amd-display-use-gfp_atomic-in-dcn20_resource_con.patch +drm-radeon-fix-a-missing-check-bug-in-radeon_dp_mst_.patch +clk-uniphier-fix-potential-infinite-loop.patch +scsi-pm80xx-increase-timeout-for-pm80xx-mpi_uninit_c.patch +scsi-pm80xx-fix-potential-infinite-loop.patch +scsi-ufs-ufshcd-pltfrm-fix-deferred-probing.patch +scsi-hisi_sas-fix-irq-checks.patch +scsi-jazz_esp-add-irq-check.patch +scsi-sun3x_esp-add-irq-check.patch +scsi-sni_53c710-add-irq-check.patch +scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch +mailbox-sprd-introduce-refcnt-when-clients-requests-.patch +mfd-stm32-timers-avoid-clearing-auto-reload-register.patch +nvmet-tcp-fix-a-segmentation-fault-during-io-parsing.patch +nvme-pci-don-t-simple-map-sgl-when-sgls-are-disabled.patch +media-cedrus-fix-h265-status-definitions.patch +hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch +x86-events-amd-iommu-fix-sysfs-type-mismatch.patch +perf-amd-uncore-fix-sysfs-type-mismatch.patch +io_uring-fix-overflows-checks-in-provide-buffers.patch +sched-debug-fix-cgroup_path-serialization.patch +drivers-block-null_blk-main-fix-a-double-free-in-nul.patch +xsk-respect-device-s-headroom-and-tailroom-on-generi.patch +hid-plantronics-workaround-for-double-volume-key-pre.patch +perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch +asoc-intel-boards-sof-wm8804-add-check-for-pll-setti.patch +asoc-intel-skylake-compile-when-any-configuration-is.patch +rdma-mlx5-fix-mlx5-rates-to-ib-rates-map.patch +wilc1000-write-value-to-wilc_intr2_enable-register.patch +kvm-x86-mmu-retry-page-faults-that-hit-an-invalid-me.patch +bluetooth-avoid-deadlock-between-hci_dev-lock-and-so.patch +net-lapbether-prevent-racing-when-checking-whether-t.patch +libbpf-add-explicit-padding-to-bpf_xdp_set_link_opts.patch +bpftool-fix-maybe-uninitialized-warnings.patch +iommu-check-dev-iommu-in-iommu_dev_xxx-functions.patch +iommu-vt-d-reject-unsupported-page-request-modes.patch +selftests-bpf-re-generate-vmlinux.h-and-bpf-skeleton.patch +libbpf-add-explicit-padding-to-btf_dump_emit_type_de.patch +powerpc-fadump-mark-fadump_calculate_reserve_size-as.patch +powerpc-prom-mark-identical_pvr_fixup-as-__init.patch +mips-fix-local_irq_-disable-enable-in-asmmacro.h.patch +ima-fix-the-error-code-for-restoring-the-pcr-value.patch +inet-use-bigger-hash-table-for-ip-id-generation.patch +pinctrl-pinctrl-single-remove-unused-parameter.patch +pinctrl-pinctrl-single-fix-pcs_pin_dbg_show-when-bit.patch +mips-loongson64-fix-bug-when-page_size-16kb.patch +asoc-wm8960-remove-bitclk-relax-condition-in-wm8960_.patch +iommu-arm-smmu-v3-add-bit-field-sfm-into-gerror_err_.patch +rdma-mlx5-fix-drop-packet-rule-in-egress-table.patch +ib-isert-fix-a-use-after-free-in-isert_connect_reque.patch +powerpc-fix-have_hardlockup_detector_arch-build-conf.patch +mips-bpf-enable-bpf_probe_read-str-on-mips-again.patch +gpio-guard-gpiochip_irqchip_add_domain-with-gpiolib_.patch +alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch +net-phy-lan87xx-fix-access-to-wrong-register-of-lan8.patch +udp-never-accept-gso_fraglist-packets.patch +powerpc-pseries-only-register-vio-drivers-if-vio-bus.patch +net-tipc-fix-missing-destroy_workqueue-on-error-in-t.patch +bug-remove-redundant-condition-check-in-report_bug.patch +rdma-core-fix-corrupted-sl-on-passive-side.patch +nfc-pn533-prevent-potential-memory-corruption.patch +net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch +mips-bmips-fix-syscon-reboot-nodes.patch +iommu-vt-d-don-t-set-then-clear-private-data-in-prq_.patch +iommu-fix-a-boundary-issue-to-avoid-performance-drop.patch +iommu-vt-d-report-right-snoop-capability-when-using-.patch +iommu-vt-d-report-the-right-page-fault-address.patch +iommu-vt-d-preset-access-dirty-bits-for-iova-over-fl.patch +iommu-vt-d-remove-wo-permissions-on-second-level-pag.patch +iommu-vt-d-invalidate-pasid-cache-when-root-context-.patch +alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch +hid-lenovo-use-brightness_set_blocking-callback-for-.patch +hid-lenovo-fix-lenovo_led_set_tp10ubkbd-error-handli.patch +hid-lenovo-check-hid_get_drvdata-returns-non-null-in.patch +hid-lenovo-map-mic-mute-button-to-key_f20-instead-of.patch +kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch +asoc-simple-card-fix-possible-uninitialized-single_c.patch +liquidio-fix-unintented-sign-extension-of-a-left-shi.patch +ib-hfi1-use-kzalloc-for-mmu_rb_handler-allocation.patch +powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch +powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch +powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch +mac80211-bail-out-if-cipher-schemes-are-invalid.patch +perf-vendor-events-amd-fix-broken-l2-cache-hits-from.patch +xfs-fix-return-of-uninitialized-value-in-variable-er.patch +rtw88-fix-an-error-code-in-rtw_debugfs_set_rsvd_page.patch +mt7601u-fix-always-true-expression.patch +mt76-mt7615-fix-tx-skb-dma-unmap.patch +mt76-mt7915-fix-tx-skb-dma-unmap.patch +mt76-mt7915-fix-aggr-len-debugfs-node.patch +mt76-mt7615-fix-mib-stats-counter-reporting-to-mac80.patch +mt76-mt7915-fix-mib-stats-counter-reporting-to-mac80.patch +mt76-mt7663s-make-all-of-packets-4-bytes-aligned-in-.patch +mt76-mt7663s-fix-the-possible-device-hang-in-high-tr.patch +kvm-ppc-book3s-hv-p9-restore-host-ctrl-spr-after-gue.patch +ovl-invalidate-readdir-cache-on-changes-to-dir-with-.patch +rdma-qedr-fix-error-return-code-in-qedr_iw_connect.patch +ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch +rdma-bnxt_re-fix-error-return-code-in-bnxt_qplib_cq_.patch +cxgb4-fix-unintentional-sign-extension-issues.patch +net-thunderx-fix-unintentional-sign-extension-issue.patch +rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch +rdma-rtrs-clt-destroy-sysfs-after-removing-session-f.patch +i2c-cadence-fix-reference-leak-when-pm_runtime_get_s.patch +i2c-img-scb-fix-reference-leak-when-pm_runtime_get_s.patch +i2c-imx-lpi2c-fix-reference-leak-when-pm_runtime_get.patch +i2c-imx-fix-reference-leak-when-pm_runtime_get_sync-.patch +i2c-omap-fix-reference-leak-when-pm_runtime_get_sync.patch +i2c-sprd-fix-reference-leak-when-pm_runtime_get_sync.patch +i2c-stm32f7-fix-reference-leak-when-pm_runtime_get_s.patch +i2c-xiic-fix-reference-leak-when-pm_runtime_get_sync.patch +i2c-cadence-add-irq-check.patch +i2c-emev2-add-irq-check.patch +i2c-jz4780-add-irq-check.patch +i2c-mlxbf-add-irq-check.patch +i2c-rcar-make-sure-irq-is-not-threaded-on-gen2-and-e.patch +i2c-rcar-protect-against-supurious-interrupts-on-v3u.patch +i2c-rcar-add-irq-check.patch +i2c-sh7760-add-irq-check.patch +powerpc-xive-drop-check-on-irq_data-in-xive_core_deb.patch +powerpc-xive-fix-xmon-command-dxi.patch +asoc-ak5558-correct-reset-polarity.patch +net-mlx5-fix-bit-wise-and-with-zero.patch +net-packet-make-packet_fanout.arr-size-configurable-.patch +net-packet-remove-data-races-in-fanout-operations.patch +drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch +iommu-amd-put-newline-after-closing-bracket-in-warni.patch +perf-beauty-fix-fsconfig-generator.patch +drm-amd-pm-fix-error-code-in-smu_set_power_limit.patch +mips-pci-legacy-stop-using-of_pci_range_to_resource.patch +powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch +powerpc-smp-reintroduce-cpu_core_mask.patch +kvm-x86-dump_vmcs-should-not-assume-guest_ia32_efer-.patch +rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch +wlcore-fix-overlapping-snprintf-arguments-in-debugfs.patch +i2c-sh7760-fix-irq-error-path.patch +i2c-mediatek-fix-wrong-dma-sync-flag.patch +mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch +netfilter-nft_payload-fix-c-vlan-offload-support.patch +netfilter-nftables_offload-vlan-id-needs-host-byteor.patch +netfilter-nftables_offload-special-ethertype-handlin.patch +vsock-vmci-log-once-the-failed-queue-pair-allocation.patch +libbpf-initialize-the-bpf_seq_printf-parameters-arra.patch +net-ethernet-ixp4xx-set-the-dma-masks-explicitly.patch +gro-fix-napi_gro_frags-fast-gro-breakage-due-to-ip-a.patch +rdma-cxgb4-add-missing-qpid-increment.patch +rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch +alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch +sfc-ef10-fix-tx-queue-lookup-in-tx-event-handling.patch +vsock-virtio-free-queued-packets-when-closing-socket.patch +net-marvell-prestera-fix-port-event-handling-on-init.patch +net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch +mt76-mt7615-fix-memleak-when-mt7615_unregister_devic.patch +crypto-ccp-detect-and-reject-invalid-addresses-desti.patch +nfp-devlink-initialize-the-devlink-port-attribute-la.patch +net-stmmac-fix-tso-and-tbs-feature-enabling-during-d.patch +net-renesas-ravb-fix-a-stuck-issue-when-a-lot-of-fra.patch +net-phy-intel-xway-enable-integrated-led-functions.patch +rdma-rxe-fix-a-bug-in-rxe_fill_ip_info.patch +rdma-core-add-cm-to-restrack-after-successful-attach.patch +powerpc-64-fix-the-definition-of-the-fixmap-area.patch +ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch +ath10k-fix-a-use-after-free-in-ath10k_htc_send_bundl.patch +ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch +wlcore-fix-buffer-overrun-by-snprintf-due-to-incorre.patch +powerpc-perf-fix-the-threshold-event-selection-for-m.patch +powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch +net-phy-marvell-fix-m88e1011_set_downshift.patch +net-phy-marvell-fix-m88e1111_set_downshift.patch +net-enetc-fix-link-error-again.patch +bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch +arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch +arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch +net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch +selftests-net-mirror_gre_vlan_bridge_1q-make-an-fdb-.patch +selftests-mlxsw-remove-a-redundant-if-statement-in-t.patch +bnxt_en-fix-rx-consumer-index-logic-in-the-error-pat.patch +kvm-vmx-intercept-fs-gs_base-msr-accesses-for-32-bit.patch +net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch +selftests-bpf-fix-bpf_core_read_bitfield-macro.patch +selftests-bpf-fix-field-existence-co-re-reloc-tests.patch +selftests-bpf-fix-core_reloc-test-runner.patch +bpf-fix-propagation-of-32-bit-unsigned-bounds-from-6.patch +rdma-siw-fix-a-use-after-free-in-siw_alloc_mr.patch +rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch +net-bridge-mcast-fix-broken-length-header-check-for-.patch +net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch +perf-tools-change-fields-type-in-perf_record_time_co.patch +perf-jit-let-convert_timestamp-to-be-backwards-compa.patch +perf-session-add-swap-operation-for-event-time_conv.patch +ia64-fix-efi_debug-build.patch +kfifo-fix-ternary-sign-extension-bugs.patch +mm-sl-b.c-remove-ctor-argument-from-kmem_cache_flags.patch +mm-slub-enable-slub_debug-static-key-when-creating-c.patch +mm-memcontrol-slab-fix-obtain-a-reference-to-a-freei.patch +mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch +mm-memory-failure-unnecessary-amount-of-unmapping.patch +afs-fix-speculative-status-fetches.patch diff --git a/queue-5.10/sfc-ef10-fix-tx-queue-lookup-in-tx-event-handling.patch b/queue-5.10/sfc-ef10-fix-tx-queue-lookup-in-tx-event-handling.patch new file mode 100644 index 00000000000..47f56a8c21d --- /dev/null +++ b/queue-5.10/sfc-ef10-fix-tx-queue-lookup-in-tx-event-handling.patch @@ -0,0 +1,39 @@ +From 1029cd2822090a2ab8b287c9d79bf1dc6d2085a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 13:29:35 +0100 +Subject: sfc: ef10: fix TX queue lookup in TX event handling + +From: Edward Cree + +[ Upstream commit 172e269edfce34bac7c61c15551816bda4b0f140 ] + +We're starting from a TXQ label, not a TXQ type, so + efx_channel_get_tx_queue() is inappropriate. This worked by chance, + because labels and types currently match on EF10, but we shouldn't + rely on that. + +Fixes: 12804793b17c ("sfc: decouple TXQ type from label") +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index da6886dcac37..4fa72b573c17 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -2928,8 +2928,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event) + + /* Get the transmit queue */ + tx_ev_q_label = EFX_QWORD_FIELD(*event, ESF_DZ_TX_QLABEL); +- tx_queue = efx_channel_get_tx_queue(channel, +- tx_ev_q_label % EFX_MAX_TXQ_PER_CHANNEL); ++ tx_queue = channel->tx_queue + (tx_ev_q_label % EFX_MAX_TXQ_PER_CHANNEL); + + if (!tx_queue->timestamping) { + /* Transmit completion */ +-- +2.30.2 + diff --git a/queue-5.10/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch b/queue-5.10/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch new file mode 100644 index 00000000000..7632b4eeea9 --- /dev/null +++ b/queue-5.10/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch @@ -0,0 +1,51 @@ +From f156a65216323f9e77bb279dedf14a325b8d9580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 09:39:19 +0930 +Subject: soc: aspeed: fix a ternary sign expansion bug + +From: Dan Carpenter + +[ Upstream commit 5ffa828534036348fa90fb3079ccc0972d202c4a ] + +The intent here was to return negative error codes but it actually +returns positive values. The problem is that type promotion with +ternary operations is quite complicated. + +"ret" is an int. "copied" is a u32. And the snoop_file_read() function +returns long. What happens is that "ret" is cast to u32 and becomes +positive then it's cast to long and it's still positive. + +Fix this by removing the ternary so that "ret" is type promoted directly +to long. + +Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") +Signed-off-by: Dan Carpenter +Signed-off-by: Joel Stanley +Reviewed-by: Patrick Venture +Link: https://lore.kernel.org/r/YIE90PSXsMTa2Y8n@mwanda +Link: https://lore.kernel.org/r/20210423000919.1249474-1-joel@jms.id.au' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/soc/aspeed/aspeed-lpc-snoop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c +index dbe5325a324d..538d7aab8db5 100644 +--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c ++++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c +@@ -95,8 +95,10 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer, + return -EINTR; + } + ret = kfifo_to_user(&chan->fifo, buffer, count, &copied); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static __poll_t snoop_file_poll(struct file *file, +-- +2.30.2 + diff --git a/queue-5.10/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch b/queue-5.10/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch new file mode 100644 index 00000000000..bd603411a47 --- /dev/null +++ b/queue-5.10/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch @@ -0,0 +1,48 @@ +From b7465b9dd7d40d5ff5bbd9b970331e95a53d70bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 15:25:26 -0800 +Subject: soc: qcom: mdt_loader: Detect truncated read of segments + +From: Bjorn Andersson + +[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ] + +Given that no validation of how much data the firmware loader read in +for a given segment truncated segment files would best case result in a +hash verification failure, without any indication of what went wrong. + +Improve this by validating that the firmware loader did return the +amount of data requested. + +Fixes: 445c2410a449 ("soc: qcom: mdt_loader: Use request_firmware_into_buf()") +Reviewed-by: Sibi Sankar +Link: https://lore.kernel.org/r/20210107232526.716989-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index 2ddaee5ef9cc..eba7f76f9d61 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -261,6 +261,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, + break; + } + ++ if (seg_fw->size != phdr->p_filesz) { ++ dev_err(dev, ++ "failed to load segment %d from truncated file %s\n", ++ i, fw_name); ++ release_firmware(seg_fw); ++ ret = -EINVAL; ++ break; ++ } ++ + release_firmware(seg_fw); + } + +-- +2.30.2 + diff --git a/queue-5.10/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch b/queue-5.10/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch new file mode 100644 index 00000000000..62ae3810ccc --- /dev/null +++ b/queue-5.10/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch @@ -0,0 +1,45 @@ +From b20cb0ce97bd06fbd787e9ff295e4e50805158d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 15:31:19 -0800 +Subject: soc: qcom: mdt_loader: Validate that p_filesz < p_memsz + +From: Bjorn Andersson + +[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ] + +The code validates that segments of p_memsz bytes of a segment will fit +in the provided memory region, but does not validate that p_filesz bytes +will, which means that an incorrectly crafted ELF header might write +beyond the provided memory region. + +Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5") +Reviewed-by: Sibi Sankar +Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index 24cd193dec55..2ddaee5ef9cc 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, + break; + } + ++ if (phdr->p_filesz > phdr->p_memsz) { ++ dev_err(dev, ++ "refusing to load segment %d with p_filesz > p_memsz\n", ++ i); ++ ret = -EINVAL; ++ break; ++ } ++ + ptr = mem_region + offset; + + if (phdr->p_filesz && phdr->p_offset < fw->size) { +-- +2.30.2 + diff --git a/queue-5.10/soc-qcom-pdr-fix-error-return-code-in-pdr_register_l.patch b/queue-5.10/soc-qcom-pdr-fix-error-return-code-in-pdr_register_l.patch new file mode 100644 index 00000000000..68eecfed37a --- /dev/null +++ b/queue-5.10/soc-qcom-pdr-fix-error-return-code-in-pdr_register_l.patch @@ -0,0 +1,38 @@ +From d44de098c4599fd8b2b223f01574152803ade36a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 14:50:34 +0800 +Subject: soc: qcom: pdr: Fix error return code in pdr_register_listener + +From: Qinglang Miao + +[ Upstream commit 769738fc49bb578e05d404b481a9241d18147d86 ] + +Fix to return the error code -EREMOTEIO from pdr_register_listener +rather than 0. + +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201125065034.154217-1-miaoqinglang@huawei.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c +index f63135c09667..205cc96823b7 100644 +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -153,7 +153,7 @@ static int pdr_register_listener(struct pdr_handle *pdr, + if (resp.resp.result != QMI_RESULT_SUCCESS_V01) { + pr_err("PDR: %s register listener failed: 0x%x\n", + pds->service_path, resp.resp.error); +- return ret; ++ return -EREMOTEIO; + } + + pds->state = resp.curr_state; +-- +2.30.2 + diff --git a/queue-5.10/soundwire-bus-fix-device-found-flag-correctly.patch b/queue-5.10/soundwire-bus-fix-device-found-flag-correctly.patch new file mode 100644 index 00000000000..a0d541607ea --- /dev/null +++ b/queue-5.10/soundwire-bus-fix-device-found-flag-correctly.patch @@ -0,0 +1,49 @@ +From b2d1a1b9385197043a4653a0bb48be1f472004b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:48:16 +0000 +Subject: soundwire: bus: Fix device found flag correctly + +From: Srinivas Kandagatla + +[ Upstream commit f03690f4f6992225d05dbd1171212e5be5a370dd ] + +found flag is used to indicate SoundWire devices that are +both enumerated on the bus and available in the device list. +However this flag is not reset correctly after one iteration, +This could miss some of the devices that are enumerated on the +bus but not in device list. So reset this correctly to fix this issue! + +Fixes: d52d7a1be02c ("soundwire: Add Slave status handling helpers") +Signed-off-by: Srinivas Kandagatla +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210309104816.20350-1-srinivas.kandagatla@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c +index 1fe786855095..3317a02bcc17 100644 +--- a/drivers/soundwire/bus.c ++++ b/drivers/soundwire/bus.c +@@ -703,7 +703,7 @@ static int sdw_program_device_num(struct sdw_bus *bus) + struct sdw_slave *slave, *_s; + struct sdw_slave_id id; + struct sdw_msg msg; +- bool found = false; ++ bool found; + int count = 0, ret; + u64 addr; + +@@ -735,6 +735,7 @@ static int sdw_program_device_num(struct sdw_bus *bus) + + sdw_extract_slave_id(bus, addr, &id); + ++ found = false; + /* Now compare with entries */ + list_for_each_entry_safe(slave, _s, &bus->slaves, node) { + if (sdw_compare_devid(slave, id) == 0) { +-- +2.30.2 + diff --git a/queue-5.10/soundwire-stream-fix-memory-leak-in-stream-config-er.patch b/queue-5.10/soundwire-stream-fix-memory-leak-in-stream-config-er.patch new file mode 100644 index 00000000000..c1e7885086f --- /dev/null +++ b/queue-5.10/soundwire-stream-fix-memory-leak-in-stream-config-er.patch @@ -0,0 +1,52 @@ +From f1c4ec9c438f9c88eb19872668a9d41b7d70690b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 08:46:10 +0800 +Subject: soundwire: stream: fix memory leak in stream config error path + +From: Rander Wang + +[ Upstream commit 48f17f96a81763c7c8bf5500460a359b9939359f ] + +When stream config is failed, master runtime will release all +slave runtime in the slave_rt_list, but slave runtime is not +added to the list at this time. This patch frees slave runtime +in the config error path to fix the memory leak. + +Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") +Signed-off-by: Rander Wang +Reviewed-by: Keyon Jie +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/stream.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index 1099b5d1262b..a418c3c7001c 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -1375,8 +1375,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, + } + + ret = sdw_config_stream(&slave->dev, stream, stream_config, true); +- if (ret) ++ if (ret) { ++ /* ++ * sdw_release_master_stream will release s_rt in slave_rt_list in ++ * stream_error case, but s_rt is only added to slave_rt_list ++ * when sdw_config_stream is successful, so free s_rt explicitly ++ * when sdw_config_stream is failed. ++ */ ++ kfree(s_rt); + goto stream_error; ++ } + + list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); + +-- +2.30.2 + diff --git a/queue-5.10/spi-fix-use-after-free-with-devm_spi_alloc_.patch b/queue-5.10/spi-fix-use-after-free-with-devm_spi_alloc_.patch new file mode 100644 index 00000000000..6b704a57606 --- /dev/null +++ b/queue-5.10/spi-fix-use-after-free-with-devm_spi_alloc_.patch @@ -0,0 +1,96 @@ +From fe017264051dcb45bab75a9e6a237d79efefd28f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 02:55:27 -0700 +Subject: spi: Fix use-after-free with devm_spi_alloc_* + +From: William A. Kennington III + +[ Upstream commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 ] + +We can't rely on the contents of the devres list during +spi_unregister_controller(), as the list is already torn down at the +time we perform devres_find() for devm_spi_release_controller. This +causes devices registered with devm_spi_alloc_{master,slave}() to be +mistakenly identified as legacy, non-devm managed devices and have their +reference counters decremented below 0. + +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 +[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) +[] (kobject_put) from [] (put_device+0x20/0x24) + r4:b6700140 +[] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) +[] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4) + r5:b6700180 r4:b6700100 +[] (release_nodes) from [] (devres_release_all+0x5c/0x60) + r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 +[] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec) + r5:b117ad94 r4:b163dc10 +[] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0) + r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 +[] (device_driver_detach) from [] (unbind_store+0xe4/0xf8) + +Instead, determine the devm allocation state as a flag on the +controller which is guaranteed to be stable during cleanup. + +Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") +Signed-off-by: William A. Kennington III +Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 9 ++------- + include/linux/spi/spi.h | 3 +++ + 2 files changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 1eee8b3c1b38..419de3d40481 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2480,6 +2480,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev, + + ctlr = __spi_alloc_controller(dev, size, slave); + if (ctlr) { ++ ctlr->devm_allocated = true; + *ptr = ctlr; + devres_add(dev, ptr); + } else { +@@ -2826,11 +2827,6 @@ int devm_spi_register_controller(struct device *dev, + } + EXPORT_SYMBOL_GPL(devm_spi_register_controller); + +-static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) +-{ +- return *(struct spi_controller **)res == ctlr; +-} +- + static int __unregister(struct device *dev, void *null) + { + spi_unregister_device(to_spi_device(dev)); +@@ -2877,8 +2873,7 @@ void spi_unregister_controller(struct spi_controller *ctlr) + /* Release the last reference on the controller if its driver + * has not yet been converted to devm_spi_alloc_master/slave(). + */ +- if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, +- devm_spi_match_controller, ctlr)) ++ if (!ctlr->devm_allocated) + put_device(&ctlr->dev); + + /* free bus id */ +diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h +index b390fdac1587..2d906b9c1499 100644 +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -511,6 +511,9 @@ struct spi_controller { + + #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */ + ++ /* flag indicating this is a non-devres managed controller */ ++ bool devm_allocated; ++ + /* flag indicating this is an SPI slave controller */ + bool slave; + +-- +2.30.2 + diff --git a/queue-5.10/spi-fsl-add-missing-iounmap-on-error-in-of_fsl_spi_p.patch b/queue-5.10/spi-fsl-add-missing-iounmap-on-error-in-of_fsl_spi_p.patch new file mode 100644 index 00000000000..0ad30df2377 --- /dev/null +++ b/queue-5.10/spi-fsl-add-missing-iounmap-on-error-in-of_fsl_spi_p.patch @@ -0,0 +1,80 @@ +From 5b61b437ca49c0af2d04f9b21e7fee179845ff62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 22:03:50 +0800 +Subject: spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() + +From: Yang Yingliang + +[ Upstream commit 5fed9fe5b41aea58e5b32be506dc50c9ab9a0e4d ] + +Add the missing iounmap() before return from of_fsl_spi_probe() +in the error handling case. + +Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210401140350.1677925-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index e4a8d203f940..d0e5aa18b7ba 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -707,6 +707,11 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + struct resource mem; + int irq, type; + int ret; ++ bool spisel_boot = false; ++#if IS_ENABLED(CONFIG_FSL_SOC) ++ struct mpc8xxx_spi_probe_info *pinfo = NULL; ++#endif ++ + + ret = of_mpc8xxx_spi_probe(ofdev); + if (ret) +@@ -715,9 +720,8 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + type = fsl_spi_get_type(&ofdev->dev); + if (type == TYPE_FSL) { + struct fsl_spi_platform_data *pdata = dev_get_platdata(dev); +- bool spisel_boot = false; + #if IS_ENABLED(CONFIG_FSL_SOC) +- struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(pdata); ++ pinfo = to_of_pinfo(pdata); + + spisel_boot = of_property_read_bool(np, "fsl,spisel_boot"); + if (spisel_boot) { +@@ -746,15 +750,24 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) + + ret = of_address_to_resource(np, 0, &mem); + if (ret) +- return ret; ++ goto unmap_out; + + irq = platform_get_irq(ofdev, 0); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto unmap_out; ++ } + + master = fsl_spi_probe(dev, &mem, irq); + + return PTR_ERR_OR_ZERO(master); ++ ++unmap_out: ++#if IS_ENABLED(CONFIG_FSL_SOC) ++ if (spisel_boot) ++ iounmap(pinfo->immr_spi_cs); ++#endif ++ return ret; + } + + static int of_fsl_spi_remove(struct platform_device *ofdev) +-- +2.30.2 + diff --git a/queue-5.10/spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch b/queue-5.10/spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch new file mode 100644 index 00000000000..8c9854054d7 --- /dev/null +++ b/queue-5.10/spi-fsl-lpspi-fix-pm-reference-leak-in-lpspi_prepare.patch @@ -0,0 +1,41 @@ +From 49840806a997cf4ecdc9d16728c107c870676307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 09:54:30 +0000 +Subject: spi: fsl-lpspi: Fix PM reference leak in + lpspi_prepare_xfer_hardware() + +From: Wang Li + +[ Upstream commit a03675497970a93fcf25d81d9d92a59c2d7377a7 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi") +Reported-by: Hulk Robot +Signed-off-by: Wang Li +Link: https://lore.kernel.org/r/20210409095430.29868-1-wangli74@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-lpspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index a2886ee44e4c..5d98611dd999 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -200,7 +200,7 @@ static int lpspi_prepare_xfer_hardware(struct spi_controller *controller) + spi_controller_get_devdata(controller); + int ret; + +- ret = pm_runtime_get_sync(fsl_lpspi->dev); ++ ret = pm_runtime_resume_and_get(fsl_lpspi->dev); + if (ret < 0) { + dev_err(fsl_lpspi->dev, "failed to enable clock\n"); + return ret; +-- +2.30.2 + diff --git a/queue-5.10/spi-rockchip-avoid-objtool-warning.patch b/queue-5.10/spi-rockchip-avoid-objtool-warning.patch new file mode 100644 index 00000000000..5fdfa37e550 --- /dev/null +++ b/queue-5.10/spi-rockchip-avoid-objtool-warning.patch @@ -0,0 +1,83 @@ +From 099adabb437594642e2b290ec4647b78eae96501 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 15:00:48 +0100 +Subject: spi: rockchip: avoid objtool warning + +From: Arnd Bergmann + +[ Upstream commit e50989527faeafb79f45a0f7529ba8e01dff1fff ] + +Building this file with clang leads to a an unreachable code path +causing a warning from objtool: + +drivers/spi/spi-rockchip.o: warning: objtool: rockchip_spi_transfer_one()+0x2e0: sibling call from callable instruction with modified stack frame + +Change the unreachable() into an error return that can be +handled if it ever happens, rather than silently crashing +the kernel. + +Fixes: 65498c6ae241 ("spi: rockchip: support 4bit words") +Signed-off-by: Arnd Bergmann +Acked-by: Pratyush Yadav +Link: https://lore.kernel.org/r/20210226140109.3477093-1-arnd@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-rockchip.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c +index 75a8a9428ff8..0aab37cd64e7 100644 +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -474,7 +474,7 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs, + return 1; + } + +-static void rockchip_spi_config(struct rockchip_spi *rs, ++static int rockchip_spi_config(struct rockchip_spi *rs, + struct spi_device *spi, struct spi_transfer *xfer, + bool use_dma, bool slave_mode) + { +@@ -519,7 +519,9 @@ static void rockchip_spi_config(struct rockchip_spi *rs, + * ctlr->bits_per_word_mask, so this shouldn't + * happen + */ +- unreachable(); ++ dev_err(rs->dev, "unknown bits per word: %d\n", ++ xfer->bits_per_word); ++ return -EINVAL; + } + + if (use_dma) { +@@ -552,6 +554,8 @@ static void rockchip_spi_config(struct rockchip_spi *rs, + */ + writel_relaxed(2 * DIV_ROUND_UP(rs->freq, 2 * xfer->speed_hz), + rs->regs + ROCKCHIP_SPI_BAUDR); ++ ++ return 0; + } + + static size_t rockchip_spi_max_transfer_size(struct spi_device *spi) +@@ -575,6 +579,7 @@ static int rockchip_spi_transfer_one( + struct spi_transfer *xfer) + { + struct rockchip_spi *rs = spi_controller_get_devdata(ctlr); ++ int ret; + bool use_dma; + + WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) && +@@ -594,7 +599,9 @@ static int rockchip_spi_transfer_one( + + use_dma = ctlr->can_dma ? ctlr->can_dma(ctlr, spi, xfer) : false; + +- rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave); ++ ret = rockchip_spi_config(rs, spi, xfer, use_dma, ctlr->slave); ++ if (ret) ++ return ret; + + if (use_dma) + return rockchip_spi_prepare_dma(rs, ctlr, xfer); +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-add-mutex-locking-for-exec_op.patch b/queue-5.10/spi-spi-zynqmp-gqspi-add-mutex-locking-for-exec_op.patch new file mode 100644 index 00000000000..422ae81ee8e --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-add-mutex-locking-for-exec_op.patch @@ -0,0 +1,62 @@ +From a404b74726bc355d14557594b6b2dc399fbaa133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:02:21 +0800 +Subject: spi: spi-zynqmp-gqspi: add mutex locking for exec_op + +From: Quanyang Wang + +[ Upstream commit a0f65be6e880a14d3445b75e7dc03d7d015fc922 ] + +The spi-mem framework has no locking to prevent ctlr->mem_ops->exec_op +from concurrency. So add the locking to zynqmp_qspi_exec_op. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Reviewed-by: Amit Kumar Mahapatra +Link: https://lore.kernel.org/r/20210408040223.23134-3-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index d49ab6575553..3b39461d58b3 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -173,6 +173,7 @@ struct zynqmp_qspi { + u32 genfifoentry; + enum mode_type mode; + struct completion data_completion; ++ struct mutex op_lock; + }; + + /** +@@ -951,6 +952,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth, + op->dummy.buswidth, op->data.buswidth); + ++ mutex_lock(&xqspi->op_lock); + zynqmp_qspi_config_op(xqspi, mem->spi); + zynqmp_qspi_chipselect(mem->spi, false); + genfifoentry |= xqspi->genfifocs; +@@ -1084,6 +1086,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + return_err: + + zynqmp_qspi_chipselect(mem->spi, true); ++ mutex_unlock(&xqspi->op_lock); + + return err; + } +@@ -1156,6 +1159,8 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) + goto clk_dis_pclk; + } + ++ mutex_init(&xqspi->op_lock); ++ + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT); + pm_runtime_set_active(&pdev->dev); +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-fix-clk_enable-disable-imbalanc.patch b/queue-5.10/spi-spi-zynqmp-gqspi-fix-clk_enable-disable-imbalanc.patch new file mode 100644 index 00000000000..9107687fa70 --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-fix-clk_enable-disable-imbalanc.patch @@ -0,0 +1,152 @@ +From 154110d5858496f058c3a3c1fcc7a1be21510436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 08:46:48 +0800 +Subject: spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue + +From: Quanyang Wang + +[ Upstream commit c6bdae08012b2ca3e94f3a41ef4ca8cfe7c9ab6f ] + +The clks "pclk" and "ref_clk" are enabled twice during the probe. The +first time is in the function zynqmp_qspi_probe and the second time is +in zynqmp_qspi_setup_op which is called by devm_spi_register_controller. +Then calling zynqmp_qspi_remove (rmmod this module) to disable these clks +will trigger a warning as below: + +[ 309.124604] Unpreparing enabled qspi_ref +[ 309.128641] WARNING: CPU: 1 PID: 537 at drivers/clk/clk.c:824 clk_core_unprepare+0x108/0x110 + +Since pm_runtime works now, clks can be enabled/disabled by calling +zynqmp_runtime_suspend/resume. So we don't need to enable these clks +explicitly in zynqmp_qspi_setup_op. Remove them to fix this issue. + +And remove clk enabling/disabling in zynqmp_qspi_resume because there is +no spi transfer operation so enabling ref_clk is redundant meanwhile pclk +is not disabled for it is shared with other peripherals. + +Furthermore replace clk_enable/disable with clk_prepare_enable and +clk_disable_unprepare in runtime_suspend/resume functions. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210416004652.2975446-2-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 47 ++++++---------------------------- + 1 file changed, 8 insertions(+), 39 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 408e348382c5..31d266cfbb4c 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -487,24 +487,10 @@ static int zynqmp_qspi_setup_op(struct spi_device *qspi) + { + struct spi_controller *ctlr = qspi->master; + struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr); +- struct device *dev = &ctlr->dev; +- int ret; + + if (ctlr->busy) + return -EBUSY; + +- ret = clk_enable(xqspi->refclk); +- if (ret) { +- dev_err(dev, "Cannot enable device clock.\n"); +- return ret; +- } +- +- ret = clk_enable(xqspi->pclk); +- if (ret) { +- dev_err(dev, "Cannot enable APB clock.\n"); +- clk_disable(xqspi->refclk); +- return ret; +- } + zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, GQSPI_EN_MASK); + + return 0; +@@ -863,26 +849,9 @@ static int __maybe_unused zynqmp_qspi_suspend(struct device *dev) + static int __maybe_unused zynqmp_qspi_resume(struct device *dev) + { + struct spi_controller *ctlr = dev_get_drvdata(dev); +- struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr); +- int ret = 0; +- +- ret = clk_enable(xqspi->pclk); +- if (ret) { +- dev_err(dev, "Cannot enable APB clock.\n"); +- return ret; +- } +- +- ret = clk_enable(xqspi->refclk); +- if (ret) { +- dev_err(dev, "Cannot enable device clock.\n"); +- clk_disable(xqspi->pclk); +- return ret; +- } + + spi_controller_resume(ctlr); + +- clk_disable(xqspi->refclk); +- clk_disable(xqspi->pclk); + return 0; + } + +@@ -898,8 +867,8 @@ static int __maybe_unused zynqmp_runtime_suspend(struct device *dev) + { + struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev); + +- clk_disable(xqspi->refclk); +- clk_disable(xqspi->pclk); ++ clk_disable_unprepare(xqspi->refclk); ++ clk_disable_unprepare(xqspi->pclk); + + return 0; + } +@@ -917,16 +886,16 @@ static int __maybe_unused zynqmp_runtime_resume(struct device *dev) + struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev); + int ret; + +- ret = clk_enable(xqspi->pclk); ++ ret = clk_prepare_enable(xqspi->pclk); + if (ret) { + dev_err(dev, "Cannot enable APB clock.\n"); + return ret; + } + +- ret = clk_enable(xqspi->refclk); ++ ret = clk_prepare_enable(xqspi->refclk); + if (ret) { + dev_err(dev, "Cannot enable device clock.\n"); +- clk_disable(xqspi->pclk); ++ clk_disable_unprepare(xqspi->pclk); + return ret; + } + +@@ -1136,13 +1105,11 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) + goto remove_master; + } + +- init_completion(&xqspi->data_completion); +- + xqspi->refclk = devm_clk_get(&pdev->dev, "ref_clk"); + if (IS_ERR(xqspi->refclk)) { + dev_err(dev, "ref_clk clock not found.\n"); + ret = PTR_ERR(xqspi->refclk); +- goto clk_dis_pclk; ++ goto remove_master; + } + + ret = clk_prepare_enable(xqspi->pclk); +@@ -1157,6 +1124,8 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) + goto clk_dis_pclk; + } + ++ init_completion(&xqspi->data_completion); ++ + mutex_init(&xqspi->op_lock); + + pm_runtime_use_autosuspend(&pdev->dev); +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-fix-hang-issue-when-suspend-res.patch b/queue-5.10/spi-spi-zynqmp-gqspi-fix-hang-issue-when-suspend-res.patch new file mode 100644 index 00000000000..6e376d5d255 --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-fix-hang-issue-when-suspend-res.patch @@ -0,0 +1,100 @@ +From a6808bcf5a065e9f7358dcf26385149463541324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 08:46:49 +0800 +Subject: spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume + +From: Quanyang Wang + +[ Upstream commit 799f923f0a66a9c99f0a3eaa078b306db7a8b33a ] + +After calling platform_set_drvdata(pdev, xqspi) in probe, the return +value of dev_get_drvdata(dev) is a pointer to struct zynqmp_qspi but +not struct spi_controller. A wrong structure type passing to the +functions spi_controller_suspend/resume will hang the system. + +And we should check the return value of spi_controller_suspend, if +an error is returned, return it to PM subsystem to stop suspend. + +Also, GQSPI_EN_MASK should be written to GQSPI_EN_OFST to enable +the spi controller in zynqmp_qspi_resume since it was disabled in +zynqmp_qspi_suspend before. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210416004652.2975446-3-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 31d266cfbb4c..d6ac8fe145a1 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -157,6 +157,7 @@ enum mode_type {GQSPI_MODE_IO, GQSPI_MODE_DMA}; + * @data_completion: completion structure + */ + struct zynqmp_qspi { ++ struct spi_controller *ctlr; + void __iomem *regs; + struct clk *refclk; + struct clk *pclk; +@@ -827,10 +828,13 @@ static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits, + */ + static int __maybe_unused zynqmp_qspi_suspend(struct device *dev) + { +- struct spi_controller *ctlr = dev_get_drvdata(dev); +- struct zynqmp_qspi *xqspi = spi_controller_get_devdata(ctlr); ++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev); ++ struct spi_controller *ctlr = xqspi->ctlr; ++ int ret; + +- spi_controller_suspend(ctlr); ++ ret = spi_controller_suspend(ctlr); ++ if (ret) ++ return ret; + + zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0); + +@@ -848,7 +852,10 @@ static int __maybe_unused zynqmp_qspi_suspend(struct device *dev) + */ + static int __maybe_unused zynqmp_qspi_resume(struct device *dev) + { +- struct spi_controller *ctlr = dev_get_drvdata(dev); ++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev); ++ struct spi_controller *ctlr = xqspi->ctlr; ++ ++ zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, GQSPI_EN_MASK); + + spi_controller_resume(ctlr); + +@@ -865,7 +872,7 @@ static int __maybe_unused zynqmp_qspi_resume(struct device *dev) + */ + static int __maybe_unused zynqmp_runtime_suspend(struct device *dev) + { +- struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev); ++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev); + + clk_disable_unprepare(xqspi->refclk); + clk_disable_unprepare(xqspi->pclk); +@@ -883,7 +890,7 @@ static int __maybe_unused zynqmp_runtime_suspend(struct device *dev) + */ + static int __maybe_unused zynqmp_runtime_resume(struct device *dev) + { +- struct zynqmp_qspi *xqspi = (struct zynqmp_qspi *)dev_get_drvdata(dev); ++ struct zynqmp_qspi *xqspi = dev_get_drvdata(dev); + int ret; + + ret = clk_prepare_enable(xqspi->pclk); +@@ -1090,6 +1097,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) + + xqspi = spi_controller_get_devdata(ctlr); + xqspi->dev = dev; ++ xqspi->ctlr = ctlr; + platform_set_drvdata(pdev, xqspi); + + xqspi->regs = devm_platform_ioremap_resource(pdev, 0); +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-fix-incorrect-operating-mode-in.patch b/queue-5.10/spi-spi-zynqmp-gqspi-fix-incorrect-operating-mode-in.patch new file mode 100644 index 00000000000..26545e63652 --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-fix-incorrect-operating-mode-in.patch @@ -0,0 +1,48 @@ +From f8efabd7725d628bcca296acb89d27ffaafc6adb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:02:23 +0800 +Subject: spi: spi-zynqmp-gqspi: fix incorrect operating mode in + zynqmp_qspi_read_op + +From: Quanyang Wang + +[ Upstream commit 41d310930084502433fcb3c4baf219e7424b7734 ] + +When starting a read operation, we should call zynqmp_qspi_setuprxdma +first to set xqspi->mode according to xqspi->bytes_to_receive and +to calculate correct xqspi->dma_rx_bytes. Then in the function +zynqmp_qspi_fillgenfifo, generate the appropriate command with +operating mode and bytes to transfer, and fill the GENFIFO with +the command to perform the read operation. + +Calling zynqmp_qspi_fillgenfifo before zynqmp_qspi_setuprxdma will +result in incorrect transfer length and operating mode. So change +the calling order to fix this issue. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Reviewed-by: Amit Kumar Mahapatra +Link: https://lore.kernel.org/r/20210408040223.23134-5-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index cf73a069b759..036d8ae41c06 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -827,8 +827,8 @@ static void zynqmp_qspi_write_op(struct zynqmp_qspi *xqspi, u8 tx_nbits, + static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits, + u32 genfifoentry) + { +- zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry); + zynqmp_qspi_setuprxdma(xqspi); ++ zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry); + } + + /** +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-fix-missing-unlock-on-error-in-.patch b/queue-5.10/spi-spi-zynqmp-gqspi-fix-missing-unlock-on-error-in-.patch new file mode 100644 index 00000000000..a6b65d77a3e --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-fix-missing-unlock-on-error-in-.patch @@ -0,0 +1,42 @@ +From 522158a5ab57c90863c0e1bb032436132615bb74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 16:00:25 +0000 +Subject: spi: spi-zynqmp-gqspi: Fix missing unlock on error in + zynqmp_qspi_exec_op() + +From: Wei Yongjun + +[ Upstream commit 6043357263fbe2df0bf0736d971ad5dce7d19dc1 ] + +Add the missing unlock before return from function zynqmp_qspi_exec_op() +in the error handling case. + +Fixes: a0f65be6e880 ("spi: spi-zynqmp-gqspi: add mutex locking for exec_op") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210412160025.194171-1-weiyongjun1@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 036d8ae41c06..408e348382c5 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -965,8 +965,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + + if (op->cmd.opcode) { + tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA); +- if (!tmpbuf) ++ if (!tmpbuf) { ++ mutex_unlock(&xqspi->op_lock); + return -ENOMEM; ++ } + tmpbuf[0] = op->cmd.opcode; + reinit_completion(&xqspi->data_completion); + xqspi->txbuf = tmpbuf; +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-fix-use-after-free-in-zynqmp_qs.patch b/queue-5.10/spi-spi-zynqmp-gqspi-fix-use-after-free-in-zynqmp_qs.patch new file mode 100644 index 00000000000..3a8578e7bac --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-fix-use-after-free-in-zynqmp_qs.patch @@ -0,0 +1,72 @@ +From a1e12ae4b0cfe46e7443655075329a9f2f7f120b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 08:46:51 +0800 +Subject: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op + +From: Quanyang Wang + +[ Upstream commit a2c5bedb2d55dd27c642c7b9fb6886d7ad7bdb58 ] + +When handling op->addr, it is using the buffer "tmpbuf" which has been +freed. This will trigger a use-after-free KASAN warning. Let's use +temporary variables to store op->addr.val and op->cmd.opcode to fix +this issue. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index d6ac8fe145a1..2a0be16b2eb0 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -926,8 +926,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + struct zynqmp_qspi *xqspi = spi_controller_get_devdata + (mem->spi->master); + int err = 0, i; +- u8 *tmpbuf; + u32 genfifoentry = 0; ++ u16 opcode = op->cmd.opcode; ++ u64 opaddr; + + dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n", + op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth, +@@ -940,14 +941,8 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + genfifoentry |= xqspi->genfifobus; + + if (op->cmd.opcode) { +- tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA); +- if (!tmpbuf) { +- mutex_unlock(&xqspi->op_lock); +- return -ENOMEM; +- } +- tmpbuf[0] = op->cmd.opcode; + reinit_completion(&xqspi->data_completion); +- xqspi->txbuf = tmpbuf; ++ xqspi->txbuf = &opcode; + xqspi->rxbuf = NULL; + xqspi->bytes_to_transfer = op->cmd.nbytes; + xqspi->bytes_to_receive = 0; +@@ -961,13 +956,12 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + if (!wait_for_completion_timeout + (&xqspi->data_completion, msecs_to_jiffies(1000))) { + err = -ETIMEDOUT; +- kfree(tmpbuf); + goto return_err; + } +- kfree(tmpbuf); + } + + if (op->addr.nbytes) { ++ xqspi->txbuf = &opaddr; + for (i = 0; i < op->addr.nbytes; i++) { + *(((u8 *)xqspi->txbuf) + i) = op->addr.val >> + (8 * (op->addr.nbytes - i - 1)); +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-return-enomem-if-dma_map_single.patch b/queue-5.10/spi-spi-zynqmp-gqspi-return-enomem-if-dma_map_single.patch new file mode 100644 index 00000000000..e27422a4796 --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-return-enomem-if-dma_map_single.patch @@ -0,0 +1,129 @@ +From d6efe070a0c7ed9633ef479455830ae3a25388c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 08:46:52 +0800 +Subject: spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails + +From: Quanyang Wang + +[ Upstream commit 126bdb606fd2802454e6048caef1be3e25dd121e ] + +The spi controller supports 44-bit address space on AXI in DMA mode, +so set dma_addr_t width to 44-bit to avoid using a swiotlb mapping. +In addition, if dma_map_single fails, it should return immediately +instead of continuing doing the DMA operation which bases on invalid +address. + +This fixes the following crash which occurs in reading a big block +from flash: + +[ 123.633577] zynqmp-qspi ff0f0000.spi: swiotlb buffer is full (sz: 4194304 bytes), total 32768 (slots), used 0 (slots) +[ 123.644230] zynqmp-qspi ff0f0000.spi: ERR:rxdma:memory not mapped +[ 123.784625] Unable to handle kernel paging request at virtual address 00000000003fffc0 +[ 123.792536] Mem abort info: +[ 123.795313] ESR = 0x96000145 +[ 123.798351] EC = 0x25: DABT (current EL), IL = 32 bits +[ 123.803655] SET = 0, FnV = 0 +[ 123.806693] EA = 0, S1PTW = 0 +[ 123.809818] Data abort info: +[ 123.812683] ISV = 0, ISS = 0x00000145 +[ 123.816503] CM = 1, WnR = 1 +[ 123.819455] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000805047000 +[ 123.825887] [00000000003fffc0] pgd=0000000803b45003, p4d=0000000803b45003, pud=0000000000000000 +[ 123.834586] Internal error: Oops: 96000145 [#1] PREEMPT SMP + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210416004652.2975446-6-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 2a0be16b2eb0..1dd2af9cc237 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -731,7 +731,7 @@ static irqreturn_t zynqmp_qspi_irq(int irq, void *dev_id) + * zynqmp_qspi_setuprxdma - This function sets up the RX DMA operation + * @xqspi: xqspi is a pointer to the GQSPI instance. + */ +-static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi) ++static int zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi) + { + u32 rx_bytes, rx_rem, config_reg; + dma_addr_t addr; +@@ -745,7 +745,7 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi) + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, config_reg); + xqspi->mode = GQSPI_MODE_IO; + xqspi->dma_rx_bytes = 0; +- return; ++ return 0; + } + + rx_rem = xqspi->bytes_to_receive % 4; +@@ -753,8 +753,10 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi) + + addr = dma_map_single(xqspi->dev, (void *)xqspi->rxbuf, + rx_bytes, DMA_FROM_DEVICE); +- if (dma_mapping_error(xqspi->dev, addr)) ++ if (dma_mapping_error(xqspi->dev, addr)) { + dev_err(xqspi->dev, "ERR:rxdma:memory not mapped\n"); ++ return -ENOMEM; ++ } + + xqspi->dma_rx_bytes = rx_bytes; + xqspi->dma_addr = addr; +@@ -775,6 +777,8 @@ static void zynqmp_qspi_setuprxdma(struct zynqmp_qspi *xqspi) + + /* Write the number of bytes to transfer */ + zynqmp_gqspi_write(xqspi, GQSPI_QSPIDMA_DST_SIZE_OFST, rx_bytes); ++ ++ return 0; + } + + /** +@@ -811,11 +815,17 @@ static void zynqmp_qspi_write_op(struct zynqmp_qspi *xqspi, u8 tx_nbits, + * @genfifoentry: genfifoentry is pointer to the variable in which + * GENFIFO mask is returned to calling function + */ +-static void zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits, ++static int zynqmp_qspi_read_op(struct zynqmp_qspi *xqspi, u8 rx_nbits, + u32 genfifoentry) + { +- zynqmp_qspi_setuprxdma(xqspi); ++ int ret; ++ ++ ret = zynqmp_qspi_setuprxdma(xqspi); ++ if (ret) ++ return ret; + zynqmp_qspi_fillgenfifo(xqspi, rx_nbits, genfifoentry); ++ ++ return 0; + } + + /** +@@ -1029,8 +1039,11 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + xqspi->rxbuf = (u8 *)op->data.buf.in; + xqspi->bytes_to_receive = op->data.nbytes; + xqspi->bytes_to_transfer = 0; +- zynqmp_qspi_read_op(xqspi, op->data.buswidth, ++ err = zynqmp_qspi_read_op(xqspi, op->data.buswidth, + genfifoentry); ++ if (err) ++ goto return_err; ++ + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, + zynqmp_gqspi_read + (xqspi, GQSPI_CONFIG_OFST) | +@@ -1152,6 +1165,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) + goto clk_dis_all; + } + ++ dma_set_mask(&pdev->dev, DMA_BIT_MASK(44)); + ctlr->bits_per_word_mask = SPI_BPW_MASK(8); + ctlr->num_chipselect = GQSPI_DEFAULT_NUM_CS; + ctlr->mem_ops = &zynqmp_qspi_mem_ops; +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-transmit-dummy-circles-by-using.patch b/queue-5.10/spi-spi-zynqmp-gqspi-transmit-dummy-circles-by-using.patch new file mode 100644 index 00000000000..af2e57c2773 --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-transmit-dummy-circles-by-using.patch @@ -0,0 +1,111 @@ +From 90423a1ea9ea5f8b1961de6d34a05e731d98c259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:02:22 +0800 +Subject: spi: spi-zynqmp-gqspi: transmit dummy circles by using the + controller's internal functionality + +From: Quanyang Wang + +[ Upstream commit 8ad07d79bd56a531990a1a3f3f1c0eb19d2de806 ] + +There is a data corruption issue that occurs in the reading operation +(cmd:0x6c) when transmitting common data as dummy circles. + +The gqspi controller has the functionality to send dummy clock circles. +When writing data with the fields [receive, transmit, data_xfer] = [0,0,1] +to the Generic FIFO, and configuring the correct SPI mode, the controller +will transmit dummy circles. + +So let's switch to hardware dummy cycles transfer to fix this issue. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Reviewed-by: Amit Kumar Mahapatra +Link: https://lore.kernel.org/r/20210408040223.23134-4-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 40 +++++++++++++++------------------- + 1 file changed, 18 insertions(+), 22 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 3b39461d58b3..cf73a069b759 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -521,7 +521,7 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size) + { + u32 count = 0, intermediate; + +- while ((xqspi->bytes_to_transfer > 0) && (count < size)) { ++ while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) { + memcpy(&intermediate, xqspi->txbuf, 4); + zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate); + +@@ -580,7 +580,7 @@ static void zynqmp_qspi_fillgenfifo(struct zynqmp_qspi *xqspi, u8 nbits, + genfifoentry |= GQSPI_GENFIFO_DATA_XFER; + genfifoentry |= GQSPI_GENFIFO_TX; + transfer_len = xqspi->bytes_to_transfer; +- } else { ++ } else if (xqspi->rxbuf) { + genfifoentry &= ~GQSPI_GENFIFO_TX; + genfifoentry |= GQSPI_GENFIFO_DATA_XFER; + genfifoentry |= GQSPI_GENFIFO_RX; +@@ -588,6 +588,11 @@ static void zynqmp_qspi_fillgenfifo(struct zynqmp_qspi *xqspi, u8 nbits, + transfer_len = xqspi->dma_rx_bytes; + else + transfer_len = xqspi->bytes_to_receive; ++ } else { ++ /* Sending dummy circles here */ ++ genfifoentry &= ~(GQSPI_GENFIFO_TX | GQSPI_GENFIFO_RX); ++ genfifoentry |= GQSPI_GENFIFO_DATA_XFER; ++ transfer_len = xqspi->bytes_to_transfer; + } + genfifoentry |= zynqmp_qspi_selectspimode(xqspi, nbits); + xqspi->genfifoentry = genfifoentry; +@@ -1011,32 +1016,23 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + } + + if (op->dummy.nbytes) { +- tmpbuf = kzalloc(op->dummy.nbytes, GFP_KERNEL | GFP_DMA); +- if (!tmpbuf) +- return -ENOMEM; +- memset(tmpbuf, 0xff, op->dummy.nbytes); +- reinit_completion(&xqspi->data_completion); +- xqspi->txbuf = tmpbuf; ++ xqspi->txbuf = NULL; + xqspi->rxbuf = NULL; +- xqspi->bytes_to_transfer = op->dummy.nbytes; ++ /* ++ * xqspi->bytes_to_transfer here represents the dummy circles ++ * which need to be sent. ++ */ ++ xqspi->bytes_to_transfer = op->dummy.nbytes * 8 / op->dummy.buswidth; + xqspi->bytes_to_receive = 0; +- zynqmp_qspi_write_op(xqspi, op->dummy.buswidth, ++ /* ++ * Using op->data.buswidth instead of op->dummy.buswidth here because ++ * we need to use it to configure the correct SPI mode. ++ */ ++ zynqmp_qspi_write_op(xqspi, op->data.buswidth, + genfifoentry); + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, + zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | + GQSPI_CFG_START_GEN_FIFO_MASK); +- zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST, +- GQSPI_IER_TXEMPTY_MASK | +- GQSPI_IER_GENFIFOEMPTY_MASK | +- GQSPI_IER_TXNOT_FULL_MASK); +- if (!wait_for_completion_interruptible_timeout +- (&xqspi->data_completion, msecs_to_jiffies(1000))) { +- err = -ETIMEDOUT; +- kfree(tmpbuf); +- goto return_err; +- } +- +- kfree(tmpbuf); + } + + if (op->data.nbytes) { +-- +2.30.2 + diff --git a/queue-5.10/spi-spi-zynqmp-gqspi-use-wait_for_completion_timeout.patch b/queue-5.10/spi-spi-zynqmp-gqspi-use-wait_for_completion_timeout.patch new file mode 100644 index 00000000000..4596af0b7fc --- /dev/null +++ b/queue-5.10/spi-spi-zynqmp-gqspi-use-wait_for_completion_timeout.patch @@ -0,0 +1,73 @@ +From 57808f683685b098c27e6edc337b705583bbc428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:02:20 +0800 +Subject: spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make + zynqmp_qspi_exec_op not interruptible + +From: Quanyang Wang + +[ Upstream commit a16bff68b75fd082d36aa0b14b540bd7a3ebebbd ] + +When Ctrl+C occurs during the process of zynqmp_qspi_exec_op, the function +wait_for_completion_interruptible_timeout will return a non-zero value +-ERESTARTSYS immediately. This will disrupt the SPI memory operation +because the data transmitting may begin before the command or address +transmitting completes. Use wait_for_completion_timeout to prevent +the process from being interruptible. + +This patch fixes the error as below: +root@xilinx-zynqmp:~# flash_erase /dev/mtd3 0 0 +Erasing 4 Kibyte @ 3d000 -- 4 % complete + (Press Ctrl+C) +[ 169.581911] zynqmp-qspi ff0f0000.spi: Chip select timed out +[ 170.585907] zynqmp-qspi ff0f0000.spi: Chip select timed out +[ 171.589910] zynqmp-qspi ff0f0000.spi: Chip select timed out +[ 172.593910] zynqmp-qspi ff0f0000.spi: Chip select timed out +[ 173.597907] zynqmp-qspi ff0f0000.spi: Chip select timed out +[ 173.603480] spi-nor spi0.0: Erase operation failed. +[ 173.608368] spi-nor spi0.0: Attempted to modify a protected sector. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Quanyang Wang +Reviewed-by: Amit Kumar Mahapatra +Link: https://lore.kernel.org/r/20210408040223.23134-2-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index c8fa6ee18ae7..d49ab6575553 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -973,7 +973,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST, + GQSPI_IER_GENFIFOEMPTY_MASK | + GQSPI_IER_TXNOT_FULL_MASK); +- if (!wait_for_completion_interruptible_timeout ++ if (!wait_for_completion_timeout + (&xqspi->data_completion, msecs_to_jiffies(1000))) { + err = -ETIMEDOUT; + kfree(tmpbuf); +@@ -1001,7 +1001,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + GQSPI_IER_TXEMPTY_MASK | + GQSPI_IER_GENFIFOEMPTY_MASK | + GQSPI_IER_TXNOT_FULL_MASK); +- if (!wait_for_completion_interruptible_timeout ++ if (!wait_for_completion_timeout + (&xqspi->data_completion, msecs_to_jiffies(1000))) { + err = -ETIMEDOUT; + goto return_err; +@@ -1076,7 +1076,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + GQSPI_IER_RXEMPTY_MASK); + } + } +- if (!wait_for_completion_interruptible_timeout ++ if (!wait_for_completion_timeout + (&xqspi->data_completion, msecs_to_jiffies(1000))) + err = -ETIMEDOUT; + } +-- +2.30.2 + diff --git a/queue-5.10/spi-stm32-drop-devres-version-of-spi_register_master.patch b/queue-5.10/spi-stm32-drop-devres-version-of-spi_register_master.patch new file mode 100644 index 00000000000..f9295b7135d --- /dev/null +++ b/queue-5.10/spi-stm32-drop-devres-version-of-spi_register_master.patch @@ -0,0 +1,70 @@ +From f424fd5db4563acfe292f5daf562032eb5c08f50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 11:34:46 +0100 +Subject: spi: stm32: drop devres version of spi_register_master + +From: Antonio Borneo + +[ Upstream commit 8d559a64f00b59af9cc02b803ff52f6e6880a651 ] + +A call to spi_unregister_master() triggers calling remove() +for all the spi devices binded to the spi master. + +Some spi device driver requires to "talk" with the spi device +during the remove(), e.g.: +- a LCD panel like drivers/gpu/drm/panel/panel-lg-lg4573.c + will turn off the backlighting sending a command over spi. +This implies that the spi master must be fully functional when +spi_unregister_master() is called, either if it is called +explicitly in the master's remove() code or implicitly by the +devres framework. + +Devres calls devres_release_all() to release all the resources +"after" the remove() of the spi master driver (check code of +__device_release_driver() in drivers/base/dd.c). +If the spi master driver has an empty remove() then there would +be no issue; the devres_release_all() will release everything +in reverse order w.r.t. probe(). +But if code in spi master driver remove() disables the spi or +makes it not functional (like in this spi-stm32), then devres +cannot be used safely for unregistering the spi master and the +binded spi devices. + +Replace devm_spi_register_master() with spi_register_master() +and add spi_unregister_master() as first action in remove(). + +Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller") + +Signed-off-by: Antonio Borneo +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1615545286-5395-1-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 53c4311cc6ab..8d8a32d46f2d 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1950,7 +1950,7 @@ static int stm32_spi_probe(struct platform_device *pdev) + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- ret = devm_spi_register_master(&pdev->dev, master); ++ ret = spi_register_master(master); + if (ret) { + dev_err(&pdev->dev, "spi master registration failed: %d\n", + ret); +@@ -1987,6 +1987,7 @@ static int stm32_spi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct stm32_spi *spi = spi_master_get_devdata(master); + ++ spi_unregister_master(master); + spi->cfg->disable(spi); + + if (master->dma_tx) +-- +2.30.2 + diff --git a/queue-5.10/spi-stm32-fix-use-after-free-on-unbind.patch b/queue-5.10/spi-stm32-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..02c769d186f --- /dev/null +++ b/queue-5.10/spi-stm32-fix-use-after-free-on-unbind.patch @@ -0,0 +1,101 @@ +From 7e101cdacc1aeb68e917cb3eb99c83dd5ed3da4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 08:24:50 +0100 +Subject: spi: stm32: Fix use-after-free on unbind + +From: Alain Volmat + +[ Upstream commit 79c6246ae8793448c05da86a4c82298eed8549b0 ] + +stm32_spi_remove() accesses the driver's private data after calling +spi_unregister_master() even though that function releases the last +reference on the spi_master and thereby frees the private data. + +Fix by switching over to the new devm_spi_alloc_master() helper which +keeps the private data accessible until the driver has unbound. + +Fixes: 8d559a64f00b ("spi: stm32: drop devres version of spi_register_master") + +Reported-by: Lukas Wunner +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1616052290-10887-1-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 8d8a32d46f2d..0318f02d6212 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1830,7 +1830,7 @@ static int stm32_spi_probe(struct platform_device *pdev) + struct resource *res; + int ret; + +- master = spi_alloc_master(&pdev->dev, sizeof(struct stm32_spi)); ++ master = devm_spi_alloc_master(&pdev->dev, sizeof(struct stm32_spi)); + if (!master) { + dev_err(&pdev->dev, "spi master allocation failed\n"); + return -ENOMEM; +@@ -1848,18 +1848,16 @@ static int stm32_spi_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + spi->base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(spi->base)) { +- ret = PTR_ERR(spi->base); +- goto err_master_put; +- } ++ if (IS_ERR(spi->base)) ++ return PTR_ERR(spi->base); + + spi->phys_addr = (dma_addr_t)res->start; + + spi->irq = platform_get_irq(pdev, 0); +- if (spi->irq <= 0) { +- ret = dev_err_probe(&pdev->dev, spi->irq, "failed to get irq\n"); +- goto err_master_put; +- } ++ if (spi->irq <= 0) ++ return dev_err_probe(&pdev->dev, spi->irq, ++ "failed to get irq\n"); ++ + ret = devm_request_threaded_irq(&pdev->dev, spi->irq, + spi->cfg->irq_handler_event, + spi->cfg->irq_handler_thread, +@@ -1867,20 +1865,20 @@ static int stm32_spi_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, "irq%d request failed: %d\n", spi->irq, + ret); +- goto err_master_put; ++ return ret; + } + + spi->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(spi->clk)) { + ret = PTR_ERR(spi->clk); + dev_err(&pdev->dev, "clk get failed: %d\n", ret); +- goto err_master_put; ++ return ret; + } + + ret = clk_prepare_enable(spi->clk); + if (ret) { + dev_err(&pdev->dev, "clk enable failed: %d\n", ret); +- goto err_master_put; ++ return ret; + } + spi->clk_rate = clk_get_rate(spi->clk); + if (!spi->clk_rate) { +@@ -1976,8 +1974,6 @@ err_dma_release: + dma_release_channel(spi->dma_rx); + err_clk_disable: + clk_disable_unprepare(spi->clk); +-err_master_put: +- spi_master_put(master); + + return ret; + } +-- +2.30.2 + diff --git a/queue-5.10/staging-comedi-tests-ni_routes_test-fix-compilation-.patch b/queue-5.10/staging-comedi-tests-ni_routes_test-fix-compilation-.patch new file mode 100644 index 00000000000..fd5b6d636e0 --- /dev/null +++ b/queue-5.10/staging-comedi-tests-ni_routes_test-fix-compilation-.patch @@ -0,0 +1,55 @@ +From ee185b86928040e72fcad8d99d401e88cb03cc95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 15:01:38 +0100 +Subject: staging: comedi: tests: ni_routes_test: Fix compilation error + +From: Ian Abbott + +[ Upstream commit 6db58ed2b2d9bb1792eace4f9aa70e8bdd730ffc ] + +The `ni_routes_test` module is not currently selectable using the +Kconfig files, but can be built by specifying `CONFIG_COMEDI_TESTS=m` on +the "make" command line. It currently fails to compile due to an extra +parameter added to the `ni_assign_device_routes` function by +commit e3b7ce73c578 ("staging: comedi: ni_routes: Allow alternate board +name for routes"). Fix it by supplying the value `NULL` for the added +`alt_board_name` parameter (which specifies that there is no alternate +board name). + +Fixes: e3b7ce73c578 ("staging: comedi: ni_routes: Allow alternate board name for routes") +Cc: Spencer E. Olson +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20210407140142.447250-2-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/comedi/drivers/tests/ni_routes_test.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/comedi/drivers/tests/ni_routes_test.c b/drivers/staging/comedi/drivers/tests/ni_routes_test.c +index eaefaf596a37..02606e39625a 100644 +--- a/drivers/staging/comedi/drivers/tests/ni_routes_test.c ++++ b/drivers/staging/comedi/drivers/tests/ni_routes_test.c +@@ -217,7 +217,8 @@ void test_ni_assign_device_routes(void) + const u8 *table, *oldtable; + + init_pci_6070e(); +- ni_assign_device_routes(ni_eseries, pci_6070e, &private.routing_tables); ++ ni_assign_device_routes(ni_eseries, pci_6070e, NULL, ++ &private.routing_tables); + devroutes = private.routing_tables.valid_routes; + table = private.routing_tables.route_values; + +@@ -253,7 +254,8 @@ void test_ni_assign_device_routes(void) + olddevroutes = devroutes; + oldtable = table; + init_pci_6220(); +- ni_assign_device_routes(ni_mseries, pci_6220, &private.routing_tables); ++ ni_assign_device_routes(ni_mseries, pci_6220, NULL, ++ &private.routing_tables); + devroutes = private.routing_tables.valid_routes; + table = private.routing_tables.route_values; + +-- +2.30.2 + diff --git a/queue-5.10/staging-fwserial-fix-tiocgserial-implementation.patch b/queue-5.10/staging-fwserial-fix-tiocgserial-implementation.patch new file mode 100644 index 00000000000..f6a67d26676 --- /dev/null +++ b/queue-5.10/staging-fwserial-fix-tiocgserial-implementation.patch @@ -0,0 +1,61 @@ +From 9269572d2d83fc919f6d5ace46666a7abb6b7542 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 12:23:22 +0200 +Subject: staging: fwserial: fix TIOCGSERIAL implementation + +From: Johan Hovold + +[ Upstream commit 5e84a66f3682af4f177bb24bb2ad5135c51f764a ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +The xmit_fifo_size parameter could be used to set the hardware transmit +fifo size of a legacy UART when it could not be detected, but the +interface is limited to eight bits and should be left unset when not +used. + +Fix the fwserial implementation by dropping its custom interpretation of +the unused xmit_fifo_size field, which was overflowed with the driver +FIFO size. Also leave the type and flags fields unset as these cannot be +changed. + +The close_delay and closing_wait parameters returned by TIOCGSERIAL are +specified in centiseconds. The driver does not yet support changing +closing_wait, but let's report back the default value actually used (30 +seconds). + +Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-5-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fwserial/fwserial.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c +index 2888b80a2c1a..0f4655d7d520 100644 +--- a/drivers/staging/fwserial/fwserial.c ++++ b/drivers/staging/fwserial/fwserial.c +@@ -1218,13 +1218,12 @@ static int get_serial_info(struct tty_struct *tty, + struct fwtty_port *port = tty->driver_data; + + mutex_lock(&port->port.mutex); +- ss->type = PORT_UNKNOWN; +- ss->line = port->port.tty->index; +- ss->flags = port->port.flags; +- ss->xmit_fifo_size = FWTTY_PORT_TXFIFO_LEN; ++ ss->line = port->index; + ss->baud_base = 400000000; + ss->close_delay = jiffies_to_msecs(port->port.close_delay) / 10; ++ ss->closing_wait = 3000; + mutex_unlock(&port->port.mutex); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/staging-fwserial-fix-tiocsserial-implementation.patch b/queue-5.10/staging-fwserial-fix-tiocsserial-implementation.patch new file mode 100644 index 00000000000..69939d06857 --- /dev/null +++ b/queue-5.10/staging-fwserial-fix-tiocsserial-implementation.patch @@ -0,0 +1,49 @@ +From 12a14426f0ad3a27bda38d33605b66a4337fcb93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 12:23:21 +0200 +Subject: staging: fwserial: fix TIOCSSERIAL implementation + +From: Johan Hovold + +[ Upstream commit a7eaaa9d1032e68669bb479496087ba8fc155ab6 ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the fwserial implementation which was returning -EPERM also for a +privileged user when trying to change certain unsupported parameters, +and instead return success consistently. + +Fixes: 7355ba3445f2 ("staging: fwserial: Add TTY-over-Firewire serial driver") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fwserial/fwserial.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c +index 440d11423812..2888b80a2c1a 100644 +--- a/drivers/staging/fwserial/fwserial.c ++++ b/drivers/staging/fwserial/fwserial.c +@@ -1234,10 +1234,6 @@ static int set_serial_info(struct tty_struct *tty, + struct fwtty_port *port = tty->driver_data; + unsigned int cdelay; + +- if (ss->irq != 0 || ss->port != 0 || ss->custom_divisor != 0 || +- ss->baud_base != 400000000) +- return -EPERM; +- + cdelay = msecs_to_jiffies(ss->close_delay * 10); + + mutex_lock(&port->port.mutex); +-- +2.30.2 + diff --git a/queue-5.10/staging-greybus-uart-fix-unprivileged-tioccserial.patch b/queue-5.10/staging-greybus-uart-fix-unprivileged-tioccserial.patch new file mode 100644 index 00000000000..043bf66d76d --- /dev/null +++ b/queue-5.10/staging-greybus-uart-fix-unprivileged-tioccserial.patch @@ -0,0 +1,47 @@ +From 803706f7cb81bfbca8b7a623491e4303dafd53b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 12:23:24 +0200 +Subject: staging: greybus: uart: fix unprivileged TIOCCSERIAL + +From: Johan Hovold + +[ Upstream commit 60c6b305c11b5fd167ce5e2ce42f3a9098c388f0 ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the greybus implementation which instead indicated that the +TIOCSSERIAL ioctl was not even implemented when a non-privileged user +set the current values. + +Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-7-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/uart.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index 29846dc1e1bf..a520f7f213db 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -641,8 +641,6 @@ static int set_serial_info(struct tty_struct *tty, + if ((close_delay != gb_tty->port.close_delay) || + (closing_wait != gb_tty->port.closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + gb_tty->port.close_delay = close_delay; + gb_tty->port.closing_wait = closing_wait; +-- +2.30.2 + diff --git a/queue-5.10/staging-rtl8192u-fix-potential-infinite-loop.patch b/queue-5.10/staging-rtl8192u-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..b692c990cf0 --- /dev/null +++ b/queue-5.10/staging-rtl8192u-fix-potential-infinite-loop.patch @@ -0,0 +1,41 @@ +From ca823637029987fdaa6651fcfc11d7c4c89124bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 16:03:08 +0100 +Subject: staging: rtl8192u: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ] + +The for-loop iterates with a u8 loop counter i and compares this +with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum +that is a u16 type. There is a potential infinite loop if SlotNum +is larger than the u8 loop counter. Fix this by making the loop +counter the same type as SlotNum. + +Addresses-Coverity: ("Infinite loop") +Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/r8192U_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 27dc181c4c9b..03d31e52b399 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -3208,7 +3208,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum, + u32 *TotalRxDataNum) + { + u16 SlotIndex; +- u8 i; ++ u16 i; + + *TotalRxBcnNum = 0; + *TotalRxDataNum = 0; +-- +2.30.2 + diff --git a/queue-5.10/tty-actually-undefine-superseded-async-flags.patch b/queue-5.10/tty-actually-undefine-superseded-async-flags.patch new file mode 100644 index 00000000000..9cd9e9e48be --- /dev/null +++ b/queue-5.10/tty-actually-undefine-superseded-async-flags.patch @@ -0,0 +1,49 @@ +From 68e45de06cf5d12d58e150ceffd3f6e0afe1bf3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:01 +0200 +Subject: tty: actually undefine superseded ASYNC flags + +From: Johan Hovold + +[ Upstream commit d09845e98a05850a8094ea8fd6dd09a8e6824fff ] + +Some kernel-internal ASYNC flags have been superseded by tty-port flags +and should no longer be used by kernel drivers. + +Fix the misspelled "__KERNEL__" compile guards which failed their sole +purpose to break out-of-tree drivers that have not yet been updated. + +Fixes: 5c0517fefc92 ("tty: core: Undefine ASYNC_* flags superceded by TTY_PORT* flags") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/uapi/linux/tty_flags.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h +index 900a32e63424..6a3ac496a56c 100644 +--- a/include/uapi/linux/tty_flags.h ++++ b/include/uapi/linux/tty_flags.h +@@ -39,7 +39,7 @@ + * WARNING: These flags are no longer used and have been superceded by the + * TTY_PORT_ flags in the iflags field (and not userspace-visible) + */ +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */ + #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */ + #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */ +@@ -81,7 +81,7 @@ + #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI) + #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI) + +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + /* These flags are no longer used (and were always masked from userspace) */ + #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED) + #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE) +-- +2.30.2 + diff --git a/queue-5.10/tty-fix-return-value-for-unsupported-ioctls.patch b/queue-5.10/tty-fix-return-value-for-unsupported-ioctls.patch new file mode 100644 index 00000000000..1ddc1b17373 --- /dev/null +++ b/queue-5.10/tty-fix-return-value-for-unsupported-ioctls.patch @@ -0,0 +1,85 @@ +From 73879f40a942a545af532b6f27bcdcde0dea5095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:02 +0200 +Subject: tty: fix return value for unsupported ioctls + +From: Johan Hovold + +[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ] + +Drivers should return -ENOTTY ("Inappropriate I/O control operation") +when an ioctl isn't supported, while -EINVAL is used for invalid +arguments. + +Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned +-EINVAL when a tty driver did not implement the corresponding +operations. + +Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a +corresponding Fixes tag below. + +Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_io.c | 8 ++++---- + include/linux/tty_driver.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 146bd6711562..bc5314092aa4 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2492,14 +2492,14 @@ out: + * @p: pointer to result + * + * Obtain the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ + + static int tty_tiocmget(struct tty_struct *tty, int __user *p) + { +- int retval = -EINVAL; ++ int retval = -ENOTTY; + + if (tty->ops->tiocmget) { + retval = tty->ops->tiocmget(tty); +@@ -2517,7 +2517,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p) + * @p: pointer to desired bits + * + * Set the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ +@@ -2529,7 +2529,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd, + unsigned int set, clear, val; + + if (tty->ops->tiocmset == NULL) +- return -EINVAL; ++ return -ENOTTY; + + retval = get_user(val, p); + if (retval) +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index 358446247ccd..7186d77f431e 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -236,7 +236,7 @@ + * + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel + * structure to complete. This method is optional and will only be called +- * if provided (otherwise EINVAL will be returned). ++ * if provided (otherwise ENOTTY will be returned). + */ + + #include +-- +2.30.2 + diff --git a/queue-5.10/tty-fix-return-value-for-unsupported-termiox-ioctls.patch b/queue-5.10/tty-fix-return-value-for-unsupported-termiox-ioctls.patch new file mode 100644 index 00000000000..6994101d29b --- /dev/null +++ b/queue-5.10/tty-fix-return-value-for-unsupported-termiox-ioctls.patch @@ -0,0 +1,50 @@ +From bb346eff1aaca5ba2b7d2cf888864dc0303ebc87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:03 +0200 +Subject: tty: fix return value for unsupported termiox ioctls + +From: Johan Hovold + +[ Upstream commit 8871de06ff78e9333d86c87d7071452b690e7c9b ] + +Drivers should return -ENOTTY ("Inappropriate I/O control operation") +when an ioctl isn't supported, while -EINVAL is used for invalid +arguments. + +Support for termiox was added by commit 1d65b4a088de ("tty: Add +termiox") in 2008 but no driver support ever followed and it was +recently ripped out by commit e0efb3168d34 ("tty: Remove dead termiox +code"). + +Fix the return value for the unsupported termiox ioctls, which have +always returned -EINVAL, by explicitly returning -ENOTTY rather than +removing them completely and falling back to the default unrecognised- +ioctl handling. + +Fixes: 1d65b4a088de ("tty: Add termiox") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c +index 4de1c6ddb8ff..803da2d111c8 100644 +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -774,8 +774,8 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file, + case TCSETX: + case TCSETXW: + case TCSETXF: +- return -EINVAL; +-#endif ++ return -ENOTTY; ++#endif + case TIOCGSOFTCAR: + copy_termios(real_tty, &kterm); + ret = put_user((kterm.c_cflag & CLOCAL) ? 1 : 0, +-- +2.30.2 + diff --git a/queue-5.10/tty-remove-dead-termiox-code.patch b/queue-5.10/tty-remove-dead-termiox-code.patch new file mode 100644 index 00000000000..87458b24cf0 --- /dev/null +++ b/queue-5.10/tty-remove-dead-termiox-code.patch @@ -0,0 +1,154 @@ +From 0eabed6f652c5e5cdf8d4372fe7407febc58c567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 03:03:31 +0100 +Subject: tty: Remove dead termiox code + +From: Jann Horn + +[ Upstream commit e0efb3168d34dc8c8c72718672b8902e40efff8f ] + +set_termiox() and the TCGETX handler bail out with -EINVAL immediately +if ->termiox is NULL, but there are no code paths that can set +->termiox to a non-NULL pointer; and no such code paths seem to have +existed since the termiox mechanism was introduced back in +commit 1d65b4a088de ("tty: Add termiox") in v2.6.28. +Similarly, no driver actually implements .set_termiox; and it looks like +no driver ever has. + +Delete this dead code; but leave the definition of struct termiox in the +UAPI headers intact. + +Signed-off-by: Jann Horn +Link: https://lore.kernel.org/r/20201203020331.2394754-1-jannh@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_ioctl.c | 61 ++------------------------------------ + include/linux/tty.h | 1 - + include/linux/tty_driver.h | 9 ------ + 3 files changed, 2 insertions(+), 69 deletions(-) + +diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c +index e18f318586ab..4de1c6ddb8ff 100644 +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -443,51 +443,6 @@ static int get_termio(struct tty_struct *tty, struct termio __user *termio) + return 0; + } + +- +-#ifdef TCGETX +- +-/** +- * set_termiox - set termiox fields if possible +- * @tty: terminal +- * @arg: termiox structure from user +- * @opt: option flags for ioctl type +- * +- * Implement the device calling points for the SYS5 termiox ioctl +- * interface in Linux +- */ +- +-static int set_termiox(struct tty_struct *tty, void __user *arg, int opt) +-{ +- struct termiox tnew; +- struct tty_ldisc *ld; +- +- if (tty->termiox == NULL) +- return -EINVAL; +- if (copy_from_user(&tnew, arg, sizeof(struct termiox))) +- return -EFAULT; +- +- ld = tty_ldisc_ref(tty); +- if (ld != NULL) { +- if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer) +- ld->ops->flush_buffer(tty); +- tty_ldisc_deref(ld); +- } +- if (opt & TERMIOS_WAIT) { +- tty_wait_until_sent(tty, 0); +- if (signal_pending(current)) +- return -ERESTARTSYS; +- } +- +- down_write(&tty->termios_rwsem); +- if (tty->ops->set_termiox) +- tty->ops->set_termiox(tty, &tnew); +- up_write(&tty->termios_rwsem); +- return 0; +-} +- +-#endif +- +- + #ifdef TIOCGETP + /* + * These are deprecated, but there is limited support.. +@@ -815,23 +770,11 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file, + return ret; + #endif + #ifdef TCGETX +- case TCGETX: { +- struct termiox ktermx; +- if (real_tty->termiox == NULL) +- return -EINVAL; +- down_read(&real_tty->termios_rwsem); +- memcpy(&ktermx, real_tty->termiox, sizeof(struct termiox)); +- up_read(&real_tty->termios_rwsem); +- if (copy_to_user(p, &ktermx, sizeof(struct termiox))) +- ret = -EFAULT; +- return ret; +- } ++ case TCGETX: + case TCSETX: +- return set_termiox(real_tty, p, 0); + case TCSETXW: +- return set_termiox(real_tty, p, TERMIOS_WAIT); + case TCSETXF: +- return set_termiox(real_tty, p, TERMIOS_FLUSH); ++ return -EINVAL; + #endif + case TIOCGSOFTCAR: + copy_termios(real_tty, &kterm); +diff --git a/include/linux/tty.h b/include/linux/tty.h +index bc8caac390fc..5972f43b9d5a 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -303,7 +303,6 @@ struct tty_struct { + spinlock_t flow_lock; + /* Termios values are protected by the termios rwsem */ + struct ktermios termios, termios_locked; +- struct termiox *termiox; /* May be NULL for unsupported */ + char name[64]; + struct pid *pgrp; /* Protected by ctrl lock */ + /* +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index 7186d77f431e..2f719b471d52 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -224,14 +224,6 @@ + * line). See tty_do_resize() if you need to wrap the standard method + * in your own logic - the usual case. + * +- * void (*set_termiox)(struct tty_struct *tty, struct termiox *new); +- * +- * Called when the device receives a termiox based ioctl. Passes down +- * the requested data from user space. This method will not be invoked +- * unless the tty also has a valid tty->termiox pointer. +- * +- * Optional: Called under the termios lock +- * + * int (*get_icount)(struct tty_struct *tty, struct serial_icounter *icount); + * + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel +@@ -285,7 +277,6 @@ struct tty_operations { + int (*tiocmset)(struct tty_struct *tty, + unsigned int set, unsigned int clear); + int (*resize)(struct tty_struct *tty, struct winsize *ws); +- int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew); + int (*get_icount)(struct tty_struct *tty, + struct serial_icounter_struct *icount); + int (*get_serial)(struct tty_struct *tty, struct serial_struct *p); +-- +2.30.2 + diff --git a/queue-5.10/ttyprintk-add-tty-hangup-callback.patch b/queue-5.10/ttyprintk-add-tty-hangup-callback.patch new file mode 100644 index 00000000000..6477210c6ce --- /dev/null +++ b/queue-5.10/ttyprintk-add-tty-hangup-callback.patch @@ -0,0 +1,87 @@ +From 3f57b3564b3eca9c1f1cd9ebb2fc7d03aaaa64c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 09:22:22 +0900 +Subject: ttyprintk: Add TTY hangup callback. + +From: Tetsuo Handa + +[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ] + +syzbot is reporting hung task due to flood of + + tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__, + port->count); + +message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from +decrementing port->count due to tty_hung_up_p() == true. + +---------- +#include +#include +#include +#include +#include + +int main(int argc, char *argv[]) +{ + int i; + int fd[10]; + + for (i = 0; i < 10; i++) + fd[i] = open("/dev/ttyprintk", O_WRONLY); + ioctl(fd[0], TIOCVHANGUP); + for (i = 0; i < 10; i++) + close(fd[i]); + close(open("/dev/ttyprintk", O_WRONLY)); + return 0; +} +---------- + +When TTY hangup happens, port->count needs to be reset via +"struct tty_operations"->hangup callback. + +[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a + +Reported-by: syzbot +Reported-by: syzbot +Tested-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: 24b4b67d17c308aa ("add ttyprintk driver") +Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/ttyprintk.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c +index 6a0059e508e3..93f5d11c830b 100644 +--- a/drivers/char/ttyprintk.c ++++ b/drivers/char/ttyprintk.c +@@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty, + return 0; + } + ++/* ++ * TTY operations hangup function. ++ */ ++static void tpk_hangup(struct tty_struct *tty) ++{ ++ struct ttyprintk_port *tpkp = tty->driver_data; ++ ++ tty_port_hangup(&tpkp->port); ++} ++ + static const struct tty_operations ttyprintk_ops = { + .open = tpk_open, + .close = tpk_close, + .write = tpk_write, + .write_room = tpk_write_room, + .ioctl = tpk_ioctl, ++ .hangup = tpk_hangup, + }; + + static const struct tty_port_operations null_ops = { }; +-- +2.30.2 + diff --git a/queue-5.10/udp-never-accept-gso_fraglist-packets.patch b/queue-5.10/udp-never-accept-gso_fraglist-packets.patch new file mode 100644 index 00000000000..6a97a2e85a5 --- /dev/null +++ b/queue-5.10/udp-never-accept-gso_fraglist-packets.patch @@ -0,0 +1,87 @@ +From fa9b0e2ca65bcd9dfaa0c29c43aee0cef61c8152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 12:28:52 +0200 +Subject: udp: never accept GSO_FRAGLIST packets + +From: Paolo Abeni + +[ Upstream commit 78352f73dc5047f3f744764cc45912498c52f3c9 ] + +Currently the UDP protocol delivers GSO_FRAGLIST packets to +the sockets without the expected segmentation. + +This change addresses the issue introducing and maintaining +a couple of new fields to explicitly accept SKB_GSO_UDP_L4 +or GSO_FRAGLIST packets. Additionally updates udp_unexpected_gso() +accordingly. + +UDP sockets enabling UDP_GRO stil keep accept_udp_fraglist +zeroed. + +v1 -> v2: + - use 2 bits instead of a whole GSO bitmask (Willem) + +Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") +Signed-off-by: Paolo Abeni +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/udp.h | 16 +++++++++++++--- + net/ipv4/udp.c | 3 +++ + 2 files changed, 16 insertions(+), 3 deletions(-) + +diff --git a/include/linux/udp.h b/include/linux/udp.h +index aa84597bdc33..ae58ff3b6b5b 100644 +--- a/include/linux/udp.h ++++ b/include/linux/udp.h +@@ -51,7 +51,9 @@ struct udp_sock { + * different encapsulation layer set + * this + */ +- gro_enabled:1; /* Can accept GRO packets */ ++ gro_enabled:1, /* Request GRO aggregation */ ++ accept_udp_l4:1, ++ accept_udp_fraglist:1; + /* + * Following member retains the information to create a UDP header + * when the socket is uncorked. +@@ -131,8 +133,16 @@ static inline void udp_cmsg_recv(struct msghdr *msg, struct sock *sk, + + static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb) + { +- return !udp_sk(sk)->gro_enabled && skb_is_gso(skb) && +- skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4; ++ if (!skb_is_gso(skb)) ++ return false; ++ ++ if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && !udp_sk(sk)->accept_udp_l4) ++ return true; ++ ++ if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST && !udp_sk(sk)->accept_udp_fraglist) ++ return true; ++ ++ return false; + } + + #define udp_portaddr_for_each_entry(__sk, list) \ +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 4a2fd286787c..9d28b2778e8f 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2657,9 +2657,12 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, + + case UDP_GRO: + lock_sock(sk); ++ ++ /* when enabling GRO, accept the related GSO packet type */ + if (valbool) + udp_tunnel_encap_enable(sk->sk_socket); + up->gro_enabled = valbool; ++ up->accept_udp_l4 = valbool; + release_sock(sk); + break; + +-- +2.30.2 + diff --git a/queue-5.10/usb-cdc-acm-fix-tiocgserial-implementation.patch b/queue-5.10/usb-cdc-acm-fix-tiocgserial-implementation.patch new file mode 100644 index 00000000000..f296add33b2 --- /dev/null +++ b/queue-5.10/usb-cdc-acm-fix-tiocgserial-implementation.patch @@ -0,0 +1,58 @@ +From f98d83198c80c60ee498e201fb41c911f0dd2310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:16:02 +0200 +Subject: USB: cdc-acm: fix TIOCGSERIAL implementation + +From: Johan Hovold + +[ Upstream commit 496960274153bdeb9d1f904ff1ea875cef8232c1 ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +The xmit_fifo_size parameter could be used to set the hardware transmit +fifo size of a legacy UART when it could not be detected, but the +interface is limited to eight bits and should be left unset when it is +not used. + +Similarly, baud_base could be used to set the UART base clock when it +could not be detected, but might as well be left unset when it is not +known (which is the case for CDC). + +Fix the cdc-acm TIOCGSERIAL implementation by dropping its custom +interpretation of the unused xmit_fifo_size and baud_base fields, which +overflowed the former with the URB buffer size and set the latter to the +current line speed. Also return the port line number, which is the only +other value used besides the close parameters. + +Note that the current line speed can still be retrieved through the +standard termios interfaces. + +Fixes: 18c75720e667 ("USB: allow users to run setserial with cdc-acm") +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210408131602.27956-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 63824552e5d0..6fbabf56dbb7 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -929,8 +929,7 @@ static int get_serial_info(struct tty_struct *tty, struct serial_struct *ss) + { + struct acm *acm = tty->driver_data; + +- ss->xmit_fifo_size = acm->writesize; +- ss->baud_base = le32_to_cpu(acm->line.dwDTERate); ++ ss->line = acm->minor; + ss->close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; + ss->closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? + ASYNC_CLOSING_WAIT_NONE : +-- +2.30.2 + diff --git a/queue-5.10/usb-cdc-acm-fix-unprivileged-tioccserial.patch b/queue-5.10/usb-cdc-acm-fix-unprivileged-tioccserial.patch new file mode 100644 index 00000000000..614bb5363d9 --- /dev/null +++ b/queue-5.10/usb-cdc-acm-fix-unprivileged-tioccserial.patch @@ -0,0 +1,48 @@ +From 1e9e92f28d136f52731887b1f1ae746046bc3a19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:16:01 +0200 +Subject: USB: cdc-acm: fix unprivileged TIOCCSERIAL + +From: Johan Hovold + +[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the cdc-acm implementation which instead indicated that the +TIOCSSERIAL ioctl was not even implemented when a non-privileged user +set the current values. + +Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)") +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0876468c2e7d..63824552e5d0 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -955,8 +955,6 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss) + if ((close_delay != acm->port.close_delay) || + (closing_wait != acm->port.closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; +-- +2.30.2 + diff --git a/queue-5.10/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch b/queue-5.10/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch new file mode 100644 index 00000000000..0c8988d00fd --- /dev/null +++ b/queue-5.10/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch @@ -0,0 +1,221 @@ +From 76cc691be11b40839fc01d723b78c3baf4cb5cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 16:47:14 +0400 +Subject: usb: dwc2: Fix hibernation between host and device modes. + +From: Artur Petrosyan + +[ Upstream commit 24d209dba5a3959b2ebde7cf3ad40c8015e814cf ] + +When core is in hibernation in host mode and a device cable +was connected then driver exited from device hibernation. +However, registers saved for host mode and when exited from +device hibernation register restore would be done for device +register which was wrong because there was no device registers +stored to restore. + +- Added dwc_handle_gpwrdn_disc_det() function which handles + gpwrdn disconnect detect flow and exits hibernation + without restoring the registers. +- Updated exiting from hibernation in GPWRDN_STS_CHGINT with + calling dwc_handle_gpwrdn_disc_det() function. Here no register + is restored which is the solution described above. + +Fixes: 65c9c4c6b01f ("usb: dwc2: Add dwc2_handle_gpwrdn_intr() handler") +Acked-by: Minas Harutyunyan +Signed-off-by: Artur Petrosyan +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/20210416124715.75355A005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/core_intr.c | 154 +++++++++++++++++++---------------- + 1 file changed, 83 insertions(+), 71 deletions(-) + +diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c +index 800c8b6c55ff..510fd0572feb 100644 +--- a/drivers/usb/dwc2/core_intr.c ++++ b/drivers/usb/dwc2/core_intr.c +@@ -660,6 +660,71 @@ static u32 dwc2_read_common_intr(struct dwc2_hsotg *hsotg) + return 0; + } + ++/** ++ * dwc_handle_gpwrdn_disc_det() - Handles the gpwrdn disconnect detect. ++ * Exits hibernation without restoring registers. ++ * ++ * @hsotg: Programming view of DWC_otg controller ++ * @gpwrdn: GPWRDN register ++ */ ++static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg, ++ u32 gpwrdn) ++{ ++ u32 gpwrdn_tmp; ++ ++ /* Switch-on voltage to the core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Reset core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Disable Power Down Clamp */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Deassert reset core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp |= GPWRDN_PWRDNRSTN; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Disable PMU interrupt */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PMUINTSEL; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ ++ /* De-assert Wakeup Logic */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PMUACTV; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ ++ hsotg->hibernated = 0; ++ hsotg->bus_suspended = 0; ++ ++ if (gpwrdn & GPWRDN_IDSTS) { ++ hsotg->op_state = OTG_STATE_B_PERIPHERAL; ++ dwc2_core_init(hsotg, false); ++ dwc2_enable_global_interrupts(hsotg); ++ dwc2_hsotg_core_init_disconnected(hsotg, false); ++ dwc2_hsotg_core_connect(hsotg); ++ } else { ++ hsotg->op_state = OTG_STATE_A_HOST; ++ ++ /* Initialize the Core for Host mode */ ++ dwc2_core_init(hsotg, false); ++ dwc2_enable_global_interrupts(hsotg); ++ dwc2_hcd_start(hsotg); ++ } ++} ++ + /* + * GPWRDN interrupt handler. + * +@@ -681,64 +746,14 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg) + + if ((gpwrdn & GPWRDN_DISCONN_DET) && + (gpwrdn & GPWRDN_DISCONN_DET_MSK) && !linestate) { +- u32 gpwrdn_tmp; +- + dev_dbg(hsotg->dev, "%s: GPWRDN_DISCONN_DET\n", __func__); +- +- /* Switch-on voltage to the core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Reset core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Disable Power Down Clamp */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Deassert reset core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp |= GPWRDN_PWRDNRSTN; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Disable PMU interrupt */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PMUINTSEL; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- +- /* De-assert Wakeup Logic */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PMUACTV; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- +- hsotg->hibernated = 0; +- +- if (gpwrdn & GPWRDN_IDSTS) { +- hsotg->op_state = OTG_STATE_B_PERIPHERAL; +- dwc2_core_init(hsotg, false); +- dwc2_enable_global_interrupts(hsotg); +- dwc2_hsotg_core_init_disconnected(hsotg, false); +- dwc2_hsotg_core_connect(hsotg); +- } else { +- hsotg->op_state = OTG_STATE_A_HOST; +- +- /* Initialize the Core for Host mode */ +- dwc2_core_init(hsotg, false); +- dwc2_enable_global_interrupts(hsotg); +- dwc2_hcd_start(hsotg); +- } +- } +- +- if ((gpwrdn & GPWRDN_LNSTSCHG) && +- (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) { ++ /* ++ * Call disconnect detect function to exit from ++ * hibernation ++ */ ++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn); ++ } else if ((gpwrdn & GPWRDN_LNSTSCHG) && ++ (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) { + dev_dbg(hsotg->dev, "%s: GPWRDN_LNSTSCHG\n", __func__); + if (hsotg->hw_params.hibernation && + hsotg->hibernated) { +@@ -749,24 +764,21 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg) + dwc2_exit_hibernation(hsotg, 1, 0, 1); + } + } +- } +- if ((gpwrdn & GPWRDN_RST_DET) && (gpwrdn & GPWRDN_RST_DET_MSK)) { ++ } else if ((gpwrdn & GPWRDN_RST_DET) && ++ (gpwrdn & GPWRDN_RST_DET_MSK)) { + dev_dbg(hsotg->dev, "%s: GPWRDN_RST_DET\n", __func__); + if (!linestate && (gpwrdn & GPWRDN_BSESSVLD)) + dwc2_exit_hibernation(hsotg, 0, 1, 0); +- } +- if ((gpwrdn & GPWRDN_STS_CHGINT) && +- (gpwrdn & GPWRDN_STS_CHGINT_MSK) && linestate) { ++ } else if ((gpwrdn & GPWRDN_STS_CHGINT) && ++ (gpwrdn & GPWRDN_STS_CHGINT_MSK)) { + dev_dbg(hsotg->dev, "%s: GPWRDN_STS_CHGINT\n", __func__); +- if (hsotg->hw_params.hibernation && +- hsotg->hibernated) { +- if (gpwrdn & GPWRDN_IDSTS) { +- dwc2_exit_hibernation(hsotg, 0, 0, 0); +- call_gadget(hsotg, resume); +- } else { +- dwc2_exit_hibernation(hsotg, 1, 0, 1); +- } +- } ++ /* ++ * As GPWRDN_STS_CHGINT exit from hibernation flow is ++ * the same as in GPWRDN_DISCONN_DET flow. Call ++ * disconnect detect helper function to exit from ++ * hibernation. ++ */ ++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn); + } + } + +-- +2.30.2 + diff --git a/queue-5.10/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch b/queue-5.10/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch new file mode 100644 index 00000000000..84e9e923a4b --- /dev/null +++ b/queue-5.10/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch @@ -0,0 +1,47 @@ +From 2302088f9bde01433f911d9e99d5b0201623d303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 16:47:06 +0400 +Subject: usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. + +From: Artur Petrosyan + +[ Upstream commit c2db8d7b9568b10e014af83b3c15e39929e3579e ] + +Added setting "port_connect_status_change" flag to "1" in order +to re-enumerate, because after exit from hibernation port +connection status is not detected. + +Fixes: c5c403dc4336 ("usb: dwc2: Add host/device hibernation functions") +Acked-by: Minas Harutyunyan +Signed-off-by: Artur Petrosyan +Link: https://lore.kernel.org/r/20210416124707.5EEC2A005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/hcd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 1a9789ec5847..6af1dcbc3656 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -5580,7 +5580,15 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup, + return ret; + } + +- dwc2_hcd_rem_wakeup(hsotg); ++ if (rem_wakeup) { ++ dwc2_hcd_rem_wakeup(hsotg); ++ /* ++ * Change "port_connect_status_change" flag to re-enumerate, ++ * because after exit from hibernation port connection status ++ * is not detected. ++ */ ++ hsotg->flags.b.port_connect_status_change = 1; ++ } + + hsotg->hibernated = 0; + hsotg->bus_suspended = 0; +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-aspeed-fix-dma-map-failure.patch b/queue-5.10/usb-gadget-aspeed-fix-dma-map-failure.patch new file mode 100644 index 00000000000..f57f38a2706 --- /dev/null +++ b/queue-5.10/usb-gadget-aspeed-fix-dma-map-failure.patch @@ -0,0 +1,87 @@ +From 725e62b510b74f0aefc18eb9df0f5ee58c06fcfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 21:58:31 -0700 +Subject: usb: gadget: aspeed: fix dma map failure + +From: Tao Ren + +[ Upstream commit bd4d607044b961cecbf8c4c2f3bb5da4fb156993 ] + +Currently the virtual port_dev device is passed to DMA API, and this is +wrong because the device passed to DMA API calls must be the actual +hardware device performing the DMA. + +The patch replaces usb_gadget_map_request/usb_gadget_unmap_request APIs +with usb_gadget_map_request_by_dev/usb_gadget_unmap_request_by_dev APIs +so the DMA capable platform device can be passed to the DMA APIs. + +The patch fixes below backtrace detected on Facebook AST2500 OpenBMC +platforms: + +[<80106550>] show_stack+0x20/0x24 +[<80106868>] dump_stack+0x28/0x30 +[<80823540>] __warn+0xfc/0x110 +[<8011ac30>] warn_slowpath_fmt+0xb0/0xc0 +[<8011ad44>] dma_map_page_attrs+0x24c/0x314 +[<8016a27c>] usb_gadget_map_request_by_dev+0x100/0x1e4 +[<805cedd8>] usb_gadget_map_request+0x1c/0x20 +[<805cefbc>] ast_vhub_epn_queue+0xa0/0x1d8 +[<7f02f710>] usb_ep_queue+0x48/0xc4 +[<805cd3e8>] ecm_do_notify+0xf8/0x248 +[<7f145920>] ecm_set_alt+0xc8/0x1d0 +[<7f145c34>] composite_setup+0x680/0x1d30 +[<7f00deb8>] ast_vhub_ep0_handle_setup+0xa4/0x1bc +[<7f02ee94>] ast_vhub_dev_irq+0x58/0x84 +[<7f0309e0>] ast_vhub_irq+0xb0/0x1c8 +[<7f02e118>] __handle_irq_event_percpu+0x50/0x19c +[<8015e5bc>] handle_irq_event_percpu+0x38/0x8c +[<8015e758>] handle_irq_event+0x38/0x4c + +Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub") +Reviewed-by: Joel Stanley +Signed-off-by: Tao Ren +Link: https://lore.kernel.org/r/20210331045831.28700-1-rentao.bupt@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/aspeed-vhub/core.c | 3 ++- + drivers/usb/gadget/udc/aspeed-vhub/epn.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/aspeed-vhub/core.c b/drivers/usb/gadget/udc/aspeed-vhub/core.c +index be7bb64e3594..d11d3d14313f 100644 +--- a/drivers/usb/gadget/udc/aspeed-vhub/core.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/core.c +@@ -36,6 +36,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req, + int status) + { + bool internal = req->internal; ++ struct ast_vhub *vhub = ep->vhub; + + EPVDBG(ep, "completing request @%p, status %d\n", req, status); + +@@ -46,7 +47,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req, + + if (req->req.dma) { + if (!WARN_ON(!ep->dev)) +- usb_gadget_unmap_request(&ep->dev->gadget, ++ usb_gadget_unmap_request_by_dev(&vhub->pdev->dev, + &req->req, ep->epn.is_in); + req->req.dma = 0; + } +diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c +index 02d8bfae58fb..cb164c615e6f 100644 +--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c +@@ -376,7 +376,7 @@ static int ast_vhub_epn_queue(struct usb_ep* u_ep, struct usb_request *u_req, + if (ep->epn.desc_mode || + ((((unsigned long)u_req->buf & 7) == 0) && + (ep->epn.is_in || !(u_req->length & (u_ep->maxpacket - 1))))) { +- rc = usb_gadget_map_request(&ep->dev->gadget, u_req, ++ rc = usb_gadget_map_request_by_dev(&vhub->pdev->dev, u_req, + ep->epn.is_in); + if (rc) { + dev_warn(&vhub->pdev->dev, +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-pch_udc-check-for-dma-mapping-error.patch b/queue-5.10/usb-gadget-pch_udc-check-for-dma-mapping-error.patch new file mode 100644 index 00000000000..495616c6e11 --- /dev/null +++ b/queue-5.10/usb-gadget-pch_udc-check-for-dma-mapping-error.patch @@ -0,0 +1,39 @@ +From 8edc3b9d59a2d9af24905cb1c6c710abbb0bff1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:22 +0200 +Subject: usb: gadget: pch_udc: Check for DMA mapping error + +From: Andy Shevchenko + +[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ] + +DMA mapping might fail, we have to check it with dma_mapping_error(). +Otherwise DMA-API is not happy: + + DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single] + +Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index b46e9bdc720f..29e89ed6aad5 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -2955,7 +2955,7 @@ static int init_dma_pools(struct pch_udc_dev *dev) + dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf, + UDC_EP0OUT_BUFF_SIZE * 4, + DMA_FROM_DEVICE); +- return 0; ++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr); + } + + static int pch_udc_start(struct usb_gadget *g, +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-pch_udc-check-if-driver-is-present-before.patch b/queue-5.10/usb-gadget-pch_udc-check-if-driver-is-present-before.patch new file mode 100644 index 00000000000..af1f04a9ce9 --- /dev/null +++ b/queue-5.10/usb-gadget-pch_udc-check-if-driver-is-present-before.patch @@ -0,0 +1,99 @@ +From 734eb69363532db83b3bd4b323630385efc72113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:21 +0200 +Subject: usb: gadget: pch_udc: Check if driver is present before calling + ->setup() + +From: Andy Shevchenko + +[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ] + +Since we have a separate routine for VBUS sense, the interrupt may occur +before gadget driver is present. Hence, ->setup() call may oops the kernel: + +[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010 +... +[ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f +... +[ 55.245843] +[ 55.245843] ? pch_udc_svc_data_out+0x160/0x160 + +Check if driver is present before calling ->setup(). + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index f6f8965c4f8c..b46e9bdc720f 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -2307,6 +2307,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num) + pch_udc_set_dma(dev, DMA_DIR_RX); + } + ++static int pch_udc_gadget_setup(struct pch_udc_dev *dev) ++ __must_hold(&dev->lock) ++{ ++ int rc; ++ ++ /* In some cases we can get an interrupt before driver gets setup */ ++ if (!dev->driver) ++ return -ESHUTDOWN; ++ ++ spin_unlock(&dev->lock); ++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); ++ return rc; ++} ++ + /** + * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts + * @dev: Reference to the device structure +@@ -2378,15 +2393,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev) + dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep; + else /* OUT */ + dev->gadget.ep0 = &ep->ep; +- spin_lock(&dev->lock); + /* If Mass storage Reset */ + if ((dev->setup_data.bRequestType == 0x21) && + (dev->setup_data.bRequest == 0xFF)) + dev->prot_stall = 0; + /* call gadget with setup data received */ +- setup_supported = dev->driver->setup(&dev->gadget, +- &dev->setup_data); +- spin_unlock(&dev->lock); ++ setup_supported = pch_udc_gadget_setup(dev); + + if (dev->setup_data.bRequestType & USB_DIR_IN) { + ep->td_data->status = (ep->td_data->status & +@@ -2634,9 +2646,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) + dev->ep[i].halted = 0; + } + dev->stall = 0; +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +@@ -2671,9 +2681,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) + dev->stall = 0; + + /* call gadget zero with setup data received */ +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-pch_udc-initialize-device-pointer-before-.patch b/queue-5.10/usb-gadget-pch_udc-initialize-device-pointer-before-.patch new file mode 100644 index 00000000000..41c374bfdb3 --- /dev/null +++ b/queue-5.10/usb-gadget-pch_udc-initialize-device-pointer-before-.patch @@ -0,0 +1,63 @@ +From dfa5b8f4989a95f2bdb70c9734750c915f716776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:25 +0200 +Subject: usb: gadget: pch_udc: Initialize device pointer before use + +From: Andy Shevchenko + +[ Upstream commit 971d080212be4ce2b91047d25a657f46d3e39635 ] + +During conversion to use GPIO descriptors the device pointer, +which is applied to devm_gpiod_get(), is not yet initialized. + +Move initialization in the ->probe() in order to have it set before use. + +Fixes: e20849a8c883 ("usb: gadget: pch_udc: Convert to use GPIO descriptors") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-6-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 29e89ed6aad5..a39122f01cdb 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1369,6 +1369,7 @@ static irqreturn_t pch_vbus_gpio_irq(int irq, void *data) + */ + static int pch_vbus_gpio_init(struct pch_udc_dev *dev) + { ++ struct device *d = &dev->pdev->dev; + int err; + int irq_num = 0; + struct gpio_desc *gpiod; +@@ -1377,7 +1378,7 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev) + dev->vbus_gpio.intr = 0; + + /* Retrieve the GPIO line from the USB gadget device */ +- gpiod = devm_gpiod_get(dev->gadget.dev.parent, NULL, GPIOD_IN); ++ gpiod = devm_gpiod_get(d, NULL, GPIOD_IN); + if (IS_ERR(gpiod)) + return PTR_ERR(gpiod); + gpiod_set_consumer_name(gpiod, "pch_vbus"); +@@ -3080,6 +3081,7 @@ static int pch_udc_probe(struct pci_dev *pdev, + if (retval) + return retval; + ++ dev->pdev = pdev; + pci_set_drvdata(pdev, dev); + + /* Determine BAR based on PCI ID */ +@@ -3121,7 +3123,6 @@ static int pch_udc_probe(struct pci_dev *pdev, + + /* device struct setup */ + spin_lock_init(&dev->lock); +- dev->pdev = pdev; + dev->gadget.ops = &pch_udc_ops; + + retval = init_dma_pools(dev); +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-pch_udc-provide-a-gpio-line-used-on-intel.patch b/queue-5.10/usb-gadget-pch_udc-provide-a-gpio-line-used-on-intel.patch new file mode 100644 index 00000000000..3cf5485d19c --- /dev/null +++ b/queue-5.10/usb-gadget-pch_udc-provide-a-gpio-line-used-on-intel.patch @@ -0,0 +1,147 @@ +From b0392f2fd7d2ab1bf976453e28ff2232d9309325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:26 +0200 +Subject: usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard + (v1) + +From: Andy Shevchenko + +[ Upstream commit 049d3db625a652e23488db88b6104de4d5b62f16 ] + +Intel Minnowboard (v1) uses SCH GPIO line SUS7 (i.e. 12) +for VBUS sense. Provide a DMI based quirk to have it's being used. + +Fixes: e20849a8c883 ("usb: gadget: pch_udc: Convert to use GPIO descriptors") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-7-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 71 +++++++++++++++++++++++++------- + 1 file changed, 57 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index a39122f01cdb..fd3656d0f760 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -7,12 +7,14 @@ + #include + #include + #include ++#include + #include ++#include ++#include + #include + #include + #include + #include +-#include + #include + + #define PCH_VBUS_PERIOD 3000 /* VBUS polling period (msec) */ +@@ -1359,6 +1361,43 @@ static irqreturn_t pch_vbus_gpio_irq(int irq, void *data) + return IRQ_HANDLED; + } + ++static struct gpiod_lookup_table minnowboard_udc_gpios = { ++ .dev_id = "0000:02:02.4", ++ .table = { ++ GPIO_LOOKUP("sch_gpio.33158", 12, NULL, GPIO_ACTIVE_HIGH), ++ {} ++ }, ++}; ++ ++static const struct dmi_system_id pch_udc_gpio_dmi_table[] = { ++ { ++ .ident = "MinnowBoard", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "MinnowBoard"), ++ }, ++ .driver_data = &minnowboard_udc_gpios, ++ }, ++ { } ++}; ++ ++static void pch_vbus_gpio_remove_table(void *table) ++{ ++ gpiod_remove_lookup_table(table); ++} ++ ++static int pch_vbus_gpio_add_table(struct pch_udc_dev *dev) ++{ ++ struct device *d = &dev->pdev->dev; ++ const struct dmi_system_id *dmi; ++ ++ dmi = dmi_first_match(pch_udc_gpio_dmi_table); ++ if (!dmi) ++ return 0; ++ ++ gpiod_add_lookup_table(dmi->driver_data); ++ return devm_add_action_or_reset(d, pch_vbus_gpio_remove_table, dmi->driver_data); ++} ++ + /** + * pch_vbus_gpio_init() - This API initializes GPIO port detecting VBUS. + * @dev: Reference to the driver structure +@@ -1377,8 +1416,12 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev) + dev->vbus_gpio.port = NULL; + dev->vbus_gpio.intr = 0; + ++ err = pch_vbus_gpio_add_table(dev); ++ if (err) ++ return err; ++ + /* Retrieve the GPIO line from the USB gadget device */ +- gpiod = devm_gpiod_get(d, NULL, GPIOD_IN); ++ gpiod = devm_gpiod_get_optional(d, NULL, GPIOD_IN); + if (IS_ERR(gpiod)) + return PTR_ERR(gpiod); + gpiod_set_consumer_name(gpiod, "pch_vbus"); +@@ -2888,14 +2931,20 @@ static void pch_udc_pcd_reinit(struct pch_udc_dev *dev) + * @dev: Reference to the driver structure + * + * Return codes: +- * 0: Success ++ * 0: Success ++ * -%ERRNO: All kind of errors when retrieving VBUS GPIO + */ + static int pch_udc_pcd_init(struct pch_udc_dev *dev) + { ++ int ret; ++ + pch_udc_init(dev); + pch_udc_pcd_reinit(dev); +- pch_vbus_gpio_init(dev); +- return 0; ++ ++ ret = pch_vbus_gpio_init(dev); ++ if (ret) ++ pch_udc_exit(dev); ++ return ret; + } + + /** +@@ -3097,16 +3146,10 @@ static int pch_udc_probe(struct pci_dev *pdev, + + dev->base_addr = pcim_iomap_table(pdev)[bar]; + +- /* +- * FIXME: add a GPIO descriptor table to pdev.dev using +- * gpiod_add_descriptor_table() from based on +- * the PCI subsystem ID. The system-dependent GPIO is necessary for +- * VBUS operation. +- */ +- + /* initialize the hardware */ +- if (pch_udc_pcd_init(dev)) +- return -ENODEV; ++ retval = pch_udc_pcd_init(dev); ++ if (retval) ++ return retval; + + pci_enable_msi(pdev); + +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch b/queue-5.10/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch new file mode 100644 index 00000000000..8ee3d945edf --- /dev/null +++ b/queue-5.10/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch @@ -0,0 +1,42 @@ +From ff8455c4fd21a539b312de3bbacda619377c06dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:20 +0200 +Subject: usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() + +From: Andy Shevchenko + +[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ] + +Either way ~0 will be in the correct byte order, hence +replace cpu_to_le32() by lower_32_bits(). Moreover, +it makes sparse happy, otherwise it complains: + +.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types) +.../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr +.../pch_udc.c:1813:27: got restricted __le32 [usertype] + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 931a09fdbf6d..f6f8965c4f8c 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1765,7 +1765,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep, + } + /* prevent from using desc. - set HOST BUSY */ + dma_desc->status |= PCH_UDC_BS_HST_BSY; +- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID); ++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID); + req->td_data = dma_desc; + req->td_data_last = dma_desc; + req->chain_len = 1; +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-r8a66597-add-missing-null-check-on-return.patch b/queue-5.10/usb-gadget-r8a66597-add-missing-null-check-on-return.patch new file mode 100644 index 00000000000..b49a36e5ff4 --- /dev/null +++ b/queue-5.10/usb-gadget-r8a66597-add-missing-null-check-on-return.patch @@ -0,0 +1,39 @@ +From 62a59b2d0947afe40c5808311805c2f746e006c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 19:45:10 +0100 +Subject: usb: gadget: r8a66597: Add missing null check on return from + platform_get_resource + +From: Colin Ian King + +[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ] + +The call to platform_get_resource can potentially return a NULL pointer +on failure, so add this check and return -EINVAL if it fails. + +Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Dereference null return") +Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index 896c1a016d55..65cae4883454 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1849,6 +1849,8 @@ static int r8a66597_probe(struct platform_device *pdev) + return PTR_ERR(reg); + + ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (!ires) ++ return -EINVAL; + irq = ires->start; + irq_trigger = ires->flags & IRQF_TRIGGER_MASK; + +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-s3c-fix-incorrect-resources-releasing.patch b/queue-5.10/usb-gadget-s3c-fix-incorrect-resources-releasing.patch new file mode 100644 index 00000000000..435d2f3d42a --- /dev/null +++ b/queue-5.10/usb-gadget-s3c-fix-incorrect-resources-releasing.patch @@ -0,0 +1,83 @@ +From 8aa607f59c1519093bb3e7b531dff310e1012111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 08:36:50 +0100 +Subject: usb: gadget: s3c: Fix incorrect resources releasing + +From: Christophe JAILLET + +[ Upstream commit 42067ccd9eb2077979ac3ce8b7b95c694bd09e14 ] + +Since commit 188db4435ac6 ("usb: gadget: s3c: use platform resources"), +'request_mem_region()' and 'ioremap()' are no more used, so they don't need +to be undone in the error handling path of the probe and in the remove +function. + +Remove these calls and the unneeded 'rsrc_start' and 'rsrc_len' global +variables. + +Fixes: 188db4435ac6 ("usb: gadget: s3c: use platform resources") +Signed-off-by: Christophe JAILLET +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/b317638464f188159bd8eea44427dd359e480625.1616830026.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/s3c2410_udc.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c +index 1d3ebb07ccd4..b81979b3bdb6 100644 +--- a/drivers/usb/gadget/udc/s3c2410_udc.c ++++ b/drivers/usb/gadget/udc/s3c2410_udc.c +@@ -54,8 +54,6 @@ static struct clk *udc_clock; + static struct clk *usb_bus_clock; + static void __iomem *base_addr; + static int irq_usbd; +-static u64 rsrc_start; +-static u64 rsrc_len; + static struct dentry *s3c2410_udc_debugfs_root; + + static inline u32 udc_read(u32 reg) +@@ -1775,7 +1773,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + base_addr = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base_addr)) { + retval = PTR_ERR(base_addr); +- goto err_mem; ++ goto err; + } + + the_controller = udc; +@@ -1793,7 +1791,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + if (retval != 0) { + dev_err(dev, "cannot get irq %i, err %d\n", irq_usbd, retval); + retval = -EBUSY; +- goto err_map; ++ goto err; + } + + dev_dbg(dev, "got irq %i\n", irq_usbd); +@@ -1864,10 +1862,7 @@ err_gpio_claim: + gpio_free(udc_info->vbus_pin); + err_int: + free_irq(irq_usbd, udc); +-err_map: +- iounmap(base_addr); +-err_mem: +- release_mem_region(rsrc_start, rsrc_len); ++err: + + return retval; + } +@@ -1899,9 +1894,6 @@ static int s3c2410_udc_remove(struct platform_device *pdev) + + free_irq(irq_usbd, udc); + +- iounmap(base_addr); +- release_mem_region(rsrc_start, rsrc_len); +- + if (!IS_ERR(udc_clock) && udc_clock != NULL) { + clk_disable_unprepare(udc_clock); + clk_put(udc_clock); +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-s3c-fix-the-error-handling-path-in-s3c241.patch b/queue-5.10/usb-gadget-s3c-fix-the-error-handling-path-in-s3c241.patch new file mode 100644 index 00000000000..d57c255de71 --- /dev/null +++ b/queue-5.10/usb-gadget-s3c-fix-the-error-handling-path-in-s3c241.patch @@ -0,0 +1,75 @@ +From 4c985de58b8ecc490931c01b9fc54ad25a81cd5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 08:38:53 +0100 +Subject: usb: gadget: s3c: Fix the error handling path in + 's3c2410_udc_probe()' + +From: Christophe JAILLET + +[ Upstream commit e5242861ec6a0bce25b4cd10af0fc8a508fd067d ] + +Some 'clk_prepare_enable()' and 'clk_get()' must be undone in the error +handling path of the probe function, as already done in the remove +function. + +Fixes: 3fc154b6b813 ("USB Gadget driver for Samsung s3c2410 ARM SoC") +Signed-off-by: Christophe JAILLET +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/2bee52e4ce968f48b4c32545cf8f3b2ab825ba82.1616830026.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/s3c2410_udc.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c +index b81979b3bdb6..b154b62abefa 100644 +--- a/drivers/usb/gadget/udc/s3c2410_udc.c ++++ b/drivers/usb/gadget/udc/s3c2410_udc.c +@@ -1750,7 +1750,8 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + udc_clock = clk_get(NULL, "usb-device"); + if (IS_ERR(udc_clock)) { + dev_err(dev, "failed to get udc clock source\n"); +- return PTR_ERR(udc_clock); ++ retval = PTR_ERR(udc_clock); ++ goto err_usb_bus_clk; + } + + clk_prepare_enable(udc_clock); +@@ -1773,7 +1774,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + base_addr = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base_addr)) { + retval = PTR_ERR(base_addr); +- goto err; ++ goto err_udc_clk; + } + + the_controller = udc; +@@ -1791,7 +1792,7 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + if (retval != 0) { + dev_err(dev, "cannot get irq %i, err %d\n", irq_usbd, retval); + retval = -EBUSY; +- goto err; ++ goto err_udc_clk; + } + + dev_dbg(dev, "got irq %i\n", irq_usbd); +@@ -1862,7 +1863,14 @@ err_gpio_claim: + gpio_free(udc_info->vbus_pin); + err_int: + free_irq(irq_usbd, udc); +-err: ++err_udc_clk: ++ clk_disable_unprepare(udc_clock); ++ clk_put(udc_clock); ++ udc_clock = NULL; ++err_usb_bus_clk: ++ clk_disable_unprepare(usb_bus_clock); ++ clk_put(usb_bus_clock); ++ usb_bus_clock = NULL; + + return retval; + } +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch b/queue-5.10/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch new file mode 100644 index 00000000000..c14e32bea90 --- /dev/null +++ b/queue-5.10/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch @@ -0,0 +1,40 @@ +From 234f526483bcba410d70eeca584953b6f8cf015b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 21:01:59 +0800 +Subject: USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() + +From: Yang Yingliang + +[ Upstream commit 2e3d055bf27d70204cae349335a62a4f9b7c165a ] + +IS_ERR() and PTR_ERR() use wrong pointer, it should be +udc->virt_addr, fix it. + +Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210330130159.1051979-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/snps_udc_plat.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c +index 32f1d3e90c26..99805d60a7ab 100644 +--- a/drivers/usb/gadget/udc/snps_udc_plat.c ++++ b/drivers/usb/gadget/udc/snps_udc_plat.c +@@ -114,8 +114,8 @@ static int udc_plat_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + udc->virt_addr = devm_ioremap_resource(dev, res); +- if (IS_ERR(udc->regs)) +- return PTR_ERR(udc->regs); ++ if (IS_ERR(udc->virt_addr)) ++ return PTR_ERR(udc->virt_addr); + + /* udc csr registers base */ + udc->csr = udc->virt_addr + UDC_CSR_ADDR; +-- +2.30.2 + diff --git a/queue-5.10/usb-typec-stusb160x-fix-return-value-check-in-stusb1.patch b/queue-5.10/usb-typec-stusb160x-fix-return-value-check-in-stusb1.patch new file mode 100644 index 00000000000..b94418d9842 --- /dev/null +++ b/queue-5.10/usb-typec-stusb160x-fix-return-value-check-in-stusb1.patch @@ -0,0 +1,43 @@ +From e718b565633dde7db0b5cca1a28949f848067171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 09:48:39 +0000 +Subject: usb: typec: stusb160x: fix return value check in stusb160x_probe() + +From: Wei Yongjun + +[ Upstream commit f2d90e07b5df2c7745ae66d2d48cc350d3f1c7d2 ] + +In case of error, the function device_get_named_child_node() returns +NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check +should be replaced with NULL test. + +Fixes: da0cb6310094 ("usb: typec: add support for STUSB160x Type-C controller family") +Reported-by: Hulk Robot +Reviewed-by: Heikki Krogerus +Reviewed-by: Amelie Delaunay +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210308094839.3586773-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/stusb160x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c +index d21750bbbb44..6eaeba9b096e 100644 +--- a/drivers/usb/typec/stusb160x.c ++++ b/drivers/usb/typec/stusb160x.c +@@ -682,8 +682,8 @@ static int stusb160x_probe(struct i2c_client *client) + } + + fwnode = device_get_named_child_node(chip->dev, "connector"); +- if (IS_ERR(fwnode)) +- return PTR_ERR(fwnode); ++ if (!fwnode) ++ return -ENODEV; + + /* + * When both VDD and VSYS power supplies are present, the low power +-- +2.30.2 + diff --git a/queue-5.10/usb-typec-tcpci-check-role_control-while-interpretin.patch b/queue-5.10/usb-typec-tcpci-check-role_control-while-interpretin.patch new file mode 100644 index 00000000000..64e45237c0a --- /dev/null +++ b/queue-5.10/usb-typec-tcpci-check-role_control-while-interpretin.patch @@ -0,0 +1,98 @@ +From f8aa2381a7450dd4f500c63822a9dc9bc71e0063 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 23:09:31 -0800 +Subject: usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS + +From: Badhri Jagan Sridharan + +[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ] + +While interpreting CC_STATUS, ROLE_CONTROL has to be read to make +sure that CC1/CC2 is not forced presenting Rp/Rd. + +>From the TCPCI spec: + +4.4.5.2 ROLE_CONTROL (Normative): +The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes +to control the Rp/Rd directly instead of having the TCPC perform +DRP toggling autonomously. When controlling Rp/Rd directly, the +TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the +CC1/CC2 values. This control is used for TCPM-TCPC implementing +Source or Sink only as well as when a connection has been detected +via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk. + +Table 4-22. CC_STATUS Register Definition: +If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1) +00b: SNK.Open (Below maximum vRa) +01b: SNK.Default (Above minimum vRd-Connect) +10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A +11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A + +If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1) +00b: SNK.Open (Below maximum vRa) +01b: SNK.Default (Above minimum vRd-Connect) +10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A +11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A + +Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)") +Acked-by: Heikki Krogerus +Signed-off-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20210304070931.1947316-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tcpm/tcpci.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index f9f0af64da5f..a06da1854c10 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -20,6 +20,15 @@ + + #define PD_RETRY_COUNT 3 + ++#define tcpc_presenting_cc1_rd(reg) \ ++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ ++ (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \ ++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT))) ++#define tcpc_presenting_cc2_rd(reg) \ ++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ ++ (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \ ++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT))) ++ + struct tcpci { + struct device *dev; + +@@ -174,19 +183,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc, + enum typec_cc_status *cc1, enum typec_cc_status *cc2) + { + struct tcpci *tcpci = tcpc_to_tcpci(tcpc); +- unsigned int reg; ++ unsigned int reg, role_control; + int ret; + ++ ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control); ++ if (ret < 0) ++ return ret; ++ + ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, ®); + if (ret < 0) + return ret; + + *cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) & + TCPC_CC_STATUS_CC1_MASK, +- reg & TCPC_CC_STATUS_TERM); ++ reg & TCPC_CC_STATUS_TERM || ++ tcpc_presenting_cc1_rd(role_control)); + *cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) & + TCPC_CC_STATUS_CC2_MASK, +- reg & TCPC_CC_STATUS_TERM); ++ reg & TCPC_CC_STATUS_TERM || ++ tcpc_presenting_cc2_rd(role_control)); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.10/usb-typec-tps6598x-fix-return-value-check-in-tps6598.patch b/queue-5.10/usb-typec-tps6598x-fix-return-value-check-in-tps6598.patch new file mode 100644 index 00000000000..07eff8361ba --- /dev/null +++ b/queue-5.10/usb-typec-tps6598x-fix-return-value-check-in-tps6598.patch @@ -0,0 +1,42 @@ +From 2dd56073979eeb3f1d46c925db44be50ebed1db6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 09:48:41 +0000 +Subject: usb: typec: tps6598x: Fix return value check in tps6598x_probe() + +From: Wei Yongjun + +[ Upstream commit 604c75893a01c8a3b5bd6dac55535963cd44c3f5 ] + +In case of error, the function device_get_named_child_node() returns +NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check +should be replaced with NULL test. + +Fixes: 18a6c866bb19 ("usb: typec: tps6598x: Add USB role switching logic") +Reported-by: Hulk Robot +Reviewed-by: Heikki Krogerus +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210308094841.3587751-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tps6598x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index d8e4594fe009..30bfc314b743 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -515,8 +515,8 @@ static int tps6598x_probe(struct i2c_client *client) + return ret; + + fwnode = device_get_named_child_node(&client->dev, "connector"); +- if (IS_ERR(fwnode)) +- return PTR_ERR(fwnode); ++ if (!fwnode) ++ return -ENODEV; + + tps->role_sw = fwnode_usb_role_switch_get(fwnode); + if (IS_ERR(tps->role_sw)) { +-- +2.30.2 + diff --git a/queue-5.10/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch b/queue-5.10/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch new file mode 100644 index 00000000000..427f7c991a8 --- /dev/null +++ b/queue-5.10/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch @@ -0,0 +1,45 @@ +From 593773df960893be5d17210d3d87a1c25e6448b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 19:23:05 +0800 +Subject: usbip: vudc: fix missing unlock on error in usbip_sockfd_store() + +From: Ye Bin + +[ Upstream commit 1d08ed588c6a85a35a24c82eb4cf0807ec2b366a ] + +Add the missing unlock before return from function usbip_sockfd_store() +in the error handling case. + +Fixes: bd8b82042269 ("usbip: vudc synchronize sysfs code paths") +Reported-by: Hulk Robot +Acked-by: Shuah Khan +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20210408112305.1022247-1-yebin10@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vudc_sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c +index f7633ee655a1..d1cf6b51bf85 100644 +--- a/drivers/usb/usbip/vudc_sysfs.c ++++ b/drivers/usb/usbip/vudc_sysfs.c +@@ -156,12 +156,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, + tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); ++ mutex_unlock(&udc->ud.sysfs_lock); + return -EINVAL; + } + tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); ++ mutex_unlock(&udc->ud.sysfs_lock); + return -EINVAL; + } + +-- +2.30.2 + diff --git a/queue-5.10/vfio-fsl-mc-re-order-vfio_fsl_mc_probe.patch b/queue-5.10/vfio-fsl-mc-re-order-vfio_fsl_mc_probe.patch new file mode 100644 index 00000000000..b2e67d78b98 --- /dev/null +++ b/queue-5.10/vfio-fsl-mc-re-order-vfio_fsl_mc_probe.patch @@ -0,0 +1,156 @@ +From 436d730cc2fb9741d4e916524c396acfac4da2ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 09:53:06 -0600 +Subject: vfio/fsl-mc: Re-order vfio_fsl_mc_probe() + +From: Jason Gunthorpe + +[ Upstream commit 2b1fe162e584a88ec7f12a651a2a50f94dd8cfac ] + +vfio_add_group_dev() must be called only after all of the private data in +vdev is fully setup and ready, otherwise there could be races with user +space instantiating a device file descriptor and starting to call ops. + +For instance vfio_fsl_mc_reflck_attach() sets vdev->reflck and +vfio_fsl_mc_open(), called by fops open, unconditionally derefs it, which +will crash if things get out of order. + +This driver started life with the right sequence, but two commits added +stuff after vfio_add_group_dev(). + +Fixes: 2e0d29561f59 ("vfio/fsl-mc: Add irq infrastructure for fsl-mc devices") +Fixes: f2ba7e8c947b ("vfio/fsl-mc: Added lock support in preparation for interrupt handling") +Co-developed-by: Diana Craciun OSS +Signed-off-by: Jason Gunthorpe +Message-Id: <5-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com> +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/fsl-mc/vfio_fsl_mc.c | 74 ++++++++++++++++++++----------- + 1 file changed, 47 insertions(+), 27 deletions(-) + +diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c +index f27e25112c40..8722f5effacd 100644 +--- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c ++++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c +@@ -568,23 +568,39 @@ static int vfio_fsl_mc_init_device(struct vfio_fsl_mc_device *vdev) + dev_err(&mc_dev->dev, "VFIO_FSL_MC: Failed to setup DPRC (%d)\n", ret); + goto out_nc_unreg; + } ++ return 0; ++ ++out_nc_unreg: ++ bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); ++ return ret; ++} + ++static int vfio_fsl_mc_scan_container(struct fsl_mc_device *mc_dev) ++{ ++ int ret; ++ ++ /* non dprc devices do not scan for other devices */ ++ if (!is_fsl_mc_bus_dprc(mc_dev)) ++ return 0; + ret = dprc_scan_container(mc_dev, false); + if (ret) { +- dev_err(&mc_dev->dev, "VFIO_FSL_MC: Container scanning failed (%d)\n", ret); +- goto out_dprc_cleanup; ++ dev_err(&mc_dev->dev, ++ "VFIO_FSL_MC: Container scanning failed (%d)\n", ret); ++ dprc_remove_devices(mc_dev, NULL, 0); ++ return ret; + } +- + return 0; ++} ++ ++static void vfio_fsl_uninit_device(struct vfio_fsl_mc_device *vdev) ++{ ++ struct fsl_mc_device *mc_dev = vdev->mc_dev; ++ ++ if (!is_fsl_mc_bus_dprc(mc_dev)) ++ return; + +-out_dprc_cleanup: +- dprc_remove_devices(mc_dev, NULL, 0); + dprc_cleanup(mc_dev); +-out_nc_unreg: + bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); +- vdev->nb.notifier_call = NULL; +- +- return ret; + } + + static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev) +@@ -607,29 +623,39 @@ static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev) + } + + vdev->mc_dev = mc_dev; +- +- ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev); +- if (ret) { +- dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n"); +- goto out_group_put; +- } ++ mutex_init(&vdev->igate); + + ret = vfio_fsl_mc_reflck_attach(vdev); + if (ret) +- goto out_group_dev; ++ goto out_group_put; + + ret = vfio_fsl_mc_init_device(vdev); + if (ret) + goto out_reflck; + +- mutex_init(&vdev->igate); ++ ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev); ++ if (ret) { ++ dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n"); ++ goto out_device; ++ } + ++ /* ++ * This triggers recursion into vfio_fsl_mc_probe() on another device ++ * and the vfio_fsl_mc_reflck_attach() must succeed, which relies on the ++ * vfio_add_group_dev() above. It has no impact on this vdev, so it is ++ * safe to be after the vfio device is made live. ++ */ ++ ret = vfio_fsl_mc_scan_container(mc_dev); ++ if (ret) ++ goto out_group_dev; + return 0; + +-out_reflck: +- vfio_fsl_mc_reflck_put(vdev->reflck); + out_group_dev: + vfio_del_group_dev(dev); ++out_device: ++ vfio_fsl_uninit_device(vdev); ++out_reflck: ++ vfio_fsl_mc_reflck_put(vdev->reflck); + out_group_put: + vfio_iommu_group_put(group, dev); + return ret; +@@ -646,16 +672,10 @@ static int vfio_fsl_mc_remove(struct fsl_mc_device *mc_dev) + + mutex_destroy(&vdev->igate); + ++ dprc_remove_devices(mc_dev, NULL, 0); ++ vfio_fsl_uninit_device(vdev); + vfio_fsl_mc_reflck_put(vdev->reflck); + +- if (is_fsl_mc_bus_dprc(mc_dev)) { +- dprc_remove_devices(mc_dev, NULL, 0); +- dprc_cleanup(mc_dev); +- } +- +- if (vdev->nb.notifier_call) +- bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); +- + vfio_iommu_group_put(mc_dev->dev.iommu_group, dev); + + return 0; +-- +2.30.2 + diff --git a/queue-5.10/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch b/queue-5.10/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch new file mode 100644 index 00000000000..50446e1b1c3 --- /dev/null +++ b/queue-5.10/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch @@ -0,0 +1,56 @@ +From 915190a02a917a350ed34cbd1a4abedf935076d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 16:40:25 -0300 +Subject: vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer + +From: Jason Gunthorpe + +[ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ] + +There is a small race where the parent is NULL even though the kobj has +already been made visible in sysfs. + +For instance the attribute_group is made visible in sysfs_create_files() +and the mdev_type_attr_show() does: + + ret = attr->show(kobj, type->parent->dev, buf); + +Which will crash on NULL parent. Move the parent setup to before the type +pointer leaves the stack frame. + +Fixes: 7b96953bc640 ("vfio: Mediated device Core driver") +Reviewed-by: Christoph Hellwig +Reviewed-by: Kevin Tian +Reviewed-by: Max Gurtovoy +Reviewed-by: Cornelia Huck +Signed-off-by: Jason Gunthorpe +Message-Id: <2-v2-d36939638fc6+d54-vfio2_jgg@nvidia.com> +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/mdev/mdev_sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c +index 917fd84c1c6f..367ff5412a38 100644 +--- a/drivers/vfio/mdev/mdev_sysfs.c ++++ b/drivers/vfio/mdev/mdev_sysfs.c +@@ -105,6 +105,7 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, + return ERR_PTR(-ENOMEM); + + type->kobj.kset = parent->mdev_types_kset; ++ type->parent = parent; + + ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL, + "%s-%s", dev_driver_string(parent->dev), +@@ -132,7 +133,6 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, + } + + type->group = group; +- type->parent = parent; + return type; + + attrs_failed: +-- +2.30.2 + diff --git a/queue-5.10/vfio-pci-move-vga-and-vf-initialization-to-functions.patch b/queue-5.10/vfio-pci-move-vga-and-vf-initialization-to-functions.patch new file mode 100644 index 00000000000..295b0fae7c6 --- /dev/null +++ b/queue-5.10/vfio-pci-move-vga-and-vf-initialization-to-functions.patch @@ -0,0 +1,195 @@ +From 57042d0d7126cbafeffe5b23f6769cc0cf97fe6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 09:53:06 -0600 +Subject: vfio/pci: Move VGA and VF initialization to functions + +From: Jason Gunthorpe + +[ Upstream commit 61e90817482871b614133c0f20feb1aba2faec86 ] + +vfio_pci_probe() is quite complicated, with optional VF and VGA sub +components. Move these into clear init/uninit functions and have a linear +flow in probe/remove. + +This fixes a few little buglets: + - vfio_pci_remove() is in the wrong order, vga_client_register() removes + a notifier and is after kfree(vdev), but the notifier refers to vdev, + so it can use after free in a race. + - vga_client_register() can fail but was ignored + +Organize things so destruction order is the reverse of creation order. + +Fixes: ecaa1f6a0154 ("vfio-pci: Add VGA arbiter client") +Reviewed-by: Christoph Hellwig +Reviewed-by: Kevin Tian +Reviewed-by: Max Gurtovoy +Reviewed-by: Cornelia Huck +Reviewed-by: Eric Auger +Signed-off-by: Jason Gunthorpe +Message-Id: <7-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com> +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 116 +++++++++++++++++++++++------------- + 1 file changed, 74 insertions(+), 42 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 465f646e3329..f31aa25f361c 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -1926,6 +1926,68 @@ static int vfio_pci_bus_notifier(struct notifier_block *nb, + return 0; + } + ++static int vfio_pci_vf_init(struct vfio_pci_device *vdev) ++{ ++ struct pci_dev *pdev = vdev->pdev; ++ int ret; ++ ++ if (!pdev->is_physfn) ++ return 0; ++ ++ vdev->vf_token = kzalloc(sizeof(*vdev->vf_token), GFP_KERNEL); ++ if (!vdev->vf_token) ++ return -ENOMEM; ++ ++ mutex_init(&vdev->vf_token->lock); ++ uuid_gen(&vdev->vf_token->uuid); ++ ++ vdev->nb.notifier_call = vfio_pci_bus_notifier; ++ ret = bus_register_notifier(&pci_bus_type, &vdev->nb); ++ if (ret) { ++ kfree(vdev->vf_token); ++ return ret; ++ } ++ return 0; ++} ++ ++static void vfio_pci_vf_uninit(struct vfio_pci_device *vdev) ++{ ++ if (!vdev->vf_token) ++ return; ++ ++ bus_unregister_notifier(&pci_bus_type, &vdev->nb); ++ WARN_ON(vdev->vf_token->users); ++ mutex_destroy(&vdev->vf_token->lock); ++ kfree(vdev->vf_token); ++} ++ ++static int vfio_pci_vga_init(struct vfio_pci_device *vdev) ++{ ++ struct pci_dev *pdev = vdev->pdev; ++ int ret; ++ ++ if (!vfio_pci_is_vga(pdev)) ++ return 0; ++ ++ ret = vga_client_register(pdev, vdev, NULL, vfio_pci_set_vga_decode); ++ if (ret) ++ return ret; ++ vga_set_legacy_decoding(pdev, vfio_pci_set_vga_decode(vdev, false)); ++ return 0; ++} ++ ++static void vfio_pci_vga_uninit(struct vfio_pci_device *vdev) ++{ ++ struct pci_dev *pdev = vdev->pdev; ++ ++ if (!vfio_pci_is_vga(pdev)) ++ return; ++ vga_client_register(pdev, NULL, NULL, NULL); ++ vga_set_legacy_decoding(pdev, VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM | ++ VGA_RSRC_LEGACY_IO | ++ VGA_RSRC_LEGACY_MEM); ++} ++ + static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { + struct vfio_pci_device *vdev; +@@ -1979,28 +2041,12 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + ret = vfio_pci_reflck_attach(vdev); + if (ret) + goto out_del_group_dev; +- +- if (pdev->is_physfn) { +- vdev->vf_token = kzalloc(sizeof(*vdev->vf_token), GFP_KERNEL); +- if (!vdev->vf_token) { +- ret = -ENOMEM; +- goto out_reflck; +- } +- +- mutex_init(&vdev->vf_token->lock); +- uuid_gen(&vdev->vf_token->uuid); +- +- vdev->nb.notifier_call = vfio_pci_bus_notifier; +- ret = bus_register_notifier(&pci_bus_type, &vdev->nb); +- if (ret) +- goto out_vf_token; +- } +- +- if (vfio_pci_is_vga(pdev)) { +- vga_client_register(pdev, vdev, NULL, vfio_pci_set_vga_decode); +- vga_set_legacy_decoding(pdev, +- vfio_pci_set_vga_decode(vdev, false)); +- } ++ ret = vfio_pci_vf_init(vdev); ++ if (ret) ++ goto out_reflck; ++ ret = vfio_pci_vga_init(vdev); ++ if (ret) ++ goto out_vf; + + vfio_pci_probe_power_state(vdev); + +@@ -2020,8 +2066,8 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + return ret; + +-out_vf_token: +- kfree(vdev->vf_token); ++out_vf: ++ vfio_pci_vf_uninit(vdev); + out_reflck: + vfio_pci_reflck_put(vdev->reflck); + out_del_group_dev: +@@ -2043,33 +2089,19 @@ static void vfio_pci_remove(struct pci_dev *pdev) + if (!vdev) + return; + +- if (vdev->vf_token) { +- WARN_ON(vdev->vf_token->users); +- mutex_destroy(&vdev->vf_token->lock); +- kfree(vdev->vf_token); +- } +- +- if (vdev->nb.notifier_call) +- bus_unregister_notifier(&pci_bus_type, &vdev->nb); +- ++ vfio_pci_vf_uninit(vdev); + vfio_pci_reflck_put(vdev->reflck); ++ vfio_pci_vga_uninit(vdev); + + vfio_iommu_group_put(pdev->dev.iommu_group, &pdev->dev); +- kfree(vdev->region); +- mutex_destroy(&vdev->ioeventfds_lock); + + if (!disable_idle_d3) + vfio_pci_set_power_state(vdev, PCI_D0); + ++ mutex_destroy(&vdev->ioeventfds_lock); ++ kfree(vdev->region); + kfree(vdev->pm_save); + kfree(vdev); +- +- if (vfio_pci_is_vga(pdev)) { +- vga_client_register(pdev, NULL, NULL, NULL); +- vga_set_legacy_decoding(pdev, +- VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM | +- VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM); +- } + } + + static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, +-- +2.30.2 + diff --git a/queue-5.10/vfio-pci-re-order-vfio_pci_probe.patch b/queue-5.10/vfio-pci-re-order-vfio_pci_probe.patch new file mode 100644 index 00000000000..d4d865ef487 --- /dev/null +++ b/queue-5.10/vfio-pci-re-order-vfio_pci_probe.patch @@ -0,0 +1,80 @@ +From 9d778edb6d18d6e19991c1151f56784b556b3750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 09:53:06 -0600 +Subject: vfio/pci: Re-order vfio_pci_probe() + +From: Jason Gunthorpe + +[ Upstream commit 4aeec3984ddc853f7c65903bde472ffdef738bae ] + +vfio_add_group_dev() must be called only after all of the private data in +vdev is fully setup and ready, otherwise there could be races with user +space instantiating a device file descriptor and starting to call ops. + +For instance vfio_pci_reflck_attach() sets vdev->reflck and +vfio_pci_open(), called by fops open, unconditionally derefs it, which +will crash if things get out of order. + +Fixes: cc20d7999000 ("vfio/pci: Introduce VF token") +Fixes: e309df5b0c9e ("vfio/pci: Parallelize device open and release") +Fixes: 6eb7018705de ("vfio-pci: Move idle devices to D3hot power state") +Fixes: ecaa1f6a0154 ("vfio-pci: Add VGA arbiter client") +Reviewed-by: Christoph Hellwig +Reviewed-by: Max Gurtovoy +Reviewed-by: Kevin Tian +Reviewed-by: Cornelia Huck +Reviewed-by: Eric Auger +Signed-off-by: Jason Gunthorpe +Message-Id: <8-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com> +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index f31aa25f361c..48b048edf1ee 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -2034,13 +2034,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + INIT_LIST_HEAD(&vdev->vma_list); + init_rwsem(&vdev->memory_lock); + +- ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev); +- if (ret) +- goto out_free; +- + ret = vfio_pci_reflck_attach(vdev); + if (ret) +- goto out_del_group_dev; ++ goto out_free; + ret = vfio_pci_vf_init(vdev); + if (ret) + goto out_reflck; +@@ -2064,15 +2060,20 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + vfio_pci_set_power_state(vdev, PCI_D3hot); + } + +- return ret; ++ ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev); ++ if (ret) ++ goto out_power; ++ return 0; + ++out_power: ++ if (!disable_idle_d3) ++ vfio_pci_set_power_state(vdev, PCI_D0); + out_vf: + vfio_pci_vf_uninit(vdev); + out_reflck: + vfio_pci_reflck_put(vdev->reflck); +-out_del_group_dev: +- vfio_del_group_dev(&pdev->dev); + out_free: ++ kfree(vdev->pm_save); + kfree(vdev); + out_group_put: + vfio_iommu_group_put(group, &pdev->dev); +-- +2.30.2 + diff --git a/queue-5.10/vsock-virtio-free-queued-packets-when-closing-socket.patch b/queue-5.10/vsock-virtio-free-queued-packets-when-closing-socket.patch new file mode 100644 index 00000000000..b12c658eae0 --- /dev/null +++ b/queue-5.10/vsock-virtio-free-queued-packets-when-closing-socket.patch @@ -0,0 +1,94 @@ +From 80827d3b2ffe3a9a14cf02843410331a76c474c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 13:07:27 +0200 +Subject: vsock/virtio: free queued packets when closing socket + +From: Stefano Garzarella + +[ Upstream commit 8432b8114957235f42e070a16118a7f750de9d39 ] + +As reported by syzbot [1], there is a memory leak while closing the +socket. We partially solved this issue with commit ac03046ece2b +("vsock/virtio: free packets during the socket release"), but we +forgot to drain the RX queue when the socket is definitely closed by +the scheduled work. + +To avoid future issues, let's use the new virtio_transport_remove_sock() +to drain the RX queue before removing the socket from the af_vsock lists +calling vsock_remove_sock(). + +[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9 + +Fixes: ac03046ece2b ("vsock/virtio: free packets during the socket release") +Reported-and-tested-by: syzbot+24452624fc4c571eedd9@syzkaller.appspotmail.com +Signed-off-by: Stefano Garzarella +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/virtio_transport_common.c | 28 +++++++++++++++++-------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index e4370b1b7494..902cb6dd710b 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -733,6 +733,23 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, + return t->send_pkt(reply); + } + ++/* This function should be called with sk_lock held and SOCK_DONE set */ ++static void virtio_transport_remove_sock(struct vsock_sock *vsk) ++{ ++ struct virtio_vsock_sock *vvs = vsk->trans; ++ struct virtio_vsock_pkt *pkt, *tmp; ++ ++ /* We don't need to take rx_lock, as the socket is closing and we are ++ * removing it. ++ */ ++ list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { ++ list_del(&pkt->list); ++ virtio_transport_free_pkt(pkt); ++ } ++ ++ vsock_remove_sock(vsk); ++} ++ + static void virtio_transport_wait_close(struct sock *sk, long timeout) + { + if (timeout) { +@@ -765,7 +782,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, + (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { + vsk->close_work_scheduled = false; + +- vsock_remove_sock(vsk); ++ virtio_transport_remove_sock(vsk); + + /* Release refcnt obtained when we scheduled the timeout */ + sock_put(sk); +@@ -828,22 +845,15 @@ static bool virtio_transport_close(struct vsock_sock *vsk) + + void virtio_transport_release(struct vsock_sock *vsk) + { +- struct virtio_vsock_sock *vvs = vsk->trans; +- struct virtio_vsock_pkt *pkt, *tmp; + struct sock *sk = &vsk->sk; + bool remove_sock = true; + + if (sk->sk_type == SOCK_STREAM) + remove_sock = virtio_transport_close(vsk); + +- list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) { +- list_del(&pkt->list); +- virtio_transport_free_pkt(pkt); +- } +- + if (remove_sock) { + sock_set_flag(sk, SOCK_DONE); +- vsock_remove_sock(vsk); ++ virtio_transport_remove_sock(vsk); + } + } + EXPORT_SYMBOL_GPL(virtio_transport_release); +-- +2.30.2 + diff --git a/queue-5.10/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch b/queue-5.10/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch new file mode 100644 index 00000000000..42294f5c2ea --- /dev/null +++ b/queue-5.10/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch @@ -0,0 +1,50 @@ +From 7358b167b5930904a6c82aa5bde0c110d31c508f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 12:44:16 +0200 +Subject: vsock/vmci: log once the failed queue pair allocation + +From: Stefano Garzarella + +[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ] + +VMCI feature is not supported in conjunction with the vSphere Fault +Tolerance (FT) feature. + +VMware Tools can repeatedly try to create a vsock connection. If FT is +enabled the kernel logs is flooded with the following messages: + + qp_alloc_hypercall result = -20 + Could not attach to queue pair with -20 + +"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 +("VMCI: Stop log spew when qp allocation isn't possible"), but "Could +not attach to queue pair with -20" is still there flooding the log. + +Since the error message can be useful in some cases, print it only once. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: Stefano Garzarella +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 8b65323207db..1c9ecb18b8e6 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -568,8 +568,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, + peer, flags, VMCI_NO_PRIVILEGE_FLAGS); + out: + if (err < 0) { +- pr_err("Could not attach to queue pair with %d\n", +- err); ++ pr_err_once("Could not attach to queue pair with %d\n", err); + err = vmci_transport_error_to_vsock_error(err); + } + +-- +2.30.2 + diff --git a/queue-5.10/wilc1000-write-value-to-wilc_intr2_enable-register.patch b/queue-5.10/wilc1000-write-value-to-wilc_intr2_enable-register.patch new file mode 100644 index 00000000000..3c9d74efd6d --- /dev/null +++ b/queue-5.10/wilc1000-write-value-to-wilc_intr2_enable-register.patch @@ -0,0 +1,36 @@ +From fb01719b094a210876bea5d5e0b6cef4893cba77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 17:37:06 +0100 +Subject: wilc1000: write value to WILC_INTR2_ENABLE register + +From: Marcus Folkesson + +[ Upstream commit e21b6e5a54628cd3935f200049d4430c25c54e03 ] + +Write the value instead of reading it twice. + +Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") +Signed-off-by: Marcus Folkesson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210224163706.519658-1-marcus.folkesson@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/sdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/sdio.c b/drivers/net/wireless/microchip/wilc1000/sdio.c +index 351ff909ab1c..e14b9fc2c67a 100644 +--- a/drivers/net/wireless/microchip/wilc1000/sdio.c ++++ b/drivers/net/wireless/microchip/wilc1000/sdio.c +@@ -947,7 +947,7 @@ static int wilc_sdio_sync_ext(struct wilc *wilc, int nint) + for (i = 0; (i < 3) && (nint > 0); i++, nint--) + reg |= BIT(i); + +- ret = wilc_sdio_read_reg(wilc, WILC_INTR2_ENABLE, ®); ++ ret = wilc_sdio_write_reg(wilc, WILC_INTR2_ENABLE, reg); + if (ret) { + dev_err(&func->dev, + "Failed write reg (%08x)...\n", +-- +2.30.2 + diff --git a/queue-5.10/wlcore-fix-buffer-overrun-by-snprintf-due-to-incorre.patch b/queue-5.10/wlcore-fix-buffer-overrun-by-snprintf-due-to-incorre.patch new file mode 100644 index 00000000000..aa5fa3cd649 --- /dev/null +++ b/queue-5.10/wlcore-fix-buffer-overrun-by-snprintf-due-to-incorre.patch @@ -0,0 +1,41 @@ +From 9f067d54931325ade2e0521bdcd16550706faa65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 15:14:05 +0100 +Subject: wlcore: Fix buffer overrun by snprintf due to incorrect buffer size + +From: Colin Ian King + +[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ] + +The size of the buffer than can be written to is currently incorrect, it is +always the size of the entire buffer even though the snprintf is writing +as position pos into the buffer. Fix this by setting the buffer size to be +the number of bytes left in the buffer, namely sizeof(buf) - pos. + +Addresses-Coverity: ("Out-of-bounds access") +Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs") +Signed-off-by: Colin Ian King +Reviewed-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210419141405.180582-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/debugfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h +index 715edfa5f89f..a9e13e6d65c5 100644 +--- a/drivers/net/wireless/ti/wlcore/debugfs.h ++++ b/drivers/net/wireless/ti/wlcore/debugfs.h +@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file, \ + wl1271_debugfs_update_stats(wl); \ + \ + for (i = 0; i < len && pos < sizeof(buf); i++) \ +- pos += snprintf(buf + pos, sizeof(buf), \ ++ pos += snprintf(buf + pos, sizeof(buf) - pos, \ + "[%d] = %d\n", i, stats->sub.name[i]); \ + \ + return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \ +-- +2.30.2 + diff --git a/queue-5.10/wlcore-fix-overlapping-snprintf-arguments-in-debugfs.patch b/queue-5.10/wlcore-fix-overlapping-snprintf-arguments-in-debugfs.patch new file mode 100644 index 00000000000..dd3838eede6 --- /dev/null +++ b/queue-5.10/wlcore-fix-overlapping-snprintf-arguments-in-debugfs.patch @@ -0,0 +1,96 @@ +From 1a39af2eb9133590901101fcf65f8a7389746502 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 13:57:14 +0100 +Subject: wlcore: fix overlapping snprintf arguments in debugfs + +From: Arnd Bergmann + +[ Upstream commit 7b0e2c4f6be3ec68bf807c84e985e81c21404cd1 ] + +gcc complains about undefined behavior in calling snprintf() +with the same buffer as input and output: + +drivers/net/wireless/ti/wl18xx/debugfs.c: In function 'diversity_num_of_packets_per_ant_read': +drivers/net/wireless/ti/wl18xx/../wlcore/debugfs.h:86:3: error: 'snprintf' argument 4 overlaps destination object 'buf' [-Werror=restrict] + 86 | snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 87 | buf, i, stats->sub.name[i]); \ + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/wireless/ti/wl18xx/debugfs.c:24:2: note: in expansion of macro 'DEBUGFS_FWSTATS_FILE_ARRAY' + 24 | DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/wireless/ti/wl18xx/debugfs.c:159:1: note: in expansion of macro 'WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY' + 159 | WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(diversity, num_of_packets_per_ant, + +There are probably other ways of handling the debugfs file, without +using on-stack buffers, but a simple workaround here is to remember the +current position in the buffer and just keep printing in there. + +Fixes: bcca1bbdd412 ("wlcore: add debugfs macro to help print fw statistics arrays") +Signed-off-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210323125723.1961432-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/boot.c | 13 ++++++++----- + drivers/net/wireless/ti/wlcore/debugfs.h | 7 ++++--- + 2 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c +index e14d88e558f0..85abd0a2d1c9 100644 +--- a/drivers/net/wireless/ti/wlcore/boot.c ++++ b/drivers/net/wireless/ti/wlcore/boot.c +@@ -72,6 +72,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl) + unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_MULTI) ? + wl->min_mr_fw_ver : wl->min_sr_fw_ver; + char min_fw_str[32] = ""; ++ int off = 0; + int i; + + /* the chip must be exactly equal */ +@@ -105,13 +106,15 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl) + return 0; + + fail: +- for (i = 0; i < NUM_FW_VER; i++) ++ for (i = 0; i < NUM_FW_VER && off < sizeof(min_fw_str); i++) + if (min_ver[i] == WLCORE_FW_VER_IGNORE) +- snprintf(min_fw_str, sizeof(min_fw_str), +- "%s*.", min_fw_str); ++ off += snprintf(min_fw_str + off, ++ sizeof(min_fw_str) - off, ++ "*."); + else +- snprintf(min_fw_str, sizeof(min_fw_str), +- "%s%u.", min_fw_str, min_ver[i]); ++ off += snprintf(min_fw_str + off, ++ sizeof(min_fw_str) - off, ++ "%u.", min_ver[i]); + + wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n" + "Please use at least FW %s\n" +diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h +index b143293e694f..715edfa5f89f 100644 +--- a/drivers/net/wireless/ti/wlcore/debugfs.h ++++ b/drivers/net/wireless/ti/wlcore/debugfs.h +@@ -78,13 +78,14 @@ static ssize_t sub## _ ##name## _read(struct file *file, \ + struct wl1271 *wl = file->private_data; \ + struct struct_type *stats = wl->stats.fw_stats; \ + char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = ""; \ ++ int pos = 0; \ + int i; \ + \ + wl1271_debugfs_update_stats(wl); \ + \ +- for (i = 0; i < len; i++) \ +- snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ +- buf, i, stats->sub.name[i]); \ ++ for (i = 0; i < len && pos < sizeof(buf); i++) \ ++ pos += snprintf(buf + pos, sizeof(buf), \ ++ "[%d] = %d\n", i, stats->sub.name[i]); \ + \ + return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \ + } \ +-- +2.30.2 + diff --git a/queue-5.10/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch b/queue-5.10/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch new file mode 100644 index 00000000000..4cf5c8a85db --- /dev/null +++ b/queue-5.10/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch @@ -0,0 +1,55 @@ +From c693ab0dcff1c0130412fea7d28bece107a5858b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 17:11:11 -0700 +Subject: x86/events/amd/iommu: Fix sysfs type mismatch + +From: Nathan Chancellor + +[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ] + +dev_attr_show() calls _iommu_event_show() via an indirect call but +_iommu_event_show()'s type does not currently match the type of the +show() member in 'struct device_attribute', resulting in a Control Flow +Integrity violation. + +$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit +csource=0x0a + +$ dmesg | grep "CFI failure" +[ 3526.735140] CFI failure (target: _iommu_event_show...): + +Change _iommu_event_show() and 'struct amd_iommu_event_desc' to +'struct device_attribute' so that there is no more CFI violation. + +Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation") +Signed-off-by: Nathan Chancellor +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/iommu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c +index be50ef8572cc..6a98a7651621 100644 +--- a/arch/x86/events/amd/iommu.c ++++ b/arch/x86/events/amd/iommu.c +@@ -81,12 +81,12 @@ static struct attribute_group amd_iommu_events_group = { + }; + + struct amd_iommu_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *event; + }; + +-static ssize_t _iommu_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++static ssize_t _iommu_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct amd_iommu_event_desc *event = + container_of(attr, struct amd_iommu_event_desc, attr); +-- +2.30.2 + diff --git a/queue-5.10/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch b/queue-5.10/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch new file mode 100644 index 00000000000..751d8b2edf7 --- /dev/null +++ b/queue-5.10/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch @@ -0,0 +1,73 @@ +From dd52d0b3271733b7ac7854c545abdb4931f386a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 19:08:31 +0900 +Subject: x86/kprobes: Fix to check non boostable prefixes correctly + +From: Masami Hiramatsu + +[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ] + +There are 2 bugs in the can_boost() function because of using +x86 insn decoder. Since the insn->opcode never has a prefix byte, +it can not find CS override prefix in it. And the insn->attr is +the attribute of the opcode, thus inat_is_address_size_prefix( +insn->attr) always returns false. + +Fix those by checking each prefix bytes with for_each_insn_prefix +loop and getting the correct attribute for each prefix byte. +Also, this removes unlikely, because this is a slow path. + +Fixes: a8d11cd0714f ("kprobes/x86: Consolidate insn decoder users for copying code") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/161666691162.1120877.2808435205294352583.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kprobes/core.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 39f7d8c3c064..535da74c124e 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -159,6 +159,8 @@ NOKPROBE_SYMBOL(skip_prefixes); + int can_boost(struct insn *insn, void *addr) + { + kprobe_opcode_t opcode; ++ insn_byte_t prefix; ++ int i; + + if (search_exception_tables((unsigned long)addr)) + return 0; /* Page fault may occur on this address. */ +@@ -171,9 +173,14 @@ int can_boost(struct insn *insn, void *addr) + if (insn->opcode.nbytes != 1) + return 0; + +- /* Can't boost Address-size override prefix */ +- if (unlikely(inat_is_address_size_prefix(insn->attr))) +- return 0; ++ for_each_insn_prefix(insn, i, prefix) { ++ insn_attr_t attr; ++ ++ attr = inat_get_opcode_attribute(prefix); ++ /* Can't boost Address-size override prefix and CS override prefix */ ++ if (prefix == 0x2e || inat_is_address_size_prefix(attr)) ++ return 0; ++ } + + opcode = insn->opcode.bytes[0]; + +@@ -198,8 +205,8 @@ int can_boost(struct insn *insn, void *addr) + /* clear and set flags are boostable */ + return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe)); + default: +- /* CS override prefix and call are not boostable */ +- return (opcode != 0x2e && opcode != 0x9a); ++ /* call is not boostable */ ++ return opcode != 0x9a; + } + } + +-- +2.30.2 + diff --git a/queue-5.10/x86-microcode-check-for-offline-cpus-before-requesti.patch b/queue-5.10/x86-microcode-check-for-offline-cpus-before-requesti.patch new file mode 100644 index 00000000000..03c23cddad8 --- /dev/null +++ b/queue-5.10/x86-microcode-check-for-offline-cpus-before-requesti.patch @@ -0,0 +1,90 @@ +From a8c6bcb5a805dc46593ba7e0a74822cb554bd631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 09:55:15 -0700 +Subject: x86/microcode: Check for offline CPUs before requesting new microcode + +From: Otavio Pontes + +[ Upstream commit 7189b3c11903667808029ec9766a6e96de5012a5 ] + +Currently, the late microcode loading mechanism checks whether any CPUs +are offlined, and, in such a case, aborts the load attempt. + +However, this must be done before the kernel caches new microcode from +the filesystem. Otherwise, when offlined CPUs are onlined later, those +cores are going to be updated through the CPU hotplug notifier callback +with the new microcode, while CPUs previously onine will continue to run +with the older microcode. + +For example: + +Turn off one core (2 threads): + + echo 0 > /sys/devices/system/cpu/cpu3/online + echo 0 > /sys/devices/system/cpu/cpu1/online + +Install the ucode fails because a primary SMT thread is offline: + + cp intel-ucode/06-8e-09 /lib/firmware/intel-ucode/ + echo 1 > /sys/devices/system/cpu/microcode/reload + bash: echo: write error: Invalid argument + +Turn the core back on + + echo 1 > /sys/devices/system/cpu/cpu3/online + echo 1 > /sys/devices/system/cpu/cpu1/online + cat /proc/cpuinfo |grep microcode + microcode : 0x30 + microcode : 0xde + microcode : 0x30 + microcode : 0xde + +The rationale for why the update is aborted when at least one primary +thread is offline is because even if that thread is soft-offlined +and idle, it will still have to participate in broadcasted MCE's +synchronization dance or enter SMM, and in both examples it will execute +instructions so it better have the same microcode revision as the other +cores. + + [ bp: Heavily edit and extend commit message with the reasoning behind all + this. ] + +Fixes: 30ec26da9967 ("x86/microcode: Do not upload microcode if CPUs are offline") +Signed-off-by: Otavio Pontes +Signed-off-by: Borislav Petkov +Reviewed-by: Tony Luck +Acked-by: Ashok Raj +Link: https://lkml.kernel.org/r/20210319165515.9240-2-otavio.pontes@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/microcode/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index ec6f0415bc6d..bbbd248fe913 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -629,16 +629,16 @@ static ssize_t reload_store(struct device *dev, + if (val != 1) + return size; + +- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); +- if (tmp_ret != UCODE_NEW) +- return size; +- + get_online_cpus(); + + ret = check_online_cpus(); + if (ret) + goto put; + ++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); ++ if (tmp_ret != UCODE_NEW) ++ goto put; ++ + mutex_lock(µcode_mutex); + ret = microcode_reload_late(); + mutex_unlock(µcode_mutex); +-- +2.30.2 + diff --git a/queue-5.10/x86-platform-uv-fix-kexec-build-failure.patch b/queue-5.10/x86-platform-uv-fix-kexec-build-failure.patch new file mode 100644 index 00000000000..0fdc83c8250 --- /dev/null +++ b/queue-5.10/x86-platform-uv-fix-kexec-build-failure.patch @@ -0,0 +1,64 @@ +From 4604f43b9c0be3a4a0f162cf2c1a761128eb77ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 09:47:42 +0200 +Subject: x86/platform/uv: Fix !KEXEC build failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ingo Molnar + +[ Upstream commit c2209ea55612efac75de0a58ef5f7394fae7fa0f ] + +When KEXEC is disabled, the UV build fails: + + arch/x86/platform/uv/uv_nmi.c:875:14: error: ‘uv_nmi_kexec_failed’ undeclared (first use in this function) + +Since uv_nmi_kexec_failed is only defined in the KEXEC_CORE #ifdef branch, +this code cannot ever have been build tested: + + if (main) + pr_err("UV: NMI kdump: KEXEC not supported in this kernel\n"); + atomic_set(&uv_nmi_kexec_failed, 1); + +Nor is this use possible in uv_handle_nmi(): + + atomic_set(&uv_nmi_kexec_failed, 0); + +These bugs were introduced in this commit: + + d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails") + +Which added the uv_nmi_kexec_failed assignments to !KEXEC code, while making the +definition KEXEC-only - apparently without testing the !KEXEC case. + +Instead of complicating the #ifdef maze, simplify the code by requiring X86_UV +to depend on KEXEC_CORE. This pattern is present in other architectures as well. + +( We'll remove the untested, 7 years old !KEXEC complications from the file in a + separate commit. ) + +Fixes: d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails") +Signed-off-by: Ingo Molnar +Cc: Mike Travis +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 183ee73d9019..f3c8a8110f60 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -562,6 +562,7 @@ config X86_UV + depends on X86_EXTENDED_PLATFORM + depends on NUMA + depends on EFI ++ depends on KEXEC_CORE + depends on X86_X2APIC + depends on PCI + help +-- +2.30.2 + diff --git a/queue-5.10/x86-platform-uv-set-section-block-size-for-hubless-a.patch b/queue-5.10/x86-platform-uv-set-section-block-size-for-hubless-a.patch new file mode 100644 index 00000000000..1f161f1006d --- /dev/null +++ b/queue-5.10/x86-platform-uv-set-section-block-size-for-hubless-a.patch @@ -0,0 +1,49 @@ +From de734ca1a330e2be9718aa8b878facf4342620ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Mar 2021 10:28:53 -0600 +Subject: x86/platform/uv: Set section block size for hubless architectures + +From: Mike Travis + +[ Upstream commit 6840a150b9daf35e4d21ab9780d0a03b4ed74a5b ] + +Commit + + bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function") + +added a call to set the block size value that is needed by the kernel +to set the boundaries in the section list. This was done for UV Hubbed +systems but missed in the UV Hubless setup. Fix that mistake by adding +that same set call for hubless systems, which support the same NVRAMs +and Intel BIOS, thus the same problem occurs. + + [ bp: Massage commit message. ] + +Fixes: bbbd2b51a2aa ("x86/platform/UV: Use new set memory block size function") +Signed-off-by: Mike Travis +Signed-off-by: Borislav Petkov +Reviewed-by: Steve Wahl +Reviewed-by: Russ Anderson +Link: https://lkml.kernel.org/r/20210305162853.299892-1-mike.travis@hpe.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/x2apic_uv_x.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c +index 235f5cde06fc..40f466de8924 100644 +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -1652,6 +1652,9 @@ static __init int uv_system_init_hubless(void) + if (rc < 0) + return rc; + ++ /* Set section block size for current node memory */ ++ set_block_size(); ++ + /* Create user access node */ + if (rc >= 0) + uv_setup_proc_files(1); +-- +2.30.2 + diff --git a/queue-5.10/xen-blkback-fix-compatibility-bug-with-single-page-r.patch b/queue-5.10/xen-blkback-fix-compatibility-bug-with-single-page-r.patch new file mode 100644 index 00000000000..47e1292be28 --- /dev/null +++ b/queue-5.10/xen-blkback-fix-compatibility-bug-with-single-page-r.patch @@ -0,0 +1,140 @@ +From 290421b9bdd33f7ef87986cdc1d445481e278dd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 17:56:59 +0000 +Subject: xen-blkback: fix compatibility bug with single page rings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Durrant + +[ Upstream commit d75e7f63b7c95c527cde42efb5d410d7f961498f ] + +Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid +inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the +behaviour of xen-blkback when connecting to a frontend was: + +- read 'ring-page-order' +- if not present then expect a single page ring specified by 'ring-ref' +- else expect a ring specified by 'ring-refX' where X is between 0 and + 1 << ring-page-order + +This was correct behaviour, but was broken by the afforementioned commit to +become: + +- read 'ring-page-order' +- if not present then expect a single page ring (i.e. ring-page-order = 0) +- expect a ring specified by 'ring-refX' where X is between 0 and + 1 << ring-page-order +- if that didn't work then see if there's a single page ring specified by + 'ring-ref' + +This incorrect behaviour works most of the time but fails when a frontend +that sets 'ring-page-order' is unloaded and replaced by one that does not +because, instead of reading 'ring-ref', xen-blkback will read the stale +'ring-ref0' left around by the previous frontend will try to map the wrong +grant reference. + +This patch restores the original behaviour. + +Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront") +Signed-off-by: Paul Durrant +Reviewed-by: Dongli Zhang +Reviewed-by: "Roger Pau Monné" +Link: https://lore.kernel.org/r/20210202175659.18452-1-paul@xen.org +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/block/xen-blkback/common.h | 1 + + drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++----------------- + 2 files changed, 17 insertions(+), 22 deletions(-) + +diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h +index a1b9df2c4ef1..040829e2d016 100644 +--- a/drivers/block/xen-blkback/common.h ++++ b/drivers/block/xen-blkback/common.h +@@ -313,6 +313,7 @@ struct xen_blkif { + + struct work_struct free_work; + unsigned int nr_ring_pages; ++ bool multi_ref; + /* All rings for this device. */ + struct xen_blkif_ring *rings; + unsigned int nr_rings; +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index 9860d4842f36..6c5e9373e91c 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -998,14 +998,17 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + for (i = 0; i < nr_grefs; i++) { + char ring_ref_name[RINGREF_NAME_LEN]; + +- snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i); ++ if (blkif->multi_ref) ++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i); ++ else { ++ WARN_ON(i != 0); ++ snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref"); ++ } ++ + err = xenbus_scanf(XBT_NIL, dir, ring_ref_name, + "%u", &ring_ref[i]); + + if (err != 1) { +- if (nr_grefs == 1) +- break; +- + err = -EINVAL; + xenbus_dev_fatal(dev, err, "reading %s/%s", + dir, ring_ref_name); +@@ -1013,18 +1016,6 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + } + } + +- if (err != 1) { +- WARN_ON(nr_grefs != 1); +- +- err = xenbus_scanf(XBT_NIL, dir, "ring-ref", "%u", +- &ring_ref[0]); +- if (err != 1) { +- err = -EINVAL; +- xenbus_dev_fatal(dev, err, "reading %s/ring-ref", dir); +- return err; +- } +- } +- + err = -ENOMEM; + for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) { + req = kzalloc(sizeof(*req), GFP_KERNEL); +@@ -1129,10 +1120,15 @@ static int connect_ring(struct backend_info *be) + blkif->nr_rings, blkif->blk_protocol, protocol, + blkif->vbd.feature_gnt_persistent ? "persistent grants" : ""); + +- ring_page_order = xenbus_read_unsigned(dev->otherend, +- "ring-page-order", 0); +- +- if (ring_page_order > xen_blkif_max_ring_order) { ++ err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-page-order", "%u", ++ &ring_page_order); ++ if (err != 1) { ++ blkif->nr_ring_pages = 1; ++ blkif->multi_ref = false; ++ } else if (ring_page_order <= xen_blkif_max_ring_order) { ++ blkif->nr_ring_pages = 1 << ring_page_order; ++ blkif->multi_ref = true; ++ } else { + err = -EINVAL; + xenbus_dev_fatal(dev, err, + "requested ring page order %d exceed max:%d", +@@ -1141,8 +1137,6 @@ static int connect_ring(struct backend_info *be) + return err; + } + +- blkif->nr_ring_pages = 1 << ring_page_order; +- + if (blkif->nr_rings == 1) + return read_per_ring_refs(&blkif->rings[0], dev->otherend); + else { +-- +2.30.2 + diff --git a/queue-5.10/xfs-fix-return-of-uninitialized-value-in-variable-er.patch b/queue-5.10/xfs-fix-return-of-uninitialized-value-in-variable-er.patch new file mode 100644 index 00000000000..9a4aab1a0bb --- /dev/null +++ b/queue-5.10/xfs-fix-return-of-uninitialized-value-in-variable-er.patch @@ -0,0 +1,43 @@ +From ce52a308b9f2eb79827c4d5177cbb71f5a969c08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 10:27:34 -0700 +Subject: xfs: fix return of uninitialized value in variable error + +From: Colin Ian King + +[ Upstream commit 3b6dd9a9aeeada19d0c820ff68e979243a888bb6 ] + +A previous commit removed a call to xfs_attr3_leaf_read that +assigned an error return code to variable error. We now have +a few early error return paths to label 'out' that return +error if error is set; however error now is uninitialized +so potentially garbage is being returned. Fix this by setting +error to zero to restore the original behaviour where error +was zero at the label 'restart'. + +Addresses-Coverity: ("Uninitialized scalar variable") +Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") +Signed-off-by: Colin Ian King +Reviewed-by: Brian Foster +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_attr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c +index fd8e6418a0d3..96ac7e562b87 100644 +--- a/fs/xfs/libxfs/xfs_attr.c ++++ b/fs/xfs/libxfs/xfs_attr.c +@@ -928,6 +928,7 @@ restart: + * Search to see if name already exists, and get back a pointer + * to where it should go. + */ ++ error = 0; + retval = xfs_attr_node_hasname(args, &state); + if (retval != -ENOATTR && retval != -EEXIST) + goto out; +-- +2.30.2 + diff --git a/queue-5.10/xsk-respect-device-s-headroom-and-tailroom-on-generi.patch b/queue-5.10/xsk-respect-device-s-headroom-and-tailroom-on-generi.patch new file mode 100644 index 00000000000..19bd09b1e86 --- /dev/null +++ b/queue-5.10/xsk-respect-device-s-headroom-and-tailroom-on-generi.patch @@ -0,0 +1,83 @@ +From 4e75e4abbf0ecb277a2f69a7308e7f2918daf29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 20:50:31 +0000 +Subject: xsk: Respect device's headroom and tailroom on generic xmit path + +From: Alexander Lobakin + +[ Upstream commit 3914d88f7608e6c2e80e344474fa289370c32451 ] + +xsk_generic_xmit() allocates a new skb and then queues it for +xmitting. The size of new skb's headroom is desc->len, so it comes +to the driver/device with no reserved headroom and/or tailroom. +Lots of drivers need some headroom (and sometimes tailroom) to +prepend (and/or append) some headers or data, e.g. CPU tags, +device-specific headers/descriptors (LSO, TLS etc.), and if case +of no available space skb_cow_head() will reallocate the skb. +Reallocations are unwanted on fast-path, especially when it comes +to XDP, so generic XSK xmit should reserve the spaces declared in +dev->needed_headroom and dev->needed tailroom to avoid them. + +Note on max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom)): + +Usually, output functions reserve LL_RESERVED_SPACE(dev), which +consists of dev->hard_header_len + dev->needed_headroom, aligned +by 16. + +However, on XSK xmit hard header is already here in the chunk, so +hard_header_len is not needed. But it'd still be better to align +data up to cacheline, while reserving no less than driver requests +for headroom. NET_SKB_PAD here is to double-insure there will be +no reallocations even when the driver advertises no needed_headroom, +but in fact need it (not so rare case). + +Fixes: 35fcde7f8deb ("xsk: support for Tx") +Signed-off-by: Alexander Lobakin +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20210218204908.5455-5-alobakin@pm.me +Signed-off-by: Sasha Levin +--- + net/xdp/xsk.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 52fd1f96b241..ca4716b92774 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -380,12 +380,16 @@ static int xsk_generic_xmit(struct sock *sk) + struct sk_buff *skb; + unsigned long flags; + int err = 0; ++ u32 hr, tr; + + mutex_lock(&xs->mutex); + + if (xs->queue_id >= xs->dev->real_num_tx_queues) + goto out; + ++ hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(xs->dev->needed_headroom)); ++ tr = xs->dev->needed_tailroom; ++ + while (xskq_cons_peek_desc(xs->tx, &desc, xs->pool)) { + char *buffer; + u64 addr; +@@ -397,11 +401,13 @@ static int xsk_generic_xmit(struct sock *sk) + } + + len = desc.len; +- skb = sock_alloc_send_skb(sk, len, 1, &err); ++ skb = sock_alloc_send_skb(sk, hr + len + tr, 1, &err); + if (unlikely(!skb)) + goto out; + ++ skb_reserve(skb, hr); + skb_put(skb, len); ++ + addr = desc.addr; + buffer = xsk_buff_raw_get_data(xs->pool, addr); + err = skb_store_bits(skb, 0, buffer, len); +-- +2.30.2 +