From: Sasha Levin Date: Mon, 1 Jun 2020 02:48:46 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.226~45 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=72c94eb87dd3b7ea1e23fee7629cf6104add0651;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch b/queue-5.4/alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch new file mode 100644 index 00000000000..9c829cceb3e --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch @@ -0,0 +1,124 @@ +From deb4b83792723c23800fbca5ef28d8366921ab58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 08:24:06 +0200 +Subject: ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC + workaround + +From: Takashi Iwai + +[ Upstream commit 399c01aa49e548c82d40f8161915a5941dd3c60e ] + +We fixed the regression of the speaker volume for some Thinkpad models +(e.g. T570) by the commit 54947cd64c1b ("ALSA: hda/realtek - Fix +speaker output regression on Thinkpad T570"). Essentially it fixes +the DAC / pin pairing by a static table. It was confirmed and merged +to stable kernel later. + +Now, interestingly, we got another regression report for the very same +model (T570) about the similar problem, and the commit above was the +culprit. That is, by some reason, there are devices that prefer the +DAC1, and another device DAC2! + +Unfortunately those have the same ID and we have no idea what can +differentiate, in this patch, a new fixup model "tpt470-dock-fix" is +provided, so that users with such a machine can apply it manually. +When model=tpt470-dock-fix option is passed to snd-hda-intel module, +it avoids the fixed DAC pairing and the DAC1 is assigned to the +speaker like the earlier versions. + +Fixes: 54947cd64c1b ("ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570") +BugLink: https://apibugzilla.suse.com/show_bug.cgi?id=1172017 +Cc: +Link: https://lore.kernel.org/r/20200526062406.9799-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 36 +++++++++++++++++++++++++---------- + 1 file changed, 26 insertions(+), 10 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index c5bec191e003..743e2dcccb8b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5484,18 +5484,9 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec, + { 0x19, 0x21a11010 }, /* dock mic */ + { } + }; +- /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise +- * the speaker output becomes too low by some reason on Thinkpads with +- * ALC298 codec +- */ +- static const hda_nid_t preferred_pairs[] = { +- 0x14, 0x03, 0x17, 0x02, 0x21, 0x02, +- 0 +- }; + struct alc_spec *spec = codec->spec; + + if (action == HDA_FIXUP_ACT_PRE_PROBE) { +- spec->gen.preferred_dacs = preferred_pairs; + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; + snd_hda_apply_pincfgs(codec, pincfgs); + } else if (action == HDA_FIXUP_ACT_INIT) { +@@ -5508,6 +5499,23 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec, + } + } + ++static void alc_fixup_tpt470_dacs(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise ++ * the speaker output becomes too low by some reason on Thinkpads with ++ * ALC298 codec ++ */ ++ static const hda_nid_t preferred_pairs[] = { ++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02, ++ 0 ++ }; ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ spec->gen.preferred_dacs = preferred_pairs; ++} ++ + static void alc_shutup_dell_xps13(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -6063,6 +6071,7 @@ enum { + ALC700_FIXUP_INTEL_REFERENCE, + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, ++ ALC298_FIXUP_TPT470_DOCK_FIX, + ALC298_FIXUP_TPT470_DOCK, + ALC255_FIXUP_DUMMY_LINEOUT_VERB, + ALC255_FIXUP_DELL_HEADSET_MIC, +@@ -6994,12 +7003,18 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC274_FIXUP_DELL_BIND_DACS + }, +- [ALC298_FIXUP_TPT470_DOCK] = { ++ [ALC298_FIXUP_TPT470_DOCK_FIX] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_tpt470_dock, + .chained = true, + .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE + }, ++ [ALC298_FIXUP_TPT470_DOCK] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_tpt470_dacs, ++ .chained = true, ++ .chain_id = ALC298_FIXUP_TPT470_DOCK_FIX ++ }, + [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -7638,6 +7653,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, + {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, + {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, ++ {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"}, + {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"}, + {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, + {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"}, +-- +2.25.1 + diff --git a/queue-5.4/alsa-hda-realtek-add-new-codec-supported-for-alc287.patch b/queue-5.4/alsa-hda-realtek-add-new-codec-supported-for-alc287.patch new file mode 100644 index 00000000000..78ee2011299 --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-new-codec-supported-for-alc287.patch @@ -0,0 +1,51 @@ +From 20c1a5ec94f6c72c3b79445a857c16f4781525ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 14:10:26 +0800 +Subject: ALSA: hda/realtek - Add new codec supported for ALC287 + +From: Kailang Yang + +[ Upstream commit 630e36126e420e1756378b3427b42711ce0b9ddd ] + +Enable new codec supported for ALC287. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/dcf5ce5507104d0589a917cbb71dc3c6@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 743e2dcccb8b..da4d21445e80 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -384,6 +384,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: ++ case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -8321,6 +8322,7 @@ static int patch_alc269(struct hda_codec *codec) + case 0x10ec0215: + case 0x10ec0245: + case 0x10ec0285: ++ case 0x10ec0287: + case 0x10ec0289: + spec->codec_variant = ALC269_TYPE_ALC215; + spec->shutup = alc225_shutup; +@@ -9599,6 +9601,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269), ++ HDA_CODEC_ENTRY(0x10ec0287, "ALC287", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269), +-- +2.25.1 + diff --git a/queue-5.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch b/queue-5.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch new file mode 100644 index 00000000000..77cba4b08d6 --- /dev/null +++ b/queue-5.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch @@ -0,0 +1,45 @@ +From bc291e897bc1f95e14447f243fdedce6e6c97fc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 00:39:21 +0000 +Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug + +From: Changming Liu + +[ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ] + +The "info.index" variable can be 31 in "1 << info.index". +This might trigger an undefined behavior since 1 is signed. + +Fix this by casting 1 to 1u just to be sure "1u << 31" is defined. + +Signed-off-by: Changming Liu +Cc: +Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/hwdep.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c +index 00cb5aed10a9..28bec15b0959 100644 +--- a/sound/core/hwdep.c ++++ b/sound/core/hwdep.c +@@ -216,12 +216,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, + if (info.index >= 32) + return -EINVAL; + /* check whether the dsp was already loaded */ +- if (hw->dsp_loaded & (1 << info.index)) ++ if (hw->dsp_loaded & (1u << info.index)) + return -EBUSY; + err = hw->ops.dsp_load(hw, &info); + if (err < 0) + return err; +- hw->dsp_loaded |= (1 << info.index); ++ hw->dsp_loaded |= (1u << info.index); + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch b/queue-5.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch new file mode 100644 index 00000000000..c6149e37b08 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch @@ -0,0 +1,52 @@ +From b996f202d6426b4ea4f42473253d73a0e588231e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 14:26:13 +0800 +Subject: ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC + +From: Chris Chiu + +[ Upstream commit 4020d1ccbe55bdf67b31d718d2400506eaf4b43f ] + +The Asus USB DAC is a USB type-C audio dongle for connecting to +the headset and headphone. The volume minimum value -23040 which +is 0xa600 in hexadecimal with the resolution value 1 indicates +this should be endianness issue caused by the firmware bug. Add +a volume quirk to fix the volume control problem. + +Also fixes this warning: + Warning! Unlikely big volume range (=23040), cval->res is probably wrong. + [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1 + Warning! Unlikely big volume range (=23040), cval->res is probably wrong. + [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1 + +Signed-off-by: Chris Chiu +Cc: +Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 583edacc9fe8..f55afe3a98e3 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1171,6 +1171,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + cval->res = 384; + } + break; ++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */ ++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) || ++ strstr(kctl->id.name, "Capture Volume") != NULL) { ++ cval->min >>= 8; ++ cval->max = 0; ++ cval->res = 1; ++ } ++ break; + } + } + +-- +2.25.1 + diff --git a/queue-5.4/alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch b/queue-5.4/alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch new file mode 100644 index 00000000000..753bcc0c946 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch @@ -0,0 +1,119 @@ +From 8219fe38fb58a946e1931efae6fb61e3c998cdb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 10:28:10 +0200 +Subject: ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio + +From: Takashi Iwai + +[ Upstream commit 7f5ad9c9003425175f46c94df380e8c9e558cfb5 ] + +Gigabyte TRX40 Aorus Master is equipped with two USB-audio devices, +a Realtek ALC1220-VB codec (USB ID 0414:a001) and an ESS SABRE9218 DAC +(USB ID 0414:a000). The latter serves solely for the headphone output +on the front panel while the former serves for the rest I/Os (mostly +for the I/Os in the rear panel but also including the front mic). + +Both chips do work more or less with the unmodified USB-audio driver, +but there are a few glitches. The ALC1220-VB returns an error for an +inquiry to some jacks, as already seen on other TRX40-based mobos. +However this machine has a slightly incompatible configuration, hence +the existing mapping cannot be used as is. + +Meanwhile the ESS chip seems working without any quirk. But since +both audio devices don't provide any specific names, both cards appear +as "USB-Audio", and it's quite confusing for users. + +This patch is an attempt to overcome those issues: + +- The specific mapping table for ALC1220-VB is provided, reducing the + non-working nodes and renaming the badly chosen controls. + The connector map isn't needed here unlike other TRX40 quirks. + +- For both USB IDs (0414:a000 and 0414:a001), provide specific card + name strings, so that user-space can identify more easily; and more + importantly, UCM profile can be applied to each. + +Reported-by: Linus Torvalds +Cc: +Link: https://lore.kernel.org/r/20200526082810.29506-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_maps.c | 19 +++++++++++++++++++ + sound/usb/quirks-table.h | 25 +++++++++++++++++++++++++ + 2 files changed, 44 insertions(+) + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 2255f9abd7a5..ac84f0b2b0bc 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -387,6 +387,21 @@ static const struct usbmix_connector_map trx40_mobo_connector_map[] = { + {} + }; + ++/* Rear panel + front mic on Gigabyte TRX40 Aorus Master with ALC1220-VB */ ++static const struct usbmix_name_map aorus_master_alc1220vb_map[] = { ++ { 17, NULL }, /* OT, IEC958?, disabled */ ++ { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */ ++ { 16, "Line Out" }, /* OT */ ++ { 22, "Line Out Playback" }, /* FU */ ++ { 7, "Line" }, /* IT */ ++ { 19, "Line Capture" }, /* FU */ ++ { 8, "Mic" }, /* IT */ ++ { 20, "Mic Capture" }, /* FU */ ++ { 9, "Front Mic" }, /* IT */ ++ { 21, "Front Mic Capture" }, /* FU */ ++ {} ++}; ++ + /* + * Control map entries + */ +@@ -506,6 +521,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x05a7, 0x1020), + .map = bose_companion5_map, + }, ++ { /* Gigabyte TRX40 Aorus Master (rear panel + front mic) */ ++ .id = USB_ID(0x0414, 0xa001), ++ .map = aorus_master_alc1220vb_map, ++ }, + { /* Gigabyte TRX40 Aorus Pro WiFi */ + .id = USB_ID(0x0414, 0xa002), + .map = trx40_mobo_map, +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index aa4c16ce0e57..bbae11605a4c 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3650,4 +3650,29 @@ ALC1220_VB_DESKTOP(0x0db0, 0x543d), /* MSI TRX40 */ + ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */ + #undef ALC1220_VB_DESKTOP + ++/* Two entries for Gigabyte TRX40 Aorus Master: ++ * TRX40 Aorus Master has two USB-audio devices, one for the front headphone ++ * with ESS SABRE9218 DAC chip, while another for the rest I/O (the rear ++ * panel and the front mic) with Realtek ALC1220-VB. ++ * Here we provide two distinct names for making UCM profiles easier. ++ */ ++{ ++ USB_DEVICE(0x0414, 0xa000), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .vendor_name = "Gigabyte", ++ .product_name = "Aorus Master Front Headphone", ++ .profile_name = "Gigabyte-Aorus-Master-Front-Headphone", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, ++{ ++ USB_DEVICE(0x0414, 0xa001), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .vendor_name = "Gigabyte", ++ .product_name = "Aorus Master Main Audio", ++ .profile_name = "Gigabyte-Aorus-Master-Main-Audio", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, ++ + #undef USB_DEVICE_VENDOR_SPEC +-- +2.25.1 + diff --git a/queue-5.4/arm-8970-1-decompressor-increase-tag-size.patch b/queue-5.4/arm-8970-1-decompressor-increase-tag-size.patch new file mode 100644 index 00000000000..a7fbc289dd7 --- /dev/null +++ b/queue-5.4/arm-8970-1-decompressor-increase-tag-size.patch @@ -0,0 +1,39 @@ +From 3cf6760fb13709ee3a6653e139dd53604903e4af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 20:36:11 +0100 +Subject: ARM: 8970/1: decompressor: increase tag size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Stelmach + +[ Upstream commit 2c962369d72f286659e6446919f88d69b943cb4d ] + +The size field of the tag header structure is supposed to be set to the +size of a tag structure including the header. + +Fixes: c772568788b5f0 ("ARM: add additional table to compressed kernel") +Signed-off-by: Łukasz Stelmach +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/vmlinux.lds.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S +index fc7ed03d8b93..51b078604978 100644 +--- a/arch/arm/boot/compressed/vmlinux.lds.S ++++ b/arch/arm/boot/compressed/vmlinux.lds.S +@@ -43,7 +43,7 @@ SECTIONS + } + .table : ALIGN(4) { + _table_start = .; +- LONG(ZIMAGE_MAGIC(2)) ++ LONG(ZIMAGE_MAGIC(4)) + LONG(ZIMAGE_MAGIC(0x5a534c4b)) + LONG(ZIMAGE_MAGIC(__piggy_size_addr - _start)) + LONG(ZIMAGE_MAGIC(_kernel_bss_size)) +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch b/queue-5.4/arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch new file mode 100644 index 00000000000..e6946ba52f4 --- /dev/null +++ b/queue-5.4/arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch @@ -0,0 +1,62 @@ +From ed3a85d792c64ac3ed303ee931988d05794f2e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 May 2020 16:30:42 +1200 +Subject: ARM: dts: bcm: HR2: Fix PPI interrupt types + +From: Hamish Martin + +[ Upstream commit be0ec060b54f0481fb95d59086c1484a949c903c ] + +These error messages are output when booting on a BCM HR2 system: + GIC: PPI11 is secure or misconfigured + GIC: PPI13 is secure or misconfigured + +Per ARM documentation these interrupts are triggered on a rising edge. +See ARM Cortex A-9 MPCore Technical Reference Manual, Revision r4p1, +Section 3.3.8 Interrupt Configuration Registers. + +The same issue was resolved for NSP systems in commit 5f1aa51c7a1e +("ARM: dts: NSP: Fix PPI interrupt types"). + +Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file") +Signed-off-by: Hamish Martin +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm-hr2.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi +index e4d49731287f..e35398cc60a0 100644 +--- a/arch/arm/boot/dts/bcm-hr2.dtsi ++++ b/arch/arm/boot/dts/bcm-hr2.dtsi +@@ -75,7 +75,7 @@ + timer@20200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0x20200 0x100>; +- interrupts = ; ++ interrupts = ; + clocks = <&periph_clk>; + }; + +@@ -83,7 +83,7 @@ + compatible = "arm,cortex-a9-twd-timer"; + reg = <0x20600 0x20>; + interrupts = ; ++ IRQ_TYPE_EDGE_RISING)>; + clocks = <&periph_clk>; + }; + +@@ -91,7 +91,7 @@ + compatible = "arm,cortex-a9-twd-wdt"; + reg = <0x20620 0x20>; + interrupts = ; ++ IRQ_TYPE_EDGE_RISING)>; + clocks = <&periph_clk>; + }; + +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch b/queue-5.4/arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch new file mode 100644 index 00000000000..cc14b0a5e87 --- /dev/null +++ b/queue-5.4/arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch @@ -0,0 +1,46 @@ +From 4d25fe44f81cd7ed46a61567ca738bd75a27e239 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Apr 2020 14:35:22 +0200 +Subject: ARM: dts: bcm2835-rpi-zero-w: Fix led polarity +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +[ Upstream commit 58bb90ab415562eededb932455046924e65df342 ] + +The status "ACT" led on the Raspberry Pi Zero W is on when GPIO 47 is low. + +This has been verified on a board and somewhat confirmed by both the GPIO +name ("STATUS_LED_N") and the reduced schematics [1]. + +[1]: https://www.raspberrypi.org/documentation/hardware/raspberrypi/schematics/rpi_SCH_ZeroW_1p1_reduced.pdf + +Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") +Signed-off-by: Vincent Stehlé +Cc: Stefan Wahren +Cc: Florian Fainelli +Tested-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +index 4c3f606e5b8d..f65448c01e31 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +@@ -24,7 +24,7 @@ + + leds { + act { +- gpios = <&gpio 47 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpio 47 GPIO_ACTIVE_LOW>; + }; + }; + +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch b/queue-5.4/arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch new file mode 100644 index 00000000000..7b340afe5c1 --- /dev/null +++ b/queue-5.4/arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch @@ -0,0 +1,122 @@ +From fd597c9204155b22b4293a235a7705c5400e2c56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 May 2020 19:02:37 +0200 +Subject: ARM: dts/imx6q-bx50v3: Set display interface clock parents + +From: Robert Beckett + +[ Upstream commit 665e7c73a7724a393b4ec92d1ae1e029925ef2b7 ] + +Avoid LDB and IPU DI clocks both using the same parent. LDB requires +pasthrough clock to avoid breaking timing while IPU DI does not. + +Force IPU DI clocks to use IMX6QDL_CLK_PLL2_PFD0_352M as parent +and LDB to use IMX6QDL_CLK_PLL5_VIDEO_DIV. + +This fixes an issue where attempting atomic modeset while using +HDMI and display port at the same time causes LDB clock programming +to destroy the programming of HDMI that was done during the same +modeset. + +Cc: stable@vger.kernel.org +Signed-off-by: Robert Beckett +[Use IMX6QDL_CLK_PLL2_PFD0_352M instead of IMX6QDL_CLK_PLL2_PFD2_396M + originally chosen by Robert Beckett to avoid affecting eMMC clock + by DRM atomic updates] +Signed-off-by: Ian Ray +[Squash Robert's and Ian's commits for bisectability, update patch + description and add stable tag] +Signed-off-by: Sebastian Reichel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-b450v3.dts | 7 ------- + arch/arm/boot/dts/imx6q-b650v3.dts | 7 ------- + arch/arm/boot/dts/imx6q-b850v3.dts | 11 ----------- + arch/arm/boot/dts/imx6q-bx50v3.dtsi | 15 +++++++++++++++ + 4 files changed, 15 insertions(+), 25 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts +index 95b8f2d71821..fb0980190aa0 100644 +--- a/arch/arm/boot/dts/imx6q-b450v3.dts ++++ b/arch/arm/boot/dts/imx6q-b450v3.dts +@@ -65,13 +65,6 @@ + }; + }; + +-&clks { +- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, +- <&clks IMX6QDL_CLK_LDB_DI1_SEL>; +- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>, +- <&clks IMX6QDL_CLK_PLL3_USB_OTG>; +-}; +- + &ldb { + status = "okay"; + +diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts +index 611cb7ae7e55..8f762d9c5ae9 100644 +--- a/arch/arm/boot/dts/imx6q-b650v3.dts ++++ b/arch/arm/boot/dts/imx6q-b650v3.dts +@@ -65,13 +65,6 @@ + }; + }; + +-&clks { +- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, +- <&clks IMX6QDL_CLK_LDB_DI1_SEL>; +- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>, +- <&clks IMX6QDL_CLK_PLL3_USB_OTG>; +-}; +- + &ldb { + status = "okay"; + +diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts +index e4cb118f88c6..1ea64ecf4291 100644 +--- a/arch/arm/boot/dts/imx6q-b850v3.dts ++++ b/arch/arm/boot/dts/imx6q-b850v3.dts +@@ -53,17 +53,6 @@ + }; + }; + +-&clks { +- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, +- <&clks IMX6QDL_CLK_LDB_DI1_SEL>, +- <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>, +- <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>; +- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, +- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, +- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>, +- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>; +-}; +- + &ldb { + fsl,dual-channel; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi +index fa27dcdf06f1..1938b04199c4 100644 +--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi ++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi +@@ -377,3 +377,18 @@ + #interrupt-cells = <1>; + }; + }; ++ ++&clks { ++ assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>, ++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>, ++ <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>, ++ <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>, ++ <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>, ++ <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>; ++ assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, ++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>, ++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>, ++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>, ++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>, ++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>; ++}; +-- +2.25.1 + diff --git a/queue-5.4/arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch b/queue-5.4/arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch new file mode 100644 index 00000000000..9a36920772a --- /dev/null +++ b/queue-5.4/arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch @@ -0,0 +1,302 @@ +From 2e3373cdf7c5812ebb64de1b89fa94c8f7458bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 May 2020 13:03:54 +0100 +Subject: ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h + +From: Russell King + +[ Upstream commit 747ffc2fcf969eff9309d7f2d1d61cb8b9e1bb40 ] + +Consolidate the user access assembly code to asm/uaccess-asm.h. This +moves the csdb, check_uaccess, uaccess_mask_range_ptr, uaccess_enable, +uaccess_disable, uaccess_save, uaccess_restore macros, and creates two +new ones for exception entry and exit - uaccess_entry and uaccess_exit. + +This makes the uaccess_save and uaccess_restore macros private to +asm/uaccess-asm.h. + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/assembler.h | 75 +------------------- + arch/arm/include/asm/uaccess-asm.h | 106 +++++++++++++++++++++++++++++ + arch/arm/kernel/entry-armv.S | 11 +-- + arch/arm/kernel/entry-header.S | 9 +-- + 4 files changed, 112 insertions(+), 89 deletions(-) + create mode 100644 arch/arm/include/asm/uaccess-asm.h + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index 99929122dad7..3546d294d55f 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -18,11 +18,11 @@ + #endif + + #include +-#include + #include + #include + #include + #include ++#include + + #define IOMEM(x) (x) + +@@ -446,79 +446,6 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) + .size \name , . - \name + .endm + +- .macro csdb +-#ifdef CONFIG_THUMB2_KERNEL +- .inst.w 0xf3af8014 +-#else +- .inst 0xe320f014 +-#endif +- .endm +- +- .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req +-#ifndef CONFIG_CPU_USE_DOMAINS +- adds \tmp, \addr, #\size - 1 +- sbcscc \tmp, \tmp, \limit +- bcs \bad +-#ifdef CONFIG_CPU_SPECTRE +- movcs \addr, #0 +- csdb +-#endif +-#endif +- .endm +- +- .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req +-#ifdef CONFIG_CPU_SPECTRE +- sub \tmp, \limit, #1 +- subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr +- addhs \tmp, \tmp, #1 @ if (tmp >= 0) { +- subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) } +- movlo \addr, #0 @ if (tmp < 0) addr = NULL +- csdb +-#endif +- .endm +- +- .macro uaccess_disable, tmp, isb=1 +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN +- /* +- * Whenever we re-enter userspace, the domains should always be +- * set appropriately. +- */ +- mov \tmp, #DACR_UACCESS_DISABLE +- mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register +- .if \isb +- instr_sync +- .endif +-#endif +- .endm +- +- .macro uaccess_enable, tmp, isb=1 +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN +- /* +- * Whenever we re-enter userspace, the domains should always be +- * set appropriately. +- */ +- mov \tmp, #DACR_UACCESS_ENABLE +- mcr p15, 0, \tmp, c3, c0, 0 +- .if \isb +- instr_sync +- .endif +-#endif +- .endm +- +- .macro uaccess_save, tmp +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN +- mrc p15, 0, \tmp, c3, c0, 0 +- str \tmp, [sp, #SVC_DACR] +-#endif +- .endm +- +- .macro uaccess_restore +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN +- ldr r0, [sp, #SVC_DACR] +- mcr p15, 0, r0, c3, c0, 0 +-#endif +- .endm +- + .irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo + .macro ret\c, reg + #if __LINUX_ARM_ARCH__ < 6 +diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h +new file mode 100644 +index 000000000000..d475e3e8145d +--- /dev/null ++++ b/arch/arm/include/asm/uaccess-asm.h +@@ -0,0 +1,106 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++#ifndef __ASM_UACCESS_ASM_H__ ++#define __ASM_UACCESS_ASM_H__ ++ ++#include ++#include ++#include ++#include ++ ++ .macro csdb ++#ifdef CONFIG_THUMB2_KERNEL ++ .inst.w 0xf3af8014 ++#else ++ .inst 0xe320f014 ++#endif ++ .endm ++ ++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req ++#ifndef CONFIG_CPU_USE_DOMAINS ++ adds \tmp, \addr, #\size - 1 ++ sbcscc \tmp, \tmp, \limit ++ bcs \bad ++#ifdef CONFIG_CPU_SPECTRE ++ movcs \addr, #0 ++ csdb ++#endif ++#endif ++ .endm ++ ++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req ++#ifdef CONFIG_CPU_SPECTRE ++ sub \tmp, \limit, #1 ++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr ++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) { ++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) } ++ movlo \addr, #0 @ if (tmp < 0) addr = NULL ++ csdb ++#endif ++ .endm ++ ++ .macro uaccess_disable, tmp, isb=1 ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ /* ++ * Whenever we re-enter userspace, the domains should always be ++ * set appropriately. ++ */ ++ mov \tmp, #DACR_UACCESS_DISABLE ++ mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register ++ .if \isb ++ instr_sync ++ .endif ++#endif ++ .endm ++ ++ .macro uaccess_enable, tmp, isb=1 ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ /* ++ * Whenever we re-enter userspace, the domains should always be ++ * set appropriately. ++ */ ++ mov \tmp, #DACR_UACCESS_ENABLE ++ mcr p15, 0, \tmp, c3, c0, 0 ++ .if \isb ++ instr_sync ++ .endif ++#endif ++ .endm ++ ++ .macro uaccess_save, tmp ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ mrc p15, 0, \tmp, c3, c0, 0 ++ str \tmp, [sp, #SVC_DACR] ++#endif ++ .endm ++ ++ .macro uaccess_restore ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ ldr r0, [sp, #SVC_DACR] ++ mcr p15, 0, r0, c3, c0, 0 ++#endif ++ .endm ++ ++ /* ++ * Save the address limit on entry to a privileged exception and ++ * if using PAN, save and disable usermode access. ++ */ ++ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable ++ ldr \tmp0, [\tsk, #TI_ADDR_LIMIT] ++ mov \tmp1, #TASK_SIZE ++ str \tmp1, [\tsk, #TI_ADDR_LIMIT] ++ str \tmp0, [sp, #SVC_ADDR_LIMIT] ++ uaccess_save \tmp0 ++ .if \disable ++ uaccess_disable \tmp0 ++ .endif ++ .endm ++ ++ /* Restore the user access state previously saved by uaccess_entry */ ++ .macro uaccess_exit, tsk, tmp0, tmp1 ++ ldr \tmp1, [sp, #SVC_ADDR_LIMIT] ++ uaccess_restore ++ str \tmp1, [\tsk, #TI_ADDR_LIMIT] ++ .endm ++ ++#endif /* __ASM_UACCESS_ASM_H__ */ +diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S +index 858d4e541532..a874b753397e 100644 +--- a/arch/arm/kernel/entry-armv.S ++++ b/arch/arm/kernel/entry-armv.S +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include "entry-header.S" + #include +@@ -179,15 +180,7 @@ ENDPROC(__und_invalid) + stmia r7, {r2 - r6} + + get_thread_info tsk +- ldr r0, [tsk, #TI_ADDR_LIMIT] +- mov r1, #TASK_SIZE +- str r1, [tsk, #TI_ADDR_LIMIT] +- str r0, [sp, #SVC_ADDR_LIMIT] +- +- uaccess_save r0 +- .if \uaccess +- uaccess_disable r0 +- .endif ++ uaccess_entry tsk, r0, r1, r2, \uaccess + + .if \trace + #ifdef CONFIG_TRACE_IRQFLAGS +diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S +index 32051ec5b33f..40db0f9188b6 100644 +--- a/arch/arm/kernel/entry-header.S ++++ b/arch/arm/kernel/entry-header.S +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + + @ Bad Abort numbers +@@ -217,9 +218,7 @@ + blne trace_hardirqs_off + #endif + .endif +- ldr r1, [sp, #SVC_ADDR_LIMIT] +- uaccess_restore +- str r1, [tsk, #TI_ADDR_LIMIT] ++ uaccess_exit tsk, r0, r1 + + #ifndef CONFIG_THUMB2_KERNEL + @ ARM mode SVC restore +@@ -263,9 +262,7 @@ + @ on the stack remains correct). + @ + .macro svc_exit_via_fiq +- ldr r1, [sp, #SVC_ADDR_LIMIT] +- uaccess_restore +- str r1, [tsk, #TI_ADDR_LIMIT] ++ uaccess_exit tsk, r0, r1 + #ifndef CONFIG_THUMB2_KERNEL + @ ARM mode restore + mov r0, sp +-- +2.25.1 + diff --git a/queue-5.4/arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch b/queue-5.4/arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch new file mode 100644 index 00000000000..ee812e60cfc --- /dev/null +++ b/queue-5.4/arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch @@ -0,0 +1,120 @@ +From 03bd1b3f79205e2aca3db993de95cc8f4393027d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 May 2020 13:24:07 +0100 +Subject: ARM: uaccess: fix DACR mismatch with nested exceptions + +From: Russell King + +[ Upstream commit 71f8af1110101facfad68989ff91f88f8e2c3e22 ] + +Tomas Paukrt reports that his SAM9X60 based system (ARM926, ARMv5TJ) +fails to fix up alignment faults, eventually resulting in a kernel +oops. + +The problem occurs when using CONFIG_CPU_USE_DOMAINS with commit +e6978e4bf181 ("ARM: save and reset the address limit when entering an +exception"). This is because the address limit is set back to +TASK_SIZE on exception entry, and, although it is restored on exception +exit, the domain register is not. + +Hence, this sequence can occur: + + interrupt + pt_regs->addr_limit = addr_limit // USER_DS + addr_limit = USER_DS + alignment exception + __probe_kernel_read() + old_fs = get_fs() // USER_DS + set_fs(KERNEL_DS) + addr_limit = KERNEL_DS + dacr.kernel = DOMAIN_MANAGER + interrupt + pt_regs->addr_limit = addr_limit // KERNEL_DS + addr_limit = USER_DS + alignment exception + __probe_kernel_read() + old_fs = get_fs() // USER_DS + set_fs(KERNEL_DS) + addr_limit = KERNEL_DS + dacr.kernel = DOMAIN_MANAGER + ... + set_fs(old_fs) + addr_limit = USER_DS + dacr.kernel = DOMAIN_CLIENT + ... + addr_limit = pt_regs->addr_limit // KERNEL_DS + interrupt returns + +At this point, addr_limit is correctly restored to KERNEL_DS for +__probe_kernel_read() to continue execution, but dacr.kernel is not, +it has been reset by the set_fs(old_fs) to DOMAIN_CLIENT. + +This would not have happened prior to the mentioned commit, because +addr_limit would remain KERNEL_DS, so get_fs() would have returned +KERNEL_DS, and so would correctly nest. + +This commit fixes the problem by also saving the DACR on exception +entry if either CONFIG_CPU_SW_DOMAIN_PAN or CONFIG_CPU_USE_DOMAINS are +enabled, and resetting the DACR appropriately on exception entry to +match addr_limit and PAN settings. + +Fixes: e6978e4bf181 ("ARM: save and reset the address limit when entering an exception") +Reported-by: Tomas Paukrt +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess-asm.h | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h +index e46468b91eaa..907571fd05c6 100644 +--- a/arch/arm/include/asm/uaccess-asm.h ++++ b/arch/arm/include/asm/uaccess-asm.h +@@ -67,15 +67,21 @@ + #endif + .endm + +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++#if defined(CONFIG_CPU_SW_DOMAIN_PAN) || defined(CONFIG_CPU_USE_DOMAINS) + #define DACR(x...) x + #else + #define DACR(x...) + #endif + + /* +- * Save the address limit on entry to a privileged exception and +- * if using PAN, save and disable usermode access. ++ * Save the address limit on entry to a privileged exception. ++ * ++ * If we are using the DACR for kernel access by the user accessors ++ * (CONFIG_CPU_USE_DOMAINS=y), always reset the DACR kernel domain ++ * back to client mode, whether or not \disable is set. ++ * ++ * If we are using SW PAN, set the DACR user domain to no access ++ * if \disable is set. + */ + .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable + ldr \tmp1, [\tsk, #TI_ADDR_LIMIT] +@@ -84,8 +90,17 @@ + DACR( mrc p15, 0, \tmp0, c3, c0, 0) + DACR( str \tmp0, [sp, #SVC_DACR]) + str \tmp1, [sp, #SVC_ADDR_LIMIT] +- .if \disable +- uaccess_disable \tmp0 ++ .if \disable && IS_ENABLED(CONFIG_CPU_SW_DOMAIN_PAN) ++ /* kernel=client, user=no access */ ++ mov \tmp2, #DACR_UACCESS_DISABLE ++ mcr p15, 0, \tmp2, c3, c0, 0 ++ instr_sync ++ .elseif IS_ENABLED(CONFIG_CPU_USE_DOMAINS) ++ /* kernel=client */ ++ bic \tmp2, \tmp0, #domain_mask(DOMAIN_KERNEL) ++ orr \tmp2, \tmp2, #domain_val(DOMAIN_KERNEL, DOMAIN_CLIENT) ++ mcr p15, 0, \tmp2, c3, c0, 0 ++ instr_sync + .endif + .endm + +-- +2.25.1 + diff --git a/queue-5.4/arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch b/queue-5.4/arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch new file mode 100644 index 00000000000..714c7aa5d82 --- /dev/null +++ b/queue-5.4/arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch @@ -0,0 +1,78 @@ +From 020206eca24b5a7e25ef1a9d4c074ef80afb75e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 May 2020 13:14:09 +0100 +Subject: ARM: uaccess: integrate uaccess_save and uaccess_restore + +From: Russell King + +[ Upstream commit 8ede890b0bcebe8c760aacfe20e934d98c3dc6aa ] + +Integrate uaccess_save / uaccess_restore macros into the new +uaccess_entry / uaccess_exit macros respectively. + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess-asm.h | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h +index d475e3e8145d..e46468b91eaa 100644 +--- a/arch/arm/include/asm/uaccess-asm.h ++++ b/arch/arm/include/asm/uaccess-asm.h +@@ -67,30 +67,23 @@ + #endif + .endm + +- .macro uaccess_save, tmp + #ifdef CONFIG_CPU_SW_DOMAIN_PAN +- mrc p15, 0, \tmp, c3, c0, 0 +- str \tmp, [sp, #SVC_DACR] +-#endif +- .endm +- +- .macro uaccess_restore +-#ifdef CONFIG_CPU_SW_DOMAIN_PAN +- ldr r0, [sp, #SVC_DACR] +- mcr p15, 0, r0, c3, c0, 0 ++#define DACR(x...) x ++#else ++#define DACR(x...) + #endif +- .endm + + /* + * Save the address limit on entry to a privileged exception and + * if using PAN, save and disable usermode access. + */ + .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable +- ldr \tmp0, [\tsk, #TI_ADDR_LIMIT] +- mov \tmp1, #TASK_SIZE +- str \tmp1, [\tsk, #TI_ADDR_LIMIT] +- str \tmp0, [sp, #SVC_ADDR_LIMIT] +- uaccess_save \tmp0 ++ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT] ++ mov \tmp2, #TASK_SIZE ++ str \tmp2, [\tsk, #TI_ADDR_LIMIT] ++ DACR( mrc p15, 0, \tmp0, c3, c0, 0) ++ DACR( str \tmp0, [sp, #SVC_DACR]) ++ str \tmp1, [sp, #SVC_ADDR_LIMIT] + .if \disable + uaccess_disable \tmp0 + .endif +@@ -99,8 +92,11 @@ + /* Restore the user access state previously saved by uaccess_entry */ + .macro uaccess_exit, tsk, tmp0, tmp1 + ldr \tmp1, [sp, #SVC_ADDR_LIMIT] +- uaccess_restore ++ DACR( ldr \tmp0, [sp, #SVC_DACR]) + str \tmp1, [\tsk, #TI_ADDR_LIMIT] ++ DACR( mcr p15, 0, \tmp0, c3, c0, 0) + .endm + ++#undef DACR ++ + #endif /* __ASM_UACCESS_ASM_H__ */ +-- +2.25.1 + diff --git a/queue-5.4/arm64-dts-mt8173-fix-vcodec-enc-clock.patch b/queue-5.4/arm64-dts-mt8173-fix-vcodec-enc-clock.patch new file mode 100644 index 00000000000..358f2efe06a --- /dev/null +++ b/queue-5.4/arm64-dts-mt8173-fix-vcodec-enc-clock.patch @@ -0,0 +1,54 @@ +From b5a74c571b71e99d9177a2066fe69a030dff5e09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2020 20:44:43 +0800 +Subject: arm64: dts: mt8173: fix vcodec-enc clock + +From: Hsin-Yi Wang + +[ Upstream commit 3b1f6c5e4dfaf767f6f2f120cd93b347b5a9f1aa ] + +Fix the assigned-clock-parents to higher frequency clock to avoid h264 +encode timeout: + +[ 134.763465] mtk_vpu 10020000.vpu: vpu ipi 4 ack time out ! +[ 134.769008] [MTK_VCODEC][ERROR][18]: vpu_enc_send_msg() vpu_ipi_send msg_id c002 len 32 fail -5 +[ 134.777707] [MTK_VCODEC][ERROR][18]: vpu_enc_encode() AP_IPIMSG_ENC_ENCODE 0 fail + +venc_sel is the clock used by h264 encoder, and venclt_sel is the clock +used by vp8 encoder. Assign venc_sel to vcodecpll_ck and venclt_sel to +vcodecpll_370p5. + + vcodecpll 1482000000 + vcodecpll_ck 494000000 + venc_sel 494000000 +... + vcodecpll_370p5 370500000 + venclt_sel 370500000 + +Fixes: fbbad0287cec ("arm64: dts: Using standard CCF interface to set vcodec clk") +Signed-off-by: Hsin-Yi Wang +Link: https://lore.kernel.org/r/20200504124442.208004-1-hsinyi@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +index 15f1842f6df3..5891b7151432 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +@@ -1397,8 +1397,8 @@ + "venc_lt_sel"; + assigned-clocks = <&topckgen CLK_TOP_VENC_SEL>, + <&topckgen CLK_TOP_VENC_LT_SEL>; +- assigned-clock-parents = <&topckgen CLK_TOP_VENCPLL_D2>, +- <&topckgen CLK_TOP_UNIVPLL1_D2>; ++ assigned-clock-parents = <&topckgen CLK_TOP_VCODECPLL>, ++ <&topckgen CLK_TOP_VCODECPLL_370P5>; + }; + + vencltsys: clock-controller@19000000 { +-- +2.25.1 + diff --git a/queue-5.4/ceph-flush-release-queue-when-handling-caps-for-unkn.patch b/queue-5.4/ceph-flush-release-queue-when-handling-caps-for-unkn.patch new file mode 100644 index 00000000000..a5a5aeeda4e --- /dev/null +++ b/queue-5.4/ceph-flush-release-queue-when-handling-caps-for-unkn.patch @@ -0,0 +1,48 @@ +From 291ac93e5187c65684365973bad1e12d09f540e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 May 2020 10:36:07 -0400 +Subject: ceph: flush release queue when handling caps for unknown inode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jeff Layton + +[ Upstream commit fb33c114d3ed5bdac230716f5b0a93b56b92a90d ] + +It's possible for the VFS to completely forget about an inode, but for +it to still be sitting on the cap release queue. If the MDS sends the +client a cap message for such an inode, it just ignores it today, which +can lead to a stall of up to 5s until the cap release queue is flushed. + +If we get a cap message for an inode that can't be located, then go +ahead and flush the cap release queue. + +Cc: stable@vger.kernel.org +URL: https://tracker.ceph.com/issues/45532 +Fixes: 1e9c2eb6811e ("ceph: delete stale dentry when last reference is dropped") +Reported-and-Tested-by: Andrej Filipčič +Suggested-by: Yan, Zheng +Signed-off-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index 2d602c2b0ff6..b2695919435e 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -3938,7 +3938,7 @@ void ceph_handle_caps(struct ceph_mds_session *session, + __ceph_queue_cap_release(session, cap); + spin_unlock(&session->s_cap_lock); + } +- goto done; ++ goto flush_cap_releases; + } + + /* these will work even if we don't have a cap yet */ +-- +2.25.1 + diff --git a/queue-5.4/clk-qcom-gcc-fix-parent-for-gpll0_out_even.patch b/queue-5.4/clk-qcom-gcc-fix-parent-for-gpll0_out_even.patch new file mode 100644 index 00000000000..c72a0c8bd7c --- /dev/null +++ b/queue-5.4/clk-qcom-gcc-fix-parent-for-gpll0_out_even.patch @@ -0,0 +1,40 @@ +From dedac3c30cd2128f069c852794402652ad8f6b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 10:57:28 +0530 +Subject: clk: qcom: gcc: Fix parent for gpll0_out_even + +From: Vinod Koul + +[ Upstream commit a76f274182f054481182c81cd62bb8794a5450a6 ] + +Documentation says that gpll0 is parent of gpll0_out_even, somehow +driver coded that as bi_tcxo, so fix it + +Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150") +Reported-by: Jonathan Marek +Signed-off-by: Vinod Koul +Link: https://lkml.kernel.org/r/20200521052728.2141377-1-vkoul@kernel.org +Reviewed-by: Bjorn Andersson +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8150.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c +index 20877214acff..e3959ff5cb55 100644 +--- a/drivers/clk/qcom/gcc-sm8150.c ++++ b/drivers/clk/qcom/gcc-sm8150.c +@@ -75,8 +75,7 @@ static struct clk_alpha_pll_postdiv gpll0_out_even = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "gpll0_out_even", + .parent_data = &(const struct clk_parent_data){ +- .fw_name = "bi_tcxo", +- .name = "bi_tcxo", ++ .hw = &gpll0.clkr.hw, + }, + .num_parents = 1, + .ops = &clk_trion_pll_postdiv_ops, +-- +2.25.1 + diff --git a/queue-5.4/drm-amd-display-drop-cursor-position-check-in-atomic.patch b/queue-5.4/drm-amd-display-drop-cursor-position-check-in-atomic.patch new file mode 100644 index 00000000000..caf7dc11178 --- /dev/null +++ b/queue-5.4/drm-amd-display-drop-cursor-position-check-in-atomic.patch @@ -0,0 +1,45 @@ +From 6355fd1a3399d1220b1d3c9a588d4d46381397c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 May 2020 11:53:41 +0000 +Subject: drm/amd/display: drop cursor position check in atomic test + +From: Simon Ser + +[ Upstream commit f7d5991b92ff824798693ddf231cf814c9d5a88b ] + +get_cursor_position already handles the case where the cursor has +negative off-screen coordinates by not setting +dc_cursor_position.enabled. + +Signed-off-by: Simon Ser +Fixes: 626bf90fe03f ("drm/amd/display: add basic atomic check for cursor plane") +Cc: Alex Deucher +Cc: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 9f30343262f3..9fd12e108a70 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -6951,13 +6951,6 @@ static int dm_update_plane_state(struct dc *dc, + return -EINVAL; + } + +- if (new_plane_state->crtc_x <= -new_acrtc->max_cursor_width || +- new_plane_state->crtc_y <= -new_acrtc->max_cursor_height) { +- DRM_DEBUG_ATOMIC("Bad cursor position %d, %d\n", +- new_plane_state->crtc_x, new_plane_state->crtc_y); +- return -EINVAL; +- } +- + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch b/queue-5.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch new file mode 100644 index 00000000000..6a4a398a02e --- /dev/null +++ b/queue-5.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch @@ -0,0 +1,52 @@ +From 36f284d2ab296e95256957e0a0344603af1da842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 May 2020 12:56:15 -0500 +Subject: exec: Always set cap_ambient in cap_bprm_set_creds + +From: Eric W. Biederman + +[ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ] + +An invariant of cap_bprm_set_creds is that every field in the new cred +structure that cap_bprm_set_creds might set, needs to be set every +time to ensure the fields does not get a stale value. + +The field cap_ambient is not set every time cap_bprm_set_creds is +called, which means that if there is a suid or sgid script with an +interpreter that has neither the suid nor the sgid bits set the +interpreter should be able to accept ambient credentials. +Unfortuantely because cap_ambient is not reset to it's original value +the interpreter can not accept ambient credentials. + +Given that the ambient capability set is expected to be controlled by +the caller, I don't think this is particularly serious. But it is +definitely worth fixing so the code works correctly. + +I have tested to verify my reading of the code is correct and the +interpreter of a sgid can receive ambient capabilities with this +change and cannot receive ambient capabilities without this change. + +Cc: stable@vger.kernel.org +Cc: Andy Lutomirski +Fixes: 58319057b784 ("capabilities: ambient capabilities") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + security/commoncap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/commoncap.c b/security/commoncap.c +index f4ee0ae106b2..0ca31c8bc0b1 100644 +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -812,6 +812,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) + int ret; + kuid_t root_uid; + ++ new->cap_ambient = old->cap_ambient; + if (WARN_ON(!cap_ambient_invariant_ok(old))) + return -EPERM; + +-- +2.25.1 + diff --git a/queue-5.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch b/queue-5.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch new file mode 100644 index 00000000000..4ea9c88cbf3 --- /dev/null +++ b/queue-5.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch @@ -0,0 +1,45 @@ +From 4c6ad925f941142c19f2170182de250ac4104601 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:52 -0700 +Subject: fs/binfmt_elf.c: allocate initialized memory in + fill_thread_core_info() + +From: Alexander Potapenko + +[ Upstream commit 1d605416fb7175e1adf094251466caa52093b413 ] + +KMSAN reported uninitialized data being written to disk when dumping +core. As a result, several kilobytes of kmalloc memory may be written +to the core file and then read by a non-privileged user. + +Reported-by: sam +Signed-off-by: Alexander Potapenko +Signed-off-by: Andrew Morton +Acked-by: Kees Cook +Cc: Al Viro +Cc: Alexey Dobriyan +Cc: +Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com +Link: https://github.com/google/kmsan/issues/76 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/binfmt_elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index c5642bcb6b46..7ce3cfd965d2 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1731,7 +1731,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset_size(t->task, regset); +- void *data = kmalloc(size, GFP_KERNEL); ++ void *data = kzalloc(size, GFP_KERNEL); + if (unlikely(!data)) + return 0; + ret = regset->get(t->task, regset, +-- +2.25.1 + diff --git a/queue-5.4/gpio-bcm-kona-fix-return-value-of-bcm_kona_gpio_prob.patch b/queue-5.4/gpio-bcm-kona-fix-return-value-of-bcm_kona_gpio_prob.patch new file mode 100644 index 00000000000..a2cf547898f --- /dev/null +++ b/queue-5.4/gpio-bcm-kona-fix-return-value-of-bcm_kona_gpio_prob.patch @@ -0,0 +1,37 @@ +From 5649f304befc2554319fd122368906cc7942524c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 12:12:18 +0800 +Subject: gpio: bcm-kona: Fix return value of bcm_kona_gpio_probe() + +From: Tiezhu Yang + +[ Upstream commit 98f7d1b15e87c84488b30ecc4ec753b0690b9dbf ] + +Propagate the error code returned by devm_platform_ioremap_resource() +out of probe() instead of overwriting it. + +Fixes: 72d8cb715477 ("drivers: gpio: bcm-kona: use devm_platform_ioremap_resource()") +Signed-off-by: Tiezhu Yang +[Bartosz: tweaked the commit message] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-bcm-kona.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c +index 9fa6d3a967d2..100575973e1f 100644 +--- a/drivers/gpio/gpio-bcm-kona.c ++++ b/drivers/gpio/gpio-bcm-kona.c +@@ -619,7 +619,7 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev) + + kona_gpio->reg_base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(kona_gpio->reg_base)) { +- ret = -ENXIO; ++ ret = PTR_ERR(kona_gpio->reg_base); + goto err_irq_domain; + } + +-- +2.25.1 + diff --git a/queue-5.4/gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch b/queue-5.4/gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch new file mode 100644 index 00000000000..fedd294593f --- /dev/null +++ b/queue-5.4/gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch @@ -0,0 +1,55 @@ +From 87527e857233c66df78193a6de35712d36476fb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Apr 2020 15:56:54 +0200 +Subject: gpio: exar: Fix bad handling for ida_simple_get error path + +From: Takashi Iwai + +[ Upstream commit 333830aa149a87cabeb5d30fbcf12eecc8040d2c ] + +The commit 7ecced0934e5 ("gpio: exar: add a check for the return value +of ida_simple_get fails") added a goto jump to the common error +handler for ida_simple_get() error, but this is wrong in two ways: +it doesn't set the proper return code and, more badly, it invokes +ida_simple_remove() with a negative index that shall lead to a kernel +panic via BUG_ON(). + +This patch addresses those two issues. + +Fixes: 7ecced0934e5 ("gpio: exar: add a check for the return value of ida_simple_get fails") +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-exar.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c +index fae327d5b06e..6890d32d9f25 100644 +--- a/drivers/gpio/gpio-exar.c ++++ b/drivers/gpio/gpio-exar.c +@@ -145,8 +145,10 @@ static int gpio_exar_probe(struct platform_device *pdev) + mutex_init(&exar_gpio->lock); + + index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL); +- if (index < 0) +- goto err_destroy; ++ if (index < 0) { ++ ret = index; ++ goto err_mutex_destroy; ++ } + + sprintf(exar_gpio->name, "exar_gpio%d", index); + exar_gpio->gpio_chip.label = exar_gpio->name; +@@ -173,6 +175,7 @@ static int gpio_exar_probe(struct platform_device *pdev) + + err_destroy: + ida_simple_remove(&ida_index, index); ++err_mutex_destroy: + mutex_destroy(&exar_gpio->lock); + return ret; + } +-- +2.25.1 + diff --git a/queue-5.4/gpio-fix-locking-open-drain-irq-lines.patch b/queue-5.4/gpio-fix-locking-open-drain-irq-lines.patch new file mode 100644 index 00000000000..7754d758d3e --- /dev/null +++ b/queue-5.4/gpio-fix-locking-open-drain-irq-lines.patch @@ -0,0 +1,61 @@ +From 11916f69284be9d657bbd0987fe202977118ac49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 16:07:58 +0200 +Subject: gpio: fix locking open drain IRQ lines + +From: Linus Walleij + +[ Upstream commit e9bdf7e655b9ee81ee912fae1d59df48ce7311b6 ] + +We provided the right semantics on open drain lines being +by definition output but incidentally the irq set up function +would only allow IRQs on lines that were "not output". + +Fix the semantics to allow output open drain lines to be used +for IRQs. + +Reported-by: Hans Verkuil +Signed-off-by: Linus Walleij +Signed-off-by: Hans Verkuil +Tested-by: Hans Verkuil +Cc: Russell King +Cc: stable@vger.kernel.org # v5.3+ +Link: https://lore.kernel.org/r/20200527140758.162280-1-linus.walleij@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index a8cf55eb54d8..abdf448b11a3 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -3894,7 +3894,9 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset) + } + } + +- if (test_bit(FLAG_IS_OUT, &desc->flags)) { ++ /* To be valid for IRQ the line needs to be input or open drain */ ++ if (test_bit(FLAG_IS_OUT, &desc->flags) && ++ !test_bit(FLAG_OPEN_DRAIN, &desc->flags)) { + chip_err(chip, + "%s: tried to flag a GPIO set as output for IRQ\n", + __func__); +@@ -3957,7 +3959,12 @@ void gpiochip_enable_irq(struct gpio_chip *chip, unsigned int offset) + + if (!IS_ERR(desc) && + !WARN_ON(!test_bit(FLAG_USED_AS_IRQ, &desc->flags))) { +- WARN_ON(test_bit(FLAG_IS_OUT, &desc->flags)); ++ /* ++ * We must not be output when using IRQ UNLESS we are ++ * open drain. ++ */ ++ WARN_ON(test_bit(FLAG_IS_OUT, &desc->flags) && ++ !test_bit(FLAG_OPEN_DRAIN, &desc->flags)); + set_bit(FLAG_IRQ_IS_ENABLED, &desc->flags); + } + } +-- +2.25.1 + diff --git a/queue-5.4/gpio-pxa-fix-return-value-of-pxa_gpio_probe.patch b/queue-5.4/gpio-pxa-fix-return-value-of-pxa_gpio_probe.patch new file mode 100644 index 00000000000..60c59cc7587 --- /dev/null +++ b/queue-5.4/gpio-pxa-fix-return-value-of-pxa_gpio_probe.patch @@ -0,0 +1,38 @@ +From 6978b2f070d90278aed64c49920fa451dea28fa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 12:12:19 +0800 +Subject: gpio: pxa: Fix return value of pxa_gpio_probe() + +From: Tiezhu Yang + +[ Upstream commit 558ab2e8155e5f42ca0a6407957cd4173dc166cc ] + +When call function devm_platform_ioremap_resource(), we should use IS_ERR() +to check the return value and return PTR_ERR() if failed. + +Fixes: 542c25b7a209 ("drivers: gpio: pxa: use devm_platform_ioremap_resource()") +Signed-off-by: Tiezhu Yang +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pxa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index 9888b62f37af..432c487f77b4 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -663,8 +663,8 @@ static int pxa_gpio_probe(struct platform_device *pdev) + pchip->irq1 = irq1; + + gpio_reg_base = devm_platform_ioremap_resource(pdev, 0); +- if (!gpio_reg_base) +- return -EINVAL; ++ if (IS_ERR(gpio_reg_base)) ++ return PTR_ERR(gpio_reg_base); + + clk = clk_get(&pdev->dev, NULL); + if (IS_ERR(clk)) { +-- +2.25.1 + diff --git a/queue-5.4/gpu-drm-ingenic-fix-opaque-pointer-casted-to-wrong-t.patch b/queue-5.4/gpu-drm-ingenic-fix-opaque-pointer-casted-to-wrong-t.patch new file mode 100644 index 00000000000..5ef2a36fe0e --- /dev/null +++ b/queue-5.4/gpu-drm-ingenic-fix-opaque-pointer-casted-to-wrong-t.patch @@ -0,0 +1,42 @@ +From 94be362c055adeed3e0058129c1cb4be580ef539 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 May 2020 23:50:50 +0200 +Subject: gpu/drm: Ingenic: Fix opaque pointer casted to wrong type + +From: Paul Cercueil + +[ Upstream commit abf56fadf0e208abfb13ad1ac0094416058da0ad ] + +The opaque pointer passed to the IRQ handler is a pointer to the +drm_device, not a pointer to our ingenic_drm structure. + +It still worked, because our ingenic_drm structure contains the +drm_device as its first field, so the pointer received had the same +value, but this was not semantically correct. + +Cc: stable@vger.kernel.org # v5.3 +Fixes: 90b86fcc47b4 ("DRM: Add KMS driver for the Ingenic JZ47xx SoCs") +Signed-off-by: Paul Cercueil +Link: https://patchwork.freedesktop.org/patch/msgid/20200516215057.392609-5-paul@crapouillou.net +Acked-by: Sam Ravnborg +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ingenic/ingenic-drm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ingenic/ingenic-drm.c b/drivers/gpu/drm/ingenic/ingenic-drm.c +index 9e95f6fd5406..376fca6ca9f4 100644 +--- a/drivers/gpu/drm/ingenic/ingenic-drm.c ++++ b/drivers/gpu/drm/ingenic/ingenic-drm.c +@@ -467,7 +467,7 @@ static int ingenic_drm_encoder_atomic_check(struct drm_encoder *encoder, + + static irqreturn_t ingenic_drm_irq_handler(int irq, void *arg) + { +- struct ingenic_drm *priv = arg; ++ struct ingenic_drm *priv = drm_device_get_priv(arg); + unsigned int state; + + regmap_read(priv->map, JZ_REG_LCD_STATE, &state); +-- +2.25.1 + diff --git a/queue-5.4/ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch b/queue-5.4/ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch new file mode 100644 index 00000000000..8649da11602 --- /dev/null +++ b/queue-5.4/ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch @@ -0,0 +1,243 @@ +From b2ffc4e7b583c3c283ed2100158b3655c4e92a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 16:47:05 +0300 +Subject: IB/ipoib: Fix double free of skb in case of multicast traffic in CM + mode + +From: Valentine Fatiev + +[ Upstream commit 1acba6a817852d4aa7916d5c4f2c82f702ee9224 ] + +When connected mode is set, and we have connected and datagram traffic in +parallel, ipoib might crash with double free of datagram skb. + +The current mechanism assumes that the order in the completion queue is +the same as the order of sent packets for all QPs. Order is kept only for +specific QP, in case of mixed UD and CM traffic we have few QPs (one UD and +few CM's) in parallel. + +The problem: +---------------------------------------------------------- + +Transmit queue: +----------------- +UD skb pointer kept in queue itself, CM skb kept in spearate queue and +uses transmit queue as a placeholder to count the number of total +transmitted packets. + +0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127 +------------------------------------------------------------ +NL ud1 UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ........... +------------------------------------------------------------ + ^ ^ + tail head + +Completion queue (problematic scenario) - the order not the same as in +the transmit queue: + + 1 2 3 4 5 6 7 8 9 +------------------------------------ + ud1 CM1 UD2 ud3 cm2 cm3 ud4 cm4 ud5 +------------------------------------ + +1. CM1 'wc' processing + - skb freed in cm separate ring. + - tx_tail of transmit queue increased although UD2 is not freed. + Now driver assumes UD2 index is already freed and it could be used for + new transmitted skb. + +0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127 +------------------------------------------------------------ +NL NL UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ........... +------------------------------------------------------------ + ^ ^ ^ + (Bad)tail head +(Bad - Could be used for new SKB) + +In this case (due to heavy load) UD2 skb pointer could be replaced by new +transmitted packet UD_NEW, as the driver assumes its free. At this point +we will have to process two 'wc' with same index but we have only one +pointer to free. + +During second attempt to free the same skb we will have NULL pointer +exception. + +2. UD2 'wc' processing + - skb freed according the index we got from 'wc', but it was already + overwritten by mistake. So actually the skb that was released is the + skb of the new transmitted packet and not the original one. + +3. UD_NEW 'wc' processing + - attempt to free already freed skb. NUll pointer exception. + +The fix: +----------------------------------------------------------------------- + +The fix is to stop using the UD ring as a placeholder for CM packets, the +cyclic ring variables tx_head and tx_tail will manage the UD tx_ring, a +new cyclic variables global_tx_head and global_tx_tail are introduced for +managing and counting the overall outstanding sent packets, then the send +queue will be stopped and waken based on these variables only. + +Note that no locking is needed since global_tx_head is updated in the xmit +flow and global_tx_tail is updated in the NAPI flow only. A previous +attempt tried to use one variable to count the outstanding sent packets, +but it did not work since xmit and NAPI flows can run at the same time and +the counter will be updated wrongly. Thus, we use the same simple cyclic +head and tail scheme that we have today for the UD tx_ring. + +Fixes: 2c104ea68350 ("IB/ipoib: Get rid of the tx_outstanding variable in all modes") +Link: https://lore.kernel.org/r/20200527134705.480068-1-leon@kernel.org +Signed-off-by: Valentine Fatiev +Signed-off-by: Alaa Hleihel +Signed-off-by: Leon Romanovsky +Acked-by: Doug Ledford +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib.h | 4 ++++ + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 15 +++++++++------ + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 +++++++-- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 10 ++++++---- + 4 files changed, 26 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 2aa3457a30ce..0e5f27caf2b2 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -377,8 +377,12 @@ struct ipoib_dev_priv { + struct ipoib_rx_buf *rx_ring; + + struct ipoib_tx_buf *tx_ring; ++ /* cyclic ring variables for managing tx_ring, for UD only */ + unsigned int tx_head; + unsigned int tx_tail; ++ /* cyclic ring variables for counting overall outstanding send WRs */ ++ unsigned int global_tx_head; ++ unsigned int global_tx_tail; + struct ib_sge tx_sge[MAX_SKB_FRAGS + 1]; + struct ib_ud_wr tx_wr; + struct ib_wc send_wc[MAX_SEND_CQE]; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index c59e00a0881f..9bf0fa30df28 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -756,7 +756,8 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_ + return; + } + +- if ((priv->tx_head - priv->tx_tail) == ipoib_sendq_size - 1) { ++ if ((priv->global_tx_head - priv->global_tx_tail) == ++ ipoib_sendq_size - 1) { + ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n", + tx->qp->qp_num); + netif_stop_queue(dev); +@@ -786,7 +787,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_ + } else { + netif_trans_update(dev); + ++tx->tx_head; +- ++priv->tx_head; ++ ++priv->global_tx_head; + } + } + +@@ -820,10 +821,11 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc) + netif_tx_lock(dev); + + ++tx->tx_tail; +- ++priv->tx_tail; ++ ++priv->global_tx_tail; + + if (unlikely(netif_queue_stopped(dev) && +- (priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1 && ++ ((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))) + netif_wake_queue(dev); + +@@ -1232,8 +1234,9 @@ timeout: + dev_kfree_skb_any(tx_req->skb); + netif_tx_lock_bh(p->dev); + ++p->tx_tail; +- ++priv->tx_tail; +- if (unlikely(priv->tx_head - priv->tx_tail == ipoib_sendq_size >> 1) && ++ ++priv->global_tx_tail; ++ if (unlikely((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + netif_queue_stopped(p->dev) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) + netif_wake_queue(p->dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index c332b4761816..da3c5315bbb5 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -407,9 +407,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc) + dev_kfree_skb_any(tx_req->skb); + + ++priv->tx_tail; ++ ++priv->global_tx_tail; + + if (unlikely(netif_queue_stopped(dev) && +- ((priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1) && ++ ((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))) + netif_wake_queue(dev); + +@@ -634,7 +636,8 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + else + priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM; + /* increase the tx_head after send success, but use it for queue state */ +- if (priv->tx_head - priv->tx_tail == ipoib_sendq_size - 1) { ++ if ((priv->global_tx_head - priv->global_tx_tail) == ++ ipoib_sendq_size - 1) { + ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n"); + netif_stop_queue(dev); + } +@@ -662,6 +665,7 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + + rc = priv->tx_head; + ++priv->tx_head; ++ ++priv->global_tx_head; + } + return rc; + } +@@ -807,6 +811,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev) + ipoib_dma_unmap_tx(priv, tx_req); + dev_kfree_skb_any(tx_req->skb); + ++priv->tx_tail; ++ ++priv->global_tx_tail; + } + + for (i = 0; i < ipoib_recvq_size; ++i) { +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index ac0583ff280d..4fd095fd63b6 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1188,9 +1188,11 @@ static void ipoib_timeout(struct net_device *dev) + + ipoib_warn(priv, "transmit timeout: latency %d msecs\n", + jiffies_to_msecs(jiffies - dev_trans_start(dev))); +- ipoib_warn(priv, "queue stopped %d, tx_head %u, tx_tail %u\n", +- netif_queue_stopped(dev), +- priv->tx_head, priv->tx_tail); ++ ipoib_warn(priv, ++ "queue stopped %d, tx_head %u, tx_tail %u, global_tx_head %u, global_tx_tail %u\n", ++ netif_queue_stopped(dev), priv->tx_head, priv->tx_tail, ++ priv->global_tx_head, priv->global_tx_tail); ++ + /* XXX reset QP, etc. */ + } + +@@ -1705,7 +1707,7 @@ static int ipoib_dev_init_default(struct net_device *dev) + goto out_rx_ring_cleanup; + } + +- /* priv->tx_head, tx_tail & tx_outstanding are already 0 */ ++ /* priv->tx_head, tx_tail and global_tx_tail/head are already 0 */ + + if (ipoib_transport_dev_init(dev, priv->ca)) { + pr_warn("%s: ipoib_transport_dev_init failed\n", +-- +2.25.1 + diff --git a/queue-5.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch b/queue-5.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch new file mode 100644 index 00000000000..86b0b40483c --- /dev/null +++ b/queue-5.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch @@ -0,0 +1,82 @@ +From d5c48f194a736f66c242b29359f7af78c81f4ad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 May 2020 23:13:28 -0400 +Subject: IB/qib: Call kobject_put() when kobject_init_and_add() fails + +From: Kaike Wan + +[ Upstream commit a35cd6447effd5c239b564c80fa109d05ff3d114 ] + +When kobject_init_and_add() returns an error in the function +qib_create_port_files(), the function kobject_put() is not called for the +corresponding kobject, which potentially leads to memory leak. + +This patch fixes the issue by calling kobject_put() even if +kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released +along with other kobjects when the sysfs is unregistered. + +Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") +Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com +Cc: +Suggested-by: Lin Yi +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 568b21eb6ea1..021df0654ba7 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -760,7 +760,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping linkcontrol sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail; ++ goto bail_link; + } + kobject_uevent(&ppd->pport_kobj, KOBJ_ADD); + +@@ -770,7 +770,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping sl2vl sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_link; ++ goto bail_sl; + } + kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD); + +@@ -780,7 +780,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping diag_counters sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_sl; ++ goto bail_diagc; + } + kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD); + +@@ -793,7 +793,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping Congestion Control sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_diagc; ++ goto bail_cc; + } + + kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); +@@ -854,6 +854,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd) + &cc_table_bin_attr); + kobject_put(&ppd->pport_cc_kobj); + } ++ kobject_put(&ppd->diagc_kobj); + kobject_put(&ppd->sl2vl_kobj); + kobject_put(&ppd->pport_kobj); + } +-- +2.25.1 + diff --git a/queue-5.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch b/queue-5.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch new file mode 100644 index 00000000000..ccde8feee46 --- /dev/null +++ b/queue-5.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch @@ -0,0 +1,48 @@ +From 745825e171b16b71d545cf6642bc6f90dab3fe53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:55 -0700 +Subject: include/asm-generic/topology.h: guard cpumask_of_node() macro + argument + +From: Arnd Bergmann + +[ Upstream commit 4377748c7b5187c3342a60fa2ceb60c8a57a8488 ] + +drivers/hwmon/amd_energy.c:195:15: error: invalid operands to binary expression ('void' and 'int') + (channel - data->nr_cpus)); + ~~~~~~~~~^~~~~~~~~~~~~~~~~ +include/asm-generic/topology.h:51:42: note: expanded from macro 'cpumask_of_node' + #define cpumask_of_node(node) ((void)node, cpu_online_mask) + ^~~~ +include/linux/cpumask.h:618:72: note: expanded from macro 'cpumask_first_and' + #define cpumask_first_and(src1p, src2p) cpumask_next_and(-1, (src1p), (src2p)) + ^~~~~ + +Fixes: f0b848ce6fe9 ("cpumask: Introduce cpumask_of_{node,pcibus} to replace {node,pcibus}_to_cpumask") +Fixes: 8abee9566b7e ("hwmon: Add amd_energy driver to report energy counters") +Signed-off-by: Arnd Bergmann +Signed-off-by: Andrew Morton +Acked-by: Guenter Roeck +Link: http://lkml.kernel.org/r/20200527134623.930247-1-arnd@arndb.de +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/asm-generic/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h +index 238873739550..5aa8705df87e 100644 +--- a/include/asm-generic/topology.h ++++ b/include/asm-generic/topology.h +@@ -48,7 +48,7 @@ + #ifdef CONFIG_NEED_MULTIPLE_NODES + #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask) + #else +- #define cpumask_of_node(node) ((void)node, cpu_online_mask) ++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask) + #endif + #endif + #ifndef pcibus_to_node +-- +2.25.1 + diff --git a/queue-5.4/input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch b/queue-5.4/input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch new file mode 100644 index 00000000000..0d216a78f37 --- /dev/null +++ b/queue-5.4/input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch @@ -0,0 +1,38 @@ +From 918d2972011c9681ff44477d650dcfd0288033c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 13:58:42 -0700 +Subject: Input: dlink-dir685-touchkeys - fix a typo in driver name + +From: Christophe JAILLET + +[ Upstream commit 38347374ae3f1ec4df56dd688bd603a64e79a0ed ] + +According to the file name and Kconfig, a 'k' is missing in this driver +name. It should be "dlink-dir685-touchkeys". + +Fixes: 131b3de7016b ("Input: add D-Link DIR-685 touchkeys driver") +Signed-off-by: Christophe JAILLET +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20200412213937.5287-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/dlink-dir685-touchkeys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/keyboard/dlink-dir685-touchkeys.c b/drivers/input/keyboard/dlink-dir685-touchkeys.c +index b0ead7199c40..a69dcc3bd30c 100644 +--- a/drivers/input/keyboard/dlink-dir685-touchkeys.c ++++ b/drivers/input/keyboard/dlink-dir685-touchkeys.c +@@ -143,7 +143,7 @@ MODULE_DEVICE_TABLE(of, dir685_tk_of_match); + + static struct i2c_driver dir685_tk_i2c_driver = { + .driver = { +- .name = "dlin-dir685-touchkeys", ++ .name = "dlink-dir685-touchkeys", + .of_match_table = of_match_ptr(dir685_tk_of_match), + }, + .probe = dir685_tk_probe, +-- +2.25.1 + diff --git a/queue-5.4/input-evdev-call-input_flush_device-on-release-not-f.patch b/queue-5.4/input-evdev-call-input_flush_device-on-release-not-f.patch new file mode 100644 index 00000000000..317eb4567bd --- /dev/null +++ b/queue-5.4/input-evdev-call-input_flush_device-on-release-not-f.patch @@ -0,0 +1,75 @@ +From 338d1d19731eb6713db7c09910d6e65e67c080dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 13:45:12 -0700 +Subject: Input: evdev - call input_flush_device() on release(), not flush() + +From: Brendan Shanks + +[ Upstream commit 09264098ff153f60866039d60b31d39b66f55a31 ] + +input_flush_device() should only be called once the struct file is being +released and no open descriptors remain, but evdev_flush() was calling +it whenever a file descriptor was closed. + +This caused uploaded force-feedback effects to be erased when a process +did a dup()/close() on the event FD, called system(), etc. + +Call input_flush_device() from evdev_release() instead. + +Reported-by: Mathieu Maret +Signed-off-by: Brendan Shanks +Link: https://lore.kernel.org/r/20200421231003.7935-1-bshanks@codeweavers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/evdev.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c +index cb6e3a5f509c..0d57e51b8ba1 100644 +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -326,20 +326,6 @@ static int evdev_fasync(int fd, struct file *file, int on) + return fasync_helper(fd, file, on, &client->fasync); + } + +-static int evdev_flush(struct file *file, fl_owner_t id) +-{ +- struct evdev_client *client = file->private_data; +- struct evdev *evdev = client->evdev; +- +- mutex_lock(&evdev->mutex); +- +- if (evdev->exist && !client->revoked) +- input_flush_device(&evdev->handle, file); +- +- mutex_unlock(&evdev->mutex); +- return 0; +-} +- + static void evdev_free(struct device *dev) + { + struct evdev *evdev = container_of(dev, struct evdev, dev); +@@ -453,6 +439,10 @@ static int evdev_release(struct inode *inode, struct file *file) + unsigned int i; + + mutex_lock(&evdev->mutex); ++ ++ if (evdev->exist && !client->revoked) ++ input_flush_device(&evdev->handle, file); ++ + evdev_ungrab(evdev, client); + mutex_unlock(&evdev->mutex); + +@@ -1310,7 +1300,6 @@ static const struct file_operations evdev_fops = { + .compat_ioctl = evdev_ioctl_compat, + #endif + .fasync = evdev_fasync, +- .flush = evdev_flush, + .llseek = no_llseek, + }; + +-- +2.25.1 + diff --git a/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch b/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch new file mode 100644 index 00000000000..53a3f067a6f --- /dev/null +++ b/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch @@ -0,0 +1,63 @@ +From 2243e4f1fc4ab6a572a94b2133d86137ee63c68d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Apr 2020 10:02:19 -0700 +Subject: Input: i8042 - add ThinkPad S230u to i8042 nomux list + +From: Kevin Locke + +[ Upstream commit 18931506465a762ffd3f4803d36a18d336a67da9 ] + +On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version +"GDETC1WW (1.81 ) 06/27/2019", whether booted in UEFI or Legacy/CSM mode +the keyboard, Synaptics TouchPad, and TrackPoint either do not function +or stop functioning a few minutes after boot. This problem has been +noted before, perhaps only occurring on BIOS 1.57 and +later.[1][2][3][4][5] + +This model does not have an external PS/2 port, so mux does not appear +to be useful. + +Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago +and although the [BIOS changelog] notes "Fixed an issue of UEFI +touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be +insufficient. + +Adding 33474HU to the nomux list avoids the issue on my system. + +[1]: https://bugs.launchpad.net/bugs/1210748 +[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425 +[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200 +[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115 +[5]: https://forums.lenovo.com/topic/findpost/27/1337119 +[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt + +Signed-off-by: Kevin Locke +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/feb8a8339a67025dab3850e6377eb6f3a0e782ba.1587400635.git.kevin@kevinlocke.name +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 08e919dbeb5d..5bbc9152731d 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -541,6 +541,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), + }, + }, ++ { ++ /* Lenovo ThinkPad Twist S230u */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), ++ }, ++ }, + { } + }; + +-- +2.25.1 + diff --git a/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch b/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch new file mode 100644 index 00000000000..335a11db458 --- /dev/null +++ b/queue-5.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch @@ -0,0 +1,60 @@ +From 134654501dd5dfbd78cef7a56a9187e8f07a719e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 18:07:20 -0700 +Subject: Input: i8042 - add ThinkPad S230u to i8042 reset list + +From: Kevin Locke + +[ Upstream commit 2712c91a54a1058d55c284152b4d93c979b67be6 ] + +On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version +"GDETC1WW (1.81 ) 06/27/2019", the keyboard, Synaptics TouchPad, and +TrackPoint either do not function or stop functioning a few minutes +after boot. This problem has been noted before, perhaps only occurring +with BIOS 1.57 and later.[1][2][3][4][5] + +Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago +and although the [BIOS changelog] notes "Fixed an issue of UEFI +touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be +insufficient. + +Setting i8042.reset=1 or adding 33474HU to the reset list avoids the +issue on my system from either warm or cold boot. + +[1]: https://bugs.launchpad.net/bugs/1210748 +[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425 +[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200 +[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115 +[5]: https://forums.lenovo.com/topic/findpost/27/1337119 +[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt + +Signed-off-by: Kevin Locke +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/94f384b0f75f90f71425d7dce7ac82c59ddb87a8.1587702636.git.kevin@kevinlocke.name +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 5bbc9152731d..c47800176534 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -669,6 +669,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), + }, + }, ++ { ++ /* Lenovo ThinkPad Twist S230u */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), ++ }, ++ }, + { } + }; + +-- +2.25.1 + diff --git a/queue-5.4/input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch b/queue-5.4/input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch new file mode 100644 index 00000000000..192db260b13 --- /dev/null +++ b/queue-5.4/input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch @@ -0,0 +1,38 @@ +From e457dbc04f421829632585aace547518cba3ae43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Apr 2020 16:09:53 -0700 +Subject: Input: synaptics-rmi4 - fix error return code in rmi_driver_probe() + +From: Wei Yongjun + +[ Upstream commit 5caab2da63207d6d631007f592f5219459e3454d ] + +Fix to return a negative error code from the input_register_device() +error handling case instead of 0, as done elsewhere in this function. + +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20200428134948.78343-1-weiyongjun1@huawei.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/rmi4/rmi_driver.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c +index c18e1a25bca6..258d5fe3d395 100644 +--- a/drivers/input/rmi4/rmi_driver.c ++++ b/drivers/input/rmi4/rmi_driver.c +@@ -1210,7 +1210,8 @@ static int rmi_driver_probe(struct device *dev) + if (data->input) { + rmi_driver_set_input_name(rmi_dev, data->input); + if (!rmi_dev->xport->input) { +- if (input_register_device(data->input)) { ++ retval = input_register_device(data->input); ++ if (retval) { + dev_err(dev, "%s: Failed to register input device.\n", + __func__); + goto err_destroy_functions; +-- +2.25.1 + diff --git a/queue-5.4/input-synaptics-rmi4-really-fix-attn_data-use-after-.patch b/queue-5.4/input-synaptics-rmi4-really-fix-attn_data-use-after-.patch new file mode 100644 index 00000000000..0e0f8288234 --- /dev/null +++ b/queue-5.4/input-synaptics-rmi4-really-fix-attn_data-use-after-.patch @@ -0,0 +1,49 @@ +From 652e949a62a4c5a695844f244c1f2b432f650a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 18:08:58 -0700 +Subject: Input: synaptics-rmi4 - really fix attn_data use-after-free + +From: Evan Green + +[ Upstream commit d5a5e5b5fa7b86c05bf073acc0ba98fa280174ec ] + +Fix a use-after-free noticed by running with KASAN enabled. If +rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among +others) will end up reading from drvdata->attn_data.data, which was +freed and left dangling in rmi_irq_fn(). + +Commit 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by +KASAN") correctly identified and analyzed this bug. However the attempted +fix only NULLed out a local variable, missing the fact that +drvdata->attn_data is a struct, not a pointer. + +NULL out the correct pointer in the driver data to prevent the attention +functions from copying from it. + +Fixes: 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by KASAN") +Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data") +Signed-off-by: Evan Green +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/rmi4/rmi_driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c +index 190b9974526b..c18e1a25bca6 100644 +--- a/drivers/input/rmi4/rmi_driver.c ++++ b/drivers/input/rmi4/rmi_driver.c +@@ -205,7 +205,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id) + + if (count) { + kfree(attn_data.data); +- attn_data.data = NULL; ++ drvdata->attn_data.data = NULL; + } + + if (!kfifo_is_empty(&drvdata->attn_fifo)) +-- +2.25.1 + diff --git a/queue-5.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch b/queue-5.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch new file mode 100644 index 00000000000..d5a9a61145b --- /dev/null +++ b/queue-5.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch @@ -0,0 +1,37 @@ +From 1510dde033b0dada8043776e4b7095068507daf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Apr 2020 21:17:12 -0700 +Subject: Input: usbtouchscreen - add support for BonXeon TP + +From: James Hilliard + +[ Upstream commit e3b4f94ef52ae1592cbe199bd38dbdc0d58b2217 ] + +Based on available information this uses the singletouch irtouch +protocol. This is tested and confirmed to be fully functional on +the BonXeon TP hardware I have. + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200413184217.55700-1-james.hilliard1@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/usbtouchscreen.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index 16d70201de4a..397cb1d3f481 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -182,6 +182,7 @@ static const struct usb_device_id usbtouch_devices[] = { + #endif + + #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH ++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES}, +-- +2.25.1 + diff --git a/queue-5.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch b/queue-5.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch new file mode 100644 index 00000000000..000c41b9a2e --- /dev/null +++ b/queue-5.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch @@ -0,0 +1,59 @@ +From 325e68786fcf3a9128ebbd3508c1664db2beea9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 14:13:09 -0700 +Subject: Input: xpad - add custom init packet for Xbox One S controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Patron + +[ Upstream commit 764f7f911bf72450c51eb74cbb262ad9933741d8 ] + +Sending [ 0x05, 0x20, 0x00, 0x0f, 0x06 ] packet for Xbox One S controllers +fixes an issue where controller is stuck in Bluetooth mode and not sending +any inputs. + +Signed-off-by: Łukasz Patron +Reviewed-by: Cameron Gutman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200422075206.18229-1-priv.luk@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 6b40a1c68f9f..c77cdb3b62b5 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -458,6 +458,16 @@ static const u8 xboxone_fw2015_init[] = { + 0x05, 0x20, 0x00, 0x01, 0x00 + }; + ++/* ++ * This packet is required for Xbox One S (0x045e:0x02ea) ++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to ++ * initialize the controller that was previously used in ++ * Bluetooth mode. ++ */ ++static const u8 xboxone_s_init[] = { ++ 0x05, 0x20, 0x00, 0x0f, 0x06 ++}; ++ + /* + * This packet is required for the Titanfall 2 Xbox One pads + * (0x0e6f:0x0165) to finish initialization and for Hori pads +@@ -516,6 +526,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = { + XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), ++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init), ++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2), + XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), +-- +2.25.1 + diff --git a/queue-5.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch b/queue-5.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch new file mode 100644 index 00000000000..28b37c81a7d --- /dev/null +++ b/queue-5.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch @@ -0,0 +1,38 @@ +From da81bbad6ca7931963fafde81f63ee81792131ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 16:00:19 -0500 +Subject: iommu: Fix reference count leak in iommu_group_alloc. + +From: Qiushi Wu + +[ Upstream commit 7cc31613734c4870ae32f5265d576ef296621343 ] + +kobject_init_and_add() takes reference even when it fails. +Thus, when kobject_init_and_add() returns an error, +kobject_put() must be called to properly clean up the kobject. + +Fixes: d72e31c93746 ("iommu: IOMMU Groups") +Signed-off-by: Qiushi Wu +Link: https://lore.kernel.org/r/20200527210020.6522-1-wu000273@umn.edu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index cd3c0ea56657..9d7232e26ecf 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -492,7 +492,7 @@ struct iommu_group *iommu_group_alloc(void) + NULL, "%d", group->id); + if (ret) { + ida_simple_remove(&iommu_group_ida, group->id); +- kfree(group); ++ kobject_put(&group->kobj); + return ERR_PTR(ret); + } + +-- +2.25.1 + diff --git a/queue-5.4/libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch b/queue-5.4/libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch new file mode 100644 index 00000000000..1a630f91ff4 --- /dev/null +++ b/queue-5.4/libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch @@ -0,0 +1,49 @@ +From ee1bfdb10d50ba88d51e618da865ea91a2e2925e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 May 2020 16:03:09 +0800 +Subject: libceph: ignore pool overlay and cache logic on redirects + +From: Jerry Lee + +[ Upstream commit 890bd0f8997ae6ac0a367dd5146154a3963306dd ] + +OSD client should ignore cache/overlay flag if got redirect reply. +Otherwise, the client hangs when the cache tier is in forward mode. + +[ idryomov: Redirects are effectively deprecated and no longer + used or tested. The original tiering modes based on redirects + are inherently flawed because redirects can race and reorder, + potentially resulting in data corruption. The new proxy and + readproxy tiering modes should be used instead of forward and + readforward. Still marking for stable as obviously correct, + though. ] + +Cc: stable@vger.kernel.org +URL: https://tracker.ceph.com/issues/23296 +URL: https://tracker.ceph.com/issues/36406 +Signed-off-by: Jerry Lee +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/osd_client.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c +index 2352afa62d1f..e513b8876d13 100644 +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -3652,7 +3652,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg) + * supported. + */ + req->r_t.target_oloc.pool = m.redirect.oloc.pool; +- req->r_flags |= CEPH_OSD_FLAG_REDIRECTED; ++ req->r_flags |= CEPH_OSD_FLAG_REDIRECTED | ++ CEPH_OSD_FLAG_IGNORE_OVERLAY | ++ CEPH_OSD_FLAG_IGNORE_CACHE; + req->r_tid = 0; + __submit_request(req, false); + goto out_unlock_osdc; +-- +2.25.1 + diff --git a/queue-5.4/mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch b/queue-5.4/mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch new file mode 100644 index 00000000000..95398520656 --- /dev/null +++ b/queue-5.4/mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch @@ -0,0 +1,99 @@ +From c7541f902c669515cbdfe682defa81368e1aa152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:47 -0700 +Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() + +From: Konstantin Khlebnikov + +[ Upstream commit 6988f31d558aa8c744464a7f6d91d34ada48ad12 ] + +Replace superfluous VM_BUG_ON() with comment about correct usage. + +Technically reverts commit 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to +page_mapcount()"), but context lines have changed. + +Function isolate_migratepages_block() runs some checks out of lru_lock +when choose pages for migration. After checking PageLRU() it checks +extra page references by comparing page_count() and page_mapcount(). +Between these two checks page could be removed from lru, freed and taken +by slab. + +As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount(). +Race window is tiny. For certain workload this happens around once a +year. + + page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0 + flags: 0x500000000008100(slab|head) + raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180 + raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 + page dumped because: VM_BUG_ON_PAGE(PageSlab(page)) + ------------[ cut here ]------------ + kernel BUG at ./include/linux/mm.h:628! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1 + Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019 + RIP: 0010:isolate_migratepages_block+0x986/0x9b0 + +The code in isolate_migratepages_block() was added in commit +119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before +adding VM_BUG_ON into page_mapcount(). + +This race has been predicted in 2015 by Vlastimil Babka (see link +below). + +[akpm@linux-foundation.org: comment tweaks, per Hugh] +Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()") +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Andrew Morton +Acked-by: Hugh Dickins +Acked-by: Kirill A. Shutemov +Acked-by: Vlastimil Babka +Cc: David Rientjes +Cc: +Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz +Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/ +Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.stgit@buzz/T/ (v1) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/mm.h | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index afa77b683a04..53bad834adf5 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -695,6 +695,11 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags) + + extern void kvfree(const void *addr); + ++/* ++ * Mapcount of compound page as a whole, does not include mapped sub-pages. ++ * ++ * Must be called only for compound pages or any their tail sub-pages. ++ */ + static inline int compound_mapcount(struct page *page) + { + VM_BUG_ON_PAGE(!PageCompound(page), page); +@@ -714,10 +719,16 @@ static inline void page_mapcount_reset(struct page *page) + + int __page_mapcount(struct page *page); + ++/* ++ * Mapcount of 0-order page; when compound sub-page, includes ++ * compound_mapcount(). ++ * ++ * Result is undefined for pages which cannot be mapped into userspace. ++ * For example SLAB or special types of pages. See function page_has_type(). ++ * They use this place in struct page differently. ++ */ + static inline int page_mapcount(struct page *page) + { +- VM_BUG_ON_PAGE(PageSlab(page), page); +- + if (unlikely(PageCompound(page))) + return __page_mapcount(page); + return atomic_read(&page->_mapcount) + 1; +-- +2.25.1 + diff --git a/queue-5.4/mm-thp-stop-leaking-unreleased-file-pages.patch b/queue-5.4/mm-thp-stop-leaking-unreleased-file-pages.patch new file mode 100644 index 00000000000..4238d9a8bc9 --- /dev/null +++ b/queue-5.4/mm-thp-stop-leaking-unreleased-file-pages.patch @@ -0,0 +1,44 @@ +From f7b494ee5e1427d4469963d35909fa8942fa35d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:43 -0700 +Subject: mm,thp: stop leaking unreleased file pages + +From: Hugh Dickins + +[ Upstream commit 2f33a706027c94cd4f70fcd3e3f4a17c1ce4ea4b ] + +When collapse_file() calls try_to_release_page(), it has already isolated +the page: so if releasing buffers happens to fail (as it sometimes does), +remember to putback_lru_page(): otherwise that page is left unreclaimable +and unfreeable, and the file extent uncollapsible. + +Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") +Signed-off-by: Hugh Dickins +Signed-off-by: Andrew Morton +Acked-by: Song Liu +Acked-by: Kirill A. Shutemov +Acked-by: Johannes Weiner +Cc: Rik van Riel +Cc: [5.4+] +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2005231837500.1766@eggly.anvils +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/khugepaged.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index a8a57bebb5fa..f765475be359 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1655,6 +1655,7 @@ static void collapse_file(struct mm_struct *mm, + if (page_has_private(page) && + !try_to_release_page(page, GFP_KERNEL)) { + result = SCAN_PAGE_HAS_PRIVATE; ++ putback_lru_page(page); + goto out_unlock; + } + +-- +2.25.1 + diff --git a/queue-5.4/mmc-block-fix-use-after-free-issue-for-rpmb.patch b/queue-5.4/mmc-block-fix-use-after-free-issue-for-rpmb.patch new file mode 100644 index 00000000000..915a6a3d88c --- /dev/null +++ b/queue-5.4/mmc-block-fix-use-after-free-issue-for-rpmb.patch @@ -0,0 +1,43 @@ +From db1fb7af485234e7af4028e8b4231464f8bdad40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 09:29:25 +0000 +Subject: mmc: block: Fix use-after-free issue for rpmb +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peng Hao + +[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ] + +The data structure member “rpmb->md” was passed to a call of the function +“mmc_blk_put” after a call of the function “put_device”. Reorder these +function calls to keep the data accesses consistent. + +Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ") +Signed-off-by: Peng Hao +Cc: stable@vger.kernel.org +[Uffe: Fixed up mangled patch and updated commit message] +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 9d01b5dca519..7f480c6b1981 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -2475,8 +2475,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp) + struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev, + struct mmc_rpmb_data, chrdev); + +- put_device(&rpmb->dev); + mmc_blk_put(rpmb->md); ++ put_device(&rpmb->dev); + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.4/parisc-fix-kernel-panic-in-mem_init.patch b/queue-5.4/parisc-fix-kernel-panic-in-mem_init.patch new file mode 100644 index 00000000000..5eeaa9cd3ed --- /dev/null +++ b/queue-5.4/parisc-fix-kernel-panic-in-mem_init.patch @@ -0,0 +1,52 @@ +From c15842b8d25ea4a866b164f2ab25b6ccc030b618 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 22:29:25 +0200 +Subject: parisc: Fix kernel panic in mem_init() + +From: Helge Deller + +[ Upstream commit bf71bc16e02162388808949b179d59d0b571b965 ] + +The Debian kernel v5.6 triggers this kernel panic: + + Kernel panic - not syncing: Bad Address (null pointer deref?) + Bad Address (null pointer deref?): Code=26 (Data memory access rights trap) at addr 0000000000000000 + CPU: 0 PID: 0 Comm: swapper Not tainted 5.6.0-2-parisc64 #1 Debian 5.6.14-1 + IAOQ[0]: mem_init+0xb0/0x150 + IAOQ[1]: mem_init+0xb4/0x150 + RP(r2): start_kernel+0x6c8/0x1190 + Backtrace: + [<0000000040101ab4>] start_kernel+0x6c8/0x1190 + [<0000000040108574>] start_parisc+0x158/0x1b8 + +on a HP-PARISC rp3440 machine with this memory layout: + Memory Ranges: + 0) Start 0x0000000000000000 End 0x000000003fffffff Size 1024 MB + 1) Start 0x0000004040000000 End 0x00000040ffdfffff Size 3070 MB + +Fix the crash by avoiding virt_to_page() and similar functions in +mem_init() until the memory zones have been fully set up. + +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Sasha Levin +--- + arch/parisc/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c +index ddca8287d43b..3e54484797f6 100644 +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -588,7 +588,7 @@ void __init mem_init(void) + > BITS_PER_LONG); + + high_memory = __va((max_pfn << PAGE_SHIFT)); +- set_max_mapnr(page_to_pfn(virt_to_page(high_memory - 1)) + 1); ++ set_max_mapnr(max_low_pfn); + memblock_free_all(); + + #ifdef CONFIG_PA11 +-- +2.25.1 + diff --git a/queue-5.4/rdma-core-fix-double-destruction-of-uobject.patch b/queue-5.4/rdma-core-fix-double-destruction-of-uobject.patch new file mode 100644 index 00000000000..7584cbcc291 --- /dev/null +++ b/queue-5.4/rdma-core-fix-double-destruction-of-uobject.patch @@ -0,0 +1,148 @@ +From b7a4df9d4d95df941f910c8da9e4c572ab50f061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 16:55:34 +0300 +Subject: RDMA/core: Fix double destruction of uobject + +From: Jason Gunthorpe + +[ Upstream commit c85f4abe66bea0b5db8d28d55da760c4fe0a0301 ] + +Fix use after free when user user space request uobject concurrently for +the same object, within the RCU grace period. + +In that case, remove_handle_idr_uobject() is called twice and we will have +an extra put on the uobject which cause use after free. Fix it by leaving +the uobject write locked after it was removed from the idr. + +Call to rdma_lookup_put_uobject with UVERBS_LOOKUP_DESTROY instead of +UVERBS_LOOKUP_WRITE will do the work. + + refcount_t: underflow; use-after-free. + WARNING: CPU: 0 PID: 1381 at lib/refcount.c:28 refcount_warn_saturate+0xfe/0x1a0 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 0 PID: 1381 Comm: syz-executor.0 Not tainted 5.5.0-rc3 #8 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + Call Trace: + dump_stack+0x94/0xce + panic+0x234/0x56f + __warn+0x1cc/0x1e1 + report_bug+0x200/0x310 + fixup_bug.part.11+0x32/0x80 + do_error_trap+0xd3/0x100 + do_invalid_op+0x31/0x40 + invalid_op+0x1e/0x30 + RIP: 0010:refcount_warn_saturate+0xfe/0x1a0 + Code: 0f 0b eb 9b e8 23 f6 6d ff 80 3d 6c d4 19 03 00 75 8d e8 15 f6 6d ff 48 c7 c7 c0 02 55 bd c6 05 57 d4 19 03 01 e8 a2 58 49 ff <0f> 0b e9 6e ff ff ff e8 f6 f5 6d ff 80 3d 42 d4 19 03 00 0f 85 5c + RSP: 0018:ffffc90002df7b98 EFLAGS: 00010282 + RAX: 0000000000000000 RBX: ffff88810f6a193c RCX: ffffffffba649009 + RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811b0283cc + RBP: 0000000000000003 R08: ffffed10236060e3 R09: ffffed10236060e3 + R10: 0000000000000001 R11: ffffed10236060e2 R12: ffff88810f6a193c + R13: ffffc90002df7d60 R14: 0000000000000000 R15: ffff888116ae6a08 + uverbs_uobject_put+0xfd/0x140 + __uobj_perform_destroy+0x3d/0x60 + ib_uverbs_close_xrcd+0x148/0x170 + ib_uverbs_write+0xaa5/0xdf0 + __vfs_write+0x7c/0x100 + vfs_write+0x168/0x4a0 + ksys_write+0xc8/0x200 + do_syscall_64+0x9c/0x390 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x465b49 + Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 + RSP: 002b:00007f759d122c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 0000000000465b49 + RDX: 000000000000000c RSI: 0000000020000080 RDI: 0000000000000003 + RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 00007f759d1236bc + R13: 00000000004ca27c R14: 000000000070de40 R15: 00000000ffffffff + Dumping ftrace buffer: + (ftrace buffer empty) + Kernel Offset: 0x39400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + +Fixes: 7452a3c745a2 ("IB/uverbs: Allow RDMA_REMOVE_DESTROY to work concurrently with disassociate") +Link: https://lore.kernel.org/r/20200527135534.482279-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/rdma_core.c | 20 +++++++++++++------- + include/rdma/uverbs_std_types.h | 2 +- + 2 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 1c95fefa1f06..d0580eed3bcb 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -160,9 +160,9 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj, + uobj->context = NULL; + + /* +- * For DESTROY the usecnt is held write locked, the caller is expected +- * to put it unlock and put the object when done with it. Only DESTROY +- * can remove the IDR handle. ++ * For DESTROY the usecnt is not changed, the caller is expected to ++ * manage it via uobj_put_destroy(). Only DESTROY can remove the IDR ++ * handle. + */ + if (reason != RDMA_REMOVE_DESTROY) + atomic_set(&uobj->usecnt, 0); +@@ -194,7 +194,7 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj, + /* + * This calls uverbs_destroy_uobject() using the RDMA_REMOVE_DESTROY + * sequence. It should only be used from command callbacks. On success the +- * caller must pair this with rdma_lookup_put_uobject(LOOKUP_WRITE). This ++ * caller must pair this with uobj_put_destroy(). This + * version requires the caller to have already obtained an + * LOOKUP_DESTROY uobject kref. + */ +@@ -205,6 +205,13 @@ int uobj_destroy(struct ib_uobject *uobj, struct uverbs_attr_bundle *attrs) + + down_read(&ufile->hw_destroy_rwsem); + ++ /* ++ * Once the uobject is destroyed by RDMA_REMOVE_DESTROY then it is left ++ * write locked as the callers put it back with UVERBS_LOOKUP_DESTROY. ++ * This is because any other concurrent thread can still see the object ++ * in the xarray due to RCU. Leaving it locked ensures nothing else will ++ * touch it. ++ */ + ret = uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE); + if (ret) + goto out_unlock; +@@ -223,7 +230,7 @@ out_unlock: + /* + * uobj_get_destroy destroys the HW object and returns a handle to the uobj + * with a NULL object pointer. The caller must pair this with +- * uverbs_put_destroy. ++ * uobj_put_destroy(). + */ + struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj, + u32 id, struct uverbs_attr_bundle *attrs) +@@ -257,8 +264,7 @@ int __uobj_perform_destroy(const struct uverbs_api_object *obj, u32 id, + uobj = __uobj_get_destroy(obj, id, attrs); + if (IS_ERR(uobj)) + return PTR_ERR(uobj); +- +- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE); ++ uobj_put_destroy(uobj); + return 0; + } + +diff --git a/include/rdma/uverbs_std_types.h b/include/rdma/uverbs_std_types.h +index 05eabfd5d0d3..9f382e7d4579 100644 +--- a/include/rdma/uverbs_std_types.h ++++ b/include/rdma/uverbs_std_types.h +@@ -88,7 +88,7 @@ struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj, + + static inline void uobj_put_destroy(struct ib_uobject *uobj) + { +- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE); ++ rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_DESTROY); + } + + static inline void uobj_put_read(struct ib_uobject *uobj) +-- +2.25.1 + diff --git a/queue-5.4/rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch b/queue-5.4/rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch new file mode 100644 index 00000000000..f7971554cfc --- /dev/null +++ b/queue-5.4/rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch @@ -0,0 +1,41 @@ +From 87345a435cbe782756ab740013fe0842995ca0d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 22:04:57 -0500 +Subject: RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qiushi Wu + +[ Upstream commit db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d ] + +In function pvrdma_pci_probe(), pdev was not disabled in one error +path. Thus replace the jump target “err_free_device” by +"err_disable_pdev". + +Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") +Link: https://lore.kernel.org/r/20200523030457.16160-1-wu000273@umn.edu +Signed-off-by: Qiushi Wu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +index e580ae9cc55a..780fd2dfc07e 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +@@ -829,7 +829,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev, + !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) { + dev_err(&pdev->dev, "PCI BAR region not MMIO\n"); + ret = -ENOMEM; +- goto err_free_device; ++ goto err_disable_pdev; + } + + ret = pci_request_regions(pdev, DRV_NAME); +-- +2.25.1 + diff --git a/queue-5.4/revert-block-end-bio-with-blk_sts_again-in-case-of-n.patch b/queue-5.4/revert-block-end-bio-with-blk_sts_again-in-case-of-n.patch new file mode 100644 index 00000000000..92f3abaaa38 --- /dev/null +++ b/queue-5.4/revert-block-end-bio-with-blk_sts_again-in-case-of-n.patch @@ -0,0 +1,50 @@ +From 0af58e1f17f180e248bc1f6e5e78f97d59fd9cc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 13:19:29 -0600 +Subject: Revert "block: end bio with BLK_STS_AGAIN in case of non-mq devs and + REQ_NOWAIT" + +From: Jens Axboe + +[ Upstream commit b0beb28097fa04177b3769f4bb7a0d0d9c4ae76e ] + +This reverts commit c58c1f83436b501d45d4050fd1296d71a9760bcb. + +io_uring does do the right thing for this case, and we're still returning +-EAGAIN to userspace for the cases we don't support. Revert this change +to avoid doing endless spins of resubmits. + +Cc: stable@vger.kernel.org # v5.6 +Reported-by: Bijan Mottahedeh +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 1075aaff606d..d5e668ec751b 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -886,14 +886,11 @@ generic_make_request_checks(struct bio *bio) + } + + /* +- * Non-mq queues do not honor REQ_NOWAIT, so complete a bio +- * with BLK_STS_AGAIN status in order to catch -EAGAIN and +- * to give a chance to the caller to repeat request gracefully. ++ * For a REQ_NOWAIT based request, return -EOPNOTSUPP ++ * if queue is not a request based queue. + */ +- if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) { +- status = BLK_STS_AGAIN; +- goto end_io; +- } ++ if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) ++ goto not_supported; + + if (should_fail_bio(bio)) + goto end_io; +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 4585406a65a..377652e3004 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -60,3 +60,47 @@ cifs-fix-null-pointer-check-in-cifs_read.patch csky-fixup-raw_copy_from_user.patch samples-bpf-fix-build-error.patch drivers-net-hamradio-fix-suspicious-rcu-usage-warnin.patch +input-usbtouchscreen-add-support-for-bonxeon-tp.patch +input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch +input-evdev-call-input_flush_device-on-release-not-f.patch +input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch +input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch +input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch +input-synaptics-rmi4-really-fix-attn_data-use-after-.patch +input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch +arm-8970-1-decompressor-increase-tag-size.patch +arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch +arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch +arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch +gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch +arm64-dts-mt8173-fix-vcodec-enc-clock.patch +soc-mediatek-cmdq-return-send-msg-error-code.patch +gpu-drm-ingenic-fix-opaque-pointer-casted-to-wrong-t.patch +ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch +arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch +arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch +arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch +mmc-block-fix-use-after-free-issue-for-rpmb.patch +gpio-pxa-fix-return-value-of-pxa_gpio_probe.patch +gpio-bcm-kona-fix-return-value-of-bcm_kona_gpio_prob.patch +rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch +alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch +alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch +alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch +exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch +clk-qcom-gcc-fix-parent-for-gpll0_out_even.patch +alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch +alsa-hda-realtek-add-new-codec-supported-for-alc287.patch +libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch +ceph-flush-release-queue-when-handling-caps-for-unkn.patch +rdma-core-fix-double-destruction-of-uobject.patch +drm-amd-display-drop-cursor-position-check-in-atomic.patch +ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch +mm-thp-stop-leaking-unreleased-file-pages.patch +mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch +fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch +include-asm-generic-topology.h-guard-cpumask_of_node.patch +revert-block-end-bio-with-blk_sts_again-in-case-of-n.patch +gpio-fix-locking-open-drain-irq-lines.patch +iommu-fix-reference-count-leak-in-iommu_group_alloc.patch +parisc-fix-kernel-panic-in-mem_init.patch diff --git a/queue-5.4/soc-mediatek-cmdq-return-send-msg-error-code.patch b/queue-5.4/soc-mediatek-cmdq-return-send-msg-error-code.patch new file mode 100644 index 00000000000..64eb53d844d --- /dev/null +++ b/queue-5.4/soc-mediatek-cmdq-return-send-msg-error-code.patch @@ -0,0 +1,40 @@ +From bcd5181f75f8b36b62c8aa8cd31609fc5975d31b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Mar 2020 18:52:47 +0800 +Subject: soc: mediatek: cmdq: return send msg error code + +From: Dennis YC Hsieh + +[ Upstream commit 34c4e4072603ff5c174df73b973896abb76cbb51 ] + +Return error code to client if send message fail, +so that client has chance to error handling. + +Fixes: 576f1b4bc802 ("soc: mediatek: Add Mediatek CMDQ helper") +Signed-off-by: Dennis YC Hsieh +Reviewed-by: CK Hu +Link: https://lore.kernel.org/r/1583664775-19382-6-git-send-email-dennis-yc.hsieh@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-cmdq-helper.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/mediatek/mtk-cmdq-helper.c b/drivers/soc/mediatek/mtk-cmdq-helper.c +index 73a852b2f417..34eec26b0c1f 100644 +--- a/drivers/soc/mediatek/mtk-cmdq-helper.c ++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c +@@ -258,7 +258,9 @@ int cmdq_pkt_flush_async(struct cmdq_pkt *pkt, cmdq_async_flush_cb cb, + spin_unlock_irqrestore(&client->lock, flags); + } + +- mbox_send_message(client->chan, pkt); ++ err = mbox_send_message(client->chan, pkt); ++ if (err < 0) ++ return err; + /* We can send next packet immediately, so just call txdone. */ + mbox_client_txdone(client->chan, 0); + +-- +2.25.1 +