From: Sasha Levin Date: Mon, 13 Sep 2021 01:33:28 +0000 (-0400) Subject: Fixes for 5.14 X-Git-Tag: v5.4.146~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7a21099e016fbacf06daa23e9ee2e8a04abc6e42;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.14 Signed-off-by: Sasha Levin --- diff --git a/queue-5.14/6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch b/queue-5.14/6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch new file mode 100644 index 00000000000..3d1689a322d --- /dev/null +++ b/queue-5.14/6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch @@ -0,0 +1,40 @@ +From d1b2e6dcaa744c3abe51777e212967147218071f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jul 2021 13:14:40 +0100 +Subject: 6lowpan: iphc: Fix an off-by-one check of array index + +From: Colin Ian King + +[ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ] + +The bounds check of id is off-by-one and the comparison should +be >= rather >. Currently the WARN_ON_ONCE check does not stop +the out of range indexing of &ldev->ctx.table[id] so also add +a return path if the bounds are out of range. + +Addresses-Coverity: ("Illegal address computation"). +Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression") +Signed-off-by: Colin Ian King +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/6lowpan/debugfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c +index 1c140af06d52..600b9563bfc5 100644 +--- a/net/6lowpan/debugfs.c ++++ b/net/6lowpan/debugfs.c +@@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev, + struct dentry *root; + char buf[32]; + +- WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE); ++ if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE)) ++ return; + + sprintf(buf, "%d", id); + +-- +2.30.2 + diff --git a/queue-5.14/alsa-usb-audio-add-lowlatency-module-option.patch b/queue-5.14/alsa-usb-audio-add-lowlatency-module-option.patch new file mode 100644 index 00000000000..c224d5f7db9 --- /dev/null +++ b/queue-5.14/alsa-usb-audio-add-lowlatency-module-option.patch @@ -0,0 +1,83 @@ +From e72dcf1dc15affbfd9da71bf39a22967a8942e24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 09:38:30 +0200 +Subject: ALSA: usb-audio: Add lowlatency module option + +From: Takashi Iwai + +[ Upstream commit 4801bee7d5a36c199b734a28cde5259183aff822 ] + +For making user to switch back to the old playback mode, this patch +adds a new module option 'lowlatency' to snd-usb-audio driver. +When user face a regression due to the recent low-latency playback +support, they can test easily by passing lowlatency=0 option without +rebuilding the kernel. + +Fixes: 307cc9baac5c ("ALSA: usb-audio: Reduce latency at playback start, take#2") +Link: https://lore.kernel.org/r/20210829073830.22686-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 4 ++++ + sound/usb/pcm.c | 3 ++- + sound/usb/usbaudio.h | 1 + + 3 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index a1f8c3a026f5..6abfc9d079e7 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -68,6 +68,7 @@ static int pid[SNDRV_CARDS] = { [0 ... (SNDRV_CARDS-1)] = -1 }; + static int device_setup[SNDRV_CARDS]; /* device parameter for this card */ + static bool ignore_ctl_error; + static bool autoclock = true; ++static bool lowlatency = true; + static char *quirk_alias[SNDRV_CARDS]; + static char *delayed_register[SNDRV_CARDS]; + static bool implicit_fb[SNDRV_CARDS]; +@@ -92,6 +93,8 @@ MODULE_PARM_DESC(ignore_ctl_error, + "Ignore errors from USB controller for mixer interfaces."); + module_param(autoclock, bool, 0444); + MODULE_PARM_DESC(autoclock, "Enable auto-clock selection for UAC2 devices (default: yes)."); ++module_param(lowlatency, bool, 0444); ++MODULE_PARM_DESC(lowlatency, "Enable low latency playback (default: yes)."); + module_param_array(quirk_alias, charp, NULL, 0444); + MODULE_PARM_DESC(quirk_alias, "Quirk aliases, e.g. 0123abcd:5678beef."); + module_param_array(delayed_register, charp, NULL, 0444); +@@ -599,6 +602,7 @@ static int snd_usb_audio_create(struct usb_interface *intf, + chip->setup = device_setup[idx]; + chip->generic_implicit_fb = implicit_fb[idx]; + chip->autoclock = autoclock; ++ chip->lowlatency = lowlatency; + atomic_set(&chip->active, 1); /* avoid autopm during probing */ + atomic_set(&chip->usage_count, 0); + atomic_set(&chip->shutdown, 0); +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index f5cbf61ac366..5dc9266180e3 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -617,7 +617,8 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) + /* check whether early start is needed for playback stream */ + subs->early_playback_start = + subs->direction == SNDRV_PCM_STREAM_PLAYBACK && +- subs->data_endpoint->nominal_queue_size >= subs->buffer_bytes; ++ (!chip->lowlatency || ++ (subs->data_endpoint->nominal_queue_size >= subs->buffer_bytes)); + + if (subs->early_playback_start) + ret = start_endpoints(subs); +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index 538831cbd925..8b70c9ea91b9 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -57,6 +57,7 @@ struct snd_usb_audio { + bool generic_implicit_fb; /* from the 'implicit_fb' module param */ + bool autoclock; /* from the 'autoclock' module param */ + ++ bool lowlatency; /* from the 'lowlatency' module param */ + struct usb_host_interface *ctrl_intf; /* the audio control interface */ + struct media_device *media_dev; + struct media_intf_devnode *ctl_intf_media_devnode; +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-aspeed-g6-fix-hvi3c-function-group-in-pinctr.patch b/queue-5.14/arm-dts-aspeed-g6-fix-hvi3c-function-group-in-pinctr.patch new file mode 100644 index 00000000000..406bae6d24c --- /dev/null +++ b/queue-5.14/arm-dts-aspeed-g6-fix-hvi3c-function-group-in-pinctr.patch @@ -0,0 +1,44 @@ +From e458ebba5b1d1339cb504ce1f586b77486ac83aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 14:27:23 +0800 +Subject: ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi + +From: Dylan Hung + +[ Upstream commit 8c295b7f3d01359ff4336fcb6e406e6ed37957d6 ] + +The HVI3C shall be a group of I3C function, not an independent function. +Correct the function name from "HVI3C" to "I3C". + +Signed-off-by: Dylan Hung +Reviewed-by: Andrew Jeffery +Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes") +Link: https://lore.kernel.org/r/20201029062723.20798-1-dylan_hung@aspeedtech.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +index 7e90d713f5e5..6dde51c2aed3 100644 +--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi ++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi +@@ -208,12 +208,12 @@ + }; + + pinctrl_hvi3c3_default: hvi3c3_default { +- function = "HVI3C3"; ++ function = "I3C3"; + groups = "HVI3C3"; + }; + + pinctrl_hvi3c4_default: hvi3c4_default { +- function = "HVI3C4"; ++ function = "I3C4"; + groups = "HVI3C4"; + }; + +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-everest-add-phase-corrections-for-emmc.patch b/queue-5.14/arm-dts-everest-add-phase-corrections-for-emmc.patch new file mode 100644 index 00000000000..012ed168e83 --- /dev/null +++ b/queue-5.14/arm-dts-everest-add-phase-corrections-for-emmc.patch @@ -0,0 +1,39 @@ +From 5f852efd3a5e18bda196591ae97bf54b216c2e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 09:06:42 +0930 +Subject: ARM: dts: everest: Add phase corrections for eMMC + +From: Andrew Jeffery + +[ Upstream commit ded3e2864c735f33ba5abbbe2d7b1c6605242f9b ] + +The values were determined via scope measurements. + +With the patch we can write and read data without issue where as booting +the system without the patch failed at the point of mounting the rootfs. + +Signed-off-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20210712233642.3119722-1-andrew@aj.id.au +Fixes: faffd1b2bde3 ("ARM: dts: everest: Add phase corrections for eMMC") +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts b/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts +index aa24cac8e5be..44b03a5e2416 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts +@@ -2832,7 +2832,7 @@ + + &emmc { + status = "okay"; +- clk-phase-mmc-hs200 = <180>, <180>; ++ clk-phase-mmc-hs200 = <210>, <228>; + }; + + &fsim0 { +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-meson8-use-a-higher-default-gpu-clock-freque.patch b/queue-5.14/arm-dts-meson8-use-a-higher-default-gpu-clock-freque.patch new file mode 100644 index 00000000000..02260948da0 --- /dev/null +++ b/queue-5.14/arm-dts-meson8-use-a-higher-default-gpu-clock-freque.patch @@ -0,0 +1,50 @@ +From 9ab00a5be7c14ee4afb47854c2cbc4d52c4f660d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jul 2021 23:40:23 +0200 +Subject: ARM: dts: meson8: Use a higher default GPU clock frequency + +From: Martin Blumenstingl + +[ Upstream commit 44cf630bcb8c5ec78125805c9447dd5766792224 ] + +We are seeing "imprecise external abort (0x1406)" errors during boot +(which then cause the whole board to hang) on Meson8 (but not Meson8m2). +These are observed while trying to access the GPU's registers when the +MALI clock is running at it's default setting of 24MHz. The 3.10 vendor +kernel uses 318.75MHz as "default" GPU frequency. Using that makes the +"imprecise external aborts" go away. +Add the assigned-clocks and assigned-clock-rates properties to also bump +the MALI clock to 318.75MHz before accessing any of it's registers. + +Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU") +Reported-by: Demetris Ierokipides +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20210711214023.2163565-1-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi +index 157a950a55d3..686c7b7c79d5 100644 +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -304,8 +304,13 @@ + "pp2", "ppmmu2", "pp4", "ppmmu4", + "pp5", "ppmmu5", "pp6", "ppmmu6"; + resets = <&reset RESET_MALI>; ++ + clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>; + clock-names = "bus", "core"; ++ ++ assigned-clocks = <&clkc CLKID_MALI>; ++ assigned-clock-rates = <318750000>; ++ + operating-points-v2 = <&gpu_opp_table>; + #cooling-cells = <2>; /* min followed by max */ + }; +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-meson8b-ec100-fix-the-pwm-regulator-supply-p.patch b/queue-5.14/arm-dts-meson8b-ec100-fix-the-pwm-regulator-supply-p.patch new file mode 100644 index 00000000000..cc737fa9f84 --- /dev/null +++ b/queue-5.14/arm-dts-meson8b-ec100-fix-the-pwm-regulator-supply-p.patch @@ -0,0 +1,62 @@ +From 98e56b258aa58436c8e26ba3003d73bfc2dbe216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 11:23:55 +0000 +Subject: ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties + +From: Anand Moon + +[ Upstream commit 72ccc373b064ae3ac0c5b5f2306069b60ca118df ] + +After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs. +Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply +instead of dummy regulator. + +[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree +[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed +[ 7.117184] VCCK: supplied by regulator-dummy +[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT +[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled +[ 7.118498] VDDEE: will resolve supply early: pwm +[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree +[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed +[ 7.118553] VDDEE: supplied by regulator-dummy +[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT + +Fixes: 087a1d8b4e4c ("ARM: dts: meson8b: ec100: add the VDDEE regulator") +Fixes: 3e7db1c1b7a3 ("ARM: dts: meson8b: ec100: improve the description of the regulators") + +Cc: Martin Blumenstingl +Signed-off-by: Anand Moon +Reviewed-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20210705112358.3554-4-linux.amoon@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b-ec100.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts +index 8e48ccc6b634..7e8ddc6f1252 100644 +--- a/arch/arm/boot/dts/meson8b-ec100.dts ++++ b/arch/arm/boot/dts/meson8b-ec100.dts +@@ -148,7 +148,7 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + +- vin-supply = <&vcc_5v>; ++ pwm-supply = <&vcc_5v>; + + pwms = <&pwm_cd 0 1148 0>; + pwm-dutycycle-range = <100 0>; +@@ -232,7 +232,7 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + +- vin-supply = <&vcc_5v>; ++ pwm-supply = <&vcc_5v>; + + pwms = <&pwm_cd 1 1148 0>; + pwm-dutycycle-range = <100 0>; +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-meson8b-mxq-fix-the-pwm-regulator-supply-pro.patch b/queue-5.14/arm-dts-meson8b-mxq-fix-the-pwm-regulator-supply-pro.patch new file mode 100644 index 00000000000..4a2e5355dd7 --- /dev/null +++ b/queue-5.14/arm-dts-meson8b-mxq-fix-the-pwm-regulator-supply-pro.patch @@ -0,0 +1,63 @@ +From 4eae1590bf2f130b043f2dfe5fd3335c88cdd159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 11:23:54 +0000 +Subject: ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties + +From: Anand Moon + +[ Upstream commit 632062e540becbbcb067523ec8bcadb1239d9578 ] + +After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs. +Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply +instead of dummy regulator. +Add missing pwm-supply for regulator-vcck regulator node. + +[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree +[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed +[ 7.117184] VCCK: supplied by regulator-dummy +[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT +[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled +[ 7.118498] VDDEE: will resolve supply early: pwm +[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree +[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed +[ 7.118553] VDDEE: supplied by regulator-dummy +[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT + +Fixes: dee51cd0d2e8 ("ARM: dts: meson8b: mxq: add the VDDEE regulator") +Fixes: d94f60e3dfa0 ("ARM: dts: meson8b: mxq: improve support for the TRONFY MXQ S805") + +Cc: Martin Blumenstingl +Signed-off-by: Anand Moon +Reviewed-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20210705112358.3554-3-linux.amoon@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b-mxq.dts | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/meson8b-mxq.dts b/arch/arm/boot/dts/meson8b-mxq.dts +index f3937d55472d..7adedd3258c3 100644 +--- a/arch/arm/boot/dts/meson8b-mxq.dts ++++ b/arch/arm/boot/dts/meson8b-mxq.dts +@@ -34,6 +34,8 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + ++ pwm-supply = <&vcc_5v>; ++ + pwms = <&pwm_cd 0 1148 0>; + pwm-dutycycle-range = <100 0>; + +@@ -79,7 +81,7 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + +- vin-supply = <&vcc_5v>; ++ pwm-supply = <&vcc_5v>; + + pwms = <&pwm_cd 1 1148 0>; + pwm-dutycycle-range = <100 0>; +-- +2.30.2 + diff --git a/queue-5.14/arm-dts-meson8b-odroidc1-fix-the-pwm-regulator-suppl.patch b/queue-5.14/arm-dts-meson8b-odroidc1-fix-the-pwm-regulator-suppl.patch new file mode 100644 index 00000000000..d59d6e0ffa7 --- /dev/null +++ b/queue-5.14/arm-dts-meson8b-odroidc1-fix-the-pwm-regulator-suppl.patch @@ -0,0 +1,64 @@ +From 41115263ed579dbc68463f62310e835dbda1d491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 11:23:53 +0000 +Subject: ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties + +From: Anand Moon + +[ Upstream commit 876228e9f935f19c7afc7ba394d17e2ec9143b65 ] + +After enabling CONFIG_REGULATOR_DEBUG=y we observe below debug logs. +Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply +instead of dummy regulator. + +[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree +[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed +[ 7.117184] VCCK: supplied by regulator-dummy +[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT +[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled +[ 7.118498] VDDEE: will resolve supply early: pwm +[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree +[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed +[ 7.118553] VDDEE: supplied by regulator-dummy +[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT + +Fixes: 524d96083b66 ("ARM: dts: meson8b: odroidc1: add the CPU voltage regulator") +Fixes: 8bdf38be712d ("ARM: dts: meson8b: odroidc1: add the VDDEE regulator") + +Tested-by: Martin Blumenstingl +Cc: Martin Blumenstingl +Signed-off-by: Anand Moon +Reviewed-by: Martin Blumenstingl +[narmstrong: fixed typo in commit s/observer/observe/] +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20210705112358.3554-2-linux.amoon@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b-odroidc1.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts +index c440ef94e082..04356bc639fa 100644 +--- a/arch/arm/boot/dts/meson8b-odroidc1.dts ++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts +@@ -131,7 +131,7 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + +- vin-supply = <&p5v0>; ++ pwm-supply = <&p5v0>; + + pwms = <&pwm_cd 0 12218 0>; + pwm-dutycycle-range = <91 0>; +@@ -163,7 +163,7 @@ + regulator-min-microvolt = <860000>; + regulator-max-microvolt = <1140000>; + +- vin-supply = <&p5v0>; ++ pwm-supply = <&p5v0>; + + pwms = <&pwm_cd 1 12218 0>; + pwm-dutycycle-range = <91 0>; +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-exynos-correct-gic-cpu-interfaces-address-.patch b/queue-5.14/arm64-dts-exynos-correct-gic-cpu-interfaces-address-.patch new file mode 100644 index 00000000000..fb0fb02dddd --- /dev/null +++ b/queue-5.14/arm64-dts-exynos-correct-gic-cpu-interfaces-address-.patch @@ -0,0 +1,41 @@ +From 7dcee71df88a739d3960ea9e5ab8a6c3d411ec9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 09:21:10 +0200 +Subject: arm64: dts: exynos: correct GIC CPU interfaces address range on + Exynos7 + +From: Krzysztof Kozlowski + +[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ] + +The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by +ARM). + +Reported-by: Sam Protsenko +Reported-by: Marc Zyngier +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Sam Protsenko +Reviewed-by: Alim Akhtar +Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7") +Link: https://lore.kernel.org/r/20210805072110.4730-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi +index 10244e59d56d..56a0bb7eb0e6 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi +@@ -102,7 +102,7 @@ + #address-cells = <0>; + interrupt-controller; + reg = <0x11001000 0x1000>, +- <0x11002000 0x1000>, ++ <0x11002000 0x2000>, + <0x11004000 0x2000>, + <0x11006000 0x2000>; + }; +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-marvell-armada-37xx-extend-pcie-mem-space.patch b/queue-5.14/arm64-dts-marvell-armada-37xx-extend-pcie-mem-space.patch new file mode 100644 index 00000000000..c3465ad7cac --- /dev/null +++ b/queue-5.14/arm64-dts-marvell-armada-37xx-extend-pcie-mem-space.patch @@ -0,0 +1,105 @@ +From cd60109b0fa1c6014eabed029589ebb1c1487ee4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 23:55:46 +0200 +Subject: arm64: dts: marvell: armada-37xx: Extend PCIe MEM space +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 514ef1e62d6521c2199d192b1c71b79d2aa21d5a ] + +Current PCIe MEM space of size 16 MB is not enough for some combination +of PCIe cards (e.g. NVMe disk together with ath11k wifi card). ARM Trusted +Firmware for Armada 3700 platform already assigns 128 MB for PCIe window, +so extend PCIe MEM space to the end of 128 MB PCIe window which allows to +allocate more PCIe BARs for more PCIe cards. + +Without this change some combination of PCIe cards cannot be used and +kernel show error messages in dmesg during initialization: + + pci 0000:00:00.0: BAR 8: no space for [mem size 0x01800000] + pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x01800000] + pci 0000:00:00.0: BAR 6: assigned [mem 0xe8000000-0xe80007ff pref] + pci 0000:01:00.0: BAR 8: no space for [mem size 0x01800000] + pci 0000:01:00.0: BAR 8: failed to assign [mem size 0x01800000] + pci 0000:02:03.0: BAR 8: no space for [mem size 0x01000000] + pci 0000:02:03.0: BAR 8: failed to assign [mem size 0x01000000] + pci 0000:02:07.0: BAR 8: no space for [mem size 0x00100000] + pci 0000:02:07.0: BAR 8: failed to assign [mem size 0x00100000] + pci 0000:03:00.0: BAR 0: no space for [mem size 0x01000000 64bit] + pci 0000:03:00.0: BAR 0: failed to assign [mem size 0x01000000 64bit] + +Due to bugs in U-Boot port for Turris Mox, the second range in Turris Mox +kernel DTS file for PCIe must start at 16 MB offset. Otherwise U-Boot +crashes during loading of kernel DTB file. This bug is present only in +U-Boot code for Turris Mox and therefore other Armada 3700 devices are not +affected by this bug. Bug is fixed in U-Boot version 2021.07. + +To not break booting new kernels on existing versions of U-Boot on Turris +Mox, use first 16 MB range for IO and second range with rest of PCIe window +for MEM. + +Signed-off-by: Pali Rohár +Fixes: 76f6386b25cc ("arm64: dts: marvell: Add Aardvark PCIe support for Armada 3700") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + .../boot/dts/marvell/armada-3720-turris-mox.dts | 17 +++++++++++++++++ + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +++++++++-- + 2 files changed, 26 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index a05b1ab2dd12..04da07ae4420 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -135,6 +135,23 @@ + pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; + status = "okay"; + reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>; ++ /* ++ * U-Boot port for Turris Mox has a bug which always expects that "ranges" DT property ++ * contains exactly 2 ranges with 3 (child) address cells, 2 (parent) address cells and ++ * 2 size cells and also expects that the second range starts at 16 MB offset. If these ++ * conditions are not met then U-Boot crashes during loading kernel DTB file. PCIe address ++ * space is 128 MB long, so the best split between MEM and IO is to use fixed 16 MB window ++ * for IO and the rest 112 MB (64+32+16) for MEM, despite that maximal IO size is just 64 kB. ++ * This bug is not present in U-Boot ports for other Armada 3700 devices and is fixed in ++ * U-Boot version 2021.07. See relevant U-Boot commits (the last one contains fix): ++ * https://source.denx.de/u-boot/u-boot/-/commit/cb2ddb291ee6fcbddd6d8f4ff49089dfe580f5d7 ++ * https://source.denx.de/u-boot/u-boot/-/commit/c64ac3b3185aeb3846297ad7391fc6df8ecd73bf ++ * https://source.denx.de/u-boot/u-boot/-/commit/4a82fca8e330157081fc132a591ebd99ba02ee33 ++ */ ++ #address-cells = <3>; ++ #size-cells = <2>; ++ ranges = <0x81000000 0 0xe8000000 0 0xe8000000 0 0x01000000 /* Port 0 IO */ ++ 0x82000000 0 0xe9000000 0 0xe9000000 0 0x07000000>; /* Port 0 MEM */ + + /* enabled by U-Boot if PCIe module is present */ + status = "disabled"; +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index 5db81a416cd6..9acc5d2b5a00 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -489,8 +489,15 @@ + #interrupt-cells = <1>; + msi-parent = <&pcie0>; + msi-controller; +- ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */ +- 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/ ++ /* ++ * The 128 MiB address range [0xe8000000-0xf0000000] is ++ * dedicated for PCIe and can be assigned to 8 windows ++ * with size a power of two. Use one 64 KiB window for ++ * IO at the end and the remaining seven windows ++ * (totaling 127 MiB) for MEM. ++ */ ++ ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */ ++ 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc 0>, + <0 0 0 2 &pcie_intc 1>, +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-qcom-sc7180-set-adau-wakeup-delay-to-80-ms.patch b/queue-5.14/arm64-dts-qcom-sc7180-set-adau-wakeup-delay-to-80-ms.patch new file mode 100644 index 00000000000..e348ca7e038 --- /dev/null +++ b/queue-5.14/arm64-dts-qcom-sc7180-set-adau-wakeup-delay-to-80-ms.patch @@ -0,0 +1,37 @@ +From cc26e5ae6af73da9982bd6eb9fa0395643fbcb46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jul 2021 17:08:10 +0800 +Subject: arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms + +From: Judy Hsiao + +[ Upstream commit a8c7f3100e708d5f55692f0607ca80c5dcd21ce8 ] + +Set audu wakeup delay to 80 ms for fixing pop noise during capture begin. + +Fixes: ba5f9b5d7ff3 ("arm64: dts: qcom: sc7180: Add wakeup delay for adau codec") +Signed-off-by: Judy Hsiao +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210708090810.174767-1-judyhsiao@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi +index 6f9c07147551..a758e4d22612 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi +@@ -23,7 +23,7 @@ ap_h1_spi: &spi0 {}; + adau7002: audio-codec-1 { + compatible = "adi,adau7002"; + IOVDD-supply = <&pp1800_l15a>; +- wakeup-delay-ms = <15>; ++ wakeup-delay-ms = <80>; + #sound-dai-cells = <0>; + }; + +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch b/queue-5.14/arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch new file mode 100644 index 00000000000..ad19587887b --- /dev/null +++ b/queue-5.14/arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch @@ -0,0 +1,42 @@ +From 99065965de33df7018277656eb71ccf41fb50442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 23:34:44 +0530 +Subject: arm64: dts: qcom: sc7280: Fixup the cpufreq node + +From: Sibi Sankar + +[ Upstream commit 11e03d692101e484df9322f892a8b6e111a82bfd ] + +Fixup the register regions used by the cpufreq node on SC7280 SoC to +support per core L3 DCVS. + +Fixes: 7dbd121a2c58 ("arm64: dts: qcom: sc7280: Add cpufreq hw node") +Signed-off-by: Sibi Sankar +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1627581885-32165-4-git-send-email-sibis@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 188c5768a55a..c08f07410699 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1437,9 +1437,9 @@ + + cpufreq_hw: cpufreq@18591000 { + compatible = "qcom,cpufreq-epss"; +- reg = <0 0x18591000 0 0x1000>, +- <0 0x18592000 0 0x1000>, +- <0 0x18593000 0 0x1000>; ++ reg = <0 0x18591100 0 0x900>, ++ <0 0x18592100 0 0x900>, ++ <0 0x18593100 0 0x900>; + clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>; + clock-names = "xo", "alternate"; + #freq-domain-cells = <1>; +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-qcom-sm8250-fix-usb2-qmp-phy-node.patch b/queue-5.14/arm64-dts-qcom-sm8250-fix-usb2-qmp-phy-node.patch new file mode 100644 index 00000000000..b469e79c401 --- /dev/null +++ b/queue-5.14/arm64-dts-qcom-sm8250-fix-usb2-qmp-phy-node.patch @@ -0,0 +1,41 @@ +From f55938396b6fadf26e11f5753209511701cebc2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 00:07:01 +0100 +Subject: arm64: dts: qcom: sm8250: fix usb2 qmp phy node + +From: Dmitry Baryshkov + +[ Upstream commit 63fa4322469648ae1023bb92a8b0d6a2f4bdaf2c ] + +Use 'lanes' as SuperSpeed lanes device node instead of just 'lane' to +fix issues with TypeC support. + +Fixes: 46a6f297d7dd ("arm64: dts: qcom: sm8250: Add USB and PHY device nodes") +Cc: robh+dt@kernel.org +Cc: devicetree@vger.kernel.org +Signed-off-by: Dmitry Baryshkov +Tested-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20210706230702.299047-2-bryan.odonoghue@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 4798368b02ef..9a6eff1813a6 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2210,7 +2210,7 @@ + <&gcc GCC_USB3_PHY_SEC_BCR>; + reset-names = "phy", "common"; + +- usb_2_ssphy: lane@88eb200 { ++ usb_2_ssphy: lanes@88eb200 { + reg = <0 0x088eb200 0 0x200>, + <0 0x088eb400 0 0x200>, + <0 0x088eb800 0 0x800>; +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-qcom-sm8350-fix-ipa-interconnects.patch b/queue-5.14/arm64-dts-qcom-sm8350-fix-ipa-interconnects.patch new file mode 100644 index 00000000000..f20464e2df5 --- /dev/null +++ b/queue-5.14/arm64-dts-qcom-sm8350-fix-ipa-interconnects.patch @@ -0,0 +1,45 @@ +From 4553786f25c8a08ecd7ff23abaf1fb87d3e603ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 16:02:14 -0500 +Subject: arm64: dts: qcom: sm8350: fix IPA interconnects + +From: Alex Elder + +[ Upstream commit 84173ca359787abd720d150d3d0d7edabf9db46c ] + +There should only be two interconnects defined for IPA on the +QUalcomm SM8350 SoC. The names should also match those specified by +the IPA Device Tree binding. + +Fixes: f11d3e7da32e ("arm64: dts: qcom: sm8350: add IPA information") +Signed-off-by: Alex Elder +Link: https://lore.kernel.org/r/20210804210214.1891755-5-elder@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index 0d16392bb976..dbc174d424e2 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -666,12 +666,10 @@ + clocks = <&rpmhcc RPMH_IPA_CLK>; + clock-names = "core"; + +- interconnects = <&aggre2_noc MASTER_IPA &gem_noc SLAVE_LLCC>, +- <&mc_virt MASTER_LLCC &mc_virt SLAVE_EBI1>, ++ interconnects = <&aggre2_noc MASTER_IPA &mc_virt SLAVE_EBI1>, + <&gem_noc MASTER_APPSS_PROC &config_noc SLAVE_IPA_CFG>; +- interconnect-names = "ipa_to_llcc", +- "llcc_to_ebi1", +- "appss_to_ipa"; ++ interconnect-names = "memory", ++ "config"; + + qcom,smem-states = <&ipa_smp2p_out 0>, + <&ipa_smp2p_out 1>; +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-renesas-hihope-rzg2-ex-add-etheravb-intern.patch b/queue-5.14/arm64-dts-renesas-hihope-rzg2-ex-add-etheravb-intern.patch new file mode 100644 index 00000000000..9767a343ccb --- /dev/null +++ b/queue-5.14/arm64-dts-renesas-hihope-rzg2-ex-add-etheravb-intern.patch @@ -0,0 +1,40 @@ +From f952d9462cceaa7d128c9c4507f306db21ac1589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 19:06:32 +0100 +Subject: arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay + +From: Biju Das + +[ Upstream commit c96ca5604a889a142d6b60889cc6da48498806e9 ] + +Hihope boards use Realtek PHY. From the very beginning it use only +tx delays. However the phy driver commit bbc4d71d63549bcd003 +("net: phy: realtek: fix rtl8211e rx/tx delay config") introduced +NFS mount failure. Now it needs rx delay inaddition to tx delay +for NFS mount to work. This patch fixes NFS mount failure issue +by adding MAC internal rx delay. + +Signed-off-by: Biju Das +Fixes: bbc4d71d63549bcd ("net: phy: realtek: fix rtl8211e rx/tx delay config") +Link: https://lore.kernel.org/r/20210721180632.15080-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi +index 202c4fc88bd5..dde3a07bc417 100644 +--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi ++++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi +@@ -20,6 +20,7 @@ + pinctrl-names = "default"; + phy-handle = <&phy0>; + tx-internal-delay-ps = <2000>; ++ rx-internal-delay-ps = <1800>; + status = "okay"; + + phy0: ethernet-phy@0 { +-- +2.30.2 + diff --git a/queue-5.14/arm64-dts-renesas-r8a77995-draak-remove-bogus-adv751.patch b/queue-5.14/arm64-dts-renesas-r8a77995-draak-remove-bogus-adv751.patch new file mode 100644 index 00000000000..334a226da17 --- /dev/null +++ b/queue-5.14/arm64-dts-renesas-r8a77995-draak-remove-bogus-adv751.patch @@ -0,0 +1,43 @@ +From 2bc3c15850b0c69e93cd397561ee7643e25e1646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 12:15:50 +0200 +Subject: arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w + properties + +From: Geert Uytterhoeven + +[ Upstream commit 4ec82a7bb3db8c6005e715c63224c32d458917a2 ] + +The "max-clock" and "min-vrefresh" properties fail to validate with +commit cfe34bb7a770c5d8 ("dt-bindings: drm: bridge: adi,adv7511.txt: +convert to yaml"). Drop them, as they are parts of an out-of-tree +workaround that is not needed upstream. + +Fixes: bcf3003438ea4645 ("arm64: dts: renesas: r8a77995: draak: Enable HDMI display output") +Signed-off-by: Geert Uytterhoeven +Acked-by: Laurent Pinchart +Reviewed-by: Ulrich Hecht +Link: https://lore.kernel.org/r/975b6686bc423421b147d367fe7fb9a0db99c5af.1625134398.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts +index 6783c3ad0856..57784341f39d 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts +@@ -277,10 +277,6 @@ + interrupt-parent = <&gpio1>; + interrupts = <28 IRQ_TYPE_LEVEL_LOW>; + +- /* Depends on LVDS */ +- max-clock = <135000000>; +- min-vrefresh = <50>; +- + adi,input-depth = <8>; + adi,input-colorspace = "rgb"; + adi,input-clock = "1x"; +-- +2.30.2 + diff --git a/queue-5.14/asoc-fsl_rpmsg-check-eprobe_defer-for-getting-clocks.patch b/queue-5.14/asoc-fsl_rpmsg-check-eprobe_defer-for-getting-clocks.patch new file mode 100644 index 00000000000..f2ad72422ee --- /dev/null +++ b/queue-5.14/asoc-fsl_rpmsg-check-eprobe_defer-for-getting-clocks.patch @@ -0,0 +1,66 @@ +From 157faf2e51d995ffb9715f54feceb6262e95f58f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 14:03:34 +0800 +Subject: ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks + +From: Shengjiu Wang + +[ Upstream commit 2fbbcffea5b6adbfe90ffc842a6b3eb2d7e381ed ] + +The devm_clk_get() may return -EPROBE_DEFER, then clocks +will be assigned to NULL wrongly. As the clocks are +optional so we can use devm_clk_get_optional() instead of +devm_clk_get(). + +Fixes: b73d9e6225e8 ("ASoC: fsl_rpmsg: Add CPU DAI driver for audio base on rpmsg") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1629266614-6942-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_rpmsg.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/fsl/fsl_rpmsg.c b/sound/soc/fsl/fsl_rpmsg.c +index ea5c973e2e84..d60f4dac6c1b 100644 +--- a/sound/soc/fsl/fsl_rpmsg.c ++++ b/sound/soc/fsl/fsl_rpmsg.c +@@ -165,25 +165,25 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) + } + + /* Get the optional clocks */ +- rpmsg->ipg = devm_clk_get(&pdev->dev, "ipg"); ++ rpmsg->ipg = devm_clk_get_optional(&pdev->dev, "ipg"); + if (IS_ERR(rpmsg->ipg)) +- rpmsg->ipg = NULL; ++ return PTR_ERR(rpmsg->ipg); + +- rpmsg->mclk = devm_clk_get(&pdev->dev, "mclk"); ++ rpmsg->mclk = devm_clk_get_optional(&pdev->dev, "mclk"); + if (IS_ERR(rpmsg->mclk)) +- rpmsg->mclk = NULL; ++ return PTR_ERR(rpmsg->mclk); + +- rpmsg->dma = devm_clk_get(&pdev->dev, "dma"); ++ rpmsg->dma = devm_clk_get_optional(&pdev->dev, "dma"); + if (IS_ERR(rpmsg->dma)) +- rpmsg->dma = NULL; ++ return PTR_ERR(rpmsg->dma); + +- rpmsg->pll8k = devm_clk_get(&pdev->dev, "pll8k"); ++ rpmsg->pll8k = devm_clk_get_optional(&pdev->dev, "pll8k"); + if (IS_ERR(rpmsg->pll8k)) +- rpmsg->pll8k = NULL; ++ return PTR_ERR(rpmsg->pll8k); + +- rpmsg->pll11k = devm_clk_get(&pdev->dev, "pll11k"); ++ rpmsg->pll11k = devm_clk_get_optional(&pdev->dev, "pll11k"); + if (IS_ERR(rpmsg->pll11k)) +- rpmsg->pll11k = NULL; ++ return PTR_ERR(rpmsg->pll11k); + + platform_set_drvdata(pdev, rpmsg); + pm_runtime_enable(&pdev->dev); +-- +2.30.2 + diff --git a/queue-5.14/asoc-intel-fix-platform-id-matching.patch b/queue-5.14/asoc-intel-fix-platform-id-matching.patch new file mode 100644 index 00000000000..0059b25664a --- /dev/null +++ b/queue-5.14/asoc-intel-fix-platform-id-matching.patch @@ -0,0 +1,59 @@ +From b8f6127c23118352b5ae7b15f335a0c9b80fab3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 14:35:39 -0700 +Subject: ASoC: Intel: Fix platform ID matching + +From: Curtis Malainey + +[ Upstream commit f4eeaed04e861b95f1f2c911263f2fcaa959c078 ] + +Sparse warnings triggered truncating the IDs of some platform device +tables. Unfortunately some of the IDs in the match tables were missed +which breaks audio. The KBL change has been verified to fix audio, the +CML change was not tested as it was found through grepping the broken +changes and found to match the same situation in anticipation that it +should also be fixed. + +Fixes: 94efd726b947 ("ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters") +Fixes: 24e46fb811e9 ("ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters") +Signed-off-by: Curtis Malainey +Tested-by: Matt Davis +Reviewed-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210809213544.1682444-1-cujomalainey@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 +- + sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-cml-match.c b/sound/soc/intel/common/soc-acpi-intel-cml-match.c +index 42ef51c3fb4f..b591c6fd13fd 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-cml-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-cml-match.c +@@ -75,7 +75,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_machines[] = { + }, + { + .id = "DLGS7219", +- .drv_name = "cml_da7219_max98357a", ++ .drv_name = "cml_da7219_mx98357a", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &max98390_spk_codecs, + .sof_fw_filename = "sof-cml.ri", +diff --git a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c +index ba5ff468c265..741bf2f9e081 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c +@@ -87,7 +87,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_kbl_machines[] = { + }, + { + .id = "DLGS7219", +- .drv_name = "kbl_da7219_max98357a", ++ .drv_name = "kbl_da7219_mx98357a", + .fw_filename = "intel/dsp_fw_kbl.bin", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &kbl_7219_98357_codecs, +-- +2.30.2 + diff --git a/queue-5.14/asoc-intel-kbl_da7219_max98927-fix-format-selection-.patch b/queue-5.14/asoc-intel-kbl_da7219_max98927-fix-format-selection-.patch new file mode 100644 index 00000000000..ff565fb1a03 --- /dev/null +++ b/queue-5.14/asoc-intel-kbl_da7219_max98927-fix-format-selection-.patch @@ -0,0 +1,138 @@ +From 403748f46ff4545a27aa8685171a500be80e11a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 09:57:32 +0200 +Subject: ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 + +From: Cezary Rojewski + +[ Upstream commit 6d41bbf2fd3615c56dbf2b67f6cbf9e83d14a2e2 ] + +Contrary to what is said in board's file, topology targeting +kbl_da7219_max98373 expects format 16b, not 24/32b. Partially revert +changes added in 'ASoC: Intel: Boards: Add Maxim98373 support' to bring +old behavior back, aligning with topology expectations. + +Fixes: 716d53cc7837 ("ASoC: Intel: Boards: Add Maxim98373 support") +Signed-off-by: Cezary Rojewski +Tested-by: Lukasz Majczak +Link: https://lore.kernel.org/r/20210818075742.1515155-2-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +++----------------- + 1 file changed, 7 insertions(+), 48 deletions(-) + +diff --git a/sound/soc/intel/boards/kbl_da7219_max98927.c b/sound/soc/intel/boards/kbl_da7219_max98927.c +index a31a7a7bbf66..2b43459adc33 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98927.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98927.c +@@ -199,7 +199,7 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream, + } + if (!strcmp(codec_dai->component->name, MAX98373_DEV0_NAME)) { + ret = snd_soc_dai_set_tdm_slot(codec_dai, +- 0x03, 3, 8, 24); ++ 0x30, 3, 8, 16); + if (ret < 0) { + dev_err(runtime->dev, + "DEV0 TDM slot err:%d\n", ret); +@@ -208,10 +208,10 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream, + } + if (!strcmp(codec_dai->component->name, MAX98373_DEV1_NAME)) { + ret = snd_soc_dai_set_tdm_slot(codec_dai, +- 0x0C, 3, 8, 24); ++ 0xC0, 3, 8, 16); + if (ret < 0) { + dev_err(runtime->dev, +- "DEV0 TDM slot err:%d\n", ret); ++ "DEV1 TDM slot err:%d\n", ret); + return ret; + } + } +@@ -311,24 +311,6 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd, + * The above 2 loops are mutually exclusive based on the stream direction, + * thus rtd_dpcm variable will never be overwritten + */ +- /* +- * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE, +- * where as kblda7219m98927 & kblmax98927 supports S16_LE by default. +- * Skipping the port wise FE and BE configuration for kblda7219m98373 & +- * kblmax98373 as the topology (FE & BE) supports S24_LE only. +- */ +- +- if (!strcmp(rtd->card->name, "kblda7219m98373") || +- !strcmp(rtd->card->name, "kblmax98373")) { +- /* The ADSP will convert the FE rate to 48k, stereo */ +- rate->min = rate->max = 48000; +- chan->min = chan->max = DUAL_CHANNEL; +- +- /* set SSP to 24 bit */ +- snd_mask_none(fmt); +- snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE); +- return 0; +- } + + /* + * The ADSP will convert the FE rate to 48k, stereo, 24 bit +@@ -479,31 +461,20 @@ static struct snd_pcm_hw_constraint_list constraints_channels_quad = { + static int kbl_fe_startup(struct snd_pcm_substream *substream) + { + struct snd_pcm_runtime *runtime = substream->runtime; +- struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream); + + /* + * On this platform for PCM device we support, + * 48Khz + * stereo ++ * 16 bit audio + */ + + runtime->hw.channels_max = DUAL_CHANNEL; + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + &constraints_channels); +- /* +- * Setup S24_LE (32 bit container and 24 bit valid data) for +- * kblda7219m98373 & kblmax98373. For kblda7219m98927 & +- * kblmax98927 keeping it as 16/16 due to topology FW dependency. +- */ +- if (!strcmp(soc_rt->card->name, "kblda7219m98373") || +- !strcmp(soc_rt->card->name, "kblmax98373")) { +- runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE; +- snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24); +- +- } else { +- runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; +- snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); +- } ++ ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); + + snd_pcm_hw_constraint_list(runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); +@@ -536,23 +507,11 @@ static int kabylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd, + static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + { + struct snd_pcm_runtime *runtime = substream->runtime; +- struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream); + + runtime->hw.channels_min = runtime->hw.channels_max = QUAD_CHANNEL; + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + &constraints_channels_quad); + +- /* +- * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE. +- * The DMIC also configured for S24_LE. Forcing the DMIC format to +- * S24_LE due to the topology FW dependency. +- */ +- if (!strcmp(soc_rt->card->name, "kblda7219m98373") || +- !strcmp(soc_rt->card->name, "kblmax98373")) { +- runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE; +- snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24); +- } +- + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +-- +2.30.2 + diff --git a/queue-5.14/asoc-intel-skylake-fix-module-resource-and-format-se.patch b/queue-5.14/asoc-intel-skylake-fix-module-resource-and-format-se.patch new file mode 100644 index 00000000000..546f8e0c794 --- /dev/null +++ b/queue-5.14/asoc-intel-skylake-fix-module-resource-and-format-se.patch @@ -0,0 +1,96 @@ +From d4bf5fad54c227b76d94679291e4533d7fee82f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 09:57:35 +0200 +Subject: ASoC: Intel: Skylake: Fix module resource and format selection + +From: Cezary Rojewski + +[ Upstream commit e8b374b649afe756c2470e0e6668022e90bf8518 ] + +Module configuration may differ between its instances depending on +resources required and input and output audio format. Available +parameters to select from are stored in module resource and interface +(format) lists. These come from topology, together with description of +each of pipe's modules. + +Ignoring index value provided by topology and relying always on 0th +entry leads to unexpected module behavior due to under/overbudged +resources assigned or impropper format selection. Fix by taking entry at +index specified by topology. + +Fixes: f6fa56e22559 ("ASoC: Intel: Skylake: Parse and update module config structure") +Signed-off-by: Cezary Rojewski +Tested-by: Lukasz Majczak +Link: https://lore.kernel.org/r/20210818075742.1515155-5-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-topology.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c +index 45b1521e6189..09037d555ec4 100644 +--- a/sound/soc/intel/skylake/skl-topology.c ++++ b/sound/soc/intel/skylake/skl-topology.c +@@ -113,7 +113,7 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w, + + static void skl_dump_mconfig(struct skl_dev *skl, struct skl_module_cfg *mcfg) + { +- struct skl_module_iface *iface = &mcfg->module->formats[0]; ++ struct skl_module_iface *iface = &mcfg->module->formats[mcfg->fmt_idx]; + + dev_dbg(skl->dev, "Dumping config\n"); + dev_dbg(skl->dev, "Input Format:\n"); +@@ -195,8 +195,8 @@ static void skl_tplg_update_params_fixup(struct skl_module_cfg *m_cfg, + struct skl_module_fmt *in_fmt, *out_fmt; + + /* Fixups will be applied to pin 0 only */ +- in_fmt = &m_cfg->module->formats[0].inputs[0].fmt; +- out_fmt = &m_cfg->module->formats[0].outputs[0].fmt; ++ in_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].inputs[0].fmt; ++ out_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].outputs[0].fmt; + + if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) { + if (is_fe) { +@@ -239,9 +239,9 @@ static void skl_tplg_update_buffer_size(struct skl_dev *skl, + /* Since fixups is applied to pin 0 only, ibs, obs needs + * change for pin 0 only + */ +- res = &mcfg->module->resources[0]; +- in_fmt = &mcfg->module->formats[0].inputs[0].fmt; +- out_fmt = &mcfg->module->formats[0].outputs[0].fmt; ++ res = &mcfg->module->resources[mcfg->res_idx]; ++ in_fmt = &mcfg->module->formats[mcfg->fmt_idx].inputs[0].fmt; ++ out_fmt = &mcfg->module->formats[mcfg->fmt_idx].outputs[0].fmt; + + if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT) + multiplier = 5; +@@ -1631,11 +1631,12 @@ int skl_tplg_update_pipe_params(struct device *dev, + struct skl_module_cfg *mconfig, + struct skl_pipe_params *params) + { +- struct skl_module_res *res = &mconfig->module->resources[0]; ++ struct skl_module_res *res; + struct skl_dev *skl = get_skl_ctx(dev); + struct skl_module_fmt *format = NULL; + u8 cfg_idx = mconfig->pipe->cur_config_idx; + ++ res = &mconfig->module->resources[mconfig->res_idx]; + skl_tplg_fill_dma_id(mconfig, params); + mconfig->fmt_idx = mconfig->mod_cfg[cfg_idx].fmt_idx; + mconfig->res_idx = mconfig->mod_cfg[cfg_idx].res_idx; +@@ -1644,9 +1645,9 @@ int skl_tplg_update_pipe_params(struct device *dev, + return 0; + + if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) +- format = &mconfig->module->formats[0].inputs[0].fmt; ++ format = &mconfig->module->formats[mconfig->fmt_idx].inputs[0].fmt; + else +- format = &mconfig->module->formats[0].outputs[0].fmt; ++ format = &mconfig->module->formats[mconfig->fmt_idx].outputs[0].fmt; + + /* set the hw_params */ + format->s_freq = params->s_freq; +-- +2.30.2 + diff --git a/queue-5.14/asoc-intel-skylake-leave-data-as-is-when-invoking-tl.patch b/queue-5.14/asoc-intel-skylake-leave-data-as-is-when-invoking-tl.patch new file mode 100644 index 00000000000..3f7a26307bf --- /dev/null +++ b/queue-5.14/asoc-intel-skylake-leave-data-as-is-when-invoking-tl.patch @@ -0,0 +1,43 @@ +From a79279e778ed152f382dd1493e5c21f4d3ff671e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 09:57:33 +0200 +Subject: ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs + +From: Cezary Rojewski + +[ Upstream commit 126b3422adc80f29d2129db7f61e0113a8a526c6 ] + +Advancing pointer initially fixed issue for some users but caused +regression for others. Leave data as it to make it easier for end users +to adjust their topology files if needed. + +Fixes: a8cd7066f042 ("ASoC: Intel: Skylake: Strip T and L from TLV IPCs") +Signed-off-by: Cezary Rojewski +Tested-by: Lukasz Majczak +Link: https://lore.kernel.org/r/20210818075742.1515155-3-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-topology.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c +index c0fdab39e7c2..45b1521e6189 100644 +--- a/sound/soc/intel/skylake/skl-topology.c ++++ b/sound/soc/intel/skylake/skl-topology.c +@@ -1463,12 +1463,6 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol, + struct skl_dev *skl = get_skl_ctx(w->dapm->dev); + + if (ac->params) { +- /* +- * Widget data is expected to be stripped of T and L +- */ +- size -= 2 * sizeof(unsigned int); +- data += 2; +- + if (size > ac->max) + return -EINVAL; + ac->size = size; +-- +2.30.2 + diff --git a/queue-5.14/asoc-mediatek-mt8183-fix-unbalanced-pm_runtime_enabl.patch b/queue-5.14/asoc-mediatek-mt8183-fix-unbalanced-pm_runtime_enabl.patch new file mode 100644 index 00000000000..b9ea6e463ac --- /dev/null +++ b/queue-5.14/asoc-mediatek-mt8183-fix-unbalanced-pm_runtime_enabl.patch @@ -0,0 +1,159 @@ +From 810be49eba38cf68bdb89b631fc31d8cead6fe99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 22:11:04 +0800 +Subject: ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in + mt8183_afe_pcm_dev_probe + +From: Zhang Qilong + +[ Upstream commit 19f479c37f76e926a6c0bec974a4d09826e32fc6 ] + +Add missing pm_runtime_disable() when probe error out. It could +avoid pm_runtime implementation complains when removing and probing +again the driver. + +Fixes:a94aec035a122 ("ASoC: mediatek: mt8183: add platform driver") + +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210618141104.105047-3-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 ++++++++++++++-------- + 1 file changed, 27 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +index c4a598cbbdaa..14e77df06b01 100644 +--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c ++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +@@ -1119,25 +1119,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + afe->regmap = syscon_node_to_regmap(dev->parent->of_node); + if (IS_ERR(afe->regmap)) { + dev_err(dev, "could not get regmap from parent\n"); +- return PTR_ERR(afe->regmap); ++ ret = PTR_ERR(afe->regmap); ++ goto err_pm_disable; + } + ret = regmap_attach_dev(dev, afe->regmap, &mt8183_afe_regmap_config); + if (ret) { + dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + rstc = devm_reset_control_get(dev, "audiosys"); + if (IS_ERR(rstc)) { + ret = PTR_ERR(rstc); + dev_err(dev, "could not get audiosys reset:%d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + ret = reset_control_reset(rstc); + if (ret) { + dev_err(dev, "failed to trigger audio reset:%d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + /* enable clock for regcache get default value from hw */ +@@ -1147,7 +1148,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config); + if (ret) { + dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + pm_runtime_put_sync(&pdev->dev); +@@ -1160,8 +1161,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + afe->memif_size = MT8183_MEMIF_NUM; + afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif), + GFP_KERNEL); +- if (!afe->memif) +- return -ENOMEM; ++ if (!afe->memif) { ++ ret = -ENOMEM; ++ goto err_pm_disable; ++ } + + for (i = 0; i < afe->memif_size; i++) { + afe->memif[i].data = &memif_data[i]; +@@ -1178,22 +1181,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + afe->irqs_size = MT8183_IRQ_NUM; + afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs), + GFP_KERNEL); +- if (!afe->irqs) +- return -ENOMEM; ++ if (!afe->irqs) { ++ ret = -ENOMEM; ++ goto err_pm_disable; ++ } + + for (i = 0; i < afe->irqs_size; i++) + afe->irqs[i].irq_data = &irq_data[i]; + + /* request irq */ + irq_id = platform_get_irq(pdev, 0); +- if (irq_id < 0) +- return irq_id; ++ if (irq_id < 0) { ++ ret = irq_id; ++ goto err_pm_disable; ++ } + + ret = devm_request_irq(dev, irq_id, mt8183_afe_irq_handler, + IRQF_TRIGGER_NONE, "asys-isr", (void *)afe); + if (ret) { + dev_err(dev, "could not request_irq for asys-isr\n"); +- return ret; ++ goto err_pm_disable; + } + + /* init sub_dais */ +@@ -1204,7 +1211,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + if (ret) { + dev_warn(afe->dev, "dai register i %d fail, ret %d\n", + i, ret); +- return ret; ++ goto err_pm_disable; + } + } + +@@ -1213,7 +1220,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + if (ret) { + dev_warn(afe->dev, "mtk_afe_combine_sub_dai fail, ret %d\n", + ret); +- return ret; ++ goto err_pm_disable; + } + + afe->mtk_afe_hardware = &mt8183_afe_hardware; +@@ -1229,7 +1236,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + NULL, 0); + if (ret) { + dev_warn(dev, "err_platform\n"); +- return ret; ++ goto err_pm_disable; + } + + ret = devm_snd_soc_register_component(afe->dev, +@@ -1238,10 +1245,14 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + afe->num_dai_drivers); + if (ret) { + dev_warn(dev, "err_dai_component\n"); +- return ret; ++ goto err_pm_disable; + } + + return ret; ++ ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); ++ return ret; + } + + static int mt8183_afe_pcm_dev_remove(struct platform_device *pdev) +-- +2.30.2 + diff --git a/queue-5.14/asoc-mediatek-mt8192-fix-unbalanced-pm_runtime_enabl.patch b/queue-5.14/asoc-mediatek-mt8192-fix-unbalanced-pm_runtime_enabl.patch new file mode 100644 index 00000000000..5872c4ed80a --- /dev/null +++ b/queue-5.14/asoc-mediatek-mt8192-fix-unbalanced-pm_runtime_enabl.patch @@ -0,0 +1,101 @@ +From 70437642a2b61b1fee2b4b19f7d961997f2c8f12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 22:11:03 +0800 +Subject: ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in + mt8192_afe_pcm_dev_probe + +From: Zhang Qilong + +[ Upstream commit 2af2f861edd21c1456ef7dbec52122ce1b581568 ] + +Add missing pm_runtime_disable() when probe error out. It could +avoid pm_runtime implementation complains when removing and probing +again the driver. + +Fixes:125ab5d588b0b ("ASoC: mediatek: mt8192: add platform driver") + +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210618141104.105047-2-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 ++++++++++++++-------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +index 7a1724f5ff4c..31c280339c50 100644 +--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c ++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +@@ -2229,12 +2229,13 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) + afe->regmap = syscon_node_to_regmap(dev->parent->of_node); + if (IS_ERR(afe->regmap)) { + dev_err(dev, "could not get regmap from parent\n"); +- return PTR_ERR(afe->regmap); ++ ret = PTR_ERR(afe->regmap); ++ goto err_pm_disable; + } + ret = regmap_attach_dev(dev, afe->regmap, &mt8192_afe_regmap_config); + if (ret) { + dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + /* enable clock for regcache get default value from hw */ +@@ -2244,7 +2245,7 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) + ret = regmap_reinit_cache(afe->regmap, &mt8192_afe_regmap_config); + if (ret) { + dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + pm_runtime_put_sync(&pdev->dev); +@@ -2257,8 +2258,10 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) + afe->memif_size = MT8192_MEMIF_NUM; + afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif), + GFP_KERNEL); +- if (!afe->memif) +- return -ENOMEM; ++ if (!afe->memif) { ++ ret = -ENOMEM; ++ goto err_pm_disable; ++ } + + for (i = 0; i < afe->memif_size; i++) { + afe->memif[i].data = &memif_data[i]; +@@ -2272,22 +2275,26 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) + afe->irqs_size = MT8192_IRQ_NUM; + afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs), + GFP_KERNEL); +- if (!afe->irqs) +- return -ENOMEM; ++ if (!afe->irqs) { ++ ret = -ENOMEM; ++ goto err_pm_disable; ++ } + + for (i = 0; i < afe->irqs_size; i++) + afe->irqs[i].irq_data = &irq_data[i]; + + /* request irq */ + irq_id = platform_get_irq(pdev, 0); +- if (irq_id < 0) +- return irq_id; ++ if (irq_id < 0) { ++ ret = irq_id; ++ goto err_pm_disable; ++ } + + ret = devm_request_irq(dev, irq_id, mt8192_afe_irq_handler, + IRQF_TRIGGER_NONE, "asys-isr", (void *)afe); + if (ret) { + dev_err(dev, "could not request_irq for Afe_ISR_Handle\n"); +- return ret; ++ goto err_pm_disable; + } + + /* init sub_dais */ +-- +2.30.2 + diff --git a/queue-5.14/asoc-rt5682-properly-turn-off-regulators-if-wrong-de.patch b/queue-5.14/asoc-rt5682-properly-turn-off-regulators-if-wrong-de.patch new file mode 100644 index 00000000000..51ad8feca54 --- /dev/null +++ b/queue-5.14/asoc-rt5682-properly-turn-off-regulators-if-wrong-de.patch @@ -0,0 +1,84 @@ +From 07a4ba789f23687ecfec750f812d45d93992fb2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:17:56 -0700 +Subject: ASoC: rt5682: Properly turn off regulators if wrong device ID + +From: Douglas Anderson + +[ Upstream commit 772d44526e203c062171786e514373f129616278 ] + +When I booted up on a board that had a slightly different codec +stuffed on it, I got this message at bootup: + + rt5682 9-001a: Device with ID register 6749 is not rt5682 + +That's normal/expected, but what wasn't normal was the splat that I +got after: + + WARNING: CPU: 7 PID: 176 at drivers/regulator/core.c:2151 _regulator_put+0x150/0x158 + pc : _regulator_put+0x150/0x158 + ... + Call trace: + _regulator_put+0x150/0x158 + regulator_bulk_free+0x48/0x70 + devm_regulator_bulk_release+0x20/0x2c + release_nodes+0x1cc/0x244 + devres_release_all+0x44/0x60 + really_probe+0x17c/0x378 + ... + +This is because the error paths don't turn off the regulator. Let's +fix that. + +Fixes: 0ddce71c21f0 ("ASoC: rt5682: add rt5682 codec driver") +Fixes: 87b42abae99d ("ASoC: rt5682: Implement remove callback") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210811081751.v2.1.I4a1d9aa5d99e05aeee15c2768db600158d76cab8@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-i2c.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c +index 4a56a52adab5..e559b965a0a6 100644 +--- a/sound/soc/codecs/rt5682-i2c.c ++++ b/sound/soc/codecs/rt5682-i2c.c +@@ -117,6 +117,13 @@ static struct snd_soc_dai_driver rt5682_dai[] = { + }, + }; + ++static void rt5682_i2c_disable_regulators(void *data) ++{ ++ struct rt5682_priv *rt5682 = data; ++ ++ regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies); ++} ++ + static int rt5682_i2c_probe(struct i2c_client *i2c, + const struct i2c_device_id *id) + { +@@ -157,6 +164,11 @@ static int rt5682_i2c_probe(struct i2c_client *i2c, + return ret; + } + ++ ret = devm_add_action_or_reset(&i2c->dev, rt5682_i2c_disable_regulators, ++ rt5682); ++ if (ret) ++ return ret; ++ + ret = regulator_bulk_enable(ARRAY_SIZE(rt5682->supplies), + rt5682->supplies); + if (ret) { +@@ -285,7 +297,6 @@ static int rt5682_i2c_remove(struct i2c_client *client) + struct rt5682_priv *rt5682 = i2c_get_clientdata(client); + + rt5682_i2c_shutdown(client); +- regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.14/asoc-tlv320aic32x4-fix-tas2505-tas2521-channel-count.patch b/queue-5.14/asoc-tlv320aic32x4-fix-tas2505-tas2521-channel-count.patch new file mode 100644 index 00000000000..57f9f7a9535 --- /dev/null +++ b/queue-5.14/asoc-tlv320aic32x4-fix-tas2505-tas2521-channel-count.patch @@ -0,0 +1,42 @@ +From 2c05a273edf361a4d123dc588df781c1a6a1e4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jul 2021 11:12:29 +0200 +Subject: ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count + +From: Marek Vasut + +[ Upstream commit 3694f996be5cb8374bd224f4e5462c945d359843 ] + +The TAS2505/TAS2521 does support up to two channels, LEFT and RIGHT, +which are being alternated on the audio data bus by Word Clock, WCLK. +This is documented in TI slau472 2.7.1 Digital Audio Interface. Note +that both the LEFT and RIGHT channels are only used for audio INPUT, +while only the LEFT channel is used for audio OUTPUT. + +Fixes: b4525b6196cd7 ("ASoC: tlv320aic32x4: add support for TAS2505") +Signed-off-by: Marek Vasut +Cc: Claudius Heine +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210708091229.56443-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic32x4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c +index 2e9175b37dc9..254a016cb1f3 100644 +--- a/sound/soc/codecs/tlv320aic32x4.c ++++ b/sound/soc/codecs/tlv320aic32x4.c +@@ -1131,7 +1131,7 @@ static struct snd_soc_dai_driver aic32x4_tas2505_dai = { + .playback = { + .stream_name = "Playback", + .channels_min = 1, +- .channels_max = 1, ++ .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_96000, + .formats = AIC32X4_FORMATS,}, + .ops = &aic32x4_ops, +-- +2.30.2 + diff --git a/queue-5.14/asoc-wcd9335-disable-irq-on-slave-ports-in-the-remov.patch b/queue-5.14/asoc-wcd9335-disable-irq-on-slave-ports-in-the-remov.patch new file mode 100644 index 00000000000..b24fea21474 --- /dev/null +++ b/queue-5.14/asoc-wcd9335-disable-irq-on-slave-ports-in-the-remov.patch @@ -0,0 +1,57 @@ +From 18801c827e054a42c66b063d9819bbdcc0a51dcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 07:25:28 +0200 +Subject: ASoC: wcd9335: Disable irq on slave ports in the remove function + +From: Christophe JAILLET + +[ Upstream commit d3efd26af2e044ff2b48d38bb871630282d77e60 ] + +The probe calls 'wcd9335_setup_irqs()' to enable interrupts on all slave +ports. +This must be undone in the remove function. + +Add a 'wcd9335_teardown_irqs()' function that undoes 'wcd9335_setup_irqs()' +function, and call it from the remove function. + +Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") +Signed-off-by: Christophe JAILLET +Message-Id: <8f761244d79bd4c098af8a482be9121d3a486d1b.1629091028.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd9335.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 47fe68edea3a..d885ced34f60 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -4076,6 +4076,16 @@ static int wcd9335_setup_irqs(struct wcd9335_codec *wcd) + return ret; + } + ++static void wcd9335_teardown_irqs(struct wcd9335_codec *wcd) ++{ ++ int i; ++ ++ /* disable interrupts on all slave ports */ ++ for (i = 0; i < WCD9335_SLIM_NUM_PORT_REG; i++) ++ regmap_write(wcd->if_regmap, WCD9335_SLIM_PGD_PORT_INT_EN0 + i, ++ 0x00); ++} ++ + static void wcd9335_cdc_sido_ccl_enable(struct wcd9335_codec *wcd, + bool ccl_flag) + { +@@ -4878,6 +4888,7 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp) + struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev); + + wcd_clsh_ctrl_free(wcd->clsh_ctrl); ++ wcd9335_teardown_irqs(wcd); + } + + static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp, +-- +2.30.2 + diff --git a/queue-5.14/asoc-wcd9335-fix-a-double-irq-free-in-the-remove-fun.patch b/queue-5.14/asoc-wcd9335-fix-a-double-irq-free-in-the-remove-fun.patch new file mode 100644 index 00000000000..14a1314f254 --- /dev/null +++ b/queue-5.14/asoc-wcd9335-fix-a-double-irq-free-in-the-remove-fun.patch @@ -0,0 +1,47 @@ +From cb559c24d0f0f1ab6188585f13d5ecc7ee1cbb64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 07:25:10 +0200 +Subject: ASoC: wcd9335: Fix a double irq free in the remove function + +From: Christophe JAILLET + +[ Upstream commit 7a6a723e98aa45f393e6add18f7309dfffa1b0e2 ] + +There is no point in calling 'free_irq()' explicitly for +'WCD9335_IRQ_SLIMBUS' in the remove function. + +The irqs are requested in 'wcd9335_setup_irqs()' using a resource managed +function (i.e. 'devm_request_threaded_irq()'). +'wcd9335_setup_irqs()' requests all what is defined in the 'wcd9335_irqs' +structure. +This structure has only one entry for 'WCD9335_IRQ_SLIMBUS'. + +So 'devm_request...irq()' + explicit 'free_irq()' would lead to a double +free. + +Remove the unneeded 'free_irq()' from the remove function. + +Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") +Signed-off-by: Christophe JAILLET +Message-Id: <0614d63bc00edd7e81dd367504128f3d84f72efa.1629091028.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd9335.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 86c92e03ea5d..933f59e4e56f 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -4869,7 +4869,6 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp) + struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev); + + wcd_clsh_ctrl_free(wcd->clsh_ctrl); +- free_irq(regmap_irq_get_virq(wcd->irq_data, WCD9335_IRQ_SLIMBUS), wcd); + } + + static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp, +-- +2.30.2 + diff --git a/queue-5.14/asoc-wcd9335-fix-a-memory-leak-in-the-error-handling.patch b/queue-5.14/asoc-wcd9335-fix-a-memory-leak-in-the-error-handling.patch new file mode 100644 index 00000000000..2cc3a0bd592 --- /dev/null +++ b/queue-5.14/asoc-wcd9335-fix-a-memory-leak-in-the-error-handling.patch @@ -0,0 +1,56 @@ +From 71f3671bb0386e4906329586a43ef966c33abf16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 07:25:20 +0200 +Subject: ASoC: wcd9335: Fix a memory leak in the error handling path of the + probe function + +From: Christophe JAILLET + +[ Upstream commit fc6fc81caa63900cef9ebb8b2e365c3ed5a9effb ] + +If 'wcd9335_setup_irqs()' fails, me must release the memory allocated in +'wcd_clsh_ctrl_alloc()', as already done in the remove function. + +Add an error handling path and the missing 'wcd_clsh_ctrl_free()' call. + +Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") +Signed-off-by: Christophe JAILLET +Message-Id: <6dc12372f09fabb70bf05941dbe6a1382dc93e43.1629091028.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd9335.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 933f59e4e56f..47fe68edea3a 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -4844,6 +4844,7 @@ static void wcd9335_codec_init(struct snd_soc_component *component) + static int wcd9335_codec_probe(struct snd_soc_component *component) + { + struct wcd9335_codec *wcd = dev_get_drvdata(component->dev); ++ int ret; + int i; + + snd_soc_component_init_regmap(component, wcd->regmap); +@@ -4861,7 +4862,15 @@ static int wcd9335_codec_probe(struct snd_soc_component *component) + for (i = 0; i < NUM_CODEC_DAIS; i++) + INIT_LIST_HEAD(&wcd->dai[i].slim_ch_list); + +- return wcd9335_setup_irqs(wcd); ++ ret = wcd9335_setup_irqs(wcd); ++ if (ret) ++ goto free_clsh_ctrl; ++ ++ return 0; ++ ++free_clsh_ctrl: ++ wcd_clsh_ctrl_free(wcd->clsh_ctrl); ++ return ret; + } + + static void wcd9335_codec_remove(struct snd_soc_component *comp) +-- +2.30.2 + diff --git a/queue-5.14/asoc-wm_adsp-put-debugfs_remove_recursive-back-in.patch b/queue-5.14/asoc-wm_adsp-put-debugfs_remove_recursive-back-in.patch new file mode 100644 index 00000000000..7b39a39a15c --- /dev/null +++ b/queue-5.14/asoc-wm_adsp-put-debugfs_remove_recursive-back-in.patch @@ -0,0 +1,55 @@ +From 698de5ef519680c48559a5a664bbbd26cf8a9c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 11:15:52 +0100 +Subject: ASoC: wm_adsp: Put debugfs_remove_recursive back in + +From: Charles Keepax + +[ Upstream commit e6d0b92ac00b53121a35b2a1ce8d393dc9179fdf ] + +This patch reverts commit acbf58e53041 ("ASoC: wm_adsp: Let +soc_cleanup_component_debugfs remove debugfs"), and adds an +alternate solution to the issue. That patch removes the call to +debugfs_remove_recursive, which cleans up the DSPs debugfs. The +intention was to avoid an unbinding issue on an out of tree +driver/platform. + +The issue with the patch is it means the driver no longer cleans up +its own debugfs, instead relying on ASoC to remove recurive on the +parent debugfs node. This is conceptually rather unclean, but also it +would prevent DSPs being added/removed independently of ASoC and soon +we are going to be upstreaming some non-audio parts with these DSPs, +which will require this. + +Finally, it seems the issue on the platform is a result of the +wm_adsp2_cleanup_debugfs getting called twice. This is very likely a +problem on the platform side and will be resolved there. But in the mean +time make the code a little more robust to such issues, and again +conceptually a bit nicer, but clearing the debugfs_root variable in the +DSP structure when the debugfs is removed. + +Fixes: acbf58e53041 ("ASoC: wm_adsp: Let soc_cleanup_component_debugfs remove debugfs" +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20210824101552.1119-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index fe15cbc7bcaf..a4d4cbf716a1 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -747,6 +747,8 @@ static void wm_adsp2_init_debugfs(struct wm_adsp *dsp, + static void wm_adsp2_cleanup_debugfs(struct wm_adsp *dsp) + { + wm_adsp_debugfs_clear(dsp); ++ debugfs_remove_recursive(dsp->debugfs_root); ++ dsp->debugfs_root = NULL; + } + #else + static inline void wm_adsp2_init_debugfs(struct wm_adsp *dsp, +-- +2.30.2 + diff --git a/queue-5.14/ath6kl-wmi-fix-an-error-code-in-ath6kl_wmi_sync_poin.patch b/queue-5.14/ath6kl-wmi-fix-an-error-code-in-ath6kl_wmi_sync_poin.patch new file mode 100644 index 00000000000..13a984d7bb1 --- /dev/null +++ b/queue-5.14/ath6kl-wmi-fix-an-error-code-in-ath6kl_wmi_sync_poin.patch @@ -0,0 +1,42 @@ +From ab4e0a2c5a5dc92176dd16f95dcc6073af7f5ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 14:34:38 +0300 +Subject: ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() + +From: Dan Carpenter + +[ Upstream commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe ] + +This error path is unlikely because of it checked for NULL and +returned -ENOMEM earlier in the function. But it should return +an error code here as well if we ever do hit it because of a +race condition or something. + +Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210813113438.GB30697@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index b137e7f34397..bd1ef6334997 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -2504,8 +2504,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx) + goto free_data_skb; + + for (index = 0; index < num_pri_streams; index++) { +- if (WARN_ON(!data_sync_bufs[index].skb)) ++ if (WARN_ON(!data_sync_bufs[index].skb)) { ++ ret = -ENOMEM; + goto free_data_skb; ++ } + + ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev, + data_sync_bufs[index]. +-- +2.30.2 + diff --git a/queue-5.14/atlantic-fix-driver-resume-flow.patch b/queue-5.14/atlantic-fix-driver-resume-flow.patch new file mode 100644 index 00000000000..ba3cbc208a2 --- /dev/null +++ b/queue-5.14/atlantic-fix-driver-resume-flow.patch @@ -0,0 +1,38 @@ +From b347980579d4e8425b1340fa7825a6d0d370aae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 04:52:25 -0700 +Subject: atlantic: Fix driver resume flow. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 57f780f1c43362b86fd23d20bd940e2468237716 ] + +Driver crashes when restoring from the Hibernate. In the resume flow, +driver need to clean up the older nic/vec objects and re-initialize them. + +Fixes: 8aaa112a57c1d ("net: atlantic: refactoring pm logic") +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index 59253846e885..f26d03735619 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -417,6 +417,9 @@ static int atl_resume_common(struct device *dev, bool deep) + pci_restore_state(pdev); + + if (deep) { ++ /* Reinitialize Nic/Vecs objects */ ++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); ++ + ret = aq_nic_init(nic); + if (ret) + goto err_exit; +-- +2.30.2 + diff --git a/queue-5.14/bcache-add-proper-error-unwinding-in-bcache_device_i.patch b/queue-5.14/bcache-add-proper-error-unwinding-in-bcache_device_i.patch new file mode 100644 index 00000000000..43ed71309fe --- /dev/null +++ b/queue-5.14/bcache-add-proper-error-unwinding-in-bcache_device_i.patch @@ -0,0 +1,69 @@ +From 631fc06e74f0201f5dea079e580a9c418064348d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 08:40:26 +0200 +Subject: bcache: add proper error unwinding in bcache_device_init + +From: Christoph Hellwig + +[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ] + +Except for the IDA none of the allocations in bcache_device_init is +unwound on error, fix that. + +Signed-off-by: Christoph Hellwig +Acked-by: Coly Li +Link: https://lore.kernel.org/r/20210809064028.1198327-7-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/super.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 185246a0d855..d0f08e946453 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -931,20 +931,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, + n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long); + d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL); + if (!d->full_dirty_stripes) +- return -ENOMEM; ++ goto out_free_stripe_sectors_dirty; + + idx = ida_simple_get(&bcache_device_idx, 0, + BCACHE_DEVICE_IDX_MAX, GFP_KERNEL); + if (idx < 0) +- return idx; ++ goto out_free_full_dirty_stripes; + + if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio), + BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER)) +- goto err; ++ goto out_ida_remove; + + d->disk = blk_alloc_disk(NUMA_NO_NODE); + if (!d->disk) +- goto err; ++ goto out_bioset_exit; + + set_capacity(d->disk, sectors); + snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx); +@@ -987,8 +987,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, + + return 0; + +-err: ++out_bioset_exit: ++ bioset_exit(&d->bio_split); ++out_ida_remove: + ida_simple_remove(&bcache_device_idx, idx); ++out_free_full_dirty_stripes: ++ kvfree(d->full_dirty_stripes); ++out_free_stripe_sectors_dirty: ++ kvfree(d->stripe_sectors_dirty); + return -ENOMEM; + + } +-- +2.30.2 + diff --git a/queue-5.14/bcma-fix-memory-leak-for-internally-handled-cores.patch b/queue-5.14/bcma-fix-memory-leak-for-internally-handled-cores.patch new file mode 100644 index 00000000000..fd5aa137a0b --- /dev/null +++ b/queue-5.14/bcma-fix-memory-leak-for-internally-handled-cores.patch @@ -0,0 +1,65 @@ +From bd8e25b037ae6c5d3a4ee008b84b1a7f0366a706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 10:52:31 +0800 +Subject: bcma: Fix memory leak for internally-handled cores + +From: Zenghui Yu + +[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ] + +kmemleak reported that dev_name() of internally-handled cores were leaked +on driver unbinding. Let's use device_initialize() to take refcounts for +them and put_device() to properly free the related stuff. + +While looking at it, there's another potential issue for those which should +be *registered* into driver core. If device_register() failed, we put +device once and freed bcma_device structures. In bcma_unregister_cores(), +they're treated as unregistered and we hit both UAF and double-free. That +smells not good and has also been fixed now. + +Fixes: ab54bc8460b5 ("bcma: fill core details for every device") +Signed-off-by: Zenghui Yu +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/bcma/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c +index 6535614a7dc1..1df2b5801c3b 100644 +--- a/drivers/bcma/main.c ++++ b/drivers/bcma/main.c +@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq); + + void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core) + { ++ device_initialize(&core->dev); + core->dev.release = bcma_release_core_dev; + core->dev.bus = &bcma_bus_type; + dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index); +@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) + { + int err; + +- err = device_register(&core->dev); ++ err = device_add(&core->dev); + if (err) { + bcma_err(bus, "Could not register dev for core 0x%03X\n", + core->id.id); +- put_device(&core->dev); + return; + } + core->dev_registered = true; +@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus) + /* Now noone uses internally-handled cores, we can free them */ + list_for_each_entry_safe(core, tmp, &bus->cores, list) { + list_del(&core->list); +- kfree(core); ++ put_device(&core->dev); + } + } + +-- +2.30.2 + diff --git a/queue-5.14/blk-crypto-fix-check-for-too-large-dun_bytes.patch b/queue-5.14/blk-crypto-fix-check-for-too-large-dun_bytes.patch new file mode 100644 index 00000000000..c12d4b8dc62 --- /dev/null +++ b/queue-5.14/blk-crypto-fix-check-for-too-large-dun_bytes.patch @@ -0,0 +1,40 @@ +From 7cf60e5cd2c324e73a64586529a68badd2d11006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 22:59:18 -0700 +Subject: blk-crypto: fix check for too-large dun_bytes + +From: Eric Biggers + +[ Upstream commit cc40b7225151f611ef837f6403cfaeadc7af214a ] + +dun_bytes needs to be less than or equal to the IV size of the +encryption mode, not just less than or equal to BLK_CRYPTO_MAX_IV_SIZE. + +Currently this doesn't matter since blk_crypto_init_key() is never +actually passed invalid values, but we might as well fix this. + +Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq") +Signed-off-by: Eric Biggers +Link: https://lore.kernel.org/r/20210825055918.51975-1-ebiggers@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-crypto.c b/block/blk-crypto.c +index c5bdaafffa29..103c2e2d50d6 100644 +--- a/block/blk-crypto.c ++++ b/block/blk-crypto.c +@@ -332,7 +332,7 @@ int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key, + if (mode->keysize == 0) + return -EINVAL; + +- if (dun_bytes == 0 || dun_bytes > BLK_CRYPTO_MAX_IV_SIZE) ++ if (dun_bytes == 0 || dun_bytes > mode->ivsize) + return -EINVAL; + + if (!is_power_of_2(data_unit_size)) +-- +2.30.2 + diff --git a/queue-5.14/blk-throtl-optimize-iops-throttle-for-large-io-scena.patch b/queue-5.14/blk-throtl-optimize-iops-throttle-for-large-io-scena.patch new file mode 100644 index 00000000000..958627a19d0 --- /dev/null +++ b/queue-5.14/blk-throtl-optimize-iops-throttle-for-large-io-scena.patch @@ -0,0 +1,155 @@ +From c6ed1ae453ecc08a532085dbf3190cf6eb8822df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Aug 2021 11:51:56 +0800 +Subject: blk-throtl: optimize IOPS throttle for large IO scenarios + +From: Chunguang Xu + +[ Upstream commit 4f1e9630afe6332de7286820fedd019f19eac057 ] + +After patch 54efd50 (block: make generic_make_request handle +arbitrarily sized bios), the IO through io-throttle may be larger, +and these IOs may be further split into more small IOs. However, +IOPS throttle does not seem to be aware of this change, which +makes the calculation of IOPS of large IOs incomplete, resulting +in disk-side IOPS that does not meet expectations. Maybe we should +fix this problem. + +We can reproduce it by set max_sectors_kb of disk to 128, set +blkio.write_iops_throttle to 100, run a dd instance inside blkio +and use iostat to watch IOPS: + +dd if=/dev/zero of=/dev/sdb bs=1M count=1000 oflag=direct + +As a result, without this change the average IOPS is 1995, with +this change the IOPS is 98. + +Signed-off-by: Chunguang Xu +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/65869aaad05475797d63b4c3fed4f529febe3c26.1627876014.git.brookxu@tencent.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 2 ++ + block/blk-throttle.c | 32 ++++++++++++++++++++++++++++++++ + block/blk.h | 2 ++ + 3 files changed, 36 insertions(+) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index a11b3b53717e..22eeaad190d7 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -348,6 +348,8 @@ void __blk_queue_split(struct bio **bio, unsigned int *nr_segs) + trace_block_split(split, (*bio)->bi_iter.bi_sector); + submit_bio_noacct(*bio); + *bio = split; ++ ++ blk_throtl_charge_bio_split(*bio); + } + } + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index b1b22d863bdf..55c49015e533 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -178,6 +178,9 @@ struct throtl_grp { + unsigned int bad_bio_cnt; /* bios exceeding latency threshold */ + unsigned long bio_cnt_reset_time; + ++ atomic_t io_split_cnt[2]; ++ atomic_t last_io_split_cnt[2]; ++ + struct blkg_rwstat stat_bytes; + struct blkg_rwstat stat_ios; + }; +@@ -777,6 +780,8 @@ static inline void throtl_start_new_slice_with_credit(struct throtl_grp *tg, + tg->bytes_disp[rw] = 0; + tg->io_disp[rw] = 0; + ++ atomic_set(&tg->io_split_cnt[rw], 0); ++ + /* + * Previous slice has expired. We must have trimmed it after last + * bio dispatch. That means since start of last slice, we never used +@@ -799,6 +804,9 @@ static inline void throtl_start_new_slice(struct throtl_grp *tg, bool rw) + tg->io_disp[rw] = 0; + tg->slice_start[rw] = jiffies; + tg->slice_end[rw] = jiffies + tg->td->throtl_slice; ++ ++ atomic_set(&tg->io_split_cnt[rw], 0); ++ + throtl_log(&tg->service_queue, + "[%c] new slice start=%lu end=%lu jiffies=%lu", + rw == READ ? 'R' : 'W', tg->slice_start[rw], +@@ -1031,6 +1039,9 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio, + jiffies + tg->td->throtl_slice); + } + ++ if (iops_limit != UINT_MAX) ++ tg->io_disp[rw] += atomic_xchg(&tg->io_split_cnt[rw], 0); ++ + if (tg_with_in_bps_limit(tg, bio, bps_limit, &bps_wait) && + tg_with_in_iops_limit(tg, bio, iops_limit, &iops_wait)) { + if (wait) +@@ -2052,12 +2063,14 @@ static void throtl_downgrade_check(struct throtl_grp *tg) + } + + if (tg->iops[READ][LIMIT_LOW]) { ++ tg->last_io_disp[READ] += atomic_xchg(&tg->last_io_split_cnt[READ], 0); + iops = tg->last_io_disp[READ] * HZ / elapsed_time; + if (iops >= tg->iops[READ][LIMIT_LOW]) + tg->last_low_overflow_time[READ] = now; + } + + if (tg->iops[WRITE][LIMIT_LOW]) { ++ tg->last_io_disp[WRITE] += atomic_xchg(&tg->last_io_split_cnt[WRITE], 0); + iops = tg->last_io_disp[WRITE] * HZ / elapsed_time; + if (iops >= tg->iops[WRITE][LIMIT_LOW]) + tg->last_low_overflow_time[WRITE] = now; +@@ -2176,6 +2189,25 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td) + } + #endif + ++void blk_throtl_charge_bio_split(struct bio *bio) ++{ ++ struct blkcg_gq *blkg = bio->bi_blkg; ++ struct throtl_grp *parent = blkg_to_tg(blkg); ++ struct throtl_service_queue *parent_sq; ++ bool rw = bio_data_dir(bio); ++ ++ do { ++ if (!parent->has_rules[rw]) ++ break; ++ ++ atomic_inc(&parent->io_split_cnt[rw]); ++ atomic_inc(&parent->last_io_split_cnt[rw]); ++ ++ parent_sq = parent->service_queue.parent_sq; ++ parent = sq_to_tg(parent_sq); ++ } while (parent); ++} ++ + bool blk_throtl_bio(struct bio *bio) + { + struct request_queue *q = bio->bi_bdev->bd_disk->queue; +diff --git a/block/blk.h b/block/blk.h +index cb01429c162c..f10cc9b2c27f 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -289,11 +289,13 @@ int create_task_io_context(struct task_struct *task, gfp_t gfp_mask, int node); + extern int blk_throtl_init(struct request_queue *q); + extern void blk_throtl_exit(struct request_queue *q); + extern void blk_throtl_register_queue(struct request_queue *q); ++extern void blk_throtl_charge_bio_split(struct bio *bio); + bool blk_throtl_bio(struct bio *bio); + #else /* CONFIG_BLK_DEV_THROTTLING */ + static inline int blk_throtl_init(struct request_queue *q) { return 0; } + static inline void blk_throtl_exit(struct request_queue *q) { } + static inline void blk_throtl_register_queue(struct request_queue *q) { } ++static inline void blk_throtl_charge_bio_split(struct bio *bio) { } + static inline bool blk_throtl_bio(struct bio *bio) { return false; } + #endif /* CONFIG_BLK_DEV_THROTTLING */ + #ifdef CONFIG_BLK_DEV_THROTTLING_LOW +-- +2.30.2 + diff --git a/queue-5.14/block-nbd-add-sanity-check-for-first_minor.patch b/queue-5.14/block-nbd-add-sanity-check-for-first_minor.patch new file mode 100644 index 00000000000..a3796cc1268 --- /dev/null +++ b/queue-5.14/block-nbd-add-sanity-check-for-first_minor.patch @@ -0,0 +1,62 @@ +From 256eb2c91f93de3eafacf05e06ffb0bee8608ad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 12:15:01 +0300 +Subject: block: nbd: add sanity check for first_minor + +From: Pavel Skripkin + +[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ] + +Syzbot hit WARNING in internal_create_group(). The problem was in +too big disk->first_minor. + +disk->first_minor is initialized by value, which comes from userspace +and there wasn't any sanity checks about value correctness. It can cause +duplicate creation of sysfs files/links, because disk->first_minor will +be passed to MKDEV() which causes truncation to byte. Since maximum +minor value is 0xff, let's check if first_minor is correct minor number. + +NOTE: the root case of the reported warning was in wrong error handling +in register_disk(), but we can avoid passing knowingly wrong values to +sysfs API, because sysfs error messages can confuse users. For example: +user passed 1048576 as index, but sysfs complains about duplicate +creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0. +Log and reproducer for above example can be found on syzkaller bug +report page. + +Link: https://syzkaller.appspot.com/bug?id=03c2ae9146416edf811958d5fd7acfab75b143d1 +Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices") +Reported-by: syzbot+9937dc42271cd87d4b98@syzkaller.appspotmail.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Pavel Skripkin +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 7ed888e99f09..93708b1938e8 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1770,7 +1770,17 @@ static int nbd_dev_add(int index) + refcount_set(&nbd->refs, 1); + INIT_LIST_HEAD(&nbd->list); + disk->major = NBD_MAJOR; ++ ++ /* Too big first_minor can cause duplicate creation of ++ * sysfs files/links, since first_minor will be truncated to ++ * byte in __device_add_disk(). ++ */ + disk->first_minor = index << part_shift; ++ if (disk->first_minor > 0xff) { ++ err = -EINVAL; ++ goto out_free_idr; ++ } ++ + disk->minors = 1 << part_shift; + disk->fops = &nbd_fops; + disk->private_data = nbd; +-- +2.30.2 + diff --git a/queue-5.14/block-return-elevator_discard_merge-if-possible.patch b/queue-5.14/block-return-elevator_discard_merge-if-possible.patch new file mode 100644 index 00000000000..46873697ebd --- /dev/null +++ b/queue-5.14/block-return-elevator_discard_merge-if-possible.patch @@ -0,0 +1,131 @@ +From 43d75518b39686590c960fa080f107dc416885e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 11:42:26 +0800 +Subject: block: return ELEVATOR_DISCARD_MERGE if possible + +From: Ming Lei + +[ Upstream commit 866663b7b52d2da267b28e12eed89ee781b8fed1 ] + +When merging one bio to request, if they are discard IO and the queue +supports multi-range discard, we need to return ELEVATOR_DISCARD_MERGE +because both block core and related drivers(nvme, virtio-blk) doesn't +handle mixed discard io merge(traditional IO merge together with +discard merge) well. + +Fix the issue by returning ELEVATOR_DISCARD_MERGE in this situation, +so both blk-mq and drivers just need to handle multi-range discard. + +Reported-by: Oleksandr Natalenko +Signed-off-by: Ming Lei +Tested-by: Oleksandr Natalenko +Fixes: 2705dfb20947 ("block: fix discard request merge") +Link: https://lore.kernel.org/r/20210729034226.1591070-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 3 +++ + block/blk-merge.c | 16 ---------------- + block/elevator.c | 3 +++ + block/mq-deadline.c | 2 ++ + include/linux/blkdev.h | 16 ++++++++++++++++ + 5 files changed, 24 insertions(+), 16 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 727955918563..673a634eadd9 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2361,6 +2361,9 @@ static int bfq_request_merge(struct request_queue *q, struct request **req, + __rq = bfq_find_rq_fmerge(bfqd, bio, q); + if (__rq && elv_bio_merge_ok(__rq, bio)) { + *req = __rq; ++ ++ if (blk_discard_mergable(__rq)) ++ return ELEVATOR_DISCARD_MERGE; + return ELEVATOR_FRONT_MERGE; + } + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 22eeaad190d7..eeba8422ae82 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -707,22 +707,6 @@ static void blk_account_io_merge_request(struct request *req) + } + } + +-/* +- * Two cases of handling DISCARD merge: +- * If max_discard_segments > 1, the driver takes every bio +- * as a range and send them to controller together. The ranges +- * needn't to be contiguous. +- * Otherwise, the bios/requests will be handled as same as +- * others which should be contiguous. +- */ +-static inline bool blk_discard_mergable(struct request *req) +-{ +- if (req_op(req) == REQ_OP_DISCARD && +- queue_max_discard_segments(req->q) > 1) +- return true; +- return false; +-} +- + static enum elv_merge blk_try_req_merge(struct request *req, + struct request *next) + { +diff --git a/block/elevator.c b/block/elevator.c +index 52ada14cfe45..a5fe2615ec0f 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -336,6 +336,9 @@ enum elv_merge elv_merge(struct request_queue *q, struct request **req, + __rq = elv_rqhash_find(q, bio->bi_iter.bi_sector); + if (__rq && elv_bio_merge_ok(__rq, bio)) { + *req = __rq; ++ ++ if (blk_discard_mergable(__rq)) ++ return ELEVATOR_DISCARD_MERGE; + return ELEVATOR_BACK_MERGE; + } + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 36920670dccc..3c3693c34f06 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -629,6 +629,8 @@ static int dd_request_merge(struct request_queue *q, struct request **rq, + + if (elv_bio_merge_ok(__rq, bio)) { + *rq = __rq; ++ if (blk_discard_mergable(__rq)) ++ return ELEVATOR_DISCARD_MERGE; + return ELEVATOR_FRONT_MERGE; + } + } +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index d3afea47ade6..4b0f8bb0671d 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1521,6 +1521,22 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector + return offset << SECTOR_SHIFT; + } + ++/* ++ * Two cases of handling DISCARD merge: ++ * If max_discard_segments > 1, the driver takes every bio ++ * as a range and send them to controller together. The ranges ++ * needn't to be contiguous. ++ * Otherwise, the bios/requests will be handled as same as ++ * others which should be contiguous. ++ */ ++static inline bool blk_discard_mergable(struct request *req) ++{ ++ if (req_op(req) == REQ_OP_DISCARD && ++ queue_max_discard_segments(req->q) > 1) ++ return true; ++ return false; ++} ++ + static inline int bdev_discard_alignment(struct block_device *bdev) + { + struct request_queue *q = bdev_get_queue(bdev); +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-add-timeout-sanity-check-to-hci_inquiry.patch b/queue-5.14/bluetooth-add-timeout-sanity-check-to-hci_inquiry.patch new file mode 100644 index 00000000000..af5abbf2b90 --- /dev/null +++ b/queue-5.14/bluetooth-add-timeout-sanity-check-to-hci_inquiry.patch @@ -0,0 +1,46 @@ +From 9386ed5731580b1209c79064dfb6a088d34634f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 18:15:21 +0300 +Subject: Bluetooth: add timeout sanity check to hci_inquiry + +From: Pavel Skripkin + +[ Upstream commit f41a4b2b5eb7872109723dab8ae1603bdd9d9ec1 ] + +Syzbot hit "task hung" bug in hci_req_sync(). The problem was in +unreasonable huge inquiry timeout passed from userspace. +Fix it by adding sanity check for timeout value to hci_inquiry(). + +Since hci_inquiry() is the only user of hci_req_sync() with user +controlled timeout value, it makes sense to check timeout value in +hci_inquiry() and don't touch hci_req_sync(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 2331612839d7..4c25bcd1ac4c 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1343,6 +1343,12 @@ int hci_inquiry(void __user *arg) + goto done; + } + ++ /* Restrict maximum inquiry length to 60 seconds */ ++ if (ir.length > 60) { ++ err = -EINVAL; ++ goto done; ++ } ++ + hci_dev_lock(hdev); + if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || + inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) { +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-btusb-fix-a-unspported-condition-to-set-av.patch b/queue-5.14/bluetooth-btusb-fix-a-unspported-condition-to-set-av.patch new file mode 100644 index 00000000000..f04f3d7beb0 --- /dev/null +++ b/queue-5.14/bluetooth-btusb-fix-a-unspported-condition-to-set-av.patch @@ -0,0 +1,61 @@ +From 4f6b17ce5201508fa38dfd3034b68cda1e3481c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jul 2021 21:46:25 +0800 +Subject: Bluetooth: btusb: Fix a unspported condition to set available debug + features + +From: Jun Miao + +[ Upstream commit 20a831f04f1526f2c3442efd3dece8630216b5d2 ] + +When reading the support debug features failed, there are not available +features init. Continue to set the debug features is illogical, we should +skip btintel_set_debug_features(), even if check it by "if (!features)". + +Fixes: c453b10c2b28 ("Bluetooth: btusb: Configure Intel debug feature based on available support") +Signed-off-by: Jun Miao +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 0255bf243ce5..bd37d6fb88c2 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2921,10 +2921,11 @@ static int btusb_setup_intel_new(struct hci_dev *hdev) + /* Read the Intel supported features and if new exception formats + * supported, need to load the additional DDC config to enable. + */ +- btintel_read_debug_features(hdev, &features); +- +- /* Set DDC mask for available debug features */ +- btintel_set_debug_features(hdev, &features); ++ err = btintel_read_debug_features(hdev, &features); ++ if (!err) { ++ /* Set DDC mask for available debug features */ ++ btintel_set_debug_features(hdev, &features); ++ } + + /* Read the Intel version information after loading the FW */ + err = btintel_read_version(hdev, &ver); +@@ -3017,10 +3018,11 @@ static int btusb_setup_intel_newgen(struct hci_dev *hdev) + /* Read the Intel supported features and if new exception formats + * supported, need to load the additional DDC config to enable. + */ +- btintel_read_debug_features(hdev, &features); +- +- /* Set DDC mask for available debug features */ +- btintel_set_debug_features(hdev, &features); ++ err = btintel_read_debug_features(hdev, &features); ++ if (!err) { ++ /* Set DDC mask for available debug features */ ++ btintel_set_debug_features(hdev, &features); ++ } + + /* Read the Intel version information after loading the FW */ + err = btintel_read_version_tlv(hdev, &version); +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-fix-repeated-calls-to-sco_sock_kill.patch b/queue-5.14/bluetooth-fix-repeated-calls-to-sco_sock_kill.patch new file mode 100644 index 00000000000..aa52bbcadc6 --- /dev/null +++ b/queue-5.14/bluetooth-fix-repeated-calls-to-sco_sock_kill.patch @@ -0,0 +1,86 @@ +From ae2a0884adf4c4bdec1712f9b7300b36f40c4f0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 12:14:10 +0800 +Subject: Bluetooth: fix repeated calls to sco_sock_kill + +From: Desmond Cheong Zhi Xi + +[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ] + +In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed +socket"), a check was added to sco_sock_kill to skip killing a socket +if the SOCK_DEAD flag was set. + +This was done after a trace for a use-after-free bug showed that the +same sock pointer was being killed twice. + +Unfortunately, this check prevents sco_sock_kill from running on any +socket. sco_sock_kill kills a socket only if it's zapped and orphaned, +however sock_orphan announces that the socket is dead before detaching +it. i.e., orphaned sockets have the SOCK_DEAD flag set. + +To fix this, we remove the check for SOCK_DEAD, and avoid repeated +calls to sco_sock_kill by removing incorrect calls in: + +1. sco_sock_timeout. The socket should not be killed on timeout as +further processing is expected to be done. For example, +sco_sock_connect sets the timer then waits for the socket to be +connected or for an error to be returned. + +2. sco_conn_del. This function should clean up resources for the +connection, but the socket itself should be cleaned up in +sco_sock_release. + +3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen +and sco_sock_release are followed by sco_sock_kill. Hence the +duplicated call should be removed. + +Fixes: 4e1a720d0312 ("Bluetooth: avoid killing an already killed socket") +Signed-off-by: Desmond Cheong Zhi Xi +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/sco.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index ffa2a77a3e4c..b5ab842c7c4a 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -85,7 +85,6 @@ static void sco_sock_timeout(struct timer_list *t) + sk->sk_state_change(sk); + bh_unlock_sock(sk); + +- sco_sock_kill(sk); + sock_put(sk); + } + +@@ -177,7 +176,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err) + sco_sock_clear_timer(sk); + sco_chan_del(sk, err); + bh_unlock_sock(sk); +- sco_sock_kill(sk); + sock_put(sk); + } + +@@ -394,8 +392,7 @@ static void sco_sock_cleanup_listen(struct sock *parent) + */ + static void sco_sock_kill(struct sock *sk) + { +- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || +- sock_flag(sk, SOCK_DEAD)) ++ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) + return; + + BT_DBG("sk %p state %d", sk, sk->sk_state); +@@ -447,7 +444,6 @@ static void sco_sock_close(struct sock *sk) + lock_sock(sk); + __sco_sock_close(sk); + release_sock(sk); +- sco_sock_kill(sk); + } + + static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg, +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-increase-btnamsiz-to-21-chars-to-fix-poten.patch b/queue-5.14/bluetooth-increase-btnamsiz-to-21-chars-to-fix-poten.patch new file mode 100644 index 00000000000..ab775734d28 --- /dev/null +++ b/queue-5.14/bluetooth-increase-btnamsiz-to-21-chars-to-fix-poten.patch @@ -0,0 +1,41 @@ +From 5bb3788fefd150095c38b4cf9004f12712edfe8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 16:09:51 +0100 +Subject: Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer + overflow + +From: Colin Ian King + +[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ] + +An earlier commit replaced using batostr to using %pMR sprintf for the +construction of session->name. Static analysis detected that this new +method can use a total of 21 characters (including the trailing '\0') +so we need to increase the BTNAMSIZ from 18 to 21 to fix potential +buffer overflows. + +Addresses-Coverity: ("Out-of-bounds write") +Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr") +Signed-off-by: Colin Ian King +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/cmtp/cmtp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h +index c32638dddbf9..f6b9dc4e408f 100644 +--- a/net/bluetooth/cmtp/cmtp.h ++++ b/net/bluetooth/cmtp/cmtp.h +@@ -26,7 +26,7 @@ + #include + #include + +-#define BTNAMSIZ 18 ++#define BTNAMSIZ 21 + + /* CMTP ioctl defines */ + #define CMTPCONNADD _IOW('C', 200, int) +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-mgmt-fix-wrong-opcode-in-the-response-for-.patch b/queue-5.14/bluetooth-mgmt-fix-wrong-opcode-in-the-response-for-.patch new file mode 100644 index 00000000000..d05d0682df4 --- /dev/null +++ b/queue-5.14/bluetooth-mgmt-fix-wrong-opcode-in-the-response-for-.patch @@ -0,0 +1,36 @@ +From acb10e548a380e5fa6d7f53774e962ada7a15dd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 13:22:36 -0700 +Subject: Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd + +From: Tedd Ho-Jeong An + +[ Upstream commit a25fca4d3c18766b6f7a3c95fa8faec23ef464c5 ] + +This patch fixes the MGMT add_advertising command repsones with the +wrong opcode when it is trying to return the not supported error. + +Fixes: cbbdfa6f33198 ("Bluetooth: Enable controller RPA resolution using Experimental feature") +Signed-off-by: Tedd Ho-Jeong An +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 3663f880df11..1e21e014efd2 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -7725,7 +7725,7 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev, + * advertising. + */ + if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) +- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, + MGMT_STATUS_NOT_SUPPORTED); + + if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-move-shutdown-callback-before-flushing-tx-.patch b/queue-5.14/bluetooth-move-shutdown-callback-before-flushing-tx-.patch new file mode 100644 index 00000000000..b370702778f --- /dev/null +++ b/queue-5.14/bluetooth-move-shutdown-callback-before-flushing-tx-.patch @@ -0,0 +1,79 @@ +From 6e532a1a79048b4fd328f93de84a43a821f26a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 12:53:15 +0800 +Subject: Bluetooth: Move shutdown callback before flushing tx and rx queue + +From: Kai-Heng Feng + +[ Upstream commit 0ea53674d07fb6db2dd7a7ec2fdc85a12eb246c2 ] + +Commit 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues +are flushed or cancelled") introduced a regression that makes mtkbtsdio +driver stops working: +[ 36.593956] Bluetooth: hci0: Firmware already downloaded +[ 46.814613] Bluetooth: hci0: Execution of wmt command timed out +[ 46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110) + +The shutdown callback depends on the result of hdev->rx_work, so we +should call it before flushing rx_work: +-> btmtksdio_shutdown() + -> mtk_hci_wmt_sync() + -> __hci_cmd_send() + -> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared + +-> btmtksdio_recv_event() + -> hci_recv_frame() + -> queue_work(hdev->workqueue, &hdev->rx_work) + -> clears BTMTKSDIO_TX_WAIT_VND_EVT + +So move the shutdown callback before flushing TX/RX queue to resolve the +issue. + +Reported-and-tested-by: Mattijs Korpershoek +Tested-by: Hsin-Yi Wang +Cc: Guenter Roeck +Fixes: 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled") +Signed-off-by: Kai-Heng Feng +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index e1a545c8a69f..2331612839d7 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1727,6 +1727,14 @@ int hci_dev_do_close(struct hci_dev *hdev) + hci_request_cancel_all(hdev); + hci_req_sync_lock(hdev); + ++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && ++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ test_bit(HCI_UP, &hdev->flags)) { ++ /* Execute vendor specific shutdown routine */ ++ if (hdev->shutdown) ++ hdev->shutdown(hdev); ++ } ++ + if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { + cancel_delayed_work_sync(&hdev->cmd_timer); + hci_req_sync_unlock(hdev); +@@ -1798,14 +1806,6 @@ int hci_dev_do_close(struct hci_dev *hdev) + clear_bit(HCI_INIT, &hdev->flags); + } + +- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && +- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && +- test_bit(HCI_UP, &hdev->flags)) { +- /* Execute vendor specific shutdown routine */ +- if (hdev->shutdown) +- hdev->shutdown(hdev); +- } +- + /* flush cmd work */ + flush_work(&hdev->cmd_work); + +-- +2.30.2 + diff --git a/queue-5.14/bluetooth-sco-prevent-information-leak-in-sco_conn_d.patch b/queue-5.14/bluetooth-sco-prevent-information-leak-in-sco_conn_d.patch new file mode 100644 index 00000000000..957c473a477 --- /dev/null +++ b/queue-5.14/bluetooth-sco-prevent-information-leak-in-sco_conn_d.patch @@ -0,0 +1,45 @@ +From 6b4899b83103b3374ef129da7d83edaa9132ffec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 18:00:09 +0300 +Subject: Bluetooth: sco: prevent information leak in sco_conn_defer_accept() + +From: Dan Carpenter + +[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ] + +Smatch complains that some of these struct members are not initialized +leading to a stack information disclosure: + + net/bluetooth/sco.c:778 sco_conn_defer_accept() warn: + check that 'cp.retrans_effort' doesn't leak information + +This seems like a valid warning. I've added a default case to fix +this issue. + +Fixes: 2f69a82acf6f ("Bluetooth: Use voice setting in deferred SCO connection request") +Signed-off-by: Dan Carpenter +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/sco.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index d9a4e88dacbb..ffa2a77a3e4c 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -773,6 +773,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) + cp.max_latency = cpu_to_le16(0xffff); + cp.retrans_effort = 0xff; + break; ++ default: ++ /* use CVSD settings as fallback */ ++ cp.max_latency = cpu_to_le16(0xffff); ++ cp.retrans_effort = 0xff; ++ break; + } + + hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, +-- +2.30.2 + diff --git a/queue-5.14/bpf-fix-a-typo-of-reuseport-map-in-bpf.h.patch b/queue-5.14/bpf-fix-a-typo-of-reuseport-map-in-bpf.h.patch new file mode 100644 index 00000000000..3789753773f --- /dev/null +++ b/queue-5.14/bpf-fix-a-typo-of-reuseport-map-in-bpf.h.patch @@ -0,0 +1,53 @@ +From f77d3842b1866955f84afd15d28e67702f549a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 21:43:17 +0900 +Subject: bpf: Fix a typo of reuseport map in bpf.h. + +From: Kuniyuki Iwashima + +[ Upstream commit f170acda7ffaf0473d06e1e17c12cd9fd63904f5 ] + +Fix s/BPF_MAP_TYPE_REUSEPORT_ARRAY/BPF_MAP_TYPE_REUSEPORT_SOCKARRAY/ typo +in bpf.h. + +Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Alexei Starovoitov +Acked-by: Martin KaFai Lau +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20210714124317.67526-1-kuniyu@amazon.co.jp +Signed-off-by: Sasha Levin +--- + include/uapi/linux/bpf.h | 2 +- + tools/include/uapi/linux/bpf.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index bf9252c7381e..5cdff1631608 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -3249,7 +3249,7 @@ union bpf_attr { + * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) + * Description + * Select a **SO_REUSEPORT** socket from a +- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. ++ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. + * It checks the selected socket is matching the incoming + * request in the socket buffer. + * Return +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index bf9252c7381e..5cdff1631608 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -3249,7 +3249,7 @@ union bpf_attr { + * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) + * Description + * Select a **SO_REUSEPORT** socket from a +- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. ++ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. + * It checks the selected socket is matching the incoming + * request in the socket buffer. + * Return +-- +2.30.2 + diff --git a/queue-5.14/bpf-fix-possible-out-of-bound-write-in-narrow-load-h.patch b/queue-5.14/bpf-fix-possible-out-of-bound-write-in-narrow-load-h.patch new file mode 100644 index 00000000000..b56fbf418c2 --- /dev/null +++ b/queue-5.14/bpf-fix-possible-out-of-bound-write-in-narrow-load-h.patch @@ -0,0 +1,129 @@ +From f7ffe155bb4f6173c1f0b490e5f978d551329bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 09:39:35 -0700 +Subject: bpf: Fix possible out of bound write in narrow load handling + +From: Andrey Ignatov + +[ Upstream commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 ] + +Fix a verifier bug found by smatch static checker in [0]. + +This problem has never been seen in prod to my best knowledge. Fixing it +still seems to be a good idea since it's hard to say for sure whether +it's possible or not to have a scenario where a combination of +convert_ctx_access() and a narrow load would lead to an out of bound +write. + +When narrow load is handled, one or two new instructions are added to +insn_buf array, but before it was only checked that + + cnt >= ARRAY_SIZE(insn_buf) + +And it's safe to add a new instruction to insn_buf[cnt++] only once. The +second try will lead to out of bound write. And this is what can happen +if `shift` is set. + +Fix it by making sure that if the BPF_RSH instruction has to be added in +addition to BPF_AND then there is enough space for two more instructions +in insn_buf. + +The full report [0] is below: + +kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array +kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array + +kernel/bpf/verifier.c + 12282 + 12283 insn->off = off & ~(size_default - 1); + 12284 insn->code = BPF_LDX | BPF_MEM | size_code; + 12285 } + 12286 + 12287 target_size = 0; + 12288 cnt = convert_ctx_access(type, insn, insn_buf, env->prog, + 12289 &target_size); + 12290 if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) || + ^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Bounds check. + + 12291 (ctx_field_size && !target_size)) { + 12292 verbose(env, "bpf verifier is misconfigured\n"); + 12293 return -EINVAL; + 12294 } + 12295 + 12296 if (is_narrower_load && size < target_size) { + 12297 u8 shift = bpf_ctx_narrow_access_offset( + 12298 off, size, size_default) * 8; + 12299 if (ctx_field_size <= 4) { + 12300 if (shift) + 12301 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, + ^^^^^ +increment beyond end of array + + 12302 insn->dst_reg, + 12303 shift); +--> 12304 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg, + ^^^^^ +out of bounds write + + 12305 (1 << size * 8) - 1); + 12306 } else { + 12307 if (shift) + 12308 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH, + 12309 insn->dst_reg, + 12310 shift); + 12311 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg, + ^^^^^^^^^^^^^^^ +Same. + + 12312 (1ULL << size * 8) - 1); + 12313 } + 12314 } + 12315 + 12316 new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + 12317 if (!new_prog) + 12318 return -ENOMEM; + 12319 + 12320 delta += cnt - 1; + 12321 + 12322 /* keep walking new program and skip insns we just inserted */ + 12323 env->prog = new_prog; + 12324 insn = new_prog->insnsi + i + delta; + 12325 } + 12326 + 12327 return 0; + 12328 } + +[0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/ + +v1->v2: +- clarify that problem was only seen by static checker but not in prod; + +Fixes: 46f53a65d2de ("bpf: Allow narrow loads with offset > 0") +Reported-by: Dan Carpenter +Signed-off-by: Andrey Ignatov +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210820163935.1902398-1-rdna@fb.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 10084c0600dd..9d94ac6ff50c 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -12013,6 +12013,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) + if (is_narrower_load && size < target_size) { + u8 shift = bpf_ctx_narrow_access_offset( + off, size, size_default) * 8; ++ if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) { ++ verbose(env, "bpf verifier narrow ctx load misconfigured\n"); ++ return -EINVAL; ++ } + if (ctx_field_size <= 4) { + if (shift) + insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, +-- +2.30.2 + diff --git a/queue-5.14/bpf-fix-potential-memleak-and-uaf-in-the-verifier.patch b/queue-5.14/bpf-fix-potential-memleak-and-uaf-in-the-verifier.patch new file mode 100644 index 00000000000..cf5b9e7800e --- /dev/null +++ b/queue-5.14/bpf-fix-potential-memleak-and-uaf-in-the-verifier.patch @@ -0,0 +1,109 @@ +From ae22934529d7953f5fe4b6353843b6aef22ff8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 10:18:15 +0000 +Subject: bpf: Fix potential memleak and UAF in the verifier. + +From: He Fengqing + +[ Upstream commit 75f0fc7b48ad45a2e5736bcf8de26c8872fe8695 ] + +In bpf_patch_insn_data(), we first use the bpf_patch_insn_single() to +insert new instructions, then use adjust_insn_aux_data() to adjust +insn_aux_data. If the old env->prog have no enough room for new inserted +instructions, we use bpf_prog_realloc to construct new_prog and free the +old env->prog. + +There have two errors here. First, if adjust_insn_aux_data() return +ENOMEM, we should free the new_prog. Second, if adjust_insn_aux_data() +return ENOMEM, bpf_patch_insn_data() will return NULL, and env->prog has +been freed in bpf_prog_realloc, but we will use it in bpf_check(). + +So in this patch, we make the adjust_insn_aux_data() never fails. In +bpf_patch_insn_data(), we first pre-malloc memory for the new +insn_aux_data, then call bpf_patch_insn_single() to insert new +instructions, at last call adjust_insn_aux_data() to adjust +insn_aux_data. + +Fixes: 8041902dae52 ("bpf: adjust insn_aux_data when patching insns") +Signed-off-by: He Fengqing +Signed-off-by: Alexei Starovoitov +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20210714101815.164322-1-hefengqing@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 49f07e2bf23b..10084c0600dd 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -11414,10 +11414,11 @@ static void convert_pseudo_ld_imm64(struct bpf_verifier_env *env) + * insni[off, off + cnt). Adjust corresponding insn_aux_data by copying + * [0, off) and [off, end) to new locations, so the patched range stays zero + */ +-static int adjust_insn_aux_data(struct bpf_verifier_env *env, +- struct bpf_prog *new_prog, u32 off, u32 cnt) ++static void adjust_insn_aux_data(struct bpf_verifier_env *env, ++ struct bpf_insn_aux_data *new_data, ++ struct bpf_prog *new_prog, u32 off, u32 cnt) + { +- struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data; ++ struct bpf_insn_aux_data *old_data = env->insn_aux_data; + struct bpf_insn *insn = new_prog->insnsi; + u32 old_seen = old_data[off].seen; + u32 prog_len; +@@ -11430,12 +11431,9 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, + old_data[off].zext_dst = insn_has_def32(env, insn + off + cnt - 1); + + if (cnt == 1) +- return 0; ++ return; + prog_len = new_prog->len; +- new_data = vzalloc(array_size(prog_len, +- sizeof(struct bpf_insn_aux_data))); +- if (!new_data) +- return -ENOMEM; ++ + memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off); + memcpy(new_data + off + cnt - 1, old_data + off, + sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1)); +@@ -11446,7 +11444,6 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, + } + env->insn_aux_data = new_data; + vfree(old_data); +- return 0; + } + + static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len) +@@ -11481,6 +11478,14 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of + const struct bpf_insn *patch, u32 len) + { + struct bpf_prog *new_prog; ++ struct bpf_insn_aux_data *new_data = NULL; ++ ++ if (len > 1) { ++ new_data = vzalloc(array_size(env->prog->len + len - 1, ++ sizeof(struct bpf_insn_aux_data))); ++ if (!new_data) ++ return NULL; ++ } + + new_prog = bpf_patch_insn_single(env->prog, off, patch, len); + if (IS_ERR(new_prog)) { +@@ -11488,10 +11493,10 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of + verbose(env, + "insn %d cannot be patched due to 16-bit range\n", + env->insn_aux_data[off].orig_idx); ++ vfree(new_data); + return NULL; + } +- if (adjust_insn_aux_data(env, new_prog, off, len)) +- return NULL; ++ adjust_insn_aux_data(env, new_data, new_prog, off, len); + adjust_subprog_starts(env, off, len); + adjust_poke_descs(new_prog, off, len); + return new_prog; +-- +2.30.2 + diff --git a/queue-5.14/bpf-samples-add-missing-mprog-disable-to-xdp_redirec.patch b/queue-5.14/bpf-samples-add-missing-mprog-disable-to-xdp_redirec.patch new file mode 100644 index 00000000000..81ca83b5735 --- /dev/null +++ b/queue-5.14/bpf-samples-add-missing-mprog-disable-to-xdp_redirec.patch @@ -0,0 +1,42 @@ +From 59928fe6ca3bb3c8eafee6bfecf43535917c15a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 17:56:32 -0700 +Subject: bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's + optstring + +From: Matthew Cover + +[ Upstream commit 34ad6d9d8c27293e1895b448af7d6cf5d351ad8d ] + +Commit ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program +on cpumap") added the following option, but missed adding it to optstring: + + - mprog-disable: disable loading XDP program on cpumap entries + +Fix it and add the missing option character. + +Fixes: ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program on cpumap") +Signed-off-by: Matthew Cover +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210731005632.13228-1-matthew.cover@stackpath.com +Signed-off-by: Sasha Levin +--- + samples/bpf/xdp_redirect_cpu_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c +index 576411612523..c7d7d3586730 100644 +--- a/samples/bpf/xdp_redirect_cpu_user.c ++++ b/samples/bpf/xdp_redirect_cpu_user.c +@@ -831,7 +831,7 @@ int main(int argc, char **argv) + memset(cpu, 0, n_cpus * sizeof(int)); + + /* Parse commands line args */ +- while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:", ++ while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:n", + long_options, &longindex)) != -1) { + switch (opt) { + case 'd': +-- +2.30.2 + diff --git a/queue-5.14/bpf-selftests-fix-test_maps-now-that-sockmap-support.patch b/queue-5.14/bpf-selftests-fix-test_maps-now-that-sockmap-support.patch new file mode 100644 index 00000000000..db6510d7689 --- /dev/null +++ b/queue-5.14/bpf-selftests-fix-test_maps-now-that-sockmap-support.patch @@ -0,0 +1,41 @@ +From d7b1d66662635a5747fa76de0b204e4531c70969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 11:48:32 -0700 +Subject: bpf, selftests: Fix test_maps now that sockmap supports UDP + +From: John Fastabend + +[ Upstream commit c39aa21599748f3845a47645f482d94099b11460 ] + +UDP socket support was added recently so testing UDP insert failure is no +longer correct and causes test_maps failure. The fix is easy though, we +simply need to test that UDP is correctly added instead of blocked. + +Fixes: 122e6c79efe1c ("sock_map: Update sock type checks for UDP") +Reported-by: Andrii Nakryiko +Signed-off-by: John Fastabend +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210720184832.452430-1-john.fastabend@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 30cbf5d98f7d..abdfc41f7685 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -764,8 +764,8 @@ static void test_sockmap(unsigned int tasks, void *data) + udp = socket(AF_INET, SOCK_DGRAM, 0); + i = 0; + err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY); +- if (!err) { +- printf("Failed socket SOCK_DGRAM allowed '%i:%i'\n", ++ if (err) { ++ printf("Failed socket update SOCK_DGRAM '%i:%i'\n", + i, udp); + goto out_sockmap; + } +-- +2.30.2 + diff --git a/queue-5.14/brcmfmac-pcie-fix-oops-on-failure-to-resume-and-repr.patch b/queue-5.14/brcmfmac-pcie-fix-oops-on-failure-to-resume-and-repr.patch new file mode 100644 index 00000000000..fe0ab3cb47e --- /dev/null +++ b/queue-5.14/brcmfmac-pcie-fix-oops-on-failure-to-resume-and-repr.patch @@ -0,0 +1,40 @@ +From 6d23e66b1e0ae7056c83718f8a88ab639601a106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 08:35:22 +0200 +Subject: brcmfmac: pcie: fix oops on failure to resume and reprobe + +From: Ahmad Fatoum + +[ Upstream commit d745ca4f2c4ae9f1bd8cf7d8ac6e22d739bffd19 ] + +When resuming from suspend, brcmf_pcie_pm_leave_D3 will first attempt a +hot resume and then fall back to removing the PCI device and then +reprobing. If this probe fails, the kernel will oops, because brcmf_err, +which is called to report the failure will dereference the stale bus +pointer. Open code and use the default bus-less brcmf_err to avoid this. + +Fixes: 8602e62441ab ("brcmfmac: pass bus to the __brcmf_err() in pcie.c") +Signed-off-by: Ahmad Fatoum +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210817063521.22450-1-a.fatoum@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index c49dd0c36ae4..bbd72c2db088 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -2075,7 +2075,7 @@ cleanup: + + err = brcmf_pcie_probe(pdev, NULL); + if (err) +- brcmf_err(bus, "probe after resume failed, err=%d\n", err); ++ __brcmf_err(NULL, __func__, "probe after resume failed, err=%d\n", err); + + return err; + } +-- +2.30.2 + diff --git a/queue-5.14/certs-trigger-creation-of-rsa-module-signing-key-if-.patch b/queue-5.14/certs-trigger-creation-of-rsa-module-signing-key-if-.patch new file mode 100644 index 00000000000..ed84c8ebcbb --- /dev/null +++ b/queue-5.14/certs-trigger-creation-of-rsa-module-signing-key-if-.patch @@ -0,0 +1,56 @@ +From 0caba533a43094cd4e6b02e99311c1e397d38bae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 17:34:20 -0400 +Subject: certs: Trigger creation of RSA module signing key if it's not an RSA + key + +From: Stefan Berger + +[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ] + +Address a kbuild issue where a developer created an ECDSA key for signing +kernel modules and then builds an older version of the kernel, when bi- +secting the kernel for example, that does not support ECDSA keys. + +If openssl is installed, trigger the creation of an RSA module signing +key if it is not an RSA key. + +Fixes: cfc411e7fff3 ("Move certificate handling to its own directory") +Cc: David Howells +Cc: David Woodhouse +Signed-off-by: Stefan Berger +Reviewed-by: Jarkko Sakkinen +Tested-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + certs/Makefile | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/certs/Makefile b/certs/Makefile +index 359239a0ee9e..f9344e52ecda 100644 +--- a/certs/Makefile ++++ b/certs/Makefile +@@ -57,11 +57,19 @@ endif + redirect_openssl = 2>&1 + quiet_redirect_openssl = 2>&1 + silent_redirect_openssl = 2>/dev/null ++openssl_available = $(shell openssl help 2>/dev/null && echo yes) + + # We do it this way rather than having a boolean option for enabling an + # external private key, because 'make randconfig' might enable such a + # boolean option and we unfortunately can't make it depend on !RANDCONFIG. + ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") ++ ++ifeq ($(openssl_available),yes) ++X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) ++ ++$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) ++endif ++ + $(obj)/signing_key.pem: $(obj)/x509.genkey + @$(kecho) "###" + @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." +-- +2.30.2 + diff --git a/queue-5.14/cgroup-cpuset-fix-a-partition-bug-with-hotplug.patch b/queue-5.14/cgroup-cpuset-fix-a-partition-bug-with-hotplug.patch new file mode 100644 index 00000000000..829bc9e7a43 --- /dev/null +++ b/queue-5.14/cgroup-cpuset-fix-a-partition-bug-with-hotplug.patch @@ -0,0 +1,45 @@ +From f83502bd7d627d08ce793d1ed40f0d429544b930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 10:18:27 -0400 +Subject: cgroup/cpuset: Fix a partition bug with hotplug + +From: Waiman Long + +[ Upstream commit 15d428e6fe77fffc3f4fff923336036f5496ef17 ] + +In cpuset_hotplug_workfn(), the detection of whether the cpu list +has been changed is done by comparing the effective cpus of the top +cpuset with the cpu_active_mask. However, in the rare case that just +all the CPUs in the subparts_cpus are offlined, the detection fails +and the partition states are not updated correctly. Fix it by forcing +the cpus_updated flag to true in this particular case. + +Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition") +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index adb5190c4429..592e9e37542f 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -3168,6 +3168,13 @@ static void cpuset_hotplug_workfn(struct work_struct *work) + cpus_updated = !cpumask_equal(top_cpuset.effective_cpus, &new_cpus); + mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems); + ++ /* ++ * In the rare case that hotplug removes all the cpus in subparts_cpus, ++ * we assumed that cpus are updated. ++ */ ++ if (!cpus_updated && top_cpuset.nr_subparts_cpus) ++ cpus_updated = true; ++ + /* synchronize cpus_allowed to cpu_active_mask */ + if (cpus_updated) { + spin_lock_irq(&callback_lock); +-- +2.30.2 + diff --git a/queue-5.14/cgroup-cpuset-fix-violation-of-cpuset-locking-rule.patch b/queue-5.14/cgroup-cpuset-fix-violation-of-cpuset-locking-rule.patch new file mode 100644 index 00000000000..32089db3e97 --- /dev/null +++ b/queue-5.14/cgroup-cpuset-fix-violation-of-cpuset-locking-rule.patch @@ -0,0 +1,242 @@ +From b546e0c1ce9bf35a0f8c7e988d636a460c2e7df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 10:18:28 -0400 +Subject: cgroup/cpuset: Fix violation of cpuset locking rule + +From: Waiman Long + +[ Upstream commit 6ba34d3c73674e46d9e126e4f0cee79e5ef2481c ] + +The cpuset fields that manage partition root state do not strictly +follow the cpuset locking rule that update to cpuset has to be done +with both the callback_lock and cpuset_mutex held. This is now fixed +by making sure that the locking rule is upheld. + +Fixes: 3881b86128d0 ("cpuset: Add an error state to cpuset.sched.partition") +Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition") +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 58 +++++++++++++++++++++++++----------------- + 1 file changed, 35 insertions(+), 23 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 28a784bf64b1..13b5be6df4da 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1148,6 +1148,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + struct cpuset *parent = parent_cs(cpuset); + int adding; /* Moving cpus from effective_cpus to subparts_cpus */ + int deleting; /* Moving cpus from subparts_cpus to effective_cpus */ ++ int new_prs; + bool part_error = false; /* Partition error? */ + + percpu_rwsem_assert_held(&cpuset_rwsem); +@@ -1183,6 +1184,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + * A cpumask update cannot make parent's effective_cpus become empty. + */ + adding = deleting = false; ++ new_prs = cpuset->partition_root_state; + if (cmd == partcmd_enable) { + cpumask_copy(tmp->addmask, cpuset->cpus_allowed); + adding = true; +@@ -1247,11 +1249,11 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + switch (cpuset->partition_root_state) { + case PRS_ENABLED: + if (part_error) +- cpuset->partition_root_state = PRS_ERROR; ++ new_prs = PRS_ERROR; + break; + case PRS_ERROR: + if (!part_error) +- cpuset->partition_root_state = PRS_ENABLED; ++ new_prs = PRS_ENABLED; + break; + } + /* +@@ -1260,10 +1262,10 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + part_error = (prev_prs == PRS_ERROR); + } + +- if (!part_error && (cpuset->partition_root_state == PRS_ERROR)) ++ if (!part_error && (new_prs == PRS_ERROR)) + return 0; /* Nothing need to be done */ + +- if (cpuset->partition_root_state == PRS_ERROR) { ++ if (new_prs == PRS_ERROR) { + /* + * Remove all its cpus from parent's subparts_cpus. + */ +@@ -1272,7 +1274,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + parent->subparts_cpus); + } + +- if (!adding && !deleting) ++ if (!adding && !deleting && (new_prs == cpuset->partition_root_state)) + return 0; + + /* +@@ -1299,6 +1301,9 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + } + + parent->nr_subparts_cpus = cpumask_weight(parent->subparts_cpus); ++ ++ if (cpuset->partition_root_state != new_prs) ++ cpuset->partition_root_state = new_prs; + spin_unlock_irq(&callback_lock); + + return cmd == partcmd_update; +@@ -1321,6 +1326,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + struct cpuset *cp; + struct cgroup_subsys_state *pos_css; + bool need_rebuild_sched_domains = false; ++ int new_prs; + + rcu_read_lock(); + cpuset_for_each_descendant_pre(cp, pos_css, cs) { +@@ -1360,7 +1366,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + * update_tasks_cpumask() again for tasks in the parent + * cpuset if the parent's subparts_cpus changes. + */ +- if ((cp != cs) && cp->partition_root_state) { ++ new_prs = cp->partition_root_state; ++ if ((cp != cs) && new_prs) { + switch (parent->partition_root_state) { + case PRS_DISABLED: + /* +@@ -1370,7 +1377,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + */ + WARN_ON_ONCE(cp->partition_root_state + != PRS_ERROR); +- cp->partition_root_state = PRS_DISABLED; ++ new_prs = PRS_DISABLED; + + /* + * clear_bit() is an atomic operation and +@@ -1391,11 +1398,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + /* + * When parent is invalid, it has to be too. + */ +- cp->partition_root_state = PRS_ERROR; +- if (cp->nr_subparts_cpus) { +- cp->nr_subparts_cpus = 0; +- cpumask_clear(cp->subparts_cpus); +- } ++ new_prs = PRS_ERROR; + break; + } + } +@@ -1407,8 +1410,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + spin_lock_irq(&callback_lock); + + cpumask_copy(cp->effective_cpus, tmp->new_cpus); +- if (cp->nr_subparts_cpus && +- (cp->partition_root_state != PRS_ENABLED)) { ++ if (cp->nr_subparts_cpus && (new_prs != PRS_ENABLED)) { + cp->nr_subparts_cpus = 0; + cpumask_clear(cp->subparts_cpus); + } else if (cp->nr_subparts_cpus) { +@@ -1435,6 +1437,10 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + = cpumask_weight(cp->subparts_cpus); + } + } ++ ++ if (new_prs != cp->partition_root_state) ++ cp->partition_root_state = new_prs; ++ + spin_unlock_irq(&callback_lock); + + WARN_ON(!is_in_v2_mode() && +@@ -1944,25 +1950,25 @@ out: + */ + static int update_prstate(struct cpuset *cs, int new_prs) + { +- int err; ++ int err, old_prs = cs->partition_root_state; + struct cpuset *parent = parent_cs(cs); + struct tmpmasks tmpmask; + +- if (new_prs == cs->partition_root_state) ++ if (old_prs == new_prs) + return 0; + + /* + * Cannot force a partial or invalid partition root to a full + * partition root. + */ +- if (new_prs && (cs->partition_root_state < 0)) ++ if (new_prs && (old_prs == PRS_ERROR)) + return -EINVAL; + + if (alloc_cpumasks(NULL, &tmpmask)) + return -ENOMEM; + + err = -EINVAL; +- if (!cs->partition_root_state) { ++ if (!old_prs) { + /* + * Turning on partition root requires setting the + * CS_CPU_EXCLUSIVE bit implicitly as well and cpus_allowed +@@ -1981,14 +1987,12 @@ static int update_prstate(struct cpuset *cs, int new_prs) + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + goto out; + } +- cs->partition_root_state = PRS_ENABLED; + } else { + /* + * Turning off partition root will clear the + * CS_CPU_EXCLUSIVE bit. + */ +- if (cs->partition_root_state == PRS_ERROR) { +- cs->partition_root_state = PRS_DISABLED; ++ if (old_prs == PRS_ERROR) { + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + err = 0; + goto out; +@@ -1999,8 +2003,6 @@ static int update_prstate(struct cpuset *cs, int new_prs) + if (err) + goto out; + +- cs->partition_root_state = PRS_DISABLED; +- + /* Turning off CS_CPU_EXCLUSIVE will not return error */ + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + } +@@ -2017,6 +2019,12 @@ static int update_prstate(struct cpuset *cs, int new_prs) + + rebuild_sched_domains_locked(); + out: ++ if (!err) { ++ spin_lock_irq(&callback_lock); ++ cs->partition_root_state = new_prs; ++ spin_unlock_irq(&callback_lock); ++ } ++ + free_cpumasks(NULL, &tmpmask); + return err; + } +@@ -3080,8 +3088,10 @@ retry: + if (is_partition_root(cs) && (cpumask_empty(&new_cpus) || + (parent->partition_root_state == PRS_ERROR))) { + if (cs->nr_subparts_cpus) { ++ spin_lock_irq(&callback_lock); + cs->nr_subparts_cpus = 0; + cpumask_clear(cs->subparts_cpus); ++ spin_unlock_irq(&callback_lock); + compute_effective_cpumask(&new_cpus, cs, parent); + } + +@@ -3095,7 +3105,9 @@ retry: + cpumask_empty(&new_cpus)) { + update_parent_subparts_cpumask(cs, partcmd_disable, + NULL, tmp); ++ spin_lock_irq(&callback_lock); + cs->partition_root_state = PRS_ERROR; ++ spin_unlock_irq(&callback_lock); + } + cpuset_force_rebuild(); + } +-- +2.30.2 + diff --git a/queue-5.14/cgroup-cpuset-miscellaneous-code-cleanup.patch b/queue-5.14/cgroup-cpuset-miscellaneous-code-cleanup.patch new file mode 100644 index 00000000000..81619bef4f0 --- /dev/null +++ b/queue-5.14/cgroup-cpuset-miscellaneous-code-cleanup.patch @@ -0,0 +1,152 @@ +From cec5f8da36c03236b3db10eedb6f40abd7952d3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 10:18:26 -0400 +Subject: cgroup/cpuset: Miscellaneous code cleanup + +From: Waiman Long + +[ Upstream commit 0f3adb8a1e5f36e792598c1d77a2cfac9c90a4f9 ] + +Use more descriptive variable names for update_prstate(), remove +unnecessary code and fix some typos. There is no functional change. + +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 40 +++++++++++++++++++--------------------- + 1 file changed, 19 insertions(+), 21 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 592e9e37542f..28a784bf64b1 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1114,7 +1114,7 @@ enum subparts_cmd { + * cpus_allowed can be granted or an error code will be returned. + * + * For partcmd_disable, the cpuset is being transofrmed from a partition +- * root back to a non-partition root. any CPUs in cpus_allowed that are in ++ * root back to a non-partition root. Any CPUs in cpus_allowed that are in + * parent's subparts_cpus will be taken away from that cpumask and put back + * into parent's effective_cpus. 0 should always be returned. + * +@@ -1225,7 +1225,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd, + /* + * partcmd_update w/o newmask: + * +- * addmask = cpus_allowed & parent->effectiveb_cpus ++ * addmask = cpus_allowed & parent->effective_cpus + * + * Note that parent's subparts_cpus may have been + * pre-shrunk in case there is a change in the cpu list. +@@ -1365,12 +1365,12 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp) + case PRS_DISABLED: + /* + * If parent is not a partition root or an +- * invalid partition root, clear the state +- * state and the CS_CPU_EXCLUSIVE flag. ++ * invalid partition root, clear its state ++ * and its CS_CPU_EXCLUSIVE flag. + */ + WARN_ON_ONCE(cp->partition_root_state + != PRS_ERROR); +- cp->partition_root_state = 0; ++ cp->partition_root_state = PRS_DISABLED; + + /* + * clear_bit() is an atomic operation and +@@ -1937,30 +1937,28 @@ out: + + /* + * update_prstate - update partititon_root_state +- * cs: the cpuset to update +- * val: 0 - disabled, 1 - enabled ++ * cs: the cpuset to update ++ * new_prs: new partition root state + * + * Call with cpuset_mutex held. + */ +-static int update_prstate(struct cpuset *cs, int val) ++static int update_prstate(struct cpuset *cs, int new_prs) + { + int err; + struct cpuset *parent = parent_cs(cs); +- struct tmpmasks tmp; ++ struct tmpmasks tmpmask; + +- if ((val != 0) && (val != 1)) +- return -EINVAL; +- if (val == cs->partition_root_state) ++ if (new_prs == cs->partition_root_state) + return 0; + + /* + * Cannot force a partial or invalid partition root to a full + * partition root. + */ +- if (val && cs->partition_root_state) ++ if (new_prs && (cs->partition_root_state < 0)) + return -EINVAL; + +- if (alloc_cpumasks(NULL, &tmp)) ++ if (alloc_cpumasks(NULL, &tmpmask)) + return -ENOMEM; + + err = -EINVAL; +@@ -1978,7 +1976,7 @@ static int update_prstate(struct cpuset *cs, int val) + goto out; + + err = update_parent_subparts_cpumask(cs, partcmd_enable, +- NULL, &tmp); ++ NULL, &tmpmask); + if (err) { + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + goto out; +@@ -1990,18 +1988,18 @@ static int update_prstate(struct cpuset *cs, int val) + * CS_CPU_EXCLUSIVE bit. + */ + if (cs->partition_root_state == PRS_ERROR) { +- cs->partition_root_state = 0; ++ cs->partition_root_state = PRS_DISABLED; + update_flag(CS_CPU_EXCLUSIVE, cs, 0); + err = 0; + goto out; + } + + err = update_parent_subparts_cpumask(cs, partcmd_disable, +- NULL, &tmp); ++ NULL, &tmpmask); + if (err) + goto out; + +- cs->partition_root_state = 0; ++ cs->partition_root_state = PRS_DISABLED; + + /* Turning off CS_CPU_EXCLUSIVE will not return error */ + update_flag(CS_CPU_EXCLUSIVE, cs, 0); +@@ -2015,11 +2013,11 @@ static int update_prstate(struct cpuset *cs, int val) + update_tasks_cpumask(parent); + + if (parent->child_ecpus_count) +- update_sibling_cpumasks(parent, cs, &tmp); ++ update_sibling_cpumasks(parent, cs, &tmpmask); + + rebuild_sched_domains_locked(); + out: +- free_cpumasks(NULL, &tmp); ++ free_cpumasks(NULL, &tmpmask); + return err; + } + +@@ -3060,7 +3058,7 @@ retry: + goto retry; + } + +- parent = parent_cs(cs); ++ parent = parent_cs(cs); + compute_effective_cpumask(&new_cpus, cs, parent); + nodes_and(new_mems, cs->mems_allowed, parent->effective_mems); + +-- +2.30.2 + diff --git a/queue-5.14/cifs-fix-a-potencially-linear-read-overflow.patch b/queue-5.14/cifs-fix-a-potencially-linear-read-overflow.patch new file mode 100644 index 00000000000..125ba0fdfbb --- /dev/null +++ b/queue-5.14/cifs-fix-a-potencially-linear-read-overflow.patch @@ -0,0 +1,53 @@ +From cea11b3afe62b8c504d0db47f3f6d0fc4d1c12b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 12:27:09 +0200 +Subject: CIFS: Fix a potencially linear read overflow + +From: Len Baker + +[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ] + +strlcpy() reads the entire source buffer first. This read may exceed the +destination size limit. This is both inefficient and can lead to linear +read overflows if a source string is not NUL-terminated. + +Also, the strnlen() call does not avoid the read overflow in the strlcpy +function when a not NUL-terminated string is passed. + +So, replace this block by a call to kstrndup() that avoids this type of +overflow and does the same. + +Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions") +Signed-off-by: Len Baker +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifs_unicode.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 9bd03a231032..171ad8b42107 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen, + if (!dst) + return NULL; + cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage, +- NO_MAP_UNI_RSVD); ++ NO_MAP_UNI_RSVD); + } else { +- len = strnlen(src, maxlen); +- len++; +- dst = kmalloc(len, GFP_KERNEL); +- if (!dst) +- return NULL; +- strlcpy(dst, src, len); ++ dst = kstrndup(src, maxlen, GFP_KERNEL); + } + + return dst; +-- +2.30.2 + diff --git a/queue-5.14/clk-staging-correct-reference-to-config-iomem-to-con.patch b/queue-5.14/clk-staging-correct-reference-to-config-iomem-to-con.patch new file mode 100644 index 00000000000..df3d2f66033 --- /dev/null +++ b/queue-5.14/clk-staging-correct-reference-to-config-iomem-to-con.patch @@ -0,0 +1,44 @@ +From d357a0c0dce5f3eefc944e73dc7a0d6a525046c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 12:54:04 +0200 +Subject: clk: staging: correct reference to config IOMEM to config HAS_IOMEM + +From: Lukas Bulwahn + +[ Upstream commit cbfa6f33e3a685c329d78e06b0cf1dcb23c9d849 ] + +Commit 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx +Clocking Wizard driver") introduces a dependency on the non-existing config +IOMEM, which basically makes it impossible to include this driver into any +build. Fortunately, ./scripts/checkkconfigsymbols.py warns: + +IOMEM +Referencing files: drivers/staging/clocking-wizard/Kconfig + +The config for IOMEM support is called HAS_IOMEM. Correct this reference to +the intended config. + +Fixes: 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx Clocking Wizard driver") +Signed-off-by: Lukas Bulwahn +Link: https://lore.kernel.org/r/20210817105404.13146-1-lukas.bulwahn@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/clocking-wizard/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/clocking-wizard/Kconfig b/drivers/staging/clocking-wizard/Kconfig +index 69cf51445f08..2324b5d73788 100644 +--- a/drivers/staging/clocking-wizard/Kconfig ++++ b/drivers/staging/clocking-wizard/Kconfig +@@ -5,6 +5,6 @@ + + config COMMON_CLK_XLNX_CLKWZRD + tristate "Xilinx Clocking Wizard" +- depends on COMMON_CLK && OF && IOMEM ++ depends on COMMON_CLK && OF && HAS_IOMEM + help + Support for the Xilinx Clocking Wizard IP core clock generator. +-- +2.30.2 + diff --git a/queue-5.14/clocksource-drivers-sh_cmt-fix-wrong-setting-if-don-.patch b/queue-5.14/clocksource-drivers-sh_cmt-fix-wrong-setting-if-don-.patch new file mode 100644 index 00000000000..d6e15199c88 --- /dev/null +++ b/queue-5.14/clocksource-drivers-sh_cmt-fix-wrong-setting-if-don-.patch @@ -0,0 +1,102 @@ +From bfd4ed72dfd817550047703740fd72830849cb0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 14:34:43 +0200 +Subject: clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ + for clock source channel +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Phong Hoang + +[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ] + +If CMT instance has at least two channels, one channel will be used +as a clock source and another one used as a clock event device. +In that case, IRQ is not requested for clock source channel so +sh_cmt_clock_event_program_verify() might work incorrectly. +Besides, when a channel is only used for clock source, don't need to +re-set the next match_value since it should be maximum timeout as +it still is. + +On the other hand, due to no IRQ, total_cycles is not counted up +when reaches compare match time (timer counter resets to zero), +so sh_cmt_clocksource_read() returns unexpected value. +Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants +will also lead to wrong delta calculation. Hence, this mask should +correspond to timer counter width, and above function just returns +the raw value of timer counter register. + +Fixes: bfa76bb12f23 ("clocksource: sh_cmt: Request IRQ for clock event device only") +Fixes: 37e7742c55ba ("clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines") +Signed-off-by: Phong Hoang +Signed-off-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210422123443.73334-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c +index d7ed99f0001f..dd0956ad969c 100644 +--- a/drivers/clocksource/sh_cmt.c ++++ b/drivers/clocksource/sh_cmt.c +@@ -579,7 +579,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag) + ch->flags |= flag; + + /* setup timeout if no clockevent */ +- if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT))) ++ if (ch->cmt->num_channels == 1 && ++ flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT))) + __sh_cmt_set_next(ch, ch->max_match_value); + out: + raw_spin_unlock_irqrestore(&ch->lock, flags); +@@ -621,20 +622,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs) + static u64 sh_cmt_clocksource_read(struct clocksource *cs) + { + struct sh_cmt_channel *ch = cs_to_sh_cmt(cs); +- unsigned long flags; + u32 has_wrapped; +- u64 value; +- u32 raw; + +- raw_spin_lock_irqsave(&ch->lock, flags); +- value = ch->total_cycles; +- raw = sh_cmt_get_counter(ch, &has_wrapped); ++ if (ch->cmt->num_channels == 1) { ++ unsigned long flags; ++ u64 value; ++ u32 raw; + +- if (unlikely(has_wrapped)) +- raw += ch->match_value + 1; +- raw_spin_unlock_irqrestore(&ch->lock, flags); ++ raw_spin_lock_irqsave(&ch->lock, flags); ++ value = ch->total_cycles; ++ raw = sh_cmt_get_counter(ch, &has_wrapped); ++ ++ if (unlikely(has_wrapped)) ++ raw += ch->match_value + 1; ++ raw_spin_unlock_irqrestore(&ch->lock, flags); ++ ++ return value + raw; ++ } + +- return value + raw; ++ return sh_cmt_get_counter(ch, &has_wrapped); + } + + static int sh_cmt_clocksource_enable(struct clocksource *cs) +@@ -697,7 +703,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch, + cs->disable = sh_cmt_clocksource_disable; + cs->suspend = sh_cmt_clocksource_suspend; + cs->resume = sh_cmt_clocksource_resume; +- cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8); ++ cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width); + cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n", +-- +2.30.2 + diff --git a/queue-5.14/counter-104-quad-8-return-error-when-invalid-mode-du.patch b/queue-5.14/counter-104-quad-8-return-error-when-invalid-mode-du.patch new file mode 100644 index 00000000000..d09229dda6c --- /dev/null +++ b/queue-5.14/counter-104-quad-8-return-error-when-invalid-mode-du.patch @@ -0,0 +1,48 @@ +From 1519a04af1ae5522f5ddf3e98729b14afaa79027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 21:06:11 +0900 +Subject: counter: 104-quad-8: Return error when invalid mode during + ceiling_write + +From: William Breathitt Gray + +[ Upstream commit 728246e8f7269ecd35a2c6e6795323e6d8f48db7 ] + +The 104-QUAD-8 only has two count modes where a ceiling value makes +sense: Range Limit and Modulo-N. Outside of these two modes, setting a +ceiling value is an invalid operation -- so let's report it as such by +returning -EINVAL. + +Fixes: fc069262261c ("counter: 104-quad-8: Add lock guards - generic interface") +Acked-by: Syed Nayyar Waris +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/a2147f022829b66839a1db5530a7fada47856847.1627990337.git.vilhelm.gray@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/counter/104-quad-8.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c +index 09a9a77cce06..81f9642777fb 100644 +--- a/drivers/counter/104-quad-8.c ++++ b/drivers/counter/104-quad-8.c +@@ -715,12 +715,13 @@ static ssize_t quad8_count_ceiling_write(struct counter_device *counter, + case 1: + case 3: + quad8_preset_register_set(priv, count->id, ceiling); +- break; ++ mutex_unlock(&priv->lock); ++ return len; + } + + mutex_unlock(&priv->lock); + +- return len; ++ return -EINVAL; + } + + static ssize_t quad8_count_preset_enable_read(struct counter_device *counter, +-- +2.30.2 + diff --git a/queue-5.14/crypto-ecc-handle-unaligned-input-buffer-in-ecc_swap.patch b/queue-5.14/crypto-ecc-handle-unaligned-input-buffer-in-ecc_swap.patch new file mode 100644 index 00000000000..393c4bdbf59 --- /dev/null +++ b/queue-5.14/crypto-ecc-handle-unaligned-input-buffer-in-ecc_swap.patch @@ -0,0 +1,70 @@ +From 4dd5507ac93e24a368adc22db4d44063f895c1e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 10:39:05 +0200 +Subject: crypto: ecc - handle unaligned input buffer in ecc_swap_digits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mian Yousaf Kaukab + +[ Upstream commit 0469dede0eeeefe12a9a2fd76078f4a266513457 ] + +ecdsa_set_pub_key() makes an u64 pointer at 1 byte offset of the key. +This results in an unaligned u64 pointer. This pointer is passed to +ecc_swap_digits() which assumes natural alignment. + +This causes a kernel crash on an armv7 platform: +[ 0.409022] Unhandled fault: alignment exception (0x001) at 0xc2a0a6a9 +... +[ 0.416982] PC is at ecdsa_set_pub_key+0xdc/0x120 +... +[ 0.491492] Backtrace: +[ 0.492059] [] (ecdsa_set_pub_key) from [] (test_akcipher_one+0xf4/0x6c0) + +Handle unaligned input buffer in ecc_swap_digits() by replacing +be64_to_cpu() to get_unaligned_be64(). Change type of in pointer to +void to reflect it doesn’t necessarily need to be aligned. + +Fixes: 4e6602916bc6 ("crypto: ecdsa - Add support for ECDSA signature verification") +Reported-by: Guillaume Gardet +Suggested-by: Takashi Iwai +Signed-off-by: Mian Yousaf Kaukab +Tested-by: Stefan Berger +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/ecc.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/crypto/ecc.h b/crypto/ecc.h +index a006132646a4..1350e8eb6ac2 100644 +--- a/crypto/ecc.h ++++ b/crypto/ecc.h +@@ -27,6 +27,7 @@ + #define _CRYPTO_ECC_H + + #include ++#include + + /* One digit is u64 qword. */ + #define ECC_CURVE_NIST_P192_DIGITS 3 +@@ -46,13 +47,13 @@ + * @out: Output array + * @ndigits: Number of digits to copy + */ +-static inline void ecc_swap_digits(const u64 *in, u64 *out, unsigned int ndigits) ++static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigits) + { + const __be64 *src = (__force __be64 *)in; + int i; + + for (i = 0; i < ndigits; i++) +- out[i] = be64_to_cpu(src[ndigits - 1 - i]); ++ out[i] = get_unaligned_be64(&src[ndigits - 1 - i]); + } + + /** +-- +2.30.2 + diff --git a/queue-5.14/crypto-hisilicon-sec-fix-the-abnormal-exiting-proces.patch b/queue-5.14/crypto-hisilicon-sec-fix-the-abnormal-exiting-proces.patch new file mode 100644 index 00000000000..a5a829e5707 --- /dev/null +++ b/queue-5.14/crypto-hisilicon-sec-fix-the-abnormal-exiting-proces.patch @@ -0,0 +1,36 @@ +From fddf193e8db2cbb027648f24c1ecd3465c177ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:41:01 +0800 +Subject: crypto: hisilicon/sec - fix the abnormal exiting process + +From: Kai Ye + +[ Upstream commit 90367a027a22c3a9ca8b8bac15df34d9e859fc11 ] + +Because the algs registration process has added a judgment. +So need to add the judgment for the abnormal exiting process. + +Signed-off-by: Kai Ye +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 490db7bccf61..8addbd7a3339 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -984,7 +984,8 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + err_alg_unregister: +- hisi_qm_alg_unregister(qm, &sec_devices); ++ if (qm->qp_num >= ctx_q_num) ++ hisi_qm_alg_unregister(qm, &sec_devices); + err_qm_stop: + sec_debugfs_exit(qm); + hisi_qm_stop(qm, QM_NORMAL); +-- +2.30.2 + diff --git a/queue-5.14/crypto-hisilicon-sec-modify-the-hardware-endian-conf.patch b/queue-5.14/crypto-hisilicon-sec-modify-the-hardware-endian-conf.patch new file mode 100644 index 00000000000..63922bfdb4e --- /dev/null +++ b/queue-5.14/crypto-hisilicon-sec-modify-the-hardware-endian-conf.patch @@ -0,0 +1,97 @@ +From fd17e75fc1ec28be41415ff3b386271050251d7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:41:02 +0800 +Subject: crypto: hisilicon/sec - modify the hardware endian configuration + +From: Kai Ye + +[ Upstream commit a52626106d6f7edf3d106c065e13a0313cfeb82f ] + +When the endian configuration of the hardware is abnormal, it will +cause the SEC engine is faulty that reports empty message. And it +will affect the normal function of the hardware. Currently the soft +configuration method can't restore the faulty device. The endian +needs to be configured according to the system properties. So fix it. + +Signed-off-by: Kai Ye +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec.h | 5 ---- + drivers/crypto/hisilicon/sec2/sec_main.c | 31 +++++++----------------- + 2 files changed, 9 insertions(+), 27 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h +index 018415b9840a..d97cf02b1df7 100644 +--- a/drivers/crypto/hisilicon/sec2/sec.h ++++ b/drivers/crypto/hisilicon/sec2/sec.h +@@ -157,11 +157,6 @@ struct sec_ctx { + struct device *dev; + }; + +-enum sec_endian { +- SEC_LE = 0, +- SEC_32BE, +- SEC_64BE +-}; + + enum sec_debug_file_index { + SEC_CLEAR_ENABLE, +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 8addbd7a3339..a0cc46b649a3 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -312,31 +312,20 @@ static const struct pci_device_id sec_dev_ids[] = { + }; + MODULE_DEVICE_TABLE(pci, sec_dev_ids); + +-static u8 sec_get_endian(struct hisi_qm *qm) ++static void sec_set_endian(struct hisi_qm *qm) + { + u32 reg; + +- /* +- * As for VF, it is a wrong way to get endian setting by +- * reading a register of the engine +- */ +- if (qm->pdev->is_virtfn) { +- dev_err_ratelimited(&qm->pdev->dev, +- "cannot access a register in VF!\n"); +- return SEC_LE; +- } + reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG); +- /* BD little endian mode */ +- if (!(reg & BIT(0))) +- return SEC_LE; ++ reg &= ~(BIT(1) | BIT(0)); ++ if (!IS_ENABLED(CONFIG_64BIT)) ++ reg |= BIT(1); + +- /* BD 32-bits big endian mode */ +- else if (!(reg & BIT(1))) +- return SEC_32BE; + +- /* BD 64-bits big endian mode */ +- else +- return SEC_64BE; ++ if (!IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN)) ++ reg |= BIT(0); ++ ++ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + + static void sec_open_sva_prefetch(struct hisi_qm *qm) +@@ -429,9 +418,7 @@ static int sec_engine_init(struct hisi_qm *qm) + qm->io_base + SEC_BD_ERR_CHK_EN_REG3); + + /* config endian */ +- reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG); +- reg |= sec_get_endian(qm); +- writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); ++ sec_set_endian(qm); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.14/crypto-mxs-dcp-check-for-dma-mapping-errors.patch b/queue-5.14/crypto-mxs-dcp-check-for-dma-mapping-errors.patch new file mode 100644 index 00000000000..c6c9354a851 --- /dev/null +++ b/queue-5.14/crypto-mxs-dcp-check-for-dma-mapping-errors.patch @@ -0,0 +1,125 @@ +From ff5b8332ac3d1e92f603097d407cbdd02b749c36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 14:56:37 -0400 +Subject: crypto: mxs-dcp - Check for DMA mapping errors + +From: Sean Anderson + +[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ] + +After calling dma_map_single(), we must also call dma_mapping_error(). +This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG: + +[ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c +[ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single] + +Signed-off-by: Sean Anderson +Reviewed-by: Richard Weinberger +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 10 deletions(-) + +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index d6a7784d2988..f397cc5bf102 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -170,15 +170,19 @@ static struct dcp *global_sdcp; + + static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) + { ++ int dma_err; + struct dcp *sdcp = global_sdcp; + const int chan = actx->chan; + uint32_t stat; + unsigned long ret; + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; +- + dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc), + DMA_TO_DEVICE); + ++ dma_err = dma_mapping_error(sdcp->dev, desc_phys); ++ if (dma_err) ++ return dma_err; ++ + reinit_completion(&sdcp->completion[chan]); + + /* Clear status register. */ +@@ -216,18 +220,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) + static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + struct skcipher_request *req, int init) + { ++ dma_addr_t key_phys, src_phys, dst_phys; + struct dcp *sdcp = global_sdcp; + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; + struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req); + int ret; + +- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, +- 2 * AES_KEYSIZE_128, +- DMA_TO_DEVICE); +- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, +- DCP_BUF_SZ, DMA_TO_DEVICE); +- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, +- DCP_BUF_SZ, DMA_FROM_DEVICE); ++ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, ++ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, key_phys); ++ if (ret) ++ return ret; ++ ++ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, ++ DCP_BUF_SZ, DMA_TO_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, src_phys); ++ if (ret) ++ goto err_src; ++ ++ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, ++ DCP_BUF_SZ, DMA_FROM_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, dst_phys); ++ if (ret) ++ goto err_dst; + + if (actx->fill % AES_BLOCK_SIZE) { + dev_err(sdcp->dev, "Invalid block size!\n"); +@@ -265,10 +280,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + ret = mxs_dcp_start_dma(actx); + + aes_done_run: ++ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); ++err_dst: ++ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); ++err_src: + dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128, + DMA_TO_DEVICE); +- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); +- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); + + return ret; + } +@@ -557,6 +574,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf, + DCP_BUF_SZ, DMA_TO_DEVICE); + ++ ret = dma_mapping_error(sdcp->dev, buf_phys); ++ if (ret) ++ return ret; ++ + /* Fill in the DMA descriptor. */ + desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE | + MXS_DCP_CONTROL0_INTERRUPT | +@@ -589,6 +610,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + if (rctx->fini) { + digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf, + DCP_SHA_PAY_SZ, DMA_FROM_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, digest_phys); ++ if (ret) ++ goto done_run; ++ + desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM; + desc->payload = digest_phys; + } +-- +2.30.2 + diff --git a/queue-5.14/crypto-omap-fix-inconsistent-locking-of-device-lists.patch b/queue-5.14/crypto-omap-fix-inconsistent-locking-of-device-lists.patch new file mode 100644 index 00000000000..fb0d2c65af2 --- /dev/null +++ b/queue-5.14/crypto-omap-fix-inconsistent-locking-of-device-lists.patch @@ -0,0 +1,203 @@ +From 389af88ac075286ac5cbb23a523bbed35788ac34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 02:06:09 +0200 +Subject: crypto: omap - Fix inconsistent locking of device lists + +From: Ben Hutchings + +[ Upstream commit fe4d55773b879c785ae61da9b1c2160f0110f67e ] + +lockdep complains that in omap-aes, the list_lock is taken both with +softirqs enabled at probe time, and also in softirq context, which +could lead to a deadlock: + + ================================ + WARNING: inconsistent lock state + 5.14.0-rc1-00035-gc836005b01c5-dirty #69 Not tainted + -------------------------------- + inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. + ksoftirqd/0/7 [HC0[0]:SC1[3]:HE1:SE0] takes: + bf00e014 (list_lock){+.?.}-{2:2}, at: omap_aes_find_dev+0x18/0x54 [omap_aes_driver] + {SOFTIRQ-ON-W} state was registered at: + _raw_spin_lock+0x40/0x50 + omap_aes_probe+0x1d4/0x664 [omap_aes_driver] + platform_probe+0x58/0xb8 + really_probe+0xbc/0x314 + __driver_probe_device+0x80/0xe4 + driver_probe_device+0x30/0xc8 + __driver_attach+0x70/0xf4 + bus_for_each_dev+0x70/0xb4 + bus_add_driver+0xf0/0x1d4 + driver_register+0x74/0x108 + do_one_initcall+0x84/0x2e4 + do_init_module+0x5c/0x240 + load_module+0x221c/0x2584 + sys_finit_module+0xb0/0xec + ret_fast_syscall+0x0/0x2c + 0xbed90b30 + irq event stamp: 111800 + hardirqs last enabled at (111800): [] __kmalloc+0x484/0x5ec + hardirqs last disabled at (111799): [] __kmalloc+0x490/0x5ec + softirqs last enabled at (111776): [] __do_softirq+0x2b8/0x4d0 + softirqs last disabled at (111781): [] run_ksoftirqd+0x34/0x50 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(list_lock); + + lock(list_lock); + + *** DEADLOCK *** + + 2 locks held by ksoftirqd/0/7: + #0: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0x6c/0x260 + #1: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x2c/0xdc + + stack backtrace: + CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 5.14.0-rc1-00035-gc836005b01c5-dirty #69 + Hardware name: Generic AM43 (Flattened Device Tree) + [] (unwind_backtrace) from [] (show_stack+0x10/0x14) + [] (show_stack) from [] (mark_lock.part.17+0x5bc/0xd04) + [] (mark_lock.part.17) from [] (__lock_acquire+0x960/0x2fa4) + [] (__lock_acquire) from [] (lock_acquire+0x10c/0x358) + [] (lock_acquire) from [] (_raw_spin_lock_bh+0x44/0x58) + [] (_raw_spin_lock_bh) from [] (omap_aes_find_dev+0x18/0x54 [omap_aes_driver]) + [] (omap_aes_find_dev [omap_aes_driver]) from [] (omap_aes_crypt+0x94/0xd4 [omap_aes_driver]) + [] (omap_aes_crypt [omap_aes_driver]) from [] (esp_input+0x1b0/0x2c8) + [] (esp_input) from [] (xfrm_input+0x410/0x1290) + [] (xfrm_input) from [] (xfrm4_esp_rcv+0x54/0x11c) + [] (xfrm4_esp_rcv) from [] (ip_protocol_deliver_rcu+0x48/0x3bc) + [] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x9c/0xdc) + [] (ip_local_deliver_finish) from [] (ip_local_deliver+0x148/0x1b0) + [] (ip_local_deliver) from [] (ip_rcv+0x11c/0x180) + [] (ip_rcv) from [] (__netif_receive_skb_one_core+0x54/0x74) + [] (__netif_receive_skb_one_core) from [] (netif_receive_skb+0xa8/0x260) + [] (netif_receive_skb) from [] (cpsw_rx_handler+0x224/0x2fc) + [] (cpsw_rx_handler) from [] (__cpdma_chan_process+0xf4/0x188) + [] (__cpdma_chan_process) from [] (cpdma_chan_process+0x3c/0x5c) + [] (cpdma_chan_process) from [] (cpsw_rx_mq_poll+0x44/0x98) + [] (cpsw_rx_mq_poll) from [] (__napi_poll+0x28/0x268) + [] (__napi_poll) from [] (net_rx_action+0xcc/0x204) + [] (net_rx_action) from [] (__do_softirq+0x140/0x4d0) + [] (__do_softirq) from [] (run_ksoftirqd+0x34/0x50) + [] (run_ksoftirqd) from [] (smpboot_thread_fn+0xf4/0x1d8) + [] (smpboot_thread_fn) from [] (kthread+0x14c/0x174) + [] (kthread) from [] (ret_from_fork+0x14/0x38) + ... + +The omap-des and omap-sham drivers appear to have a similar issue. + +Fix this by using spin_{,un}lock_bh() around device list access in all +the probe and remove functions. + +Signed-off-by: Ben Hutchings +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-aes.c | 8 ++++---- + drivers/crypto/omap-des.c | 8 ++++---- + drivers/crypto/omap-sham.c | 12 ++++++------ + 3 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c +index 0dd4c6b157de..9b968ac4ee7b 100644 +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -1175,9 +1175,9 @@ static int omap_aes_probe(struct platform_device *pdev) + spin_lock_init(&dd->lock); + + INIT_LIST_HEAD(&dd->list); +- spin_lock(&list_lock); ++ spin_lock_bh(&list_lock); + list_add_tail(&dd->list, &dev_list); +- spin_unlock(&list_lock); ++ spin_unlock_bh(&list_lock); + + /* Initialize crypto engine */ + dd->engine = crypto_engine_alloc_init(dev, 1); +@@ -1264,9 +1264,9 @@ static int omap_aes_remove(struct platform_device *pdev) + if (!dd) + return -ENODEV; + +- spin_lock(&list_lock); ++ spin_lock_bh(&list_lock); + list_del(&dd->list); +- spin_unlock(&list_lock); ++ spin_unlock_bh(&list_lock); + + for (i = dd->pdata->algs_info_size - 1; i >= 0; i--) + for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) { +diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c +index bc8631363d72..be77656864e3 100644 +--- a/drivers/crypto/omap-des.c ++++ b/drivers/crypto/omap-des.c +@@ -1033,9 +1033,9 @@ static int omap_des_probe(struct platform_device *pdev) + + + INIT_LIST_HEAD(&dd->list); +- spin_lock(&list_lock); ++ spin_lock_bh(&list_lock); + list_add_tail(&dd->list, &dev_list); +- spin_unlock(&list_lock); ++ spin_unlock_bh(&list_lock); + + /* Initialize des crypto engine */ + dd->engine = crypto_engine_alloc_init(dev, 1); +@@ -1094,9 +1094,9 @@ static int omap_des_remove(struct platform_device *pdev) + if (!dd) + return -ENODEV; + +- spin_lock(&list_lock); ++ spin_lock_bh(&list_lock); + list_del(&dd->list); +- spin_unlock(&list_lock); ++ spin_unlock_bh(&list_lock); + + for (i = dd->pdata->algs_info_size - 1; i >= 0; i--) + for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index a47ac60a4ee1..63beea7cdba5 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -2144,9 +2144,9 @@ static int omap_sham_probe(struct platform_device *pdev) + (rev & dd->pdata->major_mask) >> dd->pdata->major_shift, + (rev & dd->pdata->minor_mask) >> dd->pdata->minor_shift); + +- spin_lock(&sham.lock); ++ spin_lock_bh(&sham.lock); + list_add_tail(&dd->list, &sham.dev_list); +- spin_unlock(&sham.lock); ++ spin_unlock_bh(&sham.lock); + + dd->engine = crypto_engine_alloc_init(dev, 1); + if (!dd->engine) { +@@ -2194,9 +2194,9 @@ err_algs: + err_engine_start: + crypto_engine_exit(dd->engine); + err_engine: +- spin_lock(&sham.lock); ++ spin_lock_bh(&sham.lock); + list_del(&dd->list); +- spin_unlock(&sham.lock); ++ spin_unlock_bh(&sham.lock); + err_pm: + pm_runtime_disable(dev); + if (!dd->polling_mode) +@@ -2215,9 +2215,9 @@ static int omap_sham_remove(struct platform_device *pdev) + dd = platform_get_drvdata(pdev); + if (!dd) + return -ENODEV; +- spin_lock(&sham.lock); ++ spin_lock_bh(&sham.lock); + list_del(&dd->list); +- spin_unlock(&sham.lock); ++ spin_unlock_bh(&sham.lock); + for (i = dd->pdata->algs_info_size - 1; i >= 0; i--) + for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) { + crypto_unregister_ahash( +-- +2.30.2 + diff --git a/queue-5.14/crypto-omap-sham-clear-dma-flags-only-after-omap_sha.patch b/queue-5.14/crypto-omap-sham-clear-dma-flags-only-after-omap_sha.patch new file mode 100644 index 00000000000..a9eea6bdfdd --- /dev/null +++ b/queue-5.14/crypto-omap-sham-clear-dma-flags-only-after-omap_sha.patch @@ -0,0 +1,43 @@ +From c3f4c39ceb2e73eaaf1e31757681e980c8001209 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 13:23:34 +0300 +Subject: crypto: omap-sham - clear dma flags only after + omap_sham_update_dma_stop() + +From: Tony Lindgren + +[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ] + +We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is +done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the +end of omap_sham_update_dma_stop(). + +The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not +need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be +applied as clean-up. + +Cc: Lokesh Vutla +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-sham.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index dd53ad9987b0..a47ac60a4ee1 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -1736,7 +1736,7 @@ static void omap_sham_done_task(unsigned long data) + if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags)) + goto finish; + } else if (test_bit(FLAGS_DMA_READY, &dd->flags)) { +- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { ++ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { + omap_sham_update_dma_stop(dd); + if (dd->err) { + err = dd->err; +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-do-not-export-adf_iov_putmsg.patch b/queue-5.14/crypto-qat-do-not-export-adf_iov_putmsg.patch new file mode 100644 index 00000000000..8bcec569813 --- /dev/null +++ b/queue-5.14/crypto-qat-do-not-export-adf_iov_putmsg.patch @@ -0,0 +1,36 @@ +From cb1a99e3859c96e3b747b922b3682addd0538741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:28 +0100 +Subject: crypto: qat - do not export adf_iov_putmsg() + +From: Giovanni Cabiddu + +[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ] + +The function adf_iov_putmsg() is only used inside the intel_qat module +therefore should not be exported. +Remove EXPORT_SYMBOL for the function adf_iov_putmsg(). + +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +index 663638bb5c97..efa4bffb4f60 100644 +--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +@@ -186,7 +186,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) + + return ret; + } +-EXPORT_SYMBOL_GPL(adf_iov_putmsg); + + void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + { +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-do-not-ignore-errors-from-enable_vf2pf_co.patch b/queue-5.14/crypto-qat-do-not-ignore-errors-from-enable_vf2pf_co.patch new file mode 100644 index 00000000000..9bc9cbe7446 --- /dev/null +++ b/queue-5.14/crypto-qat-do-not-ignore-errors-from-enable_vf2pf_co.patch @@ -0,0 +1,51 @@ +From 728b9f6db11abea843e18289c1dc8920282aa4bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:13 +0100 +Subject: crypto: qat - do not ignore errors from enable_vf2pf_comms() + +From: Giovanni Cabiddu + +[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ] + +The function adf_dev_init() ignores the error code reported by +enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible +with the pf, then the load of the VF driver progresses. +This patch changes adf_dev_init() so that the error code from +enable_vf2pf_comms() is returned to the caller. + +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_init.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c +index 744c40351428..02864985dbb0 100644 +--- a/drivers/crypto/qat/qat_common/adf_init.c ++++ b/drivers/crypto/qat/qat_common/adf_init.c +@@ -61,6 +61,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) + struct service_hndl *service; + struct list_head *list_itr; + struct adf_hw_device_data *hw_data = accel_dev->hw_device; ++ int ret; + + if (!hw_data) { + dev_err(&GET_DEV(accel_dev), +@@ -127,9 +128,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) + } + + hw_data->enable_error_correction(accel_dev); +- hw_data->enable_vf2pf_comms(accel_dev); ++ ret = hw_data->enable_vf2pf_comms(accel_dev); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(adf_dev_init); + +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-fix-naming-for-init-shutdown-vf-to-pf-not.patch b/queue-5.14/crypto-qat-fix-naming-for-init-shutdown-vf-to-pf-not.patch new file mode 100644 index 00000000000..9cd295fb7c6 --- /dev/null +++ b/queue-5.14/crypto-qat-fix-naming-for-init-shutdown-vf-to-pf-not.patch @@ -0,0 +1,162 @@ +From 61b57054d923c7917479b6c2e980868fc9c37c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:22 +0100 +Subject: crypto: qat - fix naming for init/shutdown VF to PF notifications + +From: Marco Chiappero + +[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ] + +At start and shutdown, VFs notify the PF about their state. These +notifications are carried out through a message exchange using the PFVF +protocol. + +Function names lead to believe they do perform init or shutdown logic. +This is to fix the naming to better reflect their purpose. + +Signed-off-by: Marco Chiappero +Co-developed-by: Giovanni Cabiddu +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 ++-- + drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 ++-- + drivers/crypto/qat/qat_common/adf_common_drv.h | 8 ++++---- + drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 ++++++------ + .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 ++-- + 5 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +index 15f6b9bdfb22..ddf42fb32625 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +@@ -81,10 +81,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +index d231583428c9..7e202ef92523 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +@@ -81,10 +81,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; +diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h +index c61476553728..dd4a811b7e89 100644 +--- a/drivers/crypto/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h +@@ -198,8 +198,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, + void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); + void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); + +-int adf_vf2pf_init(struct adf_accel_dev *accel_dev); +-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev); ++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev); ++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev); + int adf_init_pf_wq(void); + void adf_exit_pf_wq(void); + int adf_init_vf_wq(void); +@@ -222,12 +222,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) + { + } + +-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev) ++static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) + { + return 0; + } + +-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) ++static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) + { + } + +diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +index e85bd62d134a..3e25fac051b2 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +@@ -5,14 +5,14 @@ + #include "adf_pf2vf_msg.h" + + /** +- * adf_vf2pf_init() - send init msg to PF ++ * adf_vf2pf_notify_init() - send init msg to PF + * @accel_dev: Pointer to acceleration VF device. + * + * Function sends an init message from the VF to a PF + * + * Return: 0 on success, error code otherwise. + */ +-int adf_vf2pf_init(struct adf_accel_dev *accel_dev) ++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) + { + u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | + (ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT)); +@@ -25,17 +25,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev) + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + return 0; + } +-EXPORT_SYMBOL_GPL(adf_vf2pf_init); ++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init); + + /** +- * adf_vf2pf_shutdown() - send shutdown msg to PF ++ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF + * @accel_dev: Pointer to acceleration VF device. + * + * Function sends a shutdown message from the VF to a PF + * + * Return: void + */ +-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) ++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) + { + u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | + (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT)); +@@ -45,4 +45,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) + dev_err(&GET_DEV(accel_dev), + "Failed to send Shutdown event to PF\n"); + } +-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown); ++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown); +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +index f14fb82ed6df..744734caaf7b 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +@@ -81,10 +81,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-fix-reuse-of-completion-variable.patch b/queue-5.14/crypto-qat-fix-reuse-of-completion-variable.patch new file mode 100644 index 00000000000..09f5b35d317 --- /dev/null +++ b/queue-5.14/crypto-qat-fix-reuse-of-completion-variable.patch @@ -0,0 +1,39 @@ +From f4aba3ac1d84cea7b9059973e84967660346d632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:19 +0100 +Subject: crypto: qat - fix reuse of completion variable + +From: Marco Chiappero + +[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ] + +Use reinit_completion() to set to a clean state a completion variable, +used to coordinate the VF to PF request-response flow, before every +new VF request. + +Signed-off-by: Marco Chiappero +Co-developed-by: Giovanni Cabiddu +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +index a1b77bd7a894..663638bb5c97 100644 +--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +@@ -316,6 +316,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev) + msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT; + BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255); + ++ reinit_completion(&accel_dev->vf.iov_msg_completion); ++ + /* Send request from VF to PF */ + ret = adf_iov_putmsg(accel_dev, msg, 0); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-handle-both-source-of-interrupt-in-vf-isr.patch b/queue-5.14/crypto-qat-handle-both-source-of-interrupt-in-vf-isr.patch new file mode 100644 index 00000000000..60340bb2510 --- /dev/null +++ b/queue-5.14/crypto-qat-handle-both-source-of-interrupt-in-vf-isr.patch @@ -0,0 +1,63 @@ +From 72a173886326a23366cff73fdac3b8eb10f78fcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:14 +0100 +Subject: crypto: qat - handle both source of interrupt in VF ISR + +From: Giovanni Cabiddu + +[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ] + +The top half of the VF drivers handled only a source at the time. +If an interrupt for PF2VF and bundle occurred at the same time, the ISR +scheduled only the bottom half for PF2VF. +This patch fixes the VF top half so that if both sources of interrupt +trigger at the same time, both bottom halves are scheduled. + +This patch is based on earlier work done by Conor McLoughlin. + +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c +index 888388acb6bd..3e4f64d248f9 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c +@@ -160,6 +160,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) + struct adf_bar *pmisc = + &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; + void __iomem *pmisc_bar_addr = pmisc->virt_addr; ++ bool handled = false; + u32 v_int; + + /* Read VF INT source CSR to determine the source of VF interrupt */ +@@ -172,7 +173,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) + + /* Schedule tasklet to handle interrupt BH */ + tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet); +- return IRQ_HANDLED; ++ handled = true; + } + + /* Check bundle interrupt */ +@@ -184,10 +185,10 @@ static irqreturn_t adf_isr(int irq, void *privdata) + csr_ops->write_csr_int_flag_and_col(bank->csr_addr, + bank->bank_number, 0); + tasklet_hi_schedule(&bank->resp_handler); +- return IRQ_HANDLED; ++ handled = true; + } + +- return IRQ_NONE; ++ return handled ? IRQ_HANDLED : IRQ_NONE; + } + + static int adf_request_msi_irq(struct adf_accel_dev *accel_dev) +-- +2.30.2 + diff --git a/queue-5.14/crypto-qat-use-proper-type-for-vf_mask.patch b/queue-5.14/crypto-qat-use-proper-type-for-vf_mask.patch new file mode 100644 index 00000000000..bec62d61a6a --- /dev/null +++ b/queue-5.14/crypto-qat-use-proper-type-for-vf_mask.patch @@ -0,0 +1,72 @@ +From d2efbf23c5eca604adf55d0b96b7d71ae252423d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 21:21:10 +0100 +Subject: crypto: qat - use proper type for vf_mask + +From: Giovanni Cabiddu + +[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ] + +Replace vf_mask type with unsigned long to avoid a stack-out-of-bound. + +This is to fix the following warning reported by KASAN the first time +adf_msix_isr_ae() gets called. + + [ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50 + [ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0 + [ 692.092076] Call Trace: + [ 692.092089] + [ 692.092101] dump_stack+0x9c/0xcf + [ 692.092132] print_address_description.constprop.0+0x18/0x130 + [ 692.092164] ? find_first_bit+0x28/0x50 + [ 692.092185] kasan_report.cold+0x7f/0x111 + [ 692.092213] ? static_obj+0x10/0x80 + [ 692.092234] ? find_first_bit+0x28/0x50 + [ 692.092262] find_first_bit+0x28/0x50 + [ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat] + +Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c +index e3ad5587be49..daab02011717 100644 +--- a/drivers/crypto/qat/qat_common/adf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_isr.c +@@ -15,6 +15,8 @@ + #include "adf_transport_access_macros.h" + #include "adf_transport_internal.h" + ++#define ADF_MAX_NUM_VFS 32 ++ + static int adf_enable_msix(struct adf_accel_dev *accel_dev) + { + struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev; +@@ -72,7 +74,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) + struct adf_bar *pmisc = + &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; + void __iomem *pmisc_bar_addr = pmisc->virt_addr; +- u32 vf_mask; ++ unsigned long vf_mask; + + /* Get the interrupt sources triggered by VFs */ + vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) & +@@ -93,8 +95,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) + * unless the VF is malicious and is attempting to + * flood the host OS with VF2PF interrupts. + */ +- for_each_set_bit(i, (const unsigned long *)&vf_mask, +- (sizeof(vf_mask) * BITS_PER_BYTE)) { ++ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) { + vf_info = accel_dev->pf.vf_info + i; + + if (!__ratelimit(&vf_info->vf2pf_ratelimit)) { +-- +2.30.2 + diff --git a/queue-5.14/crypto-tcrypt-fix-missing-return-value-check.patch b/queue-5.14/crypto-tcrypt-fix-missing-return-value-check.patch new file mode 100644 index 00000000000..fc87b4ec698 --- /dev/null +++ b/queue-5.14/crypto-tcrypt-fix-missing-return-value-check.patch @@ -0,0 +1,104 @@ +From 63002865ba32028a86a9f8d5b2cbd86e5c3bf575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:55:06 +0800 +Subject: crypto: tcrypt - Fix missing return value check + +From: Tianjia Zhang + +[ Upstream commit 7b3d52683b3a47c0ba1dfd6b5994a3a795b06972 ] + +There are several places where the return value check of crypto_aead_setkey +and crypto_aead_setauthsize were lost. It is necessary to add these checks. + +At the same time, move the crypto_aead_setauthsize() call out of the loop, +and only need to call it once after load transform. + +Fixee: 53f52d7aecb4 ("crypto: tcrypt - Added speed tests for AEAD crypto alogrithms in tcrypt test suite") +Signed-off-by: Tianjia Zhang +Reviewed-by: Vitaly Chikunov +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/tcrypt.c | 29 +++++++++++++++++++---------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index f8d06da78e4f..6863e57b088d 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -290,6 +290,11 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs, + } + + ret = crypto_aead_setauthsize(tfm, authsize); ++ if (ret) { ++ pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo, ++ ret); ++ goto out_free_tfm; ++ } + + for (i = 0; i < num_mb; ++i) + if (testmgr_alloc_buf(data[i].xbuf)) { +@@ -315,7 +320,7 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs, + for (i = 0; i < num_mb; ++i) { + data[i].req = aead_request_alloc(tfm, GFP_KERNEL); + if (!data[i].req) { +- pr_err("alg: skcipher: Failed to allocate request for %s\n", ++ pr_err("alg: aead: Failed to allocate request for %s\n", + algo); + while (i--) + aead_request_free(data[i].req); +@@ -567,13 +572,19 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, + sgout = &sg[9]; + + tfm = crypto_alloc_aead(algo, 0, 0); +- + if (IS_ERR(tfm)) { + pr_err("alg: aead: Failed to load transform for %s: %ld\n", algo, + PTR_ERR(tfm)); + goto out_notfm; + } + ++ ret = crypto_aead_setauthsize(tfm, authsize); ++ if (ret) { ++ pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo, ++ ret); ++ goto out_noreq; ++ } ++ + crypto_init_wait(&wait); + printk(KERN_INFO "\ntesting speed of %s (%s) %s\n", algo, + get_driver_name(crypto_aead, tfm), e); +@@ -611,8 +622,13 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, + break; + } + } ++ + ret = crypto_aead_setkey(tfm, key, *keysize); +- ret = crypto_aead_setauthsize(tfm, authsize); ++ if (ret) { ++ pr_err("setkey() failed flags=%x: %d\n", ++ crypto_aead_get_flags(tfm), ret); ++ goto out; ++ } + + iv_len = crypto_aead_ivsize(tfm); + if (iv_len) +@@ -622,15 +638,8 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, + printk(KERN_INFO "test %u (%d bit key, %d byte blocks): ", + i, *keysize * 8, bs); + +- + memset(tvmem[0], 0xff, PAGE_SIZE); + +- if (ret) { +- pr_err("setkey() failed flags=%x\n", +- crypto_aead_get_flags(tfm)); +- goto out; +- } +- + sg_init_aead(sg, xbuf, bs + (enc ? 0 : authsize), + assoc, aad_size); + +-- +2.30.2 + diff --git a/queue-5.14/crypto-x86-aes-ni-add-missing-error-checks-in-xts-co.patch b/queue-5.14/crypto-x86-aes-ni-add-missing-error-checks-in-xts-co.patch new file mode 100644 index 00000000000..e258e92a59f --- /dev/null +++ b/queue-5.14/crypto-x86-aes-ni-add-missing-error-checks-in-xts-co.patch @@ -0,0 +1,53 @@ +From 766975526cd2b9c99375c6534ca3fefffd5965d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 18:54:03 +0200 +Subject: crypto: x86/aes-ni - add missing error checks in XTS code + +From: Ard Biesheuvel + +[ Upstream commit 821720b9f34ec54106ebf012a712ba73bbcf47c2 ] + +The updated XTS code fails to check the return code of skcipher_walk_virt, +which may lead to skcipher_walk_abort() or skcipher_walk_done() being called +while the walk argument is in an inconsistent state. + +So check the return value after each such call, and bail on errors. + +Fixes: 2481104fe98d ("crypto: x86/aes-ni-xts - rewrite and drop indirections via glue helper") +Reported-by: Dave Hansen +Reported-by: syzbot +Signed-off-by: Ard Biesheuvel +Reviewed-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/aesni-intel_glue.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c +index 2144e54a6c89..388643ca2177 100644 +--- a/arch/x86/crypto/aesni-intel_glue.c ++++ b/arch/x86/crypto/aesni-intel_glue.c +@@ -849,6 +849,8 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt) + return -EINVAL; + + err = skcipher_walk_virt(&walk, req, false); ++ if (err) ++ return err; + + if (unlikely(tail > 0 && walk.nbytes < walk.total)) { + int blocks = DIV_ROUND_UP(req->cryptlen, AES_BLOCK_SIZE) - 2; +@@ -862,7 +864,10 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt) + skcipher_request_set_crypt(&subreq, req->src, req->dst, + blocks * AES_BLOCK_SIZE, req->iv); + req = &subreq; ++ + err = skcipher_walk_virt(&walk, req, false); ++ if (err) ++ return err; + } else { + tail = 0; + } +-- +2.30.2 + diff --git a/queue-5.14/debugfs-return-error-during-full-open-_proxy_open-on.patch b/queue-5.14/debugfs-return-error-during-full-open-_proxy_open-on.patch new file mode 100644 index 00000000000..982e5be865a --- /dev/null +++ b/queue-5.14/debugfs-return-error-during-full-open-_proxy_open-on.patch @@ -0,0 +1,63 @@ +From 399c31927ce1b3a25eb2d28205ece610d89d8041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Aug 2021 18:24:44 +0200 +Subject: debugfs: Return error during {full/open}_proxy_open() on rmmod +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Eckelmann + +[ Upstream commit 112cedc8e600b668688eb809bf11817adec58ddc ] + +If a kernel module gets unloaded then it printed report about a leak before +commit 275678e7a9be ("debugfs: Check module state before warning in +{full/open}_proxy_open()"). An additional check was added in this commit to +avoid this printing. But it was forgotten that the function must return an +error in this case because it was not actually opened. + +As result, the systems started to crash or to hang when a module was +unloaded while something was trying to open a file. + +Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()") +Cc: Taehee Yoo +Reported-by: Mário Lopes +Signed-off-by: Sven Eckelmann +Link: https://lore.kernel.org/r/20210802162444.7848-1-sven@narfation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index df00231d3ecc..7d162b0efbf0 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -179,8 +179,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp) + if (!fops_get(real_fops)) { + #ifdef CONFIG_MODULES + if (real_fops->owner && +- real_fops->owner->state == MODULE_STATE_GOING) ++ real_fops->owner->state == MODULE_STATE_GOING) { ++ r = -ENXIO; + goto out; ++ } + #endif + + /* Huh? Module did not clean up after itself at exit? */ +@@ -314,8 +316,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp) + if (!fops_get(real_fops)) { + #ifdef CONFIG_MODULES + if (real_fops->owner && +- real_fops->owner->state == MODULE_STATE_GOING) ++ real_fops->owner->state == MODULE_STATE_GOING) { ++ r = -ENXIO; + goto out; ++ } + #endif + + /* Huh? Module did not cleanup after itself at exit? */ +-- +2.30.2 + diff --git a/queue-5.14/devlink-break-parameter-notification-sequence-to-be-.patch b/queue-5.14/devlink-break-parameter-notification-sequence-to-be-.patch new file mode 100644 index 00000000000..abd6193df94 --- /dev/null +++ b/queue-5.14/devlink-break-parameter-notification-sequence-to-be-.patch @@ -0,0 +1,260 @@ +From 4728066867a2376366be8d627b5147870456556d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 20:19:24 +0300 +Subject: devlink: Break parameter notification sequence to be before/after + unload/load driver + +From: Leon Romanovsky + +[ Upstream commit 05a7f4a8dff19999ca8a83a35ff4782689de7bfc ] + +The change of namespaces during devlink reload calls to driver unload +before it accesses devlink parameters. The commands below causes to +use-after-free bug when trying to get flow steering mode. + + * ip netns add n1 + * devlink dev reload pci/0000:00:09.0 netns n1 + + ================================================================== + BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core] + Read of size 4 at addr ffff888009d04308 by task devlink/275 + + CPU: 6 PID: 275 Comm: devlink Not tainted 5.12.0-rc2+ #2853 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + Call Trace: + dump_stack+0x93/0xc2 + print_address_description.constprop.0+0x18/0x140 + ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core] + ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core] + kasan_report.cold+0x7c/0xd8 + ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core] + mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core] + devlink_nl_param_fill+0x1c8/0xe80 + ? __free_pages_ok+0x37a/0x8a0 + ? devlink_flash_update_timeout_notify+0xd0/0xd0 + ? lock_acquire+0x1a9/0x6d0 + ? fs_reclaim_acquire+0xb7/0x160 + ? lock_is_held_type+0x98/0x110 + ? 0xffffffff81000000 + ? lock_release+0x1f9/0x6c0 + ? fs_reclaim_release+0xa1/0xf0 + ? lock_downgrade+0x6d0/0x6d0 + ? lock_is_held_type+0x98/0x110 + ? lock_is_held_type+0x98/0x110 + ? memset+0x20/0x40 + ? __build_skb_around+0x1f8/0x2b0 + devlink_param_notify+0x6d/0x180 + devlink_reload+0x1c3/0x520 + ? devlink_remote_reload_actions_performed+0x30/0x30 + ? mutex_trylock+0x24b/0x2d0 + ? devlink_nl_cmd_reload+0x62b/0x1070 + devlink_nl_cmd_reload+0x66d/0x1070 + ? devlink_reload+0x520/0x520 + ? devlink_get_from_attrs+0x1bc/0x260 + ? devlink_nl_pre_doit+0x64/0x4d0 + genl_family_rcv_msg_doit+0x1e9/0x2f0 + ? mutex_lock_io_nested+0x1130/0x1130 + ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240 + ? security_capable+0x51/0x90 + genl_rcv_msg+0x27f/0x4a0 + ? genl_get_cmd+0x3c0/0x3c0 + ? lock_acquire+0x1a9/0x6d0 + ? devlink_reload+0x520/0x520 + ? lock_release+0x6c0/0x6c0 + netlink_rcv_skb+0x11d/0x340 + ? genl_get_cmd+0x3c0/0x3c0 + ? netlink_ack+0x9f0/0x9f0 + ? lock_release+0x1f9/0x6c0 + genl_rcv+0x24/0x40 + netlink_unicast+0x433/0x700 + ? netlink_attachskb+0x730/0x730 + ? _copy_from_iter_full+0x178/0x650 + ? __alloc_skb+0x113/0x2b0 + netlink_sendmsg+0x6f1/0xbd0 + ? netlink_unicast+0x700/0x700 + ? lock_is_held_type+0x98/0x110 + ? netlink_unicast+0x700/0x700 + sock_sendmsg+0xb0/0xe0 + __sys_sendto+0x193/0x240 + ? __x64_sys_getpeername+0xb0/0xb0 + ? do_sys_openat2+0x10b/0x370 + ? __up_read+0x1a1/0x7b0 + ? do_user_addr_fault+0x219/0xdc0 + ? __x64_sys_openat+0x120/0x1d0 + ? __x64_sys_open+0x1a0/0x1a0 + __x64_sys_sendto+0xdd/0x1b0 + ? syscall_enter_from_user_mode+0x1d/0x50 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7fc69d0af14a + Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c + RSP: 002b:00007ffc1d8292f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c + RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc69d0af14a + RDX: 0000000000000038 RSI: 0000555f57c56440 RDI: 0000000000000003 + RBP: 0000555f57c56410 R08: 00007fc69d17b200 R09: 000000000000000c + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 + R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + Allocated by task 146: + kasan_save_stack+0x1b/0x40 + __kasan_kmalloc+0x99/0xc0 + mlx5_init_fs+0xf0/0x1c50 [mlx5_core] + mlx5_load+0xd2/0x180 [mlx5_core] + mlx5_init_one+0x2f6/0x450 [mlx5_core] + probe_one+0x47d/0x6e0 [mlx5_core] + pci_device_probe+0x2a0/0x4a0 + really_probe+0x20a/0xc90 + driver_probe_device+0xd8/0x380 + device_driver_attach+0x1df/0x250 + __driver_attach+0xff/0x240 + bus_for_each_dev+0x11e/0x1a0 + bus_add_driver+0x309/0x570 + driver_register+0x1ee/0x380 + 0xffffffffa06b8062 + do_one_initcall+0xd5/0x410 + do_init_module+0x1c8/0x760 + load_module+0x6d8b/0x9650 + __do_sys_finit_module+0x118/0x1b0 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + Freed by task 275: + kasan_save_stack+0x1b/0x40 + kasan_set_track+0x1c/0x30 + kasan_set_free_info+0x20/0x30 + __kasan_slab_free+0x102/0x140 + slab_free_freelist_hook+0x74/0x1b0 + kfree+0xd7/0x2a0 + mlx5_unload+0x16/0xb0 [mlx5_core] + mlx5_unload_one+0xae/0x120 [mlx5_core] + mlx5_devlink_reload_down+0x1bc/0x380 [mlx5_core] + devlink_reload+0x141/0x520 + devlink_nl_cmd_reload+0x66d/0x1070 + genl_family_rcv_msg_doit+0x1e9/0x2f0 + genl_rcv_msg+0x27f/0x4a0 + netlink_rcv_skb+0x11d/0x340 + genl_rcv+0x24/0x40 + netlink_unicast+0x433/0x700 + netlink_sendmsg+0x6f1/0xbd0 + sock_sendmsg+0xb0/0xe0 + __sys_sendto+0x193/0x240 + __x64_sys_sendto+0xdd/0x1b0 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + The buggy address belongs to the object at ffff888009d04300 + which belongs to the cache kmalloc-128 of size 128 + The buggy address is located 8 bytes inside of + 128-byte region [ffff888009d04300, ffff888009d04380) + The buggy address belongs to the page: + page:0000000086a64ecc refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888009d04000 pfn:0x9d04 + head:0000000086a64ecc order:1 compound_mapcount:0 + flags: 0x4000000000010200(slab|head) + raw: 4000000000010200 ffffea0000203980 0000000200000002 ffff8880050428c0 + raw: ffff888009d04000 000000008020001d 00000001ffffffff 0000000000000000 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ffff888009d04200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888009d04280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + >ffff888009d04300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888009d04380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888009d04400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ================================================================== + +The right solution to devlink reload is to notify about deletion of +parameters, unload driver, change net namespaces, load driver and notify +about addition of parameters. + +Fixes: 070c63f20f6c ("net: devlink: allow to change namespaces during reload") +Reviewed-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/devlink.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 85032626de24..3963b1bc1e59 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -3801,10 +3801,12 @@ static void devlink_param_notify(struct devlink *devlink, + struct devlink_param_item *param_item, + enum devlink_command cmd); + +-static void devlink_reload_netns_change(struct devlink *devlink, +- struct net *dest_net) ++static void devlink_ns_change_notify(struct devlink *devlink, ++ struct net *dest_net, struct net *curr_net, ++ bool new) + { + struct devlink_param_item *param_item; ++ enum devlink_command cmd; + + /* Userspace needs to be notified about devlink objects + * removed from original and entering new network namespace. +@@ -3812,17 +3814,18 @@ static void devlink_reload_netns_change(struct devlink *devlink, + * reload process so the notifications are generated separatelly. + */ + +- list_for_each_entry(param_item, &devlink->param_list, list) +- devlink_param_notify(devlink, 0, param_item, +- DEVLINK_CMD_PARAM_DEL); +- devlink_notify(devlink, DEVLINK_CMD_DEL); ++ if (!dest_net || net_eq(dest_net, curr_net)) ++ return; + +- __devlink_net_set(devlink, dest_net); ++ if (new) ++ devlink_notify(devlink, DEVLINK_CMD_NEW); + +- devlink_notify(devlink, DEVLINK_CMD_NEW); ++ cmd = new ? DEVLINK_CMD_PARAM_NEW : DEVLINK_CMD_PARAM_DEL; + list_for_each_entry(param_item, &devlink->param_list, list) +- devlink_param_notify(devlink, 0, param_item, +- DEVLINK_CMD_PARAM_NEW); ++ devlink_param_notify(devlink, 0, param_item, cmd); ++ ++ if (!new) ++ devlink_notify(devlink, DEVLINK_CMD_DEL); + } + + static bool devlink_reload_supported(const struct devlink_ops *ops) +@@ -3902,6 +3905,7 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net, + u32 *actions_performed, struct netlink_ext_ack *extack) + { + u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; ++ struct net *curr_net; + int err; + + if (!devlink->reload_enabled) +@@ -3909,18 +3913,22 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net, + + memcpy(remote_reload_stats, devlink->stats.remote_reload_stats, + sizeof(remote_reload_stats)); ++ ++ curr_net = devlink_net(devlink); ++ devlink_ns_change_notify(devlink, dest_net, curr_net, false); + err = devlink->ops->reload_down(devlink, !!dest_net, action, limit, extack); + if (err) + return err; + +- if (dest_net && !net_eq(dest_net, devlink_net(devlink))) +- devlink_reload_netns_change(devlink, dest_net); ++ if (dest_net && !net_eq(dest_net, curr_net)) ++ __devlink_net_set(devlink, dest_net); + + err = devlink->ops->reload_up(devlink, action, limit, actions_performed, extack); + devlink_reload_failed_set(devlink, !!err); + if (err) + return err; + ++ devlink_ns_change_notify(devlink, dest_net, curr_net, true); + WARN_ON(!(*actions_performed & BIT(action))); + /* Catch driver on updating the remote action within devlink reload */ + WARN_ON(memcmp(remote_reload_stats, devlink->stats.remote_reload_stats, +-- +2.30.2 + diff --git a/queue-5.14/devlink-clear-whole-devlink_flash_notify-struct.patch b/queue-5.14/devlink-clear-whole-devlink_flash_notify-struct.patch new file mode 100644 index 00000000000..9845b1cd1d6 --- /dev/null +++ b/queue-5.14/devlink-clear-whole-devlink_flash_notify-struct.patch @@ -0,0 +1,50 @@ +From e4080d7953def1b5a259706026b8f438f53766b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Aug 2021 12:57:30 +0300 +Subject: devlink: Clear whole devlink_flash_notify struct + +From: Leon Romanovsky + +[ Upstream commit ed43fbac717882165a2a4bd64f7b1f56f7467bb7 ] + +The { 0 } doesn't clear all fields in the struct, but tells to the +compiler to set all fields to zero and doesn't touch any sub-fields +if they exists. + +The {} is an empty initialiser that instructs to fully initialize whole +struct including sub-fields, which is error-prone for future +devlink_flash_notify extensions. + +Fixes: 6700acc5f1fe ("devlink: collect flash notify params into a struct") +Signed-off-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/devlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 3963b1bc1e59..5a85a7b0feb2 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -4125,7 +4125,7 @@ out_free_msg: + + static void devlink_flash_update_begin_notify(struct devlink *devlink) + { +- struct devlink_flash_notify params = { 0 }; ++ struct devlink_flash_notify params = {}; + + __devlink_flash_update_notify(devlink, + DEVLINK_CMD_FLASH_UPDATE, +@@ -4134,7 +4134,7 @@ static void devlink_flash_update_begin_notify(struct devlink *devlink) + + static void devlink_flash_update_end_notify(struct devlink *devlink) + { +- struct devlink_flash_notify params = { 0 }; ++ struct devlink_flash_notify params = {}; + + __devlink_flash_update_notify(devlink, + DEVLINK_CMD_FLASH_UPDATE_END, +-- +2.30.2 + diff --git a/queue-5.14/driver-core-fix-error-return-code-in-really_probe.patch b/queue-5.14/driver-core-fix-error-return-code-in-really_probe.patch new file mode 100644 index 00000000000..d384ff130eb --- /dev/null +++ b/queue-5.14/driver-core-fix-error-return-code-in-really_probe.patch @@ -0,0 +1,65 @@ +From f6d828aeb22e3abc22cbe14b25ad3fd73d4785f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 15:43:01 +0800 +Subject: driver core: Fix error return code in really_probe() + +From: Zhen Lei + +[ Upstream commit f04948dea236b000da09c466a7ec931ecd8d7867 ] + +In the case of error handling, the error code returned by the subfunction +should be propagated instead of 0. + +Fixes: 1901fb2604fb ("Driver core: fix "driver" symlink timing") +Fixes: 23b6904442d0 ("driver core: add dev_groups to all drivers") +Fixes: 8fd456ec0cf0 ("driver core: Add state_synced sysfs file for devices that support it") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210707074301.2722-1-thunder.leizhen@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 437cd61343b2..68ea1f949daa 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -580,7 +580,8 @@ re_probe: + goto probe_failed; + } + +- if (driver_sysfs_add(dev)) { ++ ret = driver_sysfs_add(dev); ++ if (ret) { + pr_err("%s: driver_sysfs_add(%s) failed\n", + __func__, dev_name(dev)); + goto probe_failed; +@@ -602,15 +603,18 @@ re_probe: + goto probe_failed; + } + +- if (device_add_groups(dev, drv->dev_groups)) { ++ ret = device_add_groups(dev, drv->dev_groups); ++ if (ret) { + dev_err(dev, "device_add_groups() failed\n"); + goto dev_groups_failed; + } + +- if (dev_has_sync_state(dev) && +- device_create_file(dev, &dev_attr_state_synced)) { +- dev_err(dev, "state_synced sysfs add failed\n"); +- goto dev_sysfs_state_synced_failed; ++ if (dev_has_sync_state(dev)) { ++ ret = device_create_file(dev, &dev_attr_state_synced); ++ if (ret) { ++ dev_err(dev, "state_synced sysfs add failed\n"); ++ goto dev_sysfs_state_synced_failed; ++ } + } + + if (test_remove) { +-- +2.30.2 + diff --git a/queue-5.14/drm-amd-pm-fix-a-bug-communicating-with-the-smu-v5.patch b/queue-5.14/drm-amd-pm-fix-a-bug-communicating-with-the-smu-v5.patch new file mode 100644 index 00000000000..3151e943d62 --- /dev/null +++ b/queue-5.14/drm-amd-pm-fix-a-bug-communicating-with-the-smu-v5.patch @@ -0,0 +1,444 @@ +From 3ec2a5f5fa54b9b45c630236df6f0cf8c83ddb13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jul 2021 23:33:11 -0400 +Subject: drm/amd/pm: Fix a bug communicating with the SMU (v5) + +From: Luben Tuikov + +[ Upstream commit 5810323ba692895b045e3f1b3e107605c3717dab ] + +This fixes a bug which if we probe a non-existing +I2C device, and the SMU returns 0xFF, from then on +we can never communicate with the SMU, because the +code before this patch reads and interprets 0xFF +as a terminal error, and thus we never write 0 +into register 90 to clear the status (and +subsequently send a new command to the SMU.) + +It is not an error that the SMU returns status +0xFF. This means that the SMU executed the last +command successfully (execution status), but the +command result is an error of some sort (execution +result), depending on what the command was. + +When doing a status check of the SMU, before we +send a new command, the only status which +precludes us from sending a new command is 0--the +SMU hasn't finished executing a previous command, +and 0xFC--the SMU is busy. + +This bug was seen as the following line in the +kernel log, + +amdgpu: Msg issuing pre-check failed(0xff) and SMU may be not in the right state! + +when subsequent SMU commands, not necessarily +related to I2C, were sent to the SMU. + +This patch fixes this bug. + +v2: Add a comment to the description of +__smu_cmn_poll_stat() to explain why we're NOT +defining the SMU FW return codes as macros, but +are instead hard-coding them. Such a change, can +be followed up by a subsequent patch. + +v3: The changes are, +a) Add comments to break labels in + __smu_cmn_reg2errno(). + +b) When an unknown/unspecified/undefined result is + returned back from the SMU, map that to + -EREMOTEIO, to distinguish failure at the SMU + FW. + +c) Add kernel-doc to + smu_cmn_send_msg_without_waiting(), + smu_cmn_wait_for_response(), + smu_cmn_send_smc_msg_with_param(). + +d) In smu_cmn_send_smc_msg_with_param(), since we + wait for completion of the command, if the + result of the completion is + undefined/unknown/unspecified, we print that to + the kernel log. + +v4: a) Add macros as requested, though redundant, to + be removed when SMU consolidates for all + ASICs--see comment in code. + b) Get out if the SMU code is unknown. + +v5: Rename the macro names. + +Cc: Alex Deucher +Cc: Evan Quan +Cc: Lijo Lazar +Fixes: fcb1fe9c9e0031 ("drm/amd/powerplay: pre-check the SMU state before issuing message") +Signed-off-by: Luben Tuikov +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 288 +++++++++++++++++++++---- + drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 3 +- + 2 files changed, 244 insertions(+), 47 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +index e802f9a95f08..a0e2111eb783 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +@@ -55,7 +55,7 @@ + + #undef __SMU_DUMMY_MAP + #define __SMU_DUMMY_MAP(type) #type +-static const char* __smu_message_names[] = { ++static const char * const __smu_message_names[] = { + SMU_MESSAGE_TYPES + }; + +@@ -76,55 +76,258 @@ static void smu_cmn_read_arg(struct smu_context *smu, + *arg = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_82); + } + +-int smu_cmn_wait_for_response(struct smu_context *smu) ++/* Redefine the SMU error codes here. ++ * ++ * Note that these definitions are redundant and should be removed ++ * when the SMU has exported a unified header file containing these ++ * macros, which header file we can just include and use the SMU's ++ * macros. At the moment, these error codes are defined by the SMU ++ * per-ASIC unfortunately, yet we're a one driver for all ASICs. ++ */ ++#define SMU_RESP_NONE 0 ++#define SMU_RESP_OK 1 ++#define SMU_RESP_CMD_FAIL 0xFF ++#define SMU_RESP_CMD_UNKNOWN 0xFE ++#define SMU_RESP_CMD_BAD_PREREQ 0xFD ++#define SMU_RESP_BUSY_OTHER 0xFC ++#define SMU_RESP_DEBUG_END 0xFB ++ ++/** ++ * __smu_cmn_poll_stat -- poll for a status from the SMU ++ * smu: a pointer to SMU context ++ * ++ * Returns the status of the SMU, which could be, ++ * 0, the SMU is busy with your previous command; ++ * 1, execution status: success, execution result: success; ++ * 0xFF, execution status: success, execution result: failure; ++ * 0xFE, unknown command; ++ * 0xFD, valid command, but bad (command) prerequisites; ++ * 0xFC, the command was rejected as the SMU is busy; ++ * 0xFB, "SMC_Result_DebugDataDumpEnd". ++ * ++ * The values here are not defined by macros, because I'd rather we ++ * include a single header file which defines them, which is ++ * maintained by the SMU FW team, so that we're impervious to firmware ++ * changes. At the moment those values are defined in various header ++ * files, one for each ASIC, yet here we're a single ASIC-agnostic ++ * interface. Such a change can be followed-up by a subsequent patch. ++ */ ++static u32 __smu_cmn_poll_stat(struct smu_context *smu) + { + struct amdgpu_device *adev = smu->adev; +- uint32_t cur_value, i, timeout = adev->usec_timeout * 20; ++ int timeout = adev->usec_timeout * 20; ++ u32 reg; + +- for (i = 0; i < timeout; i++) { +- cur_value = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90); +- if ((cur_value & MP1_C2PMSG_90__CONTENT_MASK) != 0) +- return cur_value; ++ for ( ; timeout > 0; timeout--) { ++ reg = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90); ++ if ((reg & MP1_C2PMSG_90__CONTENT_MASK) != 0) ++ break; + + udelay(1); + } + +- /* timeout means wrong logic */ +- if (i == timeout) +- return -ETIME; +- +- return RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90); ++ return reg; + } + +-int smu_cmn_send_msg_without_waiting(struct smu_context *smu, +- uint16_t msg, uint32_t param) ++static void __smu_cmn_reg_print_error(struct smu_context *smu, ++ u32 reg_c2pmsg_90, ++ int msg_index, ++ u32 param, ++ enum smu_message_type msg) + { + struct amdgpu_device *adev = smu->adev; +- int ret; ++ const char *message = smu_get_message_name(smu, msg); + +- ret = smu_cmn_wait_for_response(smu); +- if (ret != 0x1) { +- dev_err(adev->dev, "Msg issuing pre-check failed(0x%x) and " +- "SMU may be not in the right state!\n", ret); +- if (ret != -ETIME) +- ret = -EIO; +- return ret; ++ switch (reg_c2pmsg_90) { ++ case SMU_RESP_NONE: ++ dev_err_ratelimited(adev->dev, ++ "SMU: I'm not done with your previous command!"); ++ break; ++ case SMU_RESP_OK: ++ /* The SMU executed the command. It completed with a ++ * successful result. ++ */ ++ break; ++ case SMU_RESP_CMD_FAIL: ++ /* The SMU executed the command. It completed with an ++ * unsuccessful result. ++ */ ++ break; ++ case SMU_RESP_CMD_UNKNOWN: ++ dev_err_ratelimited(adev->dev, ++ "SMU: unknown command: index:%d param:0x%08X message:%s", ++ msg_index, param, message); ++ break; ++ case SMU_RESP_CMD_BAD_PREREQ: ++ dev_err_ratelimited(adev->dev, ++ "SMU: valid command, bad prerequisites: index:%d param:0x%08X message:%s", ++ msg_index, param, message); ++ break; ++ case SMU_RESP_BUSY_OTHER: ++ dev_err_ratelimited(adev->dev, ++ "SMU: I'm very busy for your command: index:%d param:0x%08X message:%s", ++ msg_index, param, message); ++ break; ++ case SMU_RESP_DEBUG_END: ++ dev_err_ratelimited(adev->dev, ++ "SMU: I'm debugging!"); ++ break; ++ default: ++ dev_err_ratelimited(adev->dev, ++ "SMU: response:0x%08X for index:%d param:0x%08X message:%s?", ++ reg_c2pmsg_90, msg_index, param, message); ++ break; ++ } ++} ++ ++static int __smu_cmn_reg2errno(struct smu_context *smu, u32 reg_c2pmsg_90) ++{ ++ int res; ++ ++ switch (reg_c2pmsg_90) { ++ case SMU_RESP_NONE: ++ /* The SMU is busy--still executing your command. ++ */ ++ res = -ETIME; ++ break; ++ case SMU_RESP_OK: ++ res = 0; ++ break; ++ case SMU_RESP_CMD_FAIL: ++ /* Command completed successfully, but the command ++ * status was failure. ++ */ ++ res = -EIO; ++ break; ++ case SMU_RESP_CMD_UNKNOWN: ++ /* Unknown command--ignored by the SMU. ++ */ ++ res = -EOPNOTSUPP; ++ break; ++ case SMU_RESP_CMD_BAD_PREREQ: ++ /* Valid command--bad prerequisites. ++ */ ++ res = -EINVAL; ++ break; ++ case SMU_RESP_BUSY_OTHER: ++ /* The SMU is busy with other commands. The client ++ * should retry in 10 us. ++ */ ++ res = -EBUSY; ++ break; ++ default: ++ /* Unknown or debug response from the SMU. ++ */ ++ res = -EREMOTEIO; ++ break; + } + ++ return res; ++} ++ ++static void __smu_cmn_send_msg(struct smu_context *smu, ++ u16 msg, ++ u32 param) ++{ ++ struct amdgpu_device *adev = smu->adev; ++ + WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90, 0); + WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_82, param); + WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_66, msg); ++} + +- return 0; ++/** ++ * smu_cmn_send_msg_without_waiting -- send the message; don't wait for status ++ * @smu: pointer to an SMU context ++ * @msg_index: message index ++ * @param: message parameter to send to the SMU ++ * ++ * Send a message to the SMU with the parameter passed. Do not wait ++ * for status/result of the message, thus the "without_waiting". ++ * ++ * Return 0 on success, -errno on error if we weren't able to _send_ ++ * the message for some reason. See __smu_cmn_reg2errno() for details ++ * of the -errno. ++ */ ++int smu_cmn_send_msg_without_waiting(struct smu_context *smu, ++ uint16_t msg_index, ++ uint32_t param) ++{ ++ u32 reg; ++ int res; ++ ++ if (smu->adev->no_hw_access) ++ return 0; ++ ++ mutex_lock(&smu->message_lock); ++ reg = __smu_cmn_poll_stat(smu); ++ res = __smu_cmn_reg2errno(smu, reg); ++ if (reg == SMU_RESP_NONE || ++ reg == SMU_RESP_BUSY_OTHER || ++ res == -EREMOTEIO) ++ goto Out; ++ __smu_cmn_send_msg(smu, msg_index, param); ++ res = 0; ++Out: ++ mutex_unlock(&smu->message_lock); ++ return res; + } + ++/** ++ * smu_cmn_wait_for_response -- wait for response from the SMU ++ * @smu: pointer to an SMU context ++ * ++ * Wait for status from the SMU. ++ * ++ * Return 0 on success, -errno on error, indicating the execution ++ * status and result of the message being waited for. See ++ * __smu_cmn_reg2errno() for details of the -errno. ++ */ ++int smu_cmn_wait_for_response(struct smu_context *smu) ++{ ++ u32 reg; ++ ++ reg = __smu_cmn_poll_stat(smu); ++ return __smu_cmn_reg2errno(smu, reg); ++} ++ ++/** ++ * smu_cmn_send_smc_msg_with_param -- send a message with parameter ++ * @smu: pointer to an SMU context ++ * @msg: message to send ++ * @param: parameter to send to the SMU ++ * @read_arg: pointer to u32 to return a value from the SMU back ++ * to the caller ++ * ++ * Send the message @msg with parameter @param to the SMU, wait for ++ * completion of the command, and return back a value from the SMU in ++ * @read_arg pointer. ++ * ++ * Return 0 on success, -errno on error, if we weren't able to send ++ * the message or if the message completed with some kind of ++ * error. See __smu_cmn_reg2errno() for details of the -errno. ++ * ++ * If we weren't able to send the message to the SMU, we also print ++ * the error to the standard log. ++ * ++ * Command completion status is printed only if the -errno is ++ * -EREMOTEIO, indicating that the SMU returned back an ++ * undefined/unknown/unspecified result. All other cases are ++ * well-defined, not printed, but instead given back to the client to ++ * decide what further to do. ++ * ++ * The return value, @read_arg is read back regardless, to give back ++ * more information to the client, which on error would most likely be ++ * @param, but we can't assume that. This also eliminates more ++ * conditionals. ++ */ + int smu_cmn_send_smc_msg_with_param(struct smu_context *smu, + enum smu_message_type msg, + uint32_t param, + uint32_t *read_arg) + { +- struct amdgpu_device *adev = smu->adev; +- int ret = 0, index = 0; ++ int res, index; ++ u32 reg; + + if (smu->adev->no_hw_access) + return 0; +@@ -136,31 +339,24 @@ int smu_cmn_send_smc_msg_with_param(struct smu_context *smu, + return index == -EACCES ? 0 : index; + + mutex_lock(&smu->message_lock); +- ret = smu_cmn_send_msg_without_waiting(smu, (uint16_t)index, param); +- if (ret) +- goto out; +- +- ret = smu_cmn_wait_for_response(smu); +- if (ret != 0x1) { +- if (ret == -ETIME) { +- dev_err(adev->dev, "message: %15s (%d) \tparam: 0x%08x is timeout (no response)\n", +- smu_get_message_name(smu, msg), index, param); +- } else { +- dev_err(adev->dev, "failed send message: %15s (%d) \tparam: 0x%08x response %#x\n", +- smu_get_message_name(smu, msg), index, param, +- ret); +- ret = -EIO; +- } +- goto out; ++ reg = __smu_cmn_poll_stat(smu); ++ res = __smu_cmn_reg2errno(smu, reg); ++ if (reg == SMU_RESP_NONE || ++ reg == SMU_RESP_BUSY_OTHER || ++ res == -EREMOTEIO) { ++ __smu_cmn_reg_print_error(smu, reg, index, param, msg); ++ goto Out; + } +- ++ __smu_cmn_send_msg(smu, (uint16_t) index, param); ++ reg = __smu_cmn_poll_stat(smu); ++ res = __smu_cmn_reg2errno(smu, reg); ++ if (res == -EREMOTEIO) ++ __smu_cmn_reg_print_error(smu, reg, index, param, msg); + if (read_arg) + smu_cmn_read_arg(smu, read_arg); +- +- ret = 0; /* 0 as driver return value */ +-out: ++Out: + mutex_unlock(&smu->message_lock); +- return ret; ++ return res; + } + + int smu_cmn_send_smc_msg(struct smu_context *smu, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h +index 9add5f16ff56..16993daa2ae0 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h +@@ -27,7 +27,8 @@ + + #if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4) + int smu_cmn_send_msg_without_waiting(struct smu_context *smu, +- uint16_t msg, uint32_t param); ++ uint16_t msg_index, ++ uint32_t param); + int smu_cmn_send_smc_msg_with_param(struct smu_context *smu, + enum smu_message_type msg, + uint32_t param, +-- +2.30.2 + diff --git a/queue-5.14/drm-amd-pm-fix-a-bug-in-semaphore-double-lock.patch b/queue-5.14/drm-amd-pm-fix-a-bug-in-semaphore-double-lock.patch new file mode 100644 index 00000000000..e61c6b5d7f1 --- /dev/null +++ b/queue-5.14/drm-amd-pm-fix-a-bug-in-semaphore-double-lock.patch @@ -0,0 +1,50 @@ +From a13e73238be929743c7b79e3e9123ae93b76d40f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 11:07:03 -0400 +Subject: drm/amd/pm: Fix a bug in semaphore double-lock + +From: Luben Tuikov + +[ Upstream commit 544dcd74b7093ad4befac99b11d90331aa73348e ] + +Fix a bug in smu_cmn_send_msg_without_waiting() in +that this function does not need to take the +smu->message_lock mutex in order to send a message +down to the SMU. The mutex is acquired by the +caller of this function instead. + +Cc: Alex Deucher +Cc: Changfeng Zhu +Cc: Huang Rui +Fixes: 5810323ba69289 ("drm/amd/pm: Fix a bug communicating with the SMU (v5)") +Signed-off-by: Luben Tuikov +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +index a0e2111eb783..415be74df28c 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +@@ -259,7 +259,6 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu, + if (smu->adev->no_hw_access) + return 0; + +- mutex_lock(&smu->message_lock); + reg = __smu_cmn_poll_stat(smu); + res = __smu_cmn_reg2errno(smu, reg); + if (reg == SMU_RESP_NONE || +@@ -269,7 +268,6 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu, + __smu_cmn_send_msg(smu, msg_index, param); + res = 0; + Out: +- mutex_unlock(&smu->message_lock); + return res; + } + +-- +2.30.2 + diff --git a/queue-5.14/drm-amdgpu-acp-make-pm-domain-really-work.patch b/queue-5.14/drm-amdgpu-acp-make-pm-domain-really-work.patch new file mode 100644 index 00000000000..43b72958042 --- /dev/null +++ b/queue-5.14/drm-amdgpu-acp-make-pm-domain-really-work.patch @@ -0,0 +1,195 @@ +From 8aee018fea1549cca5925672c1fbf6b17cb2cd34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 01:22:15 +0800 +Subject: drm/amdgpu/acp: Make PM domain really work + +From: Kai-Heng Feng + +[ Upstream commit aff890288de2d818e4f83ec40c9315e2d735df07 ] + +Devices created by mfd_add_hotplug_devices() don't really increase the +index of its name, so get_mfd_cell_dev() cannot find any device, hence a +NULL dev is passed to pm_genpd_add_device(): +[ 56.974926] (NULL device *): amdgpu: device acp_audio_dma.0.auto added to pm domain +[ 56.974933] (NULL device *): amdgpu: Failed to add dev to genpd +[ 56.974941] [drm:amdgpu_device_ip_init [amdgpu]] *ERROR* hw_init of IP block failed -22 +[ 56.975810] amdgpu 0000:00:01.0: amdgpu: amdgpu_device_ip_init failed +[ 56.975839] amdgpu 0000:00:01.0: amdgpu: Fatal error during GPU init +[ 56.977136] ------------[ cut here ]------------ +[ 56.977143] kernel BUG at mm/slub.c:4206! +[ 56.977158] invalid opcode: 0000 [#1] SMP NOPTI +[ 56.977167] CPU: 1 PID: 1648 Comm: modprobe Not tainted 5.12.0-051200rc8-generic #202104182230 +[ 56.977175] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./FM2A68M-HD+, BIOS P5.20 02/13/2019 +[ 56.977180] RIP: 0010:kfree+0x3bf/0x410 +[ 56.977195] Code: 89 e7 48 d3 e2 f7 da e8 5f 0d 02 00 80 e7 02 75 3e 44 89 ee 4c 89 e7 e8 ef 5f fd ff e9 fa fe ff ff 49 8b 44 24 08 a8 01 75 b7 <0f> 0b 4c 8b 4d b0 48 8b 4d a8 48 89 da 4c 89 e6 41 b8 01 00 00 00 +[ 56.977202] RSP: 0018:ffffa48640ff79f0 EFLAGS: 00010246 +[ 56.977210] RAX: 0000000000000000 RBX: ffff9286127d5608 RCX: 0000000000000000 +[ 56.977215] RDX: 0000000000000000 RSI: ffffffffc099d0fb RDI: ffff9286127d5608 +[ 56.977220] RBP: ffffa48640ff7a48 R08: 0000000000000001 R09: 0000000000000001 +[ 56.977224] R10: 0000000000000000 R11: ffff9286087d8458 R12: fffff3ae0449f540 +[ 56.977229] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100 +[ 56.977234] FS: 00007f9de5929540(0000) GS:ffff928612e80000(0000) knlGS:0000000000000000 +[ 56.977240] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 56.977245] CR2: 00007f697dd97160 CR3: 00000001110f0000 CR4: 00000000001506e0 +[ 56.977251] Call Trace: +[ 56.977261] amdgpu_dm_encoder_destroy+0x1b/0x30 [amdgpu] +[ 56.978056] drm_mode_config_cleanup+0x4f/0x2e0 [drm] +[ 56.978147] ? kfree+0x3dd/0x410 +[ 56.978157] ? drm_managed_release+0xc8/0x100 [drm] +[ 56.978232] drm_mode_config_init_release+0xe/0x10 [drm] +[ 56.978311] drm_managed_release+0x9d/0x100 [drm] +[ 56.978388] devm_drm_dev_init_release+0x4d/0x70 [drm] +[ 56.978450] devm_action_release+0x15/0x20 +[ 56.978459] release_nodes+0x77/0xc0 +[ 56.978469] devres_release_all+0x3f/0x50 +[ 56.978477] really_probe+0x245/0x460 +[ 56.978485] driver_probe_device+0xe9/0x160 +[ 56.978492] device_driver_attach+0xab/0xb0 +[ 56.978499] __driver_attach+0x8f/0x150 +[ 56.978506] ? device_driver_attach+0xb0/0xb0 +[ 56.978513] bus_for_each_dev+0x7e/0xc0 +[ 56.978521] driver_attach+0x1e/0x20 +[ 56.978528] bus_add_driver+0x135/0x1f0 +[ 56.978534] driver_register+0x91/0xf0 +[ 56.978540] __pci_register_driver+0x54/0x60 +[ 56.978549] amdgpu_init+0x77/0x1000 [amdgpu] +[ 56.979246] ? 0xffffffffc0dbc000 +[ 56.979254] do_one_initcall+0x48/0x1d0 +[ 56.979265] ? kmem_cache_alloc_trace+0x120/0x230 +[ 56.979274] ? do_init_module+0x28/0x280 +[ 56.979282] do_init_module+0x62/0x280 +[ 56.979288] load_module+0x71c/0x7a0 +[ 56.979296] __do_sys_finit_module+0xc2/0x120 +[ 56.979305] __x64_sys_finit_module+0x1a/0x20 +[ 56.979311] do_syscall_64+0x38/0x90 +[ 56.979319] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 56.979328] RIP: 0033:0x7f9de54f989d +[ 56.979335] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48 +[ 56.979342] RSP: 002b:00007ffe3c395a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 56.979350] RAX: ffffffffffffffda RBX: 0000560df3ef4330 RCX: 00007f9de54f989d +[ 56.979355] RDX: 0000000000000000 RSI: 0000560df3a07358 RDI: 000000000000000f +[ 56.979360] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 +[ 56.979365] R10: 000000000000000f R11: 0000000000000246 R12: 0000560df3a07358 +[ 56.979369] R13: 0000000000000000 R14: 0000560df3ef4460 R15: 0000560df3ef4330 +[ 56.979377] Modules linked in: amdgpu(+) iommu_v2 gpu_sched drm_ttm_helper ttm drm_kms_helper cec rc_core i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt nft_counter xt_tcpudp ipt_REJECT nf_reject_ipv4 xt_conntrack iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables libcrc32c nfnetlink ip6_tables iptable_filter bpfilter input_leds binfmt_misc edac_mce_amd kvm_amd ccp kvm snd_hda_codec_realtek snd_hda_codec_generic crct10dif_pclmul snd_hda_codec_hdmi ledtrig_audio ghash_clmulni_intel aesni_intel snd_hda_intel snd_intel_dspcfg snd_seq_midi crypto_simd snd_intel_sdw_acpi cryptd snd_hda_codec snd_seq_midi_event snd_rawmidi snd_hda_core snd_hwdep snd_seq fam15h_power k10temp snd_pcm snd_seq_device snd_timer snd mac_hid soundcore sch_fq_codel nct6775 hwmon_vid drm ip_tables x_tables autofs4 dm_mirror dm_region_hash dm_log hid_generic usbhid hid uas usb_storage r8169 crc32_pclmul realtek ahci xhci_pci i2c_piix4 +[ 56.979521] xhci_pci_renesas libahci video +[ 56.979541] ---[ end trace cb8f6a346f18da7b ]--- + +Instead of finding MFD hotplugged device by its name, simply iterate +over the child devices to avoid the issue. + +Squash in unused variable removal (Alex) + +BugLink: https://bugs.launchpad.net/bugs/1920674 +Fixes: 25030321ba28 ("drm/amd: add pm domain for ACP IP sub blocks") +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 ++++++++++++------------- + 1 file changed, 26 insertions(+), 28 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +index b8655ff73a65..cc9c9f8b23b2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +@@ -160,17 +160,28 @@ static int acp_poweron(struct generic_pm_domain *genpd) + return 0; + } + +-static struct device *get_mfd_cell_dev(const char *device_name, int r) ++static int acp_genpd_add_device(struct device *dev, void *data) + { +- char auto_dev_name[25]; +- struct device *dev; ++ struct generic_pm_domain *gpd = data; ++ int ret; + +- snprintf(auto_dev_name, sizeof(auto_dev_name), +- "%s.%d.auto", device_name, r); +- dev = bus_find_device_by_name(&platform_bus_type, NULL, auto_dev_name); +- dev_info(dev, "device %s added to pm domain\n", auto_dev_name); ++ ret = pm_genpd_add_device(gpd, dev); ++ if (ret) ++ dev_err(dev, "Failed to add dev to genpd %d\n", ret); + +- return dev; ++ return ret; ++} ++ ++static int acp_genpd_remove_device(struct device *dev, void *data) ++{ ++ int ret; ++ ++ ret = pm_genpd_remove_device(dev); ++ if (ret) ++ dev_err(dev, "Failed to remove dev from genpd %d\n", ret); ++ ++ /* Continue to remove */ ++ return 0; + } + + /** +@@ -181,11 +192,10 @@ static struct device *get_mfd_cell_dev(const char *device_name, int r) + */ + static int acp_hw_init(void *handle) + { +- int r, i; ++ int r; + uint64_t acp_base; + u32 val = 0; + u32 count = 0; +- struct device *dev; + struct i2s_platform_data *i2s_pdata = NULL; + + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +@@ -341,15 +351,10 @@ static int acp_hw_init(void *handle) + if (r) + goto failure; + +- for (i = 0; i < ACP_DEVS ; i++) { +- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i); +- r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev); +- if (r) { +- dev_err(dev, "Failed to add dev to genpd\n"); +- goto failure; +- } +- } +- ++ r = device_for_each_child(adev->acp.parent, &adev->acp.acp_genpd->gpd, ++ acp_genpd_add_device); ++ if (r) ++ goto failure; + + /* Assert Soft reset of ACP */ + val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET); +@@ -410,10 +415,8 @@ failure: + */ + static int acp_hw_fini(void *handle) + { +- int i, ret; + u32 val = 0; + u32 count = 0; +- struct device *dev; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + + /* return early if no ACP */ +@@ -458,13 +461,8 @@ static int acp_hw_fini(void *handle) + udelay(100); + } + +- for (i = 0; i < ACP_DEVS ; i++) { +- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i); +- ret = pm_genpd_remove_device(dev); +- /* If removal fails, dont giveup and try rest */ +- if (ret) +- dev_err(dev, "remove dev from genpd failed\n"); +- } ++ device_for_each_child(adev->acp.parent, NULL, ++ acp_genpd_remove_device); + + mfd_remove_devices(adev->acp.parent); + kfree(adev->acp.acp_res); +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-it66121-check-drm_bridge_attach-retval.patch b/queue-5.14/drm-bridge-it66121-check-drm_bridge_attach-retval.patch new file mode 100644 index 00000000000..a01de8c470d --- /dev/null +++ b/queue-5.14/drm-bridge-it66121-check-drm_bridge_attach-retval.patch @@ -0,0 +1,38 @@ +From c84907b573edb88e7a9769f74bde776eb4d41117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 20:50:39 +0200 +Subject: drm: bridge: it66121: Check drm_bridge_attach retval + +From: Robert Foss + +[ Upstream commit bd03d440e2589b9c328f40ce60203adf2b19d2e2 ] + +The return value of drm_bridge_attach() is ignored during +the it66121_bridge_attach() call, which is incorrect. + +Fixes: 988156dc2fc9 ("drm: bridge: add it66121 driver") +Signed-off-by: Robert Foss +Acked-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20210805185039.402178-1-robert.foss@linaro.org +Link: https://patchwork.freedesktop.org/patch/msgid/20210805185039.402178-1-robert.foss@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it66121.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c +index 7149ed40af83..2f2a09adb4bc 100644 +--- a/drivers/gpu/drm/bridge/ite-it66121.c ++++ b/drivers/gpu/drm/bridge/ite-it66121.c +@@ -536,6 +536,8 @@ static int it66121_bridge_attach(struct drm_bridge *bridge, + return -EINVAL; + + ret = drm_bridge_attach(bridge->encoder, ctx->next_bridge, bridge, flags); ++ if (ret) ++ return ret; + + ret = regmap_write_bits(ctx->regmap, IT66121_CLK_BANK_REG, + IT66121_CLK_BANK_PWROFF_RCLK, 0); +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-add-some-100-us-delays.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-add-some-100-us-delays.patch new file mode 100644 index 00000000000..6daae739092 --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-add-some-100-us-delays.patch @@ -0,0 +1,53 @@ +From 4230a0fce84545a6e08a1348d584eae6f1ca7476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 08:46:02 -0700 +Subject: drm/bridge: ti-sn65dsi86: Add some 100 us delays + +From: Douglas Anderson + +[ Upstream commit e183bf31cf0d3a05162e633e428350ed176ce926 ] + +The manual has always said that we need 100 us delays in a few +places. Though it hasn't seemed to be a big deal to skip these, let's +add them in case it makes something happier. + +NOTE: this fixes no known issues but it seems good to make it right. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Douglas Anderson +Acked-by: Robert Foss +Reviewed-by: Sean Paul +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210730084534.v2.3.I842d483139531aa4651da8338512fdf0171ff23c@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index ecd4fa3a9a1d..c9cddf317c72 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -304,6 +304,9 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev) + return ret; + } + ++ /* td2: min 100 us after regulators before enabling the GPIO */ ++ usleep_range(100, 110); ++ + gpiod_set_value(pdata->enable_gpio, 1); + + /* +@@ -886,6 +889,9 @@ static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge) + + if (!pdata->refclk) + ti_sn65dsi86_enable_comms(pdata); ++ ++ /* td7: min 100 us after enable before DSI data */ ++ usleep_range(100, 110); + } + + static void ti_sn_bridge_post_disable(struct drm_bridge *bridge) +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-avoid-creating-multiple-conn.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-avoid-creating-multiple-conn.patch new file mode 100644 index 00000000000..be1678833b7 --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-avoid-creating-multiple-conn.patch @@ -0,0 +1,45 @@ +From 8017943ec390b61b5dca817252a59aa51296aeac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 16:52:47 -0700 +Subject: drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors + +From: Rob Clark + +[ Upstream commit c7782443a88926a4f938f0193041616328cf2db2 ] + +If we created our own connector because the driver does not support the +NO_CONNECTOR flag, we don't want the downstream bridge to *also* create +a connector. And if this driver did pass the NO_CONNECTOR flag (and we +supported that mode) this would change nothing. + +Fixes: 4e5763f03e10 ("drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge") +Reported-by: Stephen Boyd +Signed-off-by: Rob Clark +Tested-by: Stephen Boyd +Reviewed-by: Laurent Pinchart +Reviewed-by: Douglas Anderson +Tested-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20210811235253.924867-2-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index c9cddf317c72..3aeed2731945 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -531,6 +531,9 @@ static int ti_sn_bridge_attach(struct drm_bridge *bridge, + } + pdata->dsi = dsi; + ++ /* We never want the next bridge to *also* create a connector: */ ++ flags |= DRM_BRIDGE_ATTACH_NO_CONNECTOR; ++ + /* Attach the next bridge */ + ret = drm_bridge_attach(bridge->encoder, pdata->next_bridge, + &pdata->bridge, flags); +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-don-t-read-edid-blob-over-dd.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-don-t-read-edid-blob-over-dd.patch new file mode 100644 index 00000000000..3cfd9748854 --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-don-t-read-edid-blob-over-dd.patch @@ -0,0 +1,115 @@ +From c2b53f68f51e671442e2d75e0afbc8e49364f3b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 10:17:45 -0700 +Subject: drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC + +From: Douglas Anderson + +[ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ] + +This is really just a revert of commit 58074b08c04a ("drm/bridge: +ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts. + +The old code failed to read the EDID properly in a very important +case: before the bridge's pre_enable() was called. The way things need +to work: +1. Read the EDID. +2. Based on the EDID, decide on video settings and pixel clock. +3. Enable the bridge w/ the desired settings. + +The way things were working: +1. Try to read the EDID but fail; fall back to hardcoded values. +2. Based on hardcoded values, decide on video settings and pixel clock. +3. Enable the bridge w/ the desired settings. +4. Try again to read the EDID, it works now! +5. Realize that the hardcoded settings weren't quite right. +6. Disable / reenable the bridge w/ the right settings. + +The reasons for the failures were twofold: +a) Since we never ran the bridge chip's pre-enable then we never set + the bit to ignore HPD. This meant the bridge chip didn't even _try_ + to go out on the bus and communicate with the panel. +b) Even if we fixed things to ignore HPD, the EDID still wouldn't read + if the panel wasn't on. + +Instead of reverting the code, we could fix it to set the HPD bit and +also power on the panel. However, it also works nicely to just let the +panel code read the EDID. Now that we've split the driver up we can +expose the DDC AUX channel bus to the panel node. The panel can take +charge of reading the EDID. + +NOTE: in order for things to work, anyone that needs to read the EDID +will need to instantiate their panel using the new DP AUX bus (AKA by +listing their panel under the "aux-bus" node of the bridge chip in the +device tree). + +In the future if we want to use the bridge chip to provide a full +external DP port (which won't have a panel) then we will have to +conditinally add EDID reading back in. + +Suggested-by: Andrzej Hajda +Signed-off-by: Douglas Anderson +Reviewed-by: Bjorn Andersson +Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ---------------------- + 1 file changed, 22 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 45a2969afb2b..aef850296756 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -124,7 +124,6 @@ + * @connector: Our connector. + * @host_node: Remote DSI node. + * @dsi: Our MIPI DSI source. +- * @edid: Detected EDID of eDP panel. + * @refclk: Our reference clock. + * @panel: Our panel. + * @enable_gpio: The GPIO we toggle to enable the bridge. +@@ -154,7 +153,6 @@ struct ti_sn65dsi86 { + struct drm_dp_aux aux; + struct drm_bridge bridge; + struct drm_connector connector; +- struct edid *edid; + struct device_node *host_node; + struct mipi_dsi_device *dsi; + struct clk *refclk; +@@ -403,24 +401,6 @@ connector_to_ti_sn65dsi86(struct drm_connector *connector) + static int ti_sn_bridge_connector_get_modes(struct drm_connector *connector) + { + struct ti_sn65dsi86 *pdata = connector_to_ti_sn65dsi86(connector); +- struct edid *edid = pdata->edid; +- int num, ret; +- +- if (!edid) { +- pm_runtime_get_sync(pdata->dev); +- edid = pdata->edid = drm_get_edid(connector, &pdata->aux.ddc); +- pm_runtime_put_autosuspend(pdata->dev); +- } +- +- if (edid && drm_edid_is_valid(edid)) { +- ret = drm_connector_update_edid_property(connector, edid); +- if (!ret) { +- num = drm_add_edid_modes(connector, edid); +- if (num) +- return num; +- } +- } +- + return drm_panel_get_modes(pdata->panel, connector); + } + +@@ -1358,8 +1338,6 @@ static void ti_sn_bridge_remove(struct auxiliary_device *adev) + mipi_dsi_device_unregister(pdata->dsi); + } + +- kfree(pdata->edid); +- + drm_bridge_remove(&pdata->bridge); + + of_node_put(pdata->host_node); +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-fix-power-off-sequence.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-fix-power-off-sequence.patch new file mode 100644 index 00000000000..ad211ce93c8 --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-fix-power-off-sequence.patch @@ -0,0 +1,81 @@ +From b462a15bc3fc90a1e05d0f30da78353d1dc81b66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 08:46:01 -0700 +Subject: drm/bridge: ti-sn65dsi86: Fix power off sequence + +From: Douglas Anderson + +[ Upstream commit acb06210b096830e28e9ffd2c6501fe99bdb10fd ] + +When testing with a panel that's apparently a little more persnickety +about the correct power sequence (specifically Samsung ATNA33XC20), we +found that the ti-sn65dsi86 was doing things just slightly wrong. + +Looking closely at the ti-sn65dsi86's datasheet, the power off +sequence is supposed to be: +1. Clear VSTREAM_ENABLE bit +2. Stop DSI stream from GPU. DSI lanes must be placed in LP11 state. +3. Program the ML_TX_MODE to 0x0 (OFF) +4. Program the DP_NUM_LANES register to 0x0 +5. Clear the DP_PLL_EN bit. +6. Deassert the EN pin. +7. Remove power from supply pins + +Since we were doing the whole sequence in the "disable", I believe +that step #2 (stopping the DSI stream from the GPU) wasn't +happening. We also weren't setting DP_NUM_LANES to 0. + +Let's fix this. + +NOTE: things are a little asymmetric now. For instance, we turn the +PLL on in "enable" but now we're not turning it off until +"post_disable". It would seem to make sense to move the PLL turning on +to "pre_enable" to match. Unfortunately, I don't believe that's +allowed. It looks as if (in the non-refclk mode which probably nobody +is using) we have to wait until the MIPI clock is there before we can +enable the PLL. In any case, the way it is here won't really +hurt--it'll just leave the PLL on a little longer. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Signed-off-by: Douglas Anderson +Acked-by: Robert Foss +Reviewed-by: Sean Paul +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210730084534.v2.2.If8a8ec3bf1855cf0dbb62c005a71d6698c99c125@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 970a4859eea3..ecd4fa3a9a1d 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -558,10 +558,6 @@ static void ti_sn_bridge_disable(struct drm_bridge *bridge) + + /* disable video stream */ + regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE, 0); +- /* semi auto link training mode OFF */ +- regmap_write(pdata->regmap, SN_ML_TX_MODE_REG, 0); +- /* disable DP PLL */ +- regmap_write(pdata->regmap, SN_PLL_ENABLE_REG, 0); + } + + static void ti_sn_bridge_set_dsi_rate(struct ti_sn65dsi86 *pdata) +@@ -896,6 +892,13 @@ static void ti_sn_bridge_post_disable(struct drm_bridge *bridge) + { + struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); + ++ /* semi auto link training mode OFF */ ++ regmap_write(pdata->regmap, SN_ML_TX_MODE_REG, 0); ++ /* Num lanes to 0 as per power sequencing in data sheet */ ++ regmap_update_bits(pdata->regmap, SN_SSC_CONFIG_REG, DP_NUM_LANES_MASK, 0); ++ /* disable DP PLL */ ++ regmap_write(pdata->regmap, SN_PLL_ENABLE_REG, 0); ++ + if (!pdata->refclk) + ti_sn65dsi86_disable_comms(pdata); + +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-improve-probe-errors-with-de.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-improve-probe-errors-with-de.patch new file mode 100644 index 00000000000..ef12f7481ee --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-improve-probe-errors-with-de.patch @@ -0,0 +1,85 @@ +From 98c53541766506c492cd97408ed6f2b1f7b1744a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 10:17:46 -0700 +Subject: drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe() + +From: Douglas Anderson + +[ Upstream commit 4c1b3d94bf632c1420a5d4108199f55a5655831d ] + +As I was testing to make sure that the DEFER path worked well with my +patch series, I got tired of seeing this scary message in my logs just +because the panel needed to defer: + [drm:ti_sn_bridge_probe] *ERROR* could not find any panel node + +Let's use dev_err_probe() which nicely quiets this error and also +simplifies the code a tiny bit. We'll also update other places in the +file which can use dev_err_probe(). + +Signed-off-by: Douglas Anderson +Reviewed-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.10.I24bba069e63b1eea84443eef0c8535fd032a6311@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 31 +++++++++++---------------- + 1 file changed, 13 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index aef850296756..4d1483cf7b58 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -1302,10 +1302,9 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev, + int ret; + + ret = drm_of_find_panel_or_bridge(np, 1, 0, &pdata->panel, NULL); +- if (ret) { +- DRM_ERROR("could not find any panel node\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(&adev->dev, ret, ++ "could not find any panel node\n"); + + ti_sn_bridge_parse_lanes(pdata, np); + +@@ -1432,27 +1431,23 @@ static int ti_sn65dsi86_probe(struct i2c_client *client, + + pdata->regmap = devm_regmap_init_i2c(client, + &ti_sn65dsi86_regmap_config); +- if (IS_ERR(pdata->regmap)) { +- DRM_ERROR("regmap i2c init failed\n"); +- return PTR_ERR(pdata->regmap); +- } ++ if (IS_ERR(pdata->regmap)) ++ return dev_err_probe(dev, PTR_ERR(pdata->regmap), ++ "regmap i2c init failed\n"); + + pdata->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW); +- if (IS_ERR(pdata->enable_gpio)) { +- DRM_ERROR("failed to get enable gpio from DT\n"); +- ret = PTR_ERR(pdata->enable_gpio); +- return ret; +- } ++ if (IS_ERR(pdata->enable_gpio)) ++ return dev_err_probe(dev, PTR_ERR(pdata->enable_gpio), ++ "failed to get enable gpio from DT\n"); + + ret = ti_sn65dsi86_parse_regulators(pdata); +- if (ret) { +- DRM_ERROR("failed to parse regulators\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "failed to parse regulators\n"); + + pdata->refclk = devm_clk_get_optional(dev, "refclk"); + if (IS_ERR(pdata->refclk)) +- return PTR_ERR(pdata->refclk); ++ return dev_err_probe(dev, PTR_ERR(pdata->refclk), ++ "failed to get reference clock\n"); + + pm_runtime_enable(dev); + ret = devm_add_action_or_reset(dev, ti_sn65dsi86_runtime_disable, dev); +-- +2.30.2 + diff --git a/queue-5.14/drm-bridge-ti-sn65dsi86-wrap-panel-with-panel-bridge.patch b/queue-5.14/drm-bridge-ti-sn65dsi86-wrap-panel-with-panel-bridge.patch new file mode 100644 index 00000000000..25faf734ceb --- /dev/null +++ b/queue-5.14/drm-bridge-ti-sn65dsi86-wrap-panel-with-panel-bridge.patch @@ -0,0 +1,134 @@ +From 0b42df64275a74e911144b697763fe60729970a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 03:03:02 +0300 +Subject: drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge + +From: Laurent Pinchart + +[ Upstream commit 4e5763f03e105fedfcd7a83bec1dccae96e334dd ] + +To simplify interfacing with the panel, wrap it in a panel-bridge and +let the DRM bridge helpers handle chaining of operations. + +This also prepares for support of DRM_BRIDGE_ATTACH_NO_CONNECTOR, which +requires all components in the display pipeline to be represented by +bridges. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Jagan Teki +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20210624000304.16281-5-laurent.pinchart+renesas@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 32 +++++++++++++++++---------- + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index 4d1483cf7b58..970a4859eea3 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -125,7 +125,7 @@ + * @host_node: Remote DSI node. + * @dsi: Our MIPI DSI source. + * @refclk: Our reference clock. +- * @panel: Our panel. ++ * @next_bridge: The bridge on the eDP side. + * @enable_gpio: The GPIO we toggle to enable the bridge. + * @supplies: Data for bulk enabling/disabling our regulators. + * @dp_lanes: Count of dp_lanes we're using. +@@ -156,7 +156,7 @@ struct ti_sn65dsi86 { + struct device_node *host_node; + struct mipi_dsi_device *dsi; + struct clk *refclk; +- struct drm_panel *panel; ++ struct drm_bridge *next_bridge; + struct gpio_desc *enable_gpio; + struct regulator_bulk_data supplies[SN_REGULATOR_SUPPLY_NUM]; + int dp_lanes; +@@ -401,7 +401,8 @@ connector_to_ti_sn65dsi86(struct drm_connector *connector) + static int ti_sn_bridge_connector_get_modes(struct drm_connector *connector) + { + struct ti_sn65dsi86 *pdata = connector_to_ti_sn65dsi86(connector); +- return drm_panel_get_modes(pdata->panel, connector); ++ ++ return drm_bridge_get_modes(pdata->next_bridge, connector); + } + + static enum drm_mode_status +@@ -527,8 +528,16 @@ static int ti_sn_bridge_attach(struct drm_bridge *bridge, + } + pdata->dsi = dsi; + ++ /* Attach the next bridge */ ++ ret = drm_bridge_attach(bridge->encoder, pdata->next_bridge, ++ &pdata->bridge, flags); ++ if (ret < 0) ++ goto err_dsi_detach; ++ + return 0; + ++err_dsi_detach: ++ mipi_dsi_detach(dsi); + err_dsi_attach: + mipi_dsi_device_unregister(dsi); + err_dsi_host: +@@ -547,8 +556,6 @@ static void ti_sn_bridge_disable(struct drm_bridge *bridge) + { + struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); + +- drm_panel_disable(pdata->panel); +- + /* disable video stream */ + regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE, 0); + /* semi auto link training mode OFF */ +@@ -873,8 +880,6 @@ static void ti_sn_bridge_enable(struct drm_bridge *bridge) + /* enable video stream */ + regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE, + VSTREAM_ENABLE); +- +- drm_panel_enable(pdata->panel); + } + + static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge) +@@ -885,16 +890,12 @@ static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge) + + if (!pdata->refclk) + ti_sn65dsi86_enable_comms(pdata); +- +- drm_panel_prepare(pdata->panel); + } + + static void ti_sn_bridge_post_disable(struct drm_bridge *bridge) + { + struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge); + +- drm_panel_unprepare(pdata->panel); +- + if (!pdata->refclk) + ti_sn65dsi86_disable_comms(pdata); + +@@ -1299,13 +1300,20 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev, + { + struct ti_sn65dsi86 *pdata = dev_get_drvdata(adev->dev.parent); + struct device_node *np = pdata->dev->of_node; ++ struct drm_panel *panel; + int ret; + +- ret = drm_of_find_panel_or_bridge(np, 1, 0, &pdata->panel, NULL); ++ ret = drm_of_find_panel_or_bridge(np, 1, 0, &panel, NULL); + if (ret) + return dev_err_probe(&adev->dev, ret, + "could not find any panel node\n"); + ++ pdata->next_bridge = devm_drm_panel_bridge_add(pdata->dev, panel); ++ if (IS_ERR(pdata->next_bridge)) { ++ DRM_ERROR("failed to create panel bridge\n"); ++ return PTR_ERR(pdata->next_bridge); ++ } ++ + ti_sn_bridge_parse_lanes(pdata, np); + + ret = ti_sn_bridge_parse_dsi_host(pdata); +-- +2.30.2 + diff --git a/queue-5.14/drm-exynos-g2d-fix-missing-unlock-on-error-in-g2d_ru.patch b/queue-5.14/drm-exynos-g2d-fix-missing-unlock-on-error-in-g2d_ru.patch new file mode 100644 index 00000000000..80f89a7d298 --- /dev/null +++ b/queue-5.14/drm-exynos-g2d-fix-missing-unlock-on-error-in-g2d_ru.patch @@ -0,0 +1,44 @@ +From d5eae837d3381413f700396bcd8628e1667ff40b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 17:21:53 +0000 +Subject: drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker() + +From: Wei Yongjun + +[ Upstream commit b74a29fac6de62f39b594e8f545b3a26db7edb5e ] + +Add the missing unlock before return from function g2d_runqueue_worker() +in the error handling case. + +Fixes: 445d3bed75de ("drm/exynos: use pm_runtime_resume_and_get()") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_g2d.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +index cab4d2c370a7..0ed665501ac4 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +@@ -897,13 +897,14 @@ static void g2d_runqueue_worker(struct work_struct *work) + ret = pm_runtime_resume_and_get(g2d->dev); + if (ret < 0) { + dev_err(g2d->dev, "failed to enable G2D device.\n"); +- return; ++ goto out; + } + + g2d_dma_start(g2d, g2d->runqueue_node); + } + } + ++out: + mutex_unlock(&g2d->runqueue_mutex); + } + +-- +2.30.2 + diff --git a/queue-5.14/drm-gma500-fix-end-of-loop-tests-for-list_for_each_e.patch b/queue-5.14/drm-gma500-fix-end-of-loop-tests-for-list_for_each_e.patch new file mode 100644 index 00000000000..8bba4d17de6 --- /dev/null +++ b/queue-5.14/drm-gma500-fix-end-of-loop-tests-for-list_for_each_e.patch @@ -0,0 +1,40 @@ +From 36440023043804935272251da7e49a3d78e6efaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jul 2021 13:09:59 +0530 +Subject: drm/gma500: Fix end of loop tests for list_for_each_entry + +From: Harshvardhan Jha + +[ Upstream commit ea9a897b8affa0f7b4c90182b785dded74e434aa ] + +The list_for_each_entry() iterator, "connector" in this code, can never be +NULL. If we exit the loop without finding the correct connector then +"connector" points invalid memory that is an offset from the list head. +This will eventually lead to memory corruption and presumably a kernel +crash. + +Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling") +Signed-off-by: Harshvardhan Jha +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210709073959.11443-1-harshvardhan.jha@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c +index 432bdcc57ac9..a1332878857b 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder, + continue; + } + +- if (!connector) { ++ if (list_entry_is_head(connector, &mode_config->connector_list, head)) { + DRM_ERROR("Couldn't find connector when setting mode"); + gma_power_end(dev); + return; +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-dp-replug-event-is-converted-into-an-unplug-.patch b/queue-5.14/drm-msm-dp-replug-event-is-converted-into-an-unplug-.patch new file mode 100644 index 00000000000..68faae112e0 --- /dev/null +++ b/queue-5.14/drm-msm-dp-replug-event-is-converted-into-an-unplug-.patch @@ -0,0 +1,81 @@ +From 905baafca9a842159400ed8f652728a48788a797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 13:44:53 -0700 +Subject: drm/msm/dp: replug event is converted into an unplug followed by an + plug events + +From: Kuogee Hsieh + +[ Upstream commit 7e10bf427850f2d7133fd091999abd5fc1755cdb ] + +Remove special handling of replug interrupt and instead treat replug event +as a sequential unplug followed by a plugin event. This is needed to meet +the requirements of DP Link Layer CTS test case 4.2.1.3. + +Changes in V2: +-- add fixes statement + +Changes in V3: +-- delete EV_HPD_REPLUG_INT + +Fixes: f21c8a276c2d ("drm/msm/dp: handle irq_hpd with sink_count = 0 correctly") + +Signed-off-by: Kuogee Hsieh +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1628196295-7382-5-git-send-email-khsieh@codeaurora.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_display.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 8aca93309c1c..997fd67f7379 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -55,7 +55,6 @@ enum { + EV_HPD_INIT_SETUP, + EV_HPD_PLUG_INT, + EV_IRQ_HPD_INT, +- EV_HPD_REPLUG_INT, + EV_HPD_UNPLUG_INT, + EV_USER_NOTIFICATION, + EV_CONNECT_PENDING_TIMEOUT, +@@ -1119,9 +1118,6 @@ static int hpd_event_thread(void *data) + case EV_IRQ_HPD_INT: + dp_irq_hpd_handle(dp_priv, todo->data); + break; +- case EV_HPD_REPLUG_INT: +- /* do nothing */ +- break; + case EV_USER_NOTIFICATION: + dp_display_send_hpd_notification(dp_priv, + todo->data); +@@ -1165,10 +1161,8 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id) + + if (hpd_isr_status & 0x0F) { + /* hpd related interrupts */ +- if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK || +- hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) { ++ if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK) + dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0); +- } + + if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) { + /* stop sentinel connect pending checking */ +@@ -1176,8 +1170,10 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id) + dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0); + } + +- if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) +- dp_add_event(dp, EV_HPD_REPLUG_INT, 0, 0); ++ if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) { ++ dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0); ++ dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3); ++ } + + if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK) + dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0); +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-dp-update-is_connected-status-base-on-sink-c.patch b/queue-5.14/drm-msm-dp-update-is_connected-status-base-on-sink-c.patch new file mode 100644 index 00000000000..25e4b9803a8 --- /dev/null +++ b/queue-5.14/drm-msm-dp-update-is_connected-status-base-on-sink-c.patch @@ -0,0 +1,81 @@ +From 3e082f3acb30ece24021d5d17beba7f91ac2498e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 08:51:01 -0700 +Subject: drm/msm/dp: update is_connected status base on sink count at + dp_pm_resume() + +From: Kuogee Hsieh + +[ Upstream commit e8a767e04dbc7b201cb17ab99dca723a3488b6d4 ] + +Currently at dp_pm_resume() is_connected state is decided base on hpd connection +status only. This will put is_connected in wrongly "true" state at the scenario +that dongle attached to DUT but without hmdi cable connecting to it. Fix this +problem by adding read sink count from dongle and decided is_connected state base +on both sink count and hpd connection status. + +Changes in v2: +-- remove dp_get_sink_count() cand call drm_dp_read_sink_count() + +Changes in v3: +-- delete status local variable from dp_pm_resume() + +Changes in v4: +-- delete un necessary comment at dp_pm_resume() + +Fixes: d9aa6571b28ba ("drm/msm/dp: check sink_count before update is_connected status") +Signed-off-by: Kuogee Hsieh +Link: https://lore.kernel.org/r/1628092261-32346-1-git-send-email-khsieh@codeaurora.org +Tested-by: Stephen Boyd +Reviewed-by: Stephen Boyd +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_display.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 867388a399ad..8aca93309c1c 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1286,7 +1286,7 @@ static int dp_pm_resume(struct device *dev) + struct platform_device *pdev = to_platform_device(dev); + struct msm_dp *dp_display = platform_get_drvdata(pdev); + struct dp_display_private *dp; +- u32 status; ++ int sink_count = 0; + + dp = container_of(dp_display, struct dp_display_private, dp_display); + +@@ -1300,14 +1300,25 @@ static int dp_pm_resume(struct device *dev) + + dp_catalog_ctrl_hpd_config(dp->catalog); + +- status = dp_catalog_link_is_connected(dp->catalog); ++ /* ++ * set sink to normal operation mode -- D0 ++ * before dpcd read ++ */ ++ dp_link_psm_config(dp->link, &dp->panel->link_info, false); ++ ++ if (dp_catalog_link_is_connected(dp->catalog)) { ++ sink_count = drm_dp_read_sink_count(dp->aux); ++ if (sink_count < 0) ++ sink_count = 0; ++ } + ++ dp->link->sink_count = sink_count; + /* + * can not declared display is connected unless + * HDMI cable is plugged in and sink_count of + * dongle become 1 + */ +- if (status && dp->link->sink_count) ++ if (dp->link->sink_count) + dp->dp_display.is_connected = true; + else + dp->dp_display.is_connected = false; +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-dpu-make-dpu_hw_ctl_clear_all_blendstages-cl.patch b/queue-5.14/drm-msm-dpu-make-dpu_hw_ctl_clear_all_blendstages-cl.patch new file mode 100644 index 00000000000..a03e077f5a2 --- /dev/null +++ b/queue-5.14/drm-msm-dpu-make-dpu_hw_ctl_clear_all_blendstages-cl.patch @@ -0,0 +1,48 @@ +From 8e957c183519cc9778347067d4698e1cb6ad27df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 02:05:19 +0300 +Subject: drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary + LMs + +From: Dmitry Baryshkov + +[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ] + +dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs +instead of mixers actually used for the CTL. Change it to clear +necessary data, using provided mixer ids. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20210704230519.4081467-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +index f8a74f6cdc4c..64740ddb983e 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +@@ -345,10 +345,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx) + int i; + + for (i = 0; i < ctx->mixer_count; i++) { +- DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0); +- DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0); +- DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0); +- DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0); ++ enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id; ++ ++ DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0); ++ DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0); ++ DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0); ++ DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0); + } + + DPU_REG_WRITE(c, CTL_FETCH_PIPE_ACTIVE, 0); +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-dsi-fix-some-reference-counted-resource-leak.patch b/queue-5.14/drm-msm-dsi-fix-some-reference-counted-resource-leak.patch new file mode 100644 index 00000000000..a4268968b82 --- /dev/null +++ b/queue-5.14/drm-msm-dsi-fix-some-reference-counted-resource-leak.patch @@ -0,0 +1,62 @@ +From 3531566a7c8f94d6e7d1ed8b21094c2bc67f1b43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 11:15:13 +0200 +Subject: drm/msm/dsi: Fix some reference counted resource leaks + +From: Christophe JAILLET + +[ Upstream commit 6977cc89c87506ff17e6c05f0e37f46752256e82 ] + +'of_find_device_by_node()' takes a reference that must be released when +not needed anymore. +This is expected to be done in 'dsi_destroy()'. + +However, there are 2 issues in 'dsi_get_phy()'. + +First, if 'of_find_device_by_node()' succeeds but 'platform_get_drvdata()' +returns NULL, 'msm_dsi->phy_dev' will still be NULL, and the reference +won't be released in 'dsi_destroy()'. + +Secondly, as 'of_find_device_by_node()' already takes a reference, there is +no need for an additional 'get_device()'. + +Move the assignment to 'msm_dsi->phy_dev' a few lines above and remove the +unneeded 'get_device()' to solve both issues. + +Fixes: ec31abf6684e ("drm/msm/dsi: Separate PHY to another platform device") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/f15bc57648a00e7c99f943903468a04639d50596.1628241097.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c +index 75afc12a7b25..29d11f1cb79b 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -26,8 +26,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) + } + + phy_pdev = of_find_device_by_node(phy_node); +- if (phy_pdev) ++ if (phy_pdev) { + msm_dsi->phy = platform_get_drvdata(phy_pdev); ++ msm_dsi->phy_dev = &phy_pdev->dev; ++ } + + of_node_put(phy_node); + +@@ -36,8 +38,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) + return -EPROBE_DEFER; + } + +- msm_dsi->phy_dev = get_device(&phy_pdev->dev); +- + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-fix-error-return-code-in-msm_drm_init.patch b/queue-5.14/drm-msm-fix-error-return-code-in-msm_drm_init.patch new file mode 100644 index 00000000000..3b1ee73671f --- /dev/null +++ b/queue-5.14/drm-msm-fix-error-return-code-in-msm_drm_init.patch @@ -0,0 +1,39 @@ +From 3f7d7e16f32ddf8a1258b7d3fbe78cbad914991b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 21:43:02 +0800 +Subject: drm/msm: Fix error return code in msm_drm_init() + +From: Wei Li + +[ Upstream commit bfddcfe155a2fe448fee0169c5cbc82c7fa73491 ] + +When it fail to create crtc_event kthread, it just jump to err_msm_uninit, +while the 'ret' is not updated. So assign the return code before that. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Reported-by: Hulk Robot +Signed-off-by: Wei Li +Reviewed-by: Abhinav Kumar +Link: https://lore.kernel.org/r/20210705134302.315813-1-liwei391@huawei.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 9b8fa2ad0d84..729ab68d0203 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -539,6 +539,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + if (IS_ERR(priv->event_thread[i].worker)) { + ret = PTR_ERR(priv->event_thread[i].worker); + DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); ++ ret = PTR_ERR(priv->event_thread[i].worker); + goto err_msm_uninit; + } + +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-mdp4-move-hw-revision-detection-to-earlier-p.patch b/queue-5.14/drm-msm-mdp4-move-hw-revision-detection-to-earlier-p.patch new file mode 100644 index 00000000000..a13a6fe657c --- /dev/null +++ b/queue-5.14/drm-msm-mdp4-move-hw-revision-detection-to-earlier-p.patch @@ -0,0 +1,117 @@ +From 42444607eed4eeb09f51bd435d81d2f9cfe895c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 01:16:41 +0200 +Subject: drm/msm/mdp4: move HW revision detection to earlier phase + +From: David Heidelberg + +[ Upstream commit 4af4fc92939dc811ef291c0673946555aa4fb71f ] + +Fixes if condition, which never worked inside mdp4_kms_init, since +HW detection has been done later in mdp4_hw_init. + +Fixes: eb2b47bb9a03 ("drm/msm/mdp4: only use lut_clk on mdp4.2+") + +Signed-off-by: David Heidelberg +Link: https://lore.kernel.org/r/20210705231641.315804-2-david@ixit.cz +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 45 ++++++++++++------------ + 1 file changed, 22 insertions(+), 23 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +index 3a7a01d801aa..0712752742f4 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +@@ -19,23 +19,12 @@ static int mdp4_hw_init(struct msm_kms *kms) + { + struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms)); + struct drm_device *dev = mdp4_kms->dev; +- u32 major, minor, dmap_cfg, vg_cfg; ++ u32 dmap_cfg, vg_cfg; + unsigned long clk; + int ret = 0; + + pm_runtime_get_sync(dev->dev); + +- read_mdp_hw_revision(mdp4_kms, &major, &minor); +- +- if (major != 4) { +- DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n", +- major, minor); +- ret = -ENXIO; +- goto out; +- } +- +- mdp4_kms->rev = minor; +- + if (mdp4_kms->rev > 1) { + mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER0, 0x0707ffff); + mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER1, 0x03073f3f); +@@ -81,7 +70,6 @@ static int mdp4_hw_init(struct msm_kms *kms) + if (mdp4_kms->rev > 1) + mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1); + +-out: + pm_runtime_put_sync(dev->dev); + + return ret; +@@ -428,6 +416,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) + struct msm_kms *kms = NULL; + struct msm_gem_address_space *aspace; + int irq, ret; ++ u32 major, minor; + + mdp4_kms = kzalloc(sizeof(*mdp4_kms), GFP_KERNEL); + if (!mdp4_kms) { +@@ -488,15 +477,6 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) + if (IS_ERR(mdp4_kms->pclk)) + mdp4_kms->pclk = NULL; + +- if (mdp4_kms->rev >= 2) { +- mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk"); +- if (IS_ERR(mdp4_kms->lut_clk)) { +- DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n"); +- ret = PTR_ERR(mdp4_kms->lut_clk); +- goto fail; +- } +- } +- + mdp4_kms->axi_clk = devm_clk_get(&pdev->dev, "bus_clk"); + if (IS_ERR(mdp4_kms->axi_clk)) { + DRM_DEV_ERROR(dev->dev, "failed to get axi_clk\n"); +@@ -505,8 +485,27 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) + } + + clk_set_rate(mdp4_kms->clk, config->max_clk); +- if (mdp4_kms->lut_clk) ++ ++ read_mdp_hw_revision(mdp4_kms, &major, &minor); ++ ++ if (major != 4) { ++ DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n", ++ major, minor); ++ ret = -ENXIO; ++ goto fail; ++ } ++ ++ mdp4_kms->rev = minor; ++ ++ if (mdp4_kms->rev >= 2) { ++ mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk"); ++ if (IS_ERR(mdp4_kms->lut_clk)) { ++ DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n"); ++ ret = PTR_ERR(mdp4_kms->lut_clk); ++ goto fail; ++ } + clk_set_rate(mdp4_kms->lut_clk, config->max_clk); ++ } + + pm_runtime_enable(dev->dev); + mdp4_kms->rpm_enabled = true; +-- +2.30.2 + diff --git a/queue-5.14/drm-msm-mdp4-refactor-hw-revision-detection-into-rea.patch b/queue-5.14/drm-msm-mdp4-refactor-hw-revision-detection-into-rea.patch new file mode 100644 index 00000000000..73da74dad06 --- /dev/null +++ b/queue-5.14/drm-msm-mdp4-refactor-hw-revision-detection-into-rea.patch @@ -0,0 +1,78 @@ +From d9ad6104e67791c16de5f97e3a66a1f5cfbc2e71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 01:16:40 +0200 +Subject: drm/msm/mdp4: refactor HW revision detection into + read_mdp_hw_revision + +From: David Heidelberg + +[ Upstream commit 4d319afe666b0fc9a9855ba9bdf9ae3710ecf431 ] + +Inspired by MDP5 code. +Also use DRM_DEV_INFO for MDP version as MDP5 does. + +Cosmetic change: uint32_t -> u32 - checkpatch suggestion. + +Signed-off-by: David Heidelberg +Link: https://lore.kernel.org/r/20210705231641.315804-1-david@ixit.cz +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 27 ++++++++++++++++-------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +index 4a5b518288b0..3a7a01d801aa 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c +@@ -19,20 +19,13 @@ static int mdp4_hw_init(struct msm_kms *kms) + { + struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms)); + struct drm_device *dev = mdp4_kms->dev; +- uint32_t version, major, minor, dmap_cfg, vg_cfg; ++ u32 major, minor, dmap_cfg, vg_cfg; + unsigned long clk; + int ret = 0; + + pm_runtime_get_sync(dev->dev); + +- mdp4_enable(mdp4_kms); +- version = mdp4_read(mdp4_kms, REG_MDP4_VERSION); +- mdp4_disable(mdp4_kms); +- +- major = FIELD(version, MDP4_VERSION_MAJOR); +- minor = FIELD(version, MDP4_VERSION_MINOR); +- +- DBG("found MDP4 version v%d.%d", major, minor); ++ read_mdp_hw_revision(mdp4_kms, &major, &minor); + + if (major != 4) { + DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n", +@@ -411,6 +404,22 @@ fail: + return ret; + } + ++static void read_mdp_hw_revision(struct mdp4_kms *mdp4_kms, ++ u32 *major, u32 *minor) ++{ ++ struct drm_device *dev = mdp4_kms->dev; ++ u32 version; ++ ++ mdp4_enable(mdp4_kms); ++ version = mdp4_read(mdp4_kms, REG_MDP4_VERSION); ++ mdp4_disable(mdp4_kms); ++ ++ *major = FIELD(version, MDP4_VERSION_MAJOR); ++ *minor = FIELD(version, MDP4_VERSION_MINOR); ++ ++ DRM_DEV_INFO(dev->dev, "MDP4 version v%d.%d", *major, *minor); ++} ++ + struct msm_kms *mdp4_kms_init(struct drm_device *dev) + { + struct platform_device *pdev = to_platform_device(dev->dev); +-- +2.30.2 + diff --git a/queue-5.14/drm-mxsfb-clear-fifo_clear-bit.patch b/queue-5.14/drm-mxsfb-clear-fifo_clear-bit.patch new file mode 100644 index 00000000000..bf5c10e645d --- /dev/null +++ b/queue-5.14/drm-mxsfb-clear-fifo_clear-bit.patch @@ -0,0 +1,47 @@ +From 69fd4f7c40c32be4f4a6a2bc89b297493ab6ade5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 00:49:46 +0200 +Subject: drm: mxsfb: Clear FIFO_CLEAR bit + +From: Marek Vasut + +[ Upstream commit 5e23c98178eb1a2cdb7c4fee9a39baf8cabf282d ] + +Make sure the FIFO_CLEAR bit is latched in when configuring the +controller, so that the FIFO is really cleared. And then clear +the FIFO_CLEAR bit, since it is not self-clearing. + +Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") +Signed-off-by: Marek Vasut +Cc: Daniel Abrecht +Cc: Emil Velikov +Cc: Laurent Pinchart +Cc: Lucas Stach +Cc: Stefan Agner +Reviewed-by: Jagan Teki +Tested-by: Jagan Teki # i.Core MX8MM +Acked-by: Lucas Stach +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210620224946.189524-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +index 5bcc06c1ac0b..54f905ac75c0 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +@@ -243,6 +243,9 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb) + + /* Clear the FIFOs */ + writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET); ++ readl(mxsfb->base + LCDC_CTRL1); ++ writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_CLR); ++ readl(mxsfb->base + LCDC_CTRL1); + + if (mxsfb->devdata->has_overlay) + writel(0, mxsfb->base + LCDC_AS_CTRL); +-- +2.30.2 + diff --git a/queue-5.14/drm-mxsfb-enable-recovery-on-underflow.patch b/queue-5.14/drm-mxsfb-enable-recovery-on-underflow.patch new file mode 100644 index 00000000000..684eb5aa375 --- /dev/null +++ b/queue-5.14/drm-mxsfb-enable-recovery-on-underflow.patch @@ -0,0 +1,104 @@ +From b9a89dd788ef2548b58e83b2e0d280be1738691c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 00:47:01 +0200 +Subject: drm: mxsfb: Enable recovery on underflow + +From: Marek Vasut + +[ Upstream commit 0c9856e4edcdcac22d65618e8ceff9eb41447880 ] + +There is some sort of corner case behavior of the controller, +which could rarely be triggered at least on i.MX6SX connected +to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS +bridged 1920x1080 panel (and likely on other setups too), where +the image on the panel shifts to the right and wraps around. +This happens either when the controller is enabled on boot or +even later during run time. The condition does not correct +itself automatically, i.e. the display image remains shifted. + +It seems this problem is known and is due to sporadic underflows +of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow +IRQs, neither of the IRQs trigger and neither IRQ status bit is +asserted when this condition occurs. + +All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW +bit, which is described in the reference manual since i.MX23 as +" + Set this bit to enable the LCDIF block to recover in the next + field/frame if there was an underflow in the current field/frame. +" +Enable this bit to mitigate the sporadic underflows. + +Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") +Signed-off-by: Marek Vasut +Cc: Daniel Abrecht +Cc: Emil Velikov +Cc: Laurent Pinchart +Cc: Lucas Stach +Cc: Stefan Agner +Reviewed-by: Lucas Stach +Reviewed-by: Laurent Pinchart +Reviewed-by: Jagan Teki +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210620224701.189289-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 29 +++++++++++++++++++++++++++++ + drivers/gpu/drm/mxsfb/mxsfb_regs.h | 1 + + 2 files changed, 30 insertions(+) + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +index 300e7bab0f43..01e0f525360f 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +@@ -115,6 +115,35 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb) + reg |= VDCTRL4_SYNC_SIGNALS_ON; + writel(reg, mxsfb->base + LCDC_VDCTRL4); + ++ /* ++ * Enable recovery on underflow. ++ * ++ * There is some sort of corner case behavior of the controller, ++ * which could rarely be triggered at least on i.MX6SX connected ++ * to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS ++ * bridged 1920x1080 panel (and likely on other setups too), where ++ * the image on the panel shifts to the right and wraps around. ++ * This happens either when the controller is enabled on boot or ++ * even later during run time. The condition does not correct ++ * itself automatically, i.e. the display image remains shifted. ++ * ++ * It seems this problem is known and is due to sporadic underflows ++ * of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow ++ * IRQs, neither of the IRQs trigger and neither IRQ status bit is ++ * asserted when this condition occurs. ++ * ++ * All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW ++ * bit, which is described in the reference manual since i.MX23 as ++ * " ++ * Set this bit to enable the LCDIF block to recover in the next ++ * field/frame if there was an underflow in the current field/frame. ++ * " ++ * Enable this bit to mitigate the sporadic underflows. ++ */ ++ reg = readl(mxsfb->base + LCDC_CTRL1); ++ reg |= CTRL1_RECOVER_ON_UNDERFLOW; ++ writel(reg, mxsfb->base + LCDC_CTRL1); ++ + writel(CTRL_RUN, mxsfb->base + LCDC_CTRL + REG_SET); + } + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h +index 55d28a27f912..df90e960f495 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h ++++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h +@@ -54,6 +54,7 @@ + #define CTRL_DF24 BIT(1) + #define CTRL_RUN BIT(0) + ++#define CTRL1_RECOVER_ON_UNDERFLOW BIT(24) + #define CTRL1_FIFO_CLEAR BIT(21) + #define CTRL1_SET_BYTE_PACKAGING(x) (((x) & 0xf) << 16) + #define CTRL1_GET_BYTE_PACKAGING(x) (((x) >> 16) & 0xf) +-- +2.30.2 + diff --git a/queue-5.14/drm-mxsfb-increase-number-of-outstanding-requests-on.patch b/queue-5.14/drm-mxsfb-increase-number-of-outstanding-requests-on.patch new file mode 100644 index 00000000000..9ca31339386 --- /dev/null +++ b/queue-5.14/drm-mxsfb-increase-number-of-outstanding-requests-on.patch @@ -0,0 +1,126 @@ +From 87f60830d245d6993f43a101c91a39c81fd798fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 00:47:59 +0200 +Subject: drm: mxsfb: Increase number of outstanding requests on V4 and newer + HW + +From: Marek Vasut + +[ Upstream commit 9891cb54445bc65bf156bda416b6215048c7f617 ] + +In case the DRAM is under high load, the MXSFB FIFO might underflow +and that causes visible artifacts. This could be triggered on i.MX8MM +using e.g. "$ memtester 128M" on a device with 1920x1080 panel. The +first "Stuck Address" test of the memtester will completely corrupt +the image on the panel and leave the MXSFB FIFO in odd state. + +To avoid this underflow, increase number of outstanding requests to +DRAM from 2 to 16, which is the maximum. This mitigates the issue +and it can no longer be triggered. + +Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") +Signed-off-by: Marek Vasut +Cc: Daniel Abrecht +Cc: Emil Velikov +Cc: Laurent Pinchart +Cc: Lucas Stach +Cc: Stefan Agner +Reviewed-by: Lucas Stach +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210620224759.189351-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 3 +++ + drivers/gpu/drm/mxsfb/mxsfb_drv.h | 1 + + drivers/gpu/drm/mxsfb/mxsfb_kms.c | 8 ++++++++ + drivers/gpu/drm/mxsfb/mxsfb_regs.h | 8 ++++++++ + 4 files changed, 20 insertions(+) + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c +index 6da93551e2e5..c277d3f61a5e 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c +@@ -51,6 +51,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = { + .hs_wdth_mask = 0xff, + .hs_wdth_shift = 24, + .has_overlay = false, ++ .has_ctrl2 = false, + }, + [MXSFB_V4] = { + .transfer_count = LCDC_V4_TRANSFER_COUNT, +@@ -59,6 +60,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = { + .hs_wdth_mask = 0x3fff, + .hs_wdth_shift = 18, + .has_overlay = false, ++ .has_ctrl2 = true, + }, + [MXSFB_V6] = { + .transfer_count = LCDC_V4_TRANSFER_COUNT, +@@ -67,6 +69,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = { + .hs_wdth_mask = 0x3fff, + .hs_wdth_shift = 18, + .has_overlay = true, ++ .has_ctrl2 = true, + }, + }; + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.h b/drivers/gpu/drm/mxsfb/mxsfb_drv.h +index 399d23e91ed1..7c720e226fdf 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.h ++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.h +@@ -22,6 +22,7 @@ struct mxsfb_devdata { + unsigned int hs_wdth_mask; + unsigned int hs_wdth_shift; + bool has_overlay; ++ bool has_ctrl2; + }; + + struct mxsfb_drm_private { +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +index 01e0f525360f..5bcc06c1ac0b 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c +@@ -107,6 +107,14 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb) + clk_prepare_enable(mxsfb->clk_disp_axi); + clk_prepare_enable(mxsfb->clk); + ++ /* Increase number of outstanding requests on all supported IPs */ ++ if (mxsfb->devdata->has_ctrl2) { ++ reg = readl(mxsfb->base + LCDC_V4_CTRL2); ++ reg &= ~CTRL2_SET_OUTSTANDING_REQS_MASK; ++ reg |= CTRL2_SET_OUTSTANDING_REQS_16; ++ writel(reg, mxsfb->base + LCDC_V4_CTRL2); ++ } ++ + /* If it was disabled, re-enable the mode again */ + writel(CTRL_DOTCLK_MODE, mxsfb->base + LCDC_CTRL + REG_SET); + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h +index df90e960f495..694fea13e893 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h ++++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h +@@ -15,6 +15,7 @@ + #define LCDC_CTRL 0x00 + #define LCDC_CTRL1 0x10 + #define LCDC_V3_TRANSFER_COUNT 0x20 ++#define LCDC_V4_CTRL2 0x20 + #define LCDC_V4_TRANSFER_COUNT 0x30 + #define LCDC_V4_CUR_BUF 0x40 + #define LCDC_V4_NEXT_BUF 0x50 +@@ -61,6 +62,13 @@ + #define CTRL1_CUR_FRAME_DONE_IRQ_EN BIT(13) + #define CTRL1_CUR_FRAME_DONE_IRQ BIT(9) + ++#define CTRL2_SET_OUTSTANDING_REQS_1 0 ++#define CTRL2_SET_OUTSTANDING_REQS_2 (0x1 << 21) ++#define CTRL2_SET_OUTSTANDING_REQS_4 (0x2 << 21) ++#define CTRL2_SET_OUTSTANDING_REQS_8 (0x3 << 21) ++#define CTRL2_SET_OUTSTANDING_REQS_16 (0x4 << 21) ++#define CTRL2_SET_OUTSTANDING_REQS_MASK (0x7 << 21) ++ + #define TRANSFER_COUNT_SET_VCOUNT(x) (((x) & 0xffff) << 16) + #define TRANSFER_COUNT_GET_VCOUNT(x) (((x) >> 16) & 0xffff) + #define TRANSFER_COUNT_SET_HCOUNT(x) ((x) & 0xffff) +-- +2.30.2 + diff --git a/queue-5.14/drm-of-free-the-iterator-object-on-failure.patch b/queue-5.14/drm-of-free-the-iterator-object-on-failure.patch new file mode 100644 index 00000000000..720bcc3da4c --- /dev/null +++ b/queue-5.14/drm-of-free-the-iterator-object-on-failure.patch @@ -0,0 +1,41 @@ +From e010b5d22028ce8a2254cb96d20826880bb2702a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 15:33:00 +0100 +Subject: drm/of: free the iterator object on failure + +From: Steven Price + +[ Upstream commit 6f9223a56fabc840836b49de27dc7b27642c6a32 ] + +When bailing out due to the sanity check the iterator value needs to be +freed because the early return prevents for_each_child_of_node() from +doing the dereference itself. + +Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order") +Signed-off-by: Steven Price +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20210714143300.20632-1-steven.price@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_of.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c +index 197c57477344..997b8827fed2 100644 +--- a/drivers/gpu/drm/drm_of.c ++++ b/drivers/gpu/drm/drm_of.c +@@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type( + * configurations by passing the endpoints explicitly to + * drm_of_lvds_get_dual_link_pixel_order(). + */ +- if (!current_pt || pixels_type != current_pt) ++ if (!current_pt || pixels_type != current_pt) { ++ of_node_put(endpoint); + return -EINVAL; ++ } + } + + return pixels_type; +-- +2.30.2 + diff --git a/queue-5.14/drm-of-free-the-right-object.patch b/queue-5.14/drm-of-free-the-right-object.patch new file mode 100644 index 00000000000..d3f7cb5c127 --- /dev/null +++ b/queue-5.14/drm-of-free-the-right-object.patch @@ -0,0 +1,53 @@ +From 154c5a0897548edfb7932ffda62127d4f2d8cef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jul 2021 22:07:17 +0200 +Subject: drm/of: free the right object + +From: Julia Lawall + +[ Upstream commit b557a5f8da5798d27370ed6b73e673aae33efd55 ] + +There is no need to free a NULL value. Instead, free the object +that is leaking due to the iterator. + +The semantic patch that finds this problem is as follows: + +// +@@ +expression x,e; +identifier f; +@@ + x = f(...); + if (x == NULL) { + ... when any + when != x = e +* of_node_put(x); + ... + } +// + +Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order") +Signed-off-by: Julia Lawall +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210709200717.3676376-1-Julia.Lawall@inria.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_of.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c +index ca04c34e8251..197c57477344 100644 +--- a/drivers/gpu/drm/drm_of.c ++++ b/drivers/gpu/drm/drm_of.c +@@ -315,7 +315,7 @@ static int drm_of_lvds_get_remote_pixels_type( + + remote_port = of_graph_get_remote_port(endpoint); + if (!remote_port) { +- of_node_put(remote_port); ++ of_node_put(endpoint); + return -EPIPE; + } + +-- +2.30.2 + diff --git a/queue-5.14/drm-panfrost-fix-missing-clk_disable_unprepare-on-er.patch b/queue-5.14/drm-panfrost-fix-missing-clk_disable_unprepare-on-er.patch new file mode 100644 index 00000000000..b244c079bad --- /dev/null +++ b/queue-5.14/drm-panfrost-fix-missing-clk_disable_unprepare-on-er.patch @@ -0,0 +1,41 @@ +From 3377be56205ddd3f0f296fa8a28ff030b255b570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 14:38:56 +0000 +Subject: drm/panfrost: Fix missing clk_disable_unprepare() on error in + panfrost_clk_init() + +From: Wei Yongjun + +[ Upstream commit f42498705965bd4b026953c1892c686d8b1138e4 ] + +Fix the missing clk_disable_unprepare() before return +from panfrost_clk_init() in the error handling case. + +Fixes: b681af0bc1cc ("drm: panfrost: add optional bus_clock") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20210608143856.4154766-1-weiyongjun1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_device.c b/drivers/gpu/drm/panfrost/panfrost_device.c +index 125ed973feaa..a2a09c51eed7 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_device.c ++++ b/drivers/gpu/drm/panfrost/panfrost_device.c +@@ -54,7 +54,8 @@ static int panfrost_clk_init(struct panfrost_device *pfdev) + if (IS_ERR(pfdev->bus_clock)) { + dev_err(pfdev->dev, "get bus_clock failed %ld\n", + PTR_ERR(pfdev->bus_clock)); +- return PTR_ERR(pfdev->bus_clock); ++ err = PTR_ERR(pfdev->bus_clock); ++ goto disable_clock; + } + + if (pfdev->bus_clock) { +-- +2.30.2 + diff --git a/queue-5.14/drm-rcar-du-don-t-put-reference-to-drm_device-in-rca.patch b/queue-5.14/drm-rcar-du-don-t-put-reference-to-drm_device-in-rca.patch new file mode 100644 index 00000000000..d9080e2083c --- /dev/null +++ b/queue-5.14/drm-rcar-du-don-t-put-reference-to-drm_device-in-rca.patch @@ -0,0 +1,38 @@ +From 4f6ad8fc7ad9d8ac5c47c982007fd99e4da210a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 02:09:53 +0200 +Subject: drm: rcar-du: Don't put reference to drm_device in rcar_du_remove() + +From: Laurent Pinchart + +[ Upstream commit c29b6b0b126e9ee69a5d6339475e831a149295bd ] + +The reference to the drm_device that was acquired by +devm_drm_dev_alloc() is released automatically by the devres +infrastructure. It must not be released manually, as that causes a +reference underflow.. + +Fixes: ea6aae151887 ("drm: rcar-du: Embed drm_device in rcar_du_device") +Signed-off-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_drv.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +index bfbff90588cb..c22551c2facb 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +@@ -556,8 +556,6 @@ static int rcar_du_remove(struct platform_device *pdev) + + drm_kms_helper_poll_fini(ddev); + +- drm_dev_put(ddev); +- + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/edac-i10nm-fix-nvdimm-detection.patch b/queue-5.14/edac-i10nm-fix-nvdimm-detection.patch new file mode 100644 index 00000000000..56c6ba118c5 --- /dev/null +++ b/queue-5.14/edac-i10nm-fix-nvdimm-detection.patch @@ -0,0 +1,59 @@ +From 0dfc7d3c2db2c252179d9f58066e50ae72471eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:57:00 -0700 +Subject: EDAC/i10nm: Fix NVDIMM detection + +From: Qiuxu Zhuo + +[ Upstream commit 2294a7299f5e51667b841f63c6d69474491753fb ] + +MCDDRCFG is a per-channel register and uses bit{0,1} to indicate +the NVDIMM presence on DIMM slot{0,1}. Current i10nm_edac driver +wrongly uses MCDDRCFG as per-DIMM register and fails to detect +the NVDIMM. + +Fix it by reading MCDDRCFG as per-channel register and using its +bit{0,1} to check whether the NVDIMM is populated on DIMM slot{0,1}. + +Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors") +Reported-by: Fan Du +Tested-by: Wen Jin +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20210818175701.1611513-2-tony.luck@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index 6ce0ed2ffaaf..b4a024cb8b97 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -33,9 +33,9 @@ + #define I10NM_GET_DIMMMTR(m, i, j) \ + readl((m)->mbase + ((m)->hbm_mc ? 0x80c : 0x2080c) + \ + (i) * (m)->chan_mmio_sz + (j) * 4) +-#define I10NM_GET_MCDDRTCFG(m, i, j) \ ++#define I10NM_GET_MCDDRTCFG(m, i) \ + readl((m)->mbase + ((m)->hbm_mc ? 0x970 : 0x20970) + \ +- (i) * (m)->chan_mmio_sz + (j) * 4) ++ (i) * (m)->chan_mmio_sz) + #define I10NM_GET_MCMTR(m, i) \ + readl((m)->mbase + ((m)->hbm_mc ? 0xef8 : 0x20ef8) + \ + (i) * (m)->chan_mmio_sz) +@@ -321,10 +321,10 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + + ndimms = 0; + amap = I10NM_GET_AMAP(imc, i); ++ mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i); + for (j = 0; j < imc->num_dimms; j++) { + dimm = edac_get_dimm(mci, i, j, 0); + mtr = I10NM_GET_DIMMMTR(imc, i, j); +- mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i, j); + edac_dbg(1, "dimmmtr 0x%x mcddrtcfg 0x%x (mc%d ch%d dimm%d)\n", + mtr, mcddrtcfg, imc->mc, i, j); + +-- +2.30.2 + diff --git a/queue-5.14/edac-mce_amd-do-not-load-edac_mce_amd-module-on-gues.patch b/queue-5.14/edac-mce_amd-do-not-load-edac_mce_amd-module-on-gues.patch new file mode 100644 index 00000000000..436ba7e8987 --- /dev/null +++ b/queue-5.14/edac-mce_amd-do-not-load-edac_mce_amd-module-on-gues.patch @@ -0,0 +1,48 @@ +From 143a74a2048d01e274fcfc64cce893113688f906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 12:27:40 -0500 +Subject: EDAC/mce_amd: Do not load edac_mce_amd module on guests + +From: Smita Koralahalli + +[ Upstream commit 767f4b620edadac579c9b8b6660761d4285fa6f9 ] + +Hypervisors likely do not expose the SMCA feature to the guest and +loading this module leads to false warnings. This module should not be +loaded in guests to begin with, but people tend to do so, especially +when testing kernels in VMs. And then they complain about those false +warnings. + +Do the practical thing and do not load this module when running as a +guest to avoid all that complaining. + + [ bp: Rewrite commit message. ] + +Suggested-by: Borislav Petkov +Signed-off-by: Smita Koralahalli +Signed-off-by: Borislav Petkov +Reviewed-by: Yazen Ghannam +Tested-by: Kim Phillips +Link: https://lkml.kernel.org/r/20210628172740.245689-1-Smita.KoralahalliChannabasappa@amd.com +Signed-off-by: Sasha Levin +--- + drivers/edac/mce_amd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c +index 27d56920b469..67dbf4c31271 100644 +--- a/drivers/edac/mce_amd.c ++++ b/drivers/edac/mce_amd.c +@@ -1246,6 +1246,9 @@ static int __init mce_amd_init(void) + c->x86_vendor != X86_VENDOR_HYGON) + return -ENODEV; + ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) ++ return -ENODEV; ++ + if (boot_cpu_has(X86_FEATURE_SMCA)) { + xec_mask = 0x3f; + goto out; +-- +2.30.2 + diff --git a/queue-5.14/fcntl-fix-potential-deadlock-for-fasync_struct.fa_lo.patch b/queue-5.14/fcntl-fix-potential-deadlock-for-fasync_struct.fa_lo.patch new file mode 100644 index 00000000000..26bf6e73ced --- /dev/null +++ b/queue-5.14/fcntl-fix-potential-deadlock-for-fasync_struct.fa_lo.patch @@ -0,0 +1,78 @@ +From 1f2069077477b2fe5f47c2341fbbe39eaa11431a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 17:18:31 +0800 +Subject: fcntl: fix potential deadlock for &fasync_struct.fa_lock + +From: Desmond Cheong Zhi Xi + +[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ] + +There is an existing lock hierarchy of +&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock +from the following call chain: + + input_inject_event(): + spin_lock_irqsave(&dev->event_lock,...); + input_handle_event(): + input_pass_values(): + input_to_handler(): + evdev_events(): + evdev_pass_values(): + spin_lock(&client->buffer_lock); + __pass_event(): + kill_fasync(): + kill_fasync_rcu(): + read_lock(&fa->fa_lock); + send_sigio(): + read_lock_irqsave(&fown->lock,...); + +&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled +while grabbing &fasync_struct.fa_lock, otherwise we invert the lock +hierarchy. However, since kill_fasync which calls kill_fasync_rcu is +an exported symbol, it may not necessarily be called with interrupts +disabled. + +As kill_fasync_rcu may be called with interrupts disabled (for +example, in the call chain above), we replace calls to +read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu +with read_lock_irqsave/read_unlock_irqrestore. + +Signed-off-by: Desmond Cheong Zhi Xi +Signed-off-by: Jeff Layton +Signed-off-by: Sasha Levin +--- + fs/fcntl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/fcntl.c b/fs/fcntl.c +index 932ec1e9f5bf..68added37c15 100644 +--- a/fs/fcntl.c ++++ b/fs/fcntl.c +@@ -1004,13 +1004,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) + { + while (fa) { + struct fown_struct *fown; ++ unsigned long flags; + + if (fa->magic != FASYNC_MAGIC) { + printk(KERN_ERR "kill_fasync: bad magic number in " + "fasync_struct!\n"); + return; + } +- read_lock(&fa->fa_lock); ++ read_lock_irqsave(&fa->fa_lock, flags); + if (fa->fa_file) { + fown = &fa->fa_file->f_owner; + /* Don't send SIGURG to processes which have not set a +@@ -1019,7 +1020,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) + if (!(sig == SIGURG && fown->signum == 0)) + send_sigio(fown, fa->fa_fd, band); + } +- read_unlock(&fa->fa_lock); ++ read_unlock_irqrestore(&fa->fa_lock, flags); + fa = rcu_dereference(fa->fa_next); + } + } +-- +2.30.2 + diff --git a/queue-5.14/fcntl-fix-potential-deadlocks-for-fown_struct.lock.patch b/queue-5.14/fcntl-fix-potential-deadlocks-for-fown_struct.lock.patch new file mode 100644 index 00000000000..5ae55a18252 --- /dev/null +++ b/queue-5.14/fcntl-fix-potential-deadlocks-for-fown_struct.lock.patch @@ -0,0 +1,131 @@ +From eba8d8a05973ae91ae47204eef6168c101eddb80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 17:18:30 +0800 +Subject: fcntl: fix potential deadlocks for &fown_struct.lock + +From: Desmond Cheong Zhi Xi + +[ Upstream commit f671a691e299f58835d4660d642582bf0e8f6fda ] + +Syzbot reports a potential deadlock in do_fcntl: + +======================================================== +WARNING: possible irq lock inversion dependency detected +5.12.0-syzkaller #0 Not tainted +-------------------------------------------------------- +syz-executor132/8391 just changed the state of lock: +ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: f_getown_ex fs/fcntl.c:211 [inline] +ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: do_fcntl+0x8b4/0x1200 fs/fcntl.c:395 +but this lock was taken by another, HARDIRQ-safe lock in the past: + (&dev->event_lock){-...}-{2:2} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: +Chain exists of: + &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&f->f_owner.lock); + local_irq_disable(); + lock(&dev->event_lock); + lock(&new->fa_lock); + + lock(&dev->event_lock); + + *** DEADLOCK *** + +This happens because there is a lock hierarchy of +&dev->event_lock --> &new->fa_lock --> &f->f_owner.lock +from the following call chain: + + input_inject_event(): + spin_lock_irqsave(&dev->event_lock,...); + input_handle_event(): + input_pass_values(): + input_to_handler(): + evdev_events(): + evdev_pass_values(): + spin_lock(&client->buffer_lock); + __pass_event(): + kill_fasync(): + kill_fasync_rcu(): + read_lock(&fa->fa_lock); + send_sigio(): + read_lock_irqsave(&fown->lock,...); + +However, since &dev->event_lock is HARDIRQ-safe, interrupts have to be +disabled while grabbing &f->f_owner.lock, otherwise we invert the lock +hierarchy. + +Hence, we replace calls to read_lock/read_unlock on &f->f_owner.lock, +with read_lock_irq/read_unlock_irq. + +Reported-and-tested-by: syzbot+e6d5398a02c516ce5e70@syzkaller.appspotmail.com +Signed-off-by: Desmond Cheong Zhi Xi +Signed-off-by: Jeff Layton +Signed-off-by: Sasha Levin +--- + fs/fcntl.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/fcntl.c b/fs/fcntl.c +index f946bec8f1f1..932ec1e9f5bf 100644 +--- a/fs/fcntl.c ++++ b/fs/fcntl.c +@@ -150,7 +150,8 @@ void f_delown(struct file *filp) + pid_t f_getown(struct file *filp) + { + pid_t pid = 0; +- read_lock(&filp->f_owner.lock); ++ ++ read_lock_irq(&filp->f_owner.lock); + rcu_read_lock(); + if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) { + pid = pid_vnr(filp->f_owner.pid); +@@ -158,7 +159,7 @@ pid_t f_getown(struct file *filp) + pid = -pid; + } + rcu_read_unlock(); +- read_unlock(&filp->f_owner.lock); ++ read_unlock_irq(&filp->f_owner.lock); + return pid; + } + +@@ -208,7 +209,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg) + struct f_owner_ex owner = {}; + int ret = 0; + +- read_lock(&filp->f_owner.lock); ++ read_lock_irq(&filp->f_owner.lock); + rcu_read_lock(); + if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) + owner.pid = pid_vnr(filp->f_owner.pid); +@@ -231,7 +232,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg) + ret = -EINVAL; + break; + } +- read_unlock(&filp->f_owner.lock); ++ read_unlock_irq(&filp->f_owner.lock); + + if (!ret) { + ret = copy_to_user(owner_p, &owner, sizeof(owner)); +@@ -249,10 +250,10 @@ static int f_getowner_uids(struct file *filp, unsigned long arg) + uid_t src[2]; + int err; + +- read_lock(&filp->f_owner.lock); ++ read_lock_irq(&filp->f_owner.lock); + src[0] = from_kuid(user_ns, filp->f_owner.uid); + src[1] = from_kuid(user_ns, filp->f_owner.euid); +- read_unlock(&filp->f_owner.lock); ++ read_unlock_irq(&filp->f_owner.lock); + + err = put_user(src[0], &dst[0]); + err |= put_user(src[1], &dst[1]); +-- +2.30.2 + diff --git a/queue-5.14/firmware-fix-theoretical-uaf-race-with-firmware-cach.patch b/queue-5.14/firmware-fix-theoretical-uaf-race-with-firmware-cach.patch new file mode 100644 index 00000000000..c87eb1c875e --- /dev/null +++ b/queue-5.14/firmware-fix-theoretical-uaf-race-with-firmware-cach.patch @@ -0,0 +1,117 @@ +From 99c057ea4f91e9afb75790baed7ec511c998352c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 14:45:31 +0800 +Subject: firmware: fix theoretical UAF race with firmware cache and resume + +From: Zhen Lei + +[ Upstream commit 3ecc8cb7c092b2f50e21d2aaaae35b8221ee7214 ] + +This race was discovered when I carefully analyzed the code to locate +another firmware-related UAF issue. It can be triggered only when the +firmware load operation is executed during suspend. This possibility is +almost impossible because there are few firmware load and suspend actions +in the actual environment. + + CPU0 CPU1 +__device_uncache_fw_images(): assign_fw(): + fw_cache_piggyback_on_request() + <----- P0 + spin_lock(&fwc->name_lock); + ... + list_del(&fce->list); + spin_unlock(&fwc->name_lock); + + uncache_firmware(fce->name); + <----- P1 + kref_get(&fw_priv->ref); + +If CPU1 is interrupted at position P0, the new 'fce' has been added to the +list fwc->fw_names by the fw_cache_piggyback_on_request(). In this case, +CPU0 executes __device_uncache_fw_images() and will be able to see it when +it traverses list fwc->fw_names. Before CPU1 executes kref_get() at P1, if +CPU0 further executes uncache_firmware(), the count of fw_priv->ref may +decrease to 0, causing fw_priv to be released in advance. + +Move kref_get() to the lock protection range of fwc->name_lock to fix it. + +Fixes: ac39b3ea73aa ("firmware loader: let caching firmware piggyback on loading firmware") +Acked-by: Luis Chamberlain +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210719064531.3733-2-thunder.leizhen@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/firmware_loader/main.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c +index 68c549d71230..bdbedc6660a8 100644 +--- a/drivers/base/firmware_loader/main.c ++++ b/drivers/base/firmware_loader/main.c +@@ -165,7 +165,7 @@ static inline int fw_state_wait(struct fw_priv *fw_priv) + return __fw_state_wait_common(fw_priv, MAX_SCHEDULE_TIMEOUT); + } + +-static int fw_cache_piggyback_on_request(const char *name); ++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv); + + static struct fw_priv *__allocate_fw_priv(const char *fw_name, + struct firmware_cache *fwc, +@@ -707,10 +707,8 @@ int assign_fw(struct firmware *fw, struct device *device) + * on request firmware. + */ + if (!(fw_priv->opt_flags & FW_OPT_NOCACHE) && +- fw_priv->fwc->state == FW_LOADER_START_CACHE) { +- if (fw_cache_piggyback_on_request(fw_priv->fw_name)) +- kref_get(&fw_priv->ref); +- } ++ fw_priv->fwc->state == FW_LOADER_START_CACHE) ++ fw_cache_piggyback_on_request(fw_priv); + + /* pass the pages buffer to driver at the last minute */ + fw_set_page_data(fw_priv, fw); +@@ -1259,11 +1257,11 @@ static int __fw_entry_found(const char *name) + return 0; + } + +-static int fw_cache_piggyback_on_request(const char *name) ++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv) + { +- struct firmware_cache *fwc = &fw_cache; ++ const char *name = fw_priv->fw_name; ++ struct firmware_cache *fwc = fw_priv->fwc; + struct fw_cache_entry *fce; +- int ret = 0; + + spin_lock(&fwc->name_lock); + if (__fw_entry_found(name)) +@@ -1271,13 +1269,12 @@ static int fw_cache_piggyback_on_request(const char *name) + + fce = alloc_fw_cache_entry(name); + if (fce) { +- ret = 1; + list_add(&fce->list, &fwc->fw_names); ++ kref_get(&fw_priv->ref); + pr_debug("%s: fw: %s\n", __func__, name); + } + found: + spin_unlock(&fwc->name_lock); +- return ret; + } + + static void free_fw_cache_entry(struct fw_cache_entry *fce) +@@ -1508,9 +1505,8 @@ static inline void unregister_fw_pm_ops(void) + unregister_pm_notifier(&fw_cache.pm_notify); + } + #else +-static int fw_cache_piggyback_on_request(const char *name) ++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv) + { +- return 0; + } + static inline int register_fw_pm_ops(void) + { +-- +2.30.2 + diff --git a/queue-5.14/firmware-raspberrypi-fix-a-leak-in-rpi_firmware_get.patch b/queue-5.14/firmware-raspberrypi-fix-a-leak-in-rpi_firmware_get.patch new file mode 100644 index 00000000000..929889f511f --- /dev/null +++ b/queue-5.14/firmware-raspberrypi-fix-a-leak-in-rpi_firmware_get.patch @@ -0,0 +1,52 @@ +From afa45fca24acceb49fdab610f1f84579612bdca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 08:46:11 +0200 +Subject: firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' + +From: Christophe JAILLET + +[ Upstream commit 09cbd1df7d2615c19e40facbe31fdcb5f1ebfa96 ] + +The reference taken by 'of_find_device_by_node()' must be released when +not needed anymore. + +Add the corresponding 'put_device()' in the normal and error handling +paths. + +Fixes: 4e3d60656a72 ("ARM: bcm2835: Add the Raspberry Pi firmware driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/5e17e5409b934cd08bf6f9279c73be5c1cb11cce.1628232242.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index 250e01680742..4b8978b254f9 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -329,12 +329,18 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) + + fw = platform_get_drvdata(pdev); + if (!fw) +- return NULL; ++ goto err_put_device; + + if (!kref_get_unless_zero(&fw->consumers)) +- return NULL; ++ goto err_put_device; ++ ++ put_device(&pdev->dev); + + return fw; ++ ++err_put_device: ++ put_device(&pdev->dev); ++ return NULL; + } + EXPORT_SYMBOL_GPL(rpi_firmware_get); + +-- +2.30.2 + diff --git a/queue-5.14/genirq-timings-fix-error-return-code-in-irq_timings_.patch b/queue-5.14/genirq-timings-fix-error-return-code-in-irq_timings_.patch new file mode 100644 index 00000000000..063b8d75a4d --- /dev/null +++ b/queue-5.14/genirq-timings-fix-error-return-code-in-irq_timings_.patch @@ -0,0 +1,44 @@ +From 228273881c1c34cffaff94348c386857f82ac6f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 17:33:32 +0800 +Subject: genirq/timings: Fix error return code in irq_timings_test_irqs() + +From: Zhen Lei + +[ Upstream commit 290fdc4b7ef14e33d0e30058042b0e9bfd02b89b ] + +Return a negative error code from the error handling case instead of 0, as +done elsewhere in this function. + +Fixes: f52da98d900e ("genirq/timings: Add selftest for irqs circular buffer") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210811093333.2376-1-thunder.leizhen@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/irq/timings.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c +index 4d2a702d7aa9..c43e2ac2f8de 100644 +--- a/kernel/irq/timings.c ++++ b/kernel/irq/timings.c +@@ -799,12 +799,14 @@ static int __init irq_timings_test_irqs(struct timings_intervals *ti) + + __irq_timings_store(irq, irqs, ti->intervals[i]); + if (irqs->circ_timings[i & IRQ_TIMINGS_MASK] != index) { ++ ret = -EBADSLT; + pr_err("Failed to store in the circular buffer\n"); + goto out; + } + } + + if (irqs->count != ti->count) { ++ ret = -ERANGE; + pr_err("Count differs\n"); + goto out; + } +-- +2.30.2 + diff --git a/queue-5.14/gfs2-fix-memory-leak-of-object-lsi-on-error-return-p.patch b/queue-5.14/gfs2-fix-memory-leak-of-object-lsi-on-error-return-p.patch new file mode 100644 index 00000000000..5ea50e3ff27 --- /dev/null +++ b/queue-5.14/gfs2-fix-memory-leak-of-object-lsi-on-error-return-p.patch @@ -0,0 +1,37 @@ +From 318b6e777db2574602c824926559f764b4b93bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jul 2021 17:24:30 +0100 +Subject: gfs2: Fix memory leak of object lsi on error return path + +From: Colin Ian King + +[ Upstream commit a6579cbfd7216b071008db13360c322a6b21400b ] + +In the case where IS_ERR(lsi->si_sc_inode) is true the error exit path +to free_local does not kfree the allocated object lsi leading to a memory +leak. Fix this by kfree'ing lst before taking the error exit path. + +Addresses-Coverity: ("Resource leak") +Fixes: 97fd734ba17e ("gfs2: lookup local statfs inodes prior to journal recovery") +Signed-off-by: Colin Ian King +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/ops_fstype.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index 5f4504dd0875..bd3b3be1a473 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -677,6 +677,7 @@ static int init_statfs(struct gfs2_sbd *sdp) + error = PTR_ERR(lsi->si_sc_inode); + fs_err(sdp, "can't find local \"sc\" file#%u: %d\n", + jd->jd_jid, error); ++ kfree(lsi); + goto free_local; + } + lsi->si_jid = jd->jd_jid; +-- +2.30.2 + diff --git a/queue-5.14/gfs2-init-system-threads-before-freeze-lock.patch b/queue-5.14/gfs2-init-system-threads-before-freeze-lock.patch new file mode 100644 index 00000000000..654119e2676 --- /dev/null +++ b/queue-5.14/gfs2-init-system-threads-before-freeze-lock.patch @@ -0,0 +1,202 @@ +From b143fd003323677769860f4f1ec94593479f51d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 07:42:33 -0500 +Subject: gfs2: init system threads before freeze lock + +From: Bob Peterson + +[ Upstream commit a28dc123fa66ba7f3eca7cffc4b01d96bfd35c27 ] + +Patch 96b1454f2e ("gfs2: move freeze glock outside the make_fs_rw and _ro +functions") changed the gfs2 mount sequence so that it holds the freeze +lock before calling gfs2_make_fs_rw. Before this patch, gfs2_make_fs_rw +called init_threads to initialize the quotad and logd threads. That is a +problem if the system needs to withdraw due to IO errors early in the +mount sequence, for example, while initializing the system statfs inode: + +1. An IO error causes the statfs glock to not sync properly after + recovery, and leaves items on the ail list. +2. The leftover items on the ail list causes its do_xmote call to fail, + which makes it want to withdraw. But since the glock code cannot + withdraw (because the withdraw sequence uses glocks) it relies upon + the logd daemon to initiate the withdraw. +3. The withdraw can never be performed by the logd daemon because all + this takes place before the logd daemon is started. + +This patch moves function init_threads from super.c to ops_fstype.c +and it changes gfs2_fill_super to start its threads before holding the +freeze lock, and if there's an error, stop its threads after releasing +it. This allows the logd to run unblocked by the freeze lock. Thus, +the logd daemon can perform its withdraw sequence properly. + +Fixes: 96b1454f2e8e ("gfs2: move freeze glock outside the make_fs_rw and _ro functions") +Signed-off-by: Bob Peterson +Signed-off-by: Sasha Levin +--- + fs/gfs2/ops_fstype.c | 42 ++++++++++++++++++++++++++++++ + fs/gfs2/super.c | 61 +++++--------------------------------------- + 2 files changed, 48 insertions(+), 55 deletions(-) + +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index bd3b3be1a473..ca76e3b8792c 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -1089,6 +1089,34 @@ void gfs2_online_uevent(struct gfs2_sbd *sdp) + kobject_uevent_env(&sdp->sd_kobj, KOBJ_ONLINE, envp); + } + ++static int init_threads(struct gfs2_sbd *sdp) ++{ ++ struct task_struct *p; ++ int error = 0; ++ ++ p = kthread_run(gfs2_logd, sdp, "gfs2_logd"); ++ if (IS_ERR(p)) { ++ error = PTR_ERR(p); ++ fs_err(sdp, "can't start logd thread: %d\n", error); ++ return error; ++ } ++ sdp->sd_logd_process = p; ++ ++ p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad"); ++ if (IS_ERR(p)) { ++ error = PTR_ERR(p); ++ fs_err(sdp, "can't start quotad thread: %d\n", error); ++ goto fail; ++ } ++ sdp->sd_quotad_process = p; ++ return 0; ++ ++fail: ++ kthread_stop(sdp->sd_logd_process); ++ sdp->sd_logd_process = NULL; ++ return error; ++} ++ + /** + * gfs2_fill_super - Read in superblock + * @sb: The VFS superblock +@@ -1217,6 +1245,14 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) + goto fail_per_node; + } + ++ if (!sb_rdonly(sb)) { ++ error = init_threads(sdp); ++ if (error) { ++ gfs2_withdraw_delayed(sdp); ++ goto fail_per_node; ++ } ++ } ++ + error = gfs2_freeze_lock(sdp, &freeze_gh, 0); + if (error) + goto fail_per_node; +@@ -1226,6 +1262,12 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc) + + gfs2_freeze_unlock(&freeze_gh); + if (error) { ++ if (sdp->sd_quotad_process) ++ kthread_stop(sdp->sd_quotad_process); ++ sdp->sd_quotad_process = NULL; ++ if (sdp->sd_logd_process) ++ kthread_stop(sdp->sd_logd_process); ++ sdp->sd_logd_process = NULL; + fs_err(sdp, "can't make FS RW: %d\n", error); + goto fail_per_node; + } +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 4d4ceb0b6903..2bdbba5ea8d7 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -119,34 +119,6 @@ int gfs2_jdesc_check(struct gfs2_jdesc *jd) + return 0; + } + +-static int init_threads(struct gfs2_sbd *sdp) +-{ +- struct task_struct *p; +- int error = 0; +- +- p = kthread_run(gfs2_logd, sdp, "gfs2_logd"); +- if (IS_ERR(p)) { +- error = PTR_ERR(p); +- fs_err(sdp, "can't start logd thread: %d\n", error); +- return error; +- } +- sdp->sd_logd_process = p; +- +- p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad"); +- if (IS_ERR(p)) { +- error = PTR_ERR(p); +- fs_err(sdp, "can't start quotad thread: %d\n", error); +- goto fail; +- } +- sdp->sd_quotad_process = p; +- return 0; +- +-fail: +- kthread_stop(sdp->sd_logd_process); +- sdp->sd_logd_process = NULL; +- return error; +-} +- + /** + * gfs2_make_fs_rw - Turn a Read-Only FS into a Read-Write one + * @sdp: the filesystem +@@ -161,26 +133,17 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + struct gfs2_log_header_host head; + int error; + +- error = init_threads(sdp); +- if (error) { +- gfs2_withdraw_delayed(sdp); +- return error; +- } +- + j_gl->gl_ops->go_inval(j_gl, DIO_METADATA); +- if (gfs2_withdrawn(sdp)) { +- error = -EIO; +- goto fail; +- } ++ if (gfs2_withdrawn(sdp)) ++ return -EIO; + + error = gfs2_find_jhead(sdp->sd_jdesc, &head, false); + if (error || gfs2_withdrawn(sdp)) +- goto fail; ++ return error; + + if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) { + gfs2_consist(sdp); +- error = -EIO; +- goto fail; ++ return -EIO; + } + + /* Initialize some head of the log stuff */ +@@ -188,20 +151,8 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + gfs2_log_pointers_init(sdp, head.lh_blkno); + + error = gfs2_quota_init(sdp); +- if (error || gfs2_withdrawn(sdp)) +- goto fail; +- +- set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); +- +- return 0; +- +-fail: +- if (sdp->sd_quotad_process) +- kthread_stop(sdp->sd_quotad_process); +- sdp->sd_quotad_process = NULL; +- if (sdp->sd_logd_process) +- kthread_stop(sdp->sd_logd_process); +- sdp->sd_logd_process = NULL; ++ if (!error && !gfs2_withdrawn(sdp)) ++ set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); + return error; + } + +-- +2.30.2 + diff --git a/queue-5.14/gve-fix-the-wrong-adminq-buffer-overflow-check.patch b/queue-5.14/gve-fix-the-wrong-adminq-buffer-overflow-check.patch new file mode 100644 index 00000000000..7c881f83960 --- /dev/null +++ b/queue-5.14/gve-fix-the-wrong-adminq-buffer-overflow-check.patch @@ -0,0 +1,48 @@ +From 02b5cc94cb7ebdd99623783f534dc0e0c06ba4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 15:34:59 +0800 +Subject: gve: fix the wrong AdminQ buffer overflow check + +From: Haiyue Wang + +[ Upstream commit 63a9192b8fa1ea55efeba1f18fad52bb24d9bf12 ] + +The 'tail' pointer is also free-running count, so it needs to be masked +as 'adminq_prod_cnt' does, to become an index value of AdminQ buffer. + +Fixes: 5cdad90de62c ("gve: Batch AQ commands for creating and destroying queues.") +Signed-off-by: Haiyue Wang +Reviewed-by: Catherine Sullivan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_adminq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c +index 5bb56b454541..f089d33dd48e 100644 +--- a/drivers/net/ethernet/google/gve/gve_adminq.c ++++ b/drivers/net/ethernet/google/gve/gve_adminq.c +@@ -322,7 +322,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv, + tail = ioread32be(&priv->reg_bar0->adminq_event_counter); + + // Check if next command will overflow the buffer. +- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) { ++ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == ++ (tail & priv->adminq_mask)) { + int err; + + // Flush existing commands to make room. +@@ -332,7 +333,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv, + + // Retry. + tail = ioread32be(&priv->reg_bar0->adminq_event_counter); +- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) { ++ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == ++ (tail & priv->adminq_mask)) { + // This should never happen. We just flushed the + // command queue so there should be enough space. + return -ENOMEM; +-- +2.30.2 + diff --git a/queue-5.14/hrtimer-avoid-double-reprogramming-in-__hrtimer_star.patch b/queue-5.14/hrtimer-avoid-double-reprogramming-in-__hrtimer_star.patch new file mode 100644 index 00000000000..026d7d4a96e --- /dev/null +++ b/queue-5.14/hrtimer-avoid-double-reprogramming-in-__hrtimer_star.patch @@ -0,0 +1,139 @@ +From 0156b892a3e0e903464563586b7a3fc24cd42f29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 15:39:46 +0200 +Subject: hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() + +From: Thomas Gleixner + +[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ] + +If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then +the timer has to be canceled first and then added back. If the timer is the +first expiring timer then on removal the clockevent device is reprogrammed +to the next expiring timer to avoid that the pending expiry fires needlessly. + +If the new expiry time ends up to be the first expiry again then the clock +event device has to reprogrammed again. + +Avoid this by checking whether the timer is the first to expire and in that +case, keep the timer on the current CPU and delay the reprogramming up to +the point where the timer has been enqueued again. + +Reported-by: Lorenzo Colitti +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210713135157.873137732@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 53 insertions(+), 7 deletions(-) + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 4a66725b1d4a..ba2e0d0a0e5a 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1030,12 +1030,13 @@ static void __remove_hrtimer(struct hrtimer *timer, + * remove hrtimer, called with base lock held + */ + static inline int +-remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart) ++remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, ++ bool restart, bool keep_local) + { + u8 state = timer->state; + + if (state & HRTIMER_STATE_ENQUEUED) { +- int reprogram; ++ bool reprogram; + + /* + * Remove the timer and force reprogramming when high +@@ -1048,8 +1049,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest + debug_deactivate(timer); + reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases); + ++ /* ++ * If the timer is not restarted then reprogramming is ++ * required if the timer is local. If it is local and about ++ * to be restarted, avoid programming it twice (on removal ++ * and a moment later when it's requeued). ++ */ + if (!restart) + state = HRTIMER_STATE_INACTIVE; ++ else ++ reprogram &= !keep_local; + + __remove_hrtimer(timer, base, state, reprogram); + return 1; +@@ -1103,9 +1112,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, + struct hrtimer_clock_base *base) + { + struct hrtimer_clock_base *new_base; ++ bool force_local, first; + +- /* Remove an active timer from the queue: */ +- remove_hrtimer(timer, base, true); ++ /* ++ * If the timer is on the local cpu base and is the first expiring ++ * timer then this might end up reprogramming the hardware twice ++ * (on removal and on enqueue). To avoid that by prevent the ++ * reprogram on removal, keep the timer local to the current CPU ++ * and enforce reprogramming after it is queued no matter whether ++ * it is the new first expiring timer again or not. ++ */ ++ force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); ++ force_local &= base->cpu_base->next_timer == timer; ++ ++ /* ++ * Remove an active timer from the queue. In case it is not queued ++ * on the current CPU, make sure that remove_hrtimer() updates the ++ * remote data correctly. ++ * ++ * If it's on the current CPU and the first expiring timer, then ++ * skip reprogramming, keep the timer local and enforce ++ * reprogramming later if it was the first expiring timer. This ++ * avoids programming the underlying clock event twice (once at ++ * removal and once after enqueue). ++ */ ++ remove_hrtimer(timer, base, true, force_local); + + if (mode & HRTIMER_MODE_REL) + tim = ktime_add_safe(tim, base->get_time()); +@@ -1115,9 +1146,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, + hrtimer_set_expires_range_ns(timer, tim, delta_ns); + + /* Switch the timer base, if necessary: */ +- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED); ++ if (!force_local) { ++ new_base = switch_hrtimer_base(timer, base, ++ mode & HRTIMER_MODE_PINNED); ++ } else { ++ new_base = base; ++ } ++ ++ first = enqueue_hrtimer(timer, new_base, mode); ++ if (!force_local) ++ return first; + +- return enqueue_hrtimer(timer, new_base, mode); ++ /* ++ * Timer was forced to stay on the current CPU to avoid ++ * reprogramming on removal and enqueue. Force reprogram the ++ * hardware by evaluating the new first expiring timer. ++ */ ++ hrtimer_force_reprogram(new_base->cpu_base, 1); ++ return 0; + } + + /** +@@ -1183,7 +1229,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer) + base = lock_hrtimer_base(timer, &flags); + + if (!hrtimer_callback_running(timer)) +- ret = remove_hrtimer(timer, base, false); ++ ret = remove_hrtimer(timer, base, false, false); + + unlock_hrtimer_base(timer, &flags); + +-- +2.30.2 + diff --git a/queue-5.14/hrtimer-ensure-timerfd-notification-for-highres-n.patch b/queue-5.14/hrtimer-ensure-timerfd-notification-for-highres-n.patch new file mode 100644 index 00000000000..ccc543d6a79 --- /dev/null +++ b/queue-5.14/hrtimer-ensure-timerfd-notification-for-highres-n.patch @@ -0,0 +1,117 @@ +From ffe788386bffed1918b343529f6f48707883e29e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 15:39:48 +0200 +Subject: hrtimer: Ensure timerfd notification for HIGHRES=n + +From: Thomas Gleixner + +[ Upstream commit 8c3b5e6ec0fee18bc2ce38d1dfe913413205f908 ] + +If high resolution timers are disabled the timerfd notification about a +clock was set event is not happening for all cases which use +clock_was_set_delayed() because that's a NOP for HIGHRES=n, which is wrong. + +Make clock_was_set_delayed() unconditially available to fix that. + +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210713135158.196661266@linutronix.de +Signed-off-by: Sasha Levin +--- + include/linux/hrtimer.h | 5 ----- + kernel/time/hrtimer.c | 32 ++++++++++++++++---------------- + kernel/time/tick-internal.h | 3 +++ + 3 files changed, 19 insertions(+), 21 deletions(-) + +diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h +index bb5e7b0a4274..77295af72426 100644 +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -318,16 +318,12 @@ struct clock_event_device; + + extern void hrtimer_interrupt(struct clock_event_device *dev); + +-extern void clock_was_set_delayed(void); +- + extern unsigned int hrtimer_resolution; + + #else + + #define hrtimer_resolution (unsigned int)LOW_RES_NSEC + +-static inline void clock_was_set_delayed(void) { } +- + #endif + + static inline ktime_t +@@ -351,7 +347,6 @@ hrtimer_expires_remaining_adjusted(const struct hrtimer *timer) + timer->base->get_time()); + } + +-extern void clock_was_set(void); + #ifdef CONFIG_TIMERFD + extern void timerfd_clock_was_set(void); + #else +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index ba2e0d0a0e5a..5af758473488 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -758,22 +758,6 @@ static void hrtimer_switch_to_hres(void) + retrigger_next_event(NULL); + } + +-static void clock_was_set_work(struct work_struct *work) +-{ +- clock_was_set(); +-} +- +-static DECLARE_WORK(hrtimer_work, clock_was_set_work); +- +-/* +- * Called from timekeeping and resume code to reprogram the hrtimer +- * interrupt device on all cpus. +- */ +-void clock_was_set_delayed(void) +-{ +- schedule_work(&hrtimer_work); +-} +- + #else + + static inline int hrtimer_is_hres_enabled(void) { return 0; } +@@ -891,6 +875,22 @@ void clock_was_set(void) + timerfd_clock_was_set(); + } + ++static void clock_was_set_work(struct work_struct *work) ++{ ++ clock_was_set(); ++} ++ ++static DECLARE_WORK(hrtimer_work, clock_was_set_work); ++ ++/* ++ * Called from timekeeping and resume code to reprogram the hrtimer ++ * interrupt device on all cpus and to notify timerfd. ++ */ ++void clock_was_set_delayed(void) ++{ ++ schedule_work(&hrtimer_work); ++} ++ + /* + * During resume we might have to reprogram the high resolution timer + * interrupt on all online CPUs. However, all other CPUs will be +diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h +index 6a742a29e545..cd610faa2523 100644 +--- a/kernel/time/tick-internal.h ++++ b/kernel/time/tick-internal.h +@@ -165,3 +165,6 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases); + + extern u64 get_next_timer_interrupt(unsigned long basej, u64 basem); + void timer_clear_idle(void); ++ ++void clock_was_set(void); ++void clock_was_set_delayed(void); +-- +2.30.2 + diff --git a/queue-5.14/hv_utils-set-the-maximum-packet-size-for-vss-driver-.patch b/queue-5.14/hv_utils-set-the-maximum-packet-size-for-vss-driver-.patch new file mode 100644 index 00000000000..d1e93e150bf --- /dev/null +++ b/queue-5.14/hv_utils-set-the-maximum-packet-size-for-vss-driver-.patch @@ -0,0 +1,48 @@ +From 4795368c6371291a8e94f6ef16c251239883b377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 15:38:57 +0200 +Subject: hv_utils: Set the maximum packet size for VSS driver to the length of + the receive buffer + +From: Vitaly Kuznetsov + +[ Upstream commit 9d68cd9120e4e3af38f843e165631c323b86b4e4 ] + +Commit adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out +of the ring buffer") introduced a notion of maximum packet size and for +KVM and FCOPY drivers set it to the length of the receive buffer. VSS +driver wasn't updated, this means that the maximum packet size is now +VMBUS_DEFAULT_MAX_PKT_SIZE (4k). Apparently, this is not enough. I'm +observing a packet of 6304 bytes which is being truncated to 4096. When +VSS driver tries to read next packet from ring buffer it starts from the +wrong offset and receives garbage. + +Set the maximum packet size to 'HV_HYP_PAGE_SIZE * 2' in VSS driver. This +matches the length of the receive buffer and is in line with other utils +drivers. + +Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") +Signed-off-by: Vitaly Kuznetsov +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20210825133857.847866-1-vkuznets@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hv_snapshot.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c +index 2267bd4c3472..6018b9d1b1fb 100644 +--- a/drivers/hv/hv_snapshot.c ++++ b/drivers/hv/hv_snapshot.c +@@ -375,6 +375,7 @@ hv_vss_init(struct hv_util_service *srv) + } + recv_buffer = srv->recv_buffer; + vss_transaction.recv_channel = srv->channel; ++ vss_transaction.recv_channel->max_pkt_size = HV_HYP_PAGE_SIZE * 2; + + /* + * When this driver loads, the user level daemon that +-- +2.30.2 + diff --git a/queue-5.14/hwmon-pmbus-bpa-rs600-don-t-use-rated-limits-as-warn.patch b/queue-5.14/hwmon-pmbus-bpa-rs600-don-t-use-rated-limits-as-warn.patch new file mode 100644 index 00000000000..39b68944b59 --- /dev/null +++ b/queue-5.14/hwmon-pmbus-bpa-rs600-don-t-use-rated-limits-as-warn.patch @@ -0,0 +1,79 @@ +From 1e448549dda3c8c72499abc65e612b7f132a32eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 13:39:59 +1200 +Subject: hwmon: (pmbus/bpa-rs600) Don't use rated limits as warn limits + +From: Chris Packham + +[ Upstream commit 7a8c68c57fd09541377f6971f25efdeb9a926c37 ] + +In the initial implementation a number of PMBUS_x_WARN_LIMITs were +mapped to MFR fields. This was incorrect as these MFR limits reflect the +rated limit as opposed to a limit which will generate warning. Instead +return -ENXIO like we were already doing for other WARN_LIMITs. + +Subsequently these rated limits have been exposed generically as new +fields in the sysfs ABI so the values are still available. + +Fixes: 15b2703e5e02 ("hwmon: (pmbus) Add driver for BluTek BPA-RS600") +Signed-off-by: Chris Packham +Link: https://lore.kernel.org/r/20210812014000.26293-2-chris.packham@alliedtelesis.co.nz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/bpa-rs600.c | 25 ------------------------- + 1 file changed, 25 deletions(-) + +diff --git a/drivers/hwmon/pmbus/bpa-rs600.c b/drivers/hwmon/pmbus/bpa-rs600.c +index 2be69fedfa36..be76efe67d83 100644 +--- a/drivers/hwmon/pmbus/bpa-rs600.c ++++ b/drivers/hwmon/pmbus/bpa-rs600.c +@@ -12,15 +12,6 @@ + #include + #include "pmbus.h" + +-#define BPARS600_MFR_VIN_MIN 0xa0 +-#define BPARS600_MFR_VIN_MAX 0xa1 +-#define BPARS600_MFR_IIN_MAX 0xa2 +-#define BPARS600_MFR_PIN_MAX 0xa3 +-#define BPARS600_MFR_VOUT_MIN 0xa4 +-#define BPARS600_MFR_VOUT_MAX 0xa5 +-#define BPARS600_MFR_IOUT_MAX 0xa6 +-#define BPARS600_MFR_POUT_MAX 0xa7 +- + static int bpa_rs600_read_byte_data(struct i2c_client *client, int page, int reg) + { + int ret; +@@ -81,29 +72,13 @@ static int bpa_rs600_read_word_data(struct i2c_client *client, int page, int pha + + switch (reg) { + case PMBUS_VIN_UV_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MIN); +- break; + case PMBUS_VIN_OV_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MAX); +- break; + case PMBUS_VOUT_UV_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MIN); +- break; + case PMBUS_VOUT_OV_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MAX); +- break; + case PMBUS_IIN_OC_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IIN_MAX); +- break; + case PMBUS_IOUT_OC_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IOUT_MAX); +- break; + case PMBUS_PIN_OP_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_PIN_MAX); +- break; + case PMBUS_POUT_OP_WARN_LIMIT: +- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_POUT_MAX); +- break; + case PMBUS_VIN_UV_FAULT_LIMIT: + case PMBUS_VIN_OV_FAULT_LIMIT: + case PMBUS_VOUT_UV_FAULT_LIMIT: +-- +2.30.2 + diff --git a/queue-5.14/hwmon-remove-amd_energy-driver-in-makefile.patch b/queue-5.14/hwmon-remove-amd_energy-driver-in-makefile.patch new file mode 100644 index 00000000000..6debce249d2 --- /dev/null +++ b/queue-5.14/hwmon-remove-amd_energy-driver-in-makefile.patch @@ -0,0 +1,43 @@ +From 67776fa110f9ac27beb047223109d1adfd3001b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 10:48:11 +0200 +Subject: hwmon: remove amd_energy driver in Makefile + +From: Lukas Bulwahn + +[ Upstream commit b3a7ab2d4376726178909e27b6956c012277ac4e ] + +Commit 9049572fb145 ("hwmon: Remove amd_energy driver") removes the driver, +but misses to adjust the Makefile. + +Hence, ./scripts/checkkconfigsymbols.py warns: + +SENSORS_AMD_ENERGY +Referencing files: drivers/hwmon/Makefile + +Remove the missing piece of this driver removal. + +Fixes: 9049572fb145 ("hwmon: Remove amd_energy driver") +Signed-off-by: Lukas Bulwahn +Link: https://lore.kernel.org/r/20210817084811.10673-1-lukas.bulwahn@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Makefile | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile +index d712c61c1f5e..0241ed84b692 100644 +--- a/drivers/hwmon/Makefile ++++ b/drivers/hwmon/Makefile +@@ -45,7 +45,6 @@ obj-$(CONFIG_SENSORS_ADT7462) += adt7462.o + obj-$(CONFIG_SENSORS_ADT7470) += adt7470.o + obj-$(CONFIG_SENSORS_ADT7475) += adt7475.o + obj-$(CONFIG_SENSORS_AHT10) += aht10.o +-obj-$(CONFIG_SENSORS_AMD_ENERGY) += amd_energy.o + obj-$(CONFIG_SENSORS_APPLESMC) += applesmc.o + obj-$(CONFIG_SENSORS_ARM_SCMI) += scmi-hwmon.o + obj-$(CONFIG_SENSORS_ARM_SCPI) += scpi-hwmon.o +-- +2.30.2 + diff --git a/queue-5.14/i2c-highlander-add-irq-check.patch b/queue-5.14/i2c-highlander-add-irq-check.patch new file mode 100644 index 00000000000..64e386cdaf7 --- /dev/null +++ b/queue-5.14/i2c-highlander-add-irq-check.patch @@ -0,0 +1,39 @@ +From a0322f38d76f4e69f30037107d9b200525e29c32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 May 2021 22:13:45 +0300 +Subject: i2c: highlander: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit f16a3bb69aa6baabf8f0aca982c8cf21e2a4f6bc ] + +The driver is written as if platform_get_irq() returns 0 on errors (while +actually it returns a negative error code), blithely passing these error +codes to request_irq() (which takes *unsigned* IRQ #) -- which fails with +-EINVAL. Add the necessary error check to the pre-existing *if* statement +forcing the driver into the polling mode... + +Fixes: 4ad48e6ab18c ("i2c: Renesas Highlander FPGA SMBus support") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-highlander.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c +index 803dad70e2a7..a2add128d084 100644 +--- a/drivers/i2c/busses/i2c-highlander.c ++++ b/drivers/i2c/busses/i2c-highlander.c +@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + + dev->irq = platform_get_irq(pdev, 0); +- if (iic_force_poll) ++ if (dev->irq < 0 || iic_force_poll) + dev->irq = 0; + + if (dev->irq) { +-- +2.30.2 + diff --git a/queue-5.14/i2c-hix5hd2-fix-irq-check.patch b/queue-5.14/i2c-hix5hd2-fix-irq-check.patch new file mode 100644 index 00000000000..86499874ef7 --- /dev/null +++ b/queue-5.14/i2c-hix5hd2-fix-irq-check.patch @@ -0,0 +1,37 @@ +From 22fbde132b4e8013aa9c0423fb3d19b16b3e745e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 17:35:54 +0300 +Subject: i2c: hix5hd2: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit f9b459c2ba5edfe247e86b45ad5dea8da542f3ea ] + +Iff platform_get_irq() returns 0, the driver's probe() method will return 0 +early (as if the method's call was successful). Let's consider IRQ0 valid +for simplicity -- devm_request_irq() can always override that decision... + +Fixes: 15ef27756b23 ("i2c: hix5hd2: add i2c controller driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-hix5hd2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c +index aa00ba8bcb70..61ae58f57047 100644 +--- a/drivers/i2c/busses/i2c-hix5hd2.c ++++ b/drivers/i2c/busses/i2c-hix5hd2.c +@@ -413,7 +413,7 @@ static int hix5hd2_i2c_probe(struct platform_device *pdev) + return PTR_ERR(priv->regs); + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) ++ if (irq < 0) + return irq; + + priv->clk = devm_clk_get(&pdev->dev, NULL); +-- +2.30.2 + diff --git a/queue-5.14/i2c-iop3xx-fix-deferred-probing.patch b/queue-5.14/i2c-iop3xx-fix-deferred-probing.patch new file mode 100644 index 00000000000..d4f13a6eafb --- /dev/null +++ b/queue-5.14/i2c-iop3xx-fix-deferred-probing.patch @@ -0,0 +1,53 @@ +From 37d43c944fd32b5c7d0f167a154b968265346d42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 23:35:09 +0300 +Subject: i2c: iop3xx: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit a1299505162ad00def3573260c2c68b9c8e8d697 ] + +When adding the code to handle platform_get_irq*() errors in the commit +489447380a29 ("handle errors returned by platform_get_irq*()"), the +actual error code was enforced to be -ENXIO in the driver for some +strange reason. This didn't matter much until the deferred probing was +introduced -- which requires an actual error code to be propagated +upstream from the failure site. + +While fixing this, also stop overriding the errors from request_irq() to +-EIO (done since the pre-git era). + +Fixes: 489447380a29 ("[PATCH] handle errors returned by platform_get_irq*()") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-iop3xx.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c +index cfecaf18ccbb..4a6ff54d87fe 100644 +--- a/drivers/i2c/busses/i2c-iop3xx.c ++++ b/drivers/i2c/busses/i2c-iop3xx.c +@@ -469,16 +469,14 @@ iop3xx_i2c_probe(struct platform_device *pdev) + + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +- ret = -ENXIO; ++ ret = irq; + goto unmap; + } + ret = request_irq(irq, iop3xx_i2c_irq_handler, 0, + pdev->name, adapter_data); + +- if (ret) { +- ret = -EIO; ++ if (ret) + goto unmap; +- } + + memcpy(new_adapter->name, pdev->name, strlen(pdev->name)); + new_adapter->owner = THIS_MODULE; +-- +2.30.2 + diff --git a/queue-5.14/i2c-mt65xx-fix-irq-check.patch b/queue-5.14/i2c-mt65xx-fix-irq-check.patch new file mode 100644 index 00000000000..ad8fae06d1e --- /dev/null +++ b/queue-5.14/i2c-mt65xx-fix-irq-check.patch @@ -0,0 +1,38 @@ +From 75fc01265a2b17771cfc0d0e7f2b021d7ea4c65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 17:38:45 +0300 +Subject: i2c: mt65xx: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 58fb7c643d346e2364404554f531cfa6a1a3917c ] + +Iff platform_get_irq() returns 0, the driver's probe() method will return 0 +early (as if the method's call was successful). Let's consider IRQ0 valid +for simplicity -- devm_request_irq() can always override that decision... + +Fixes: ce38815d39ea ("I2C: mediatek: Add driver for MediaTek I2C controller") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Qii Wang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 4ca716e09149..477480d1de6b 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1211,7 +1211,7 @@ static int mtk_i2c_probe(struct platform_device *pdev) + return PTR_ERR(i2c->pdmabase); + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) ++ if (irq < 0) + return irq; + + init_completion(&i2c->msg_complete); +-- +2.30.2 + diff --git a/queue-5.14/i2c-s3c2410-fix-irq-check.patch b/queue-5.14/i2c-s3c2410-fix-irq-check.patch new file mode 100644 index 00000000000..825a5722deb --- /dev/null +++ b/queue-5.14/i2c-s3c2410-fix-irq-check.patch @@ -0,0 +1,38 @@ +From 16bf848f1c3aec537d311a9f35f3324ee7efa605 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 17:45:25 +0300 +Subject: i2c: s3c2410: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit d6840a5e370b7ea4fde16ce2caf431bcc87f9a75 ] + +Iff platform_get_irq() returns 0, the driver's probe() method will return 0 +early (as if the method's call was successful). Let's consider IRQ0 valid +for simplicity -- devm_request_irq() can always override that decision... + +Fixes: e0d1ec97853f ("i2c-s3c2410: Change IRQ to be plain integer.") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-s3c2410.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index 4d82761e1585..b49a1b170bb2 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1137,7 +1137,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + */ + if (!(i2c->quirks & QUIRK_POLL)) { + i2c->irq = ret = platform_get_irq(pdev, 0); +- if (ret <= 0) { ++ if (ret < 0) { + dev_err(&pdev->dev, "cannot find IRQ\n"); + clk_unprepare(i2c->clk); + return ret; +-- +2.30.2 + diff --git a/queue-5.14/i2c-synquacer-fix-deferred-probing.patch b/queue-5.14/i2c-synquacer-fix-deferred-probing.patch new file mode 100644 index 00000000000..58ee4e4b510 --- /dev/null +++ b/queue-5.14/i2c-synquacer-fix-deferred-probing.patch @@ -0,0 +1,39 @@ +From e0b569d16dc8a8e4f64134d36b50849a2cecdd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 23:39:11 +0300 +Subject: i2c: synquacer: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 8d744da241b81f4211f4813b0d3c1981326fa9ca ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the +error codes upstream. + +Fixes: 0d676a6c4390 ("i2c: add support for Socionext SynQuacer I2C controller") +Signed-off-by: Sergey Shtylyov +Acked-by: Ard Biesheuvel +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-synquacer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c +index 31be1811d5e6..e4026c5416b1 100644 +--- a/drivers/i2c/busses/i2c-synquacer.c ++++ b/drivers/i2c/busses/i2c-synquacer.c +@@ -578,7 +578,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev) + + i2c->irq = platform_get_irq(pdev, 0); + if (i2c->irq < 0) +- return -ENODEV; ++ return i2c->irq; + + ret = devm_request_irq(&pdev->dev, i2c->irq, synquacer_i2c_isr, + 0, dev_name(&pdev->dev), i2c); +-- +2.30.2 + diff --git a/queue-5.14/i2c-xlp9xx-fix-main-irq-check.patch b/queue-5.14/i2c-xlp9xx-fix-main-irq-check.patch new file mode 100644 index 00000000000..925f01cc10a --- /dev/null +++ b/queue-5.14/i2c-xlp9xx-fix-main-irq-check.patch @@ -0,0 +1,39 @@ +From d4f7356b1e66e435e29885fe7f8c4995dcf1e6bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 17:47:54 +0300 +Subject: i2c: xlp9xx: fix main IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 661e8a88e8317eb9ffe69c69d6cb4876370fe7e2 ] + +Iff platform_get_irq() returns 0 for the main IRQ, the driver's probe() +method will return 0 early (as if the method's call was successful). +Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always +override that decision... + +Fixes: 2bbd681ba2b ("i2c: xlp9xx: Driver for Netlogic XLP9XX/5XX I2C controller") +Signed-off-by: Sergey Shtylyov +Reviewed-by: George Cherian +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xlp9xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c +index f2241cedf5d3..6d24dc385522 100644 +--- a/drivers/i2c/busses/i2c-xlp9xx.c ++++ b/drivers/i2c/busses/i2c-xlp9xx.c +@@ -517,7 +517,7 @@ static int xlp9xx_i2c_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + + priv->irq = platform_get_irq(pdev, 0); +- if (priv->irq <= 0) ++ if (priv->irq < 0) + return priv->irq; + /* SMBAlert irq */ + priv->alert_data.irq = platform_get_irq(pdev, 1); +-- +2.30.2 + diff --git a/queue-5.14/i40e-improve-locking-of-mac_filter_hash.patch b/queue-5.14/i40e-improve-locking-of-mac_filter_hash.patch new file mode 100644 index 00000000000..35621fadf6f --- /dev/null +++ b/queue-5.14/i40e-improve-locking-of-mac_filter_hash.patch @@ -0,0 +1,86 @@ +From e55f8bf89d705d836129c2bfddf4bd8f7b5e5526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 10:34:30 +0100 +Subject: i40e: improve locking of mac_filter_hash + +From: Stefan Assmann + +[ Upstream commit 8b4b06919fd66caf49fdf4fe59f9d6312cf7956d ] + +i40e_config_vf_promiscuous_mode() calls +i40e_getnum_vf_vsi_vlan_filters() without acquiring the +mac_filter_hash_lock spinlock. + +This is unsafe because mac_filter_hash may get altered in another thread +while i40e_getnum_vf_vsi_vlan_filters() traverses the hashes. + +Simply adding the spinlock in i40e_getnum_vf_vsi_vlan_filters() is not +possible as it already gets called in i40e_get_vlan_list_sync() with the +spinlock held. Therefore adding a wrapper that acquires the spinlock and +call the correct function where appropriate. + +Fixes: 37d318d7805f ("i40e: Remove scheduling while atomic possibility") +Fix-suggested-by: Paolo Abeni +Signed-off-by: Stefan Assmann +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 ++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index eff0a30790dd..472f56b360b8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1160,12 +1160,12 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf) + } + + /** +- * i40e_getnum_vf_vsi_vlan_filters ++ * __i40e_getnum_vf_vsi_vlan_filters + * @vsi: pointer to the vsi + * + * called to get the number of VLANs offloaded on this VF + **/ +-static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) ++static int __i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) + { + struct i40e_mac_filter *f; + u16 num_vlans = 0, bkt; +@@ -1178,6 +1178,23 @@ static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) + return num_vlans; + } + ++/** ++ * i40e_getnum_vf_vsi_vlan_filters ++ * @vsi: pointer to the vsi ++ * ++ * wrapper for __i40e_getnum_vf_vsi_vlan_filters() with spinlock held ++ **/ ++static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi) ++{ ++ int num_vlans; ++ ++ spin_lock_bh(&vsi->mac_filter_hash_lock); ++ num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi); ++ spin_unlock_bh(&vsi->mac_filter_hash_lock); ++ ++ return num_vlans; ++} ++ + /** + * i40e_get_vlan_list_sync + * @vsi: pointer to the VSI +@@ -1195,7 +1212,7 @@ static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, u16 *num_vlans, + int bkt; + + spin_lock_bh(&vsi->mac_filter_hash_lock); +- *num_vlans = i40e_getnum_vf_vsi_vlan_filters(vsi); ++ *num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi); + *vlan_list = kcalloc(*num_vlans, sizeof(**vlan_list), GFP_ATOMIC); + if (!(*vlan_list)) + goto err; +-- +2.30.2 + diff --git a/queue-5.14/ice-add-lock-around-tx-timestamp-tracker-flush.patch b/queue-5.14/ice-add-lock-around-tx-timestamp-tracker-flush.patch new file mode 100644 index 00000000000..b4547c7eaff --- /dev/null +++ b/queue-5.14/ice-add-lock-around-tx-timestamp-tracker-flush.patch @@ -0,0 +1,50 @@ +From 750e4635b9f97f56b5acff4e679b87088c7346d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 17:01:48 -0700 +Subject: ice: add lock around Tx timestamp tracker flush + +From: Jacob Keller + +[ Upstream commit 4dd0d5c33c3ebf24a07cae6141648aeb7ba56072 ] + +The driver didn't take the lock while flushing the Tx tracker, which +could cause a race where one thread is trying to read timestamps out +while another thread is trying to read the tracker to check the +timestamps. + +Avoid this by ensuring that flushing is locked against read accesses. + +Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") +Signed-off-by: Jacob Keller +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index f54148fb0e21..8970037177fe 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -1278,6 +1278,8 @@ ice_ptp_flush_tx_tracker(struct ice_pf *pf, struct ice_ptp_tx *tx) + { + u8 idx; + ++ spin_lock(&tx->lock); ++ + for (idx = 0; idx < tx->len; idx++) { + u8 phy_idx = idx + tx->quad_offset; + +@@ -1290,6 +1292,8 @@ ice_ptp_flush_tx_tracker(struct ice_pf *pf, struct ice_ptp_tx *tx) + tx->tstamps[idx].skb = NULL; + } + } ++ ++ spin_unlock(&tx->lock); + } + + /** +-- +2.30.2 + diff --git a/queue-5.14/ice-fix-tx-queue-iteration-for-tx-timestamp-enableme.patch b/queue-5.14/ice-fix-tx-queue-iteration-for-tx-timestamp-enableme.patch new file mode 100644 index 00000000000..b230d03e291 --- /dev/null +++ b/queue-5.14/ice-fix-tx-queue-iteration-for-tx-timestamp-enableme.patch @@ -0,0 +1,47 @@ +From cea016e862cbff193c87a6283a37e7b38d9443ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 17:01:46 -0700 +Subject: ice: fix Tx queue iteration for Tx timestamp enablement + +From: Jacob Keller + +[ Upstream commit 84c5fb8c4264ec12ef9d21905c562d2297a0234e ] + +The driver accidentally copied the ice_for_each_rxq iterator when +implementing enablement of the ptp_tx bit for the Tx rings. We still +load the Tx rings and set the ptp_tx field, but we iterate over the +count of the num_rxq. + +If the number of Tx and Rx queues differ, this could either cause +a buffer overrun when accessing the tx_rings list if num_txq is greater +than num_rxq, or it could cause us to fail to enable Tx timestamps for +some rings. + +This was not noticed originally as we generally have the same number of +Tx and Rx queues. + +Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") +Signed-off-by: Jacob Keller +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index 9e3ddb9b8b51..f54148fb0e21 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -22,7 +22,7 @@ static void ice_set_tx_tstamp(struct ice_pf *pf, bool on) + return; + + /* Set the timestamp enable flag for all the Tx rings */ +- ice_for_each_rxq(vsi, i) { ++ ice_for_each_txq(vsi, i) { + if (!vsi->tx_rings[i]) + continue; + vsi->tx_rings[i]->ptp_tx = on; +-- +2.30.2 + diff --git a/queue-5.14/ice-only-lock-to-update-netdev-dev_addr.patch b/queue-5.14/ice-only-lock-to-update-netdev-dev_addr.patch new file mode 100644 index 00000000000..10ee8ff9842 --- /dev/null +++ b/queue-5.14/ice-only-lock-to-update-netdev-dev_addr.patch @@ -0,0 +1,129 @@ +From ea69cb5c74306f51da78c2a5fa5dff35e61e005a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 12:27:53 -0700 +Subject: ice: Only lock to update netdev dev_addr + +From: Brett Creeley + +[ Upstream commit b357d9717be7f95fde2c6c4650b186a995b71e59 ] + +commit 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync +list") introduced calls to netif_addr_lock_bh() and +netif_addr_unlock_bh() in the driver's ndo_set_mac() callback. This is +fine since the driver is updated the netdev's dev_addr, but since this +is a spinlock, the driver cannot sleep when the lock is held. +Unfortunately the functions to add/delete MAC filters depend on a mutex. +This was causing a trace with the lock debug kernel config options +enabled when changing the mac address via iproute. + +[ 203.273059] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 +[ 203.273065] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6698, name: ip +[ 203.273068] Preemption disabled at: +[ 203.273068] [] ice_set_mac_address+0x8b/0x1c0 [ice] +[ 203.273097] CPU: 31 PID: 6698 Comm: ip Tainted: G S W I 5.14.0-rc4 #2 +[ 203.273100] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 +[ 203.273102] Call Trace: +[ 203.273107] dump_stack_lvl+0x33/0x42 +[ 203.273113] ? ice_set_mac_address+0x8b/0x1c0 [ice] +[ 203.273124] ___might_sleep.cold.150+0xda/0xea +[ 203.273131] mutex_lock+0x1c/0x40 +[ 203.273136] ice_remove_mac+0xe3/0x180 [ice] +[ 203.273155] ? ice_fltr_add_mac_list+0x20/0x20 [ice] +[ 203.273175] ice_fltr_prepare_mac+0x43/0xa0 [ice] +[ 203.273194] ice_set_mac_address+0xab/0x1c0 [ice] +[ 203.273206] dev_set_mac_address+0xb8/0x120 +[ 203.273210] dev_set_mac_address_user+0x2c/0x50 +[ 203.273212] do_setlink+0x1dd/0x10e0 +[ 203.273217] ? __nla_validate_parse+0x12d/0x1a0 +[ 203.273221] __rtnl_newlink+0x530/0x910 +[ 203.273224] ? __kmalloc_node_track_caller+0x17f/0x380 +[ 203.273230] ? preempt_count_add+0x68/0xa0 +[ 203.273236] ? _raw_spin_lock_irqsave+0x1f/0x30 +[ 203.273241] ? kmem_cache_alloc_trace+0x4d/0x440 +[ 203.273244] rtnl_newlink+0x43/0x60 +[ 203.273245] rtnetlink_rcv_msg+0x13a/0x380 +[ 203.273248] ? rtnl_calcit.isra.40+0x130/0x130 +[ 203.273250] netlink_rcv_skb+0x4e/0x100 +[ 203.273256] netlink_unicast+0x1a2/0x280 +[ 203.273258] netlink_sendmsg+0x242/0x490 +[ 203.273260] sock_sendmsg+0x58/0x60 +[ 203.273263] ____sys_sendmsg+0x1ef/0x260 +[ 203.273265] ? copy_msghdr_from_user+0x5c/0x90 +[ 203.273268] ? ____sys_recvmsg+0xe6/0x170 +[ 203.273270] ___sys_sendmsg+0x7c/0xc0 +[ 203.273272] ? copy_msghdr_from_user+0x5c/0x90 +[ 203.273274] ? ___sys_recvmsg+0x89/0xc0 +[ 203.273276] ? __netlink_sendskb+0x50/0x50 +[ 203.273278] ? mod_objcg_state+0xee/0x310 +[ 203.273282] ? __dentry_kill+0x114/0x170 +[ 203.273286] ? get_max_files+0x10/0x10 +[ 203.273288] __sys_sendmsg+0x57/0xa0 +[ 203.273290] do_syscall_64+0x37/0x80 +[ 203.273295] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 203.273296] RIP: 0033:0x7f8edf96e278 +[ 203.273298] Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 63 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55 +[ 203.273300] RSP: 002b:00007ffcb8bdac08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[ 203.273303] RAX: ffffffffffffffda RBX: 000000006115e0ae RCX: 00007f8edf96e278 +[ 203.273304] RDX: 0000000000000000 RSI: 00007ffcb8bdac70 RDI: 0000000000000003 +[ 203.273305] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007ffcb8bda5b0 +[ 203.273306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 +[ 203.273306] R13: 0000555e10092020 R14: 0000000000000000 R15: 0000000000000005 + +Fix this by only locking when changing the netdev->dev_addr. Also, make +sure to restore the old netdev->dev_addr on any failures. + +Fixes: 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list") +Signed-off-by: Brett Creeley +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index fe2ded775f25..a8bd512d5b45 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5122,6 +5122,7 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi) + struct ice_hw *hw = &pf->hw; + struct sockaddr *addr = pi; + enum ice_status status; ++ u8 old_mac[ETH_ALEN]; + u8 flags = 0; + int err = 0; + u8 *mac; +@@ -5144,8 +5145,13 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi) + } + + netif_addr_lock_bh(netdev); ++ ether_addr_copy(old_mac, netdev->dev_addr); ++ /* change the netdev's MAC address */ ++ memcpy(netdev->dev_addr, mac, netdev->addr_len); ++ netif_addr_unlock_bh(netdev); ++ + /* Clean up old MAC filter. Not an error if old filter doesn't exist */ +- status = ice_fltr_remove_mac(vsi, netdev->dev_addr, ICE_FWD_TO_VSI); ++ status = ice_fltr_remove_mac(vsi, old_mac, ICE_FWD_TO_VSI); + if (status && status != ICE_ERR_DOES_NOT_EXIST) { + err = -EADDRNOTAVAIL; + goto err_update_filters; +@@ -5168,13 +5174,12 @@ err_update_filters: + if (err) { + netdev_err(netdev, "can't set MAC %pM. filter update failed\n", + mac); ++ netif_addr_lock_bh(netdev); ++ ether_addr_copy(netdev->dev_addr, old_mac); + netif_addr_unlock_bh(netdev); + return err; + } + +- /* change the netdev's MAC address */ +- memcpy(netdev->dev_addr, mac, netdev->addr_len); +- netif_addr_unlock_bh(netdev); + netdev_dbg(vsi->netdev, "updated MAC address to %pM\n", + netdev->dev_addr); + +-- +2.30.2 + diff --git a/queue-5.14/ice-restart-periodic-outputs-around-time-changes.patch b/queue-5.14/ice-restart-periodic-outputs-around-time-changes.patch new file mode 100644 index 00000000000..395686a226c --- /dev/null +++ b/queue-5.14/ice-restart-periodic-outputs-around-time-changes.patch @@ -0,0 +1,122 @@ +From 63c86d686846e8ab1fc96403481d24d16589ba96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 17:01:49 -0700 +Subject: ice: restart periodic outputs around time changes + +From: Jacob Keller + +[ Upstream commit 9ee313433c483e4a6ecd517c38c0f8aee1962c53 ] + +When we enabled auxiliary input/output support for the E810 device, we +forgot to add logic to restart the output when we change time. This is +important as the periodic output will be incorrect after a time change +otherwise. + +This unfortunately includes the adjust time function, even though it +uses an atomic hardware interface. The atomic adjustment can still cause +the pin output to stall permanently, so we need to stop and restart it. + +Introduce wrapper functions to temporarily disable and then re-enable +the clock outputs. + +Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins") +Signed-off-by: Jacob Keller +Tested-by: Sunitha D Mekala +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 49 ++++++++++++++++++++++++ + 1 file changed, 49 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index 8970037177fe..234bc68e79f9 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -688,6 +688,41 @@ err: + return -EFAULT; + } + ++/** ++ * ice_ptp_disable_all_clkout - Disable all currently configured outputs ++ * @pf: pointer to the PF structure ++ * ++ * Disable all currently configured clock outputs. This is necessary before ++ * certain changes to the PTP hardware clock. Use ice_ptp_enable_all_clkout to ++ * re-enable the clocks again. ++ */ ++static void ice_ptp_disable_all_clkout(struct ice_pf *pf) ++{ ++ uint i; ++ ++ for (i = 0; i < pf->ptp.info.n_per_out; i++) ++ if (pf->ptp.perout_channels[i].ena) ++ ice_ptp_cfg_clkout(pf, i, NULL, false); ++} ++ ++/** ++ * ice_ptp_enable_all_clkout - Enable all configured periodic clock outputs ++ * @pf: pointer to the PF structure ++ * ++ * Enable all currently configured clock outputs. Use this after ++ * ice_ptp_disable_all_clkout to reconfigure the output signals according to ++ * their configuration. ++ */ ++static void ice_ptp_enable_all_clkout(struct ice_pf *pf) ++{ ++ uint i; ++ ++ for (i = 0; i < pf->ptp.info.n_per_out; i++) ++ if (pf->ptp.perout_channels[i].ena) ++ ice_ptp_cfg_clkout(pf, i, &pf->ptp.perout_channels[i], ++ false); ++} ++ + /** + * ice_ptp_gpio_enable_e810 - Enable/disable ancillary features of PHC + * @info: the driver's PTP info structure +@@ -783,12 +818,17 @@ ice_ptp_settime64(struct ptp_clock_info *info, const struct timespec64 *ts) + goto exit; + } + ++ /* Disable periodic outputs */ ++ ice_ptp_disable_all_clkout(pf); ++ + err = ice_ptp_write_init(pf, &ts64); + ice_ptp_unlock(hw); + + if (!err) + ice_ptp_update_cached_phctime(pf); + ++ /* Reenable periodic outputs */ ++ ice_ptp_enable_all_clkout(pf); + exit: + if (err) { + dev_err(ice_pf_to_dev(pf), "PTP failed to set time %d\n", err); +@@ -842,8 +882,14 @@ static int ice_ptp_adjtime(struct ptp_clock_info *info, s64 delta) + return -EBUSY; + } + ++ /* Disable periodic outputs */ ++ ice_ptp_disable_all_clkout(pf); ++ + err = ice_ptp_write_adj(pf, delta); + ++ /* Reenable periodic outputs */ ++ ice_ptp_enable_all_clkout(pf); ++ + ice_ptp_unlock(hw); + + if (err) { +@@ -1554,6 +1600,9 @@ void ice_ptp_release(struct ice_pf *pf) + if (!pf->ptp.clock) + return; + ++ /* Disable periodic outputs */ ++ ice_ptp_disable_all_clkout(pf); ++ + ice_clear_ptp_clock_index(pf); + ptp_clock_unregister(pf->ptp.clock); + pf->ptp.clock = NULL; +-- +2.30.2 + diff --git a/queue-5.14/io-wq-remove-gfp_atomic-allocation-off-schedule-out-.patch b/queue-5.14/io-wq-remove-gfp_atomic-allocation-off-schedule-out-.patch new file mode 100644 index 00000000000..a72ef5223ce --- /dev/null +++ b/queue-5.14/io-wq-remove-gfp_atomic-allocation-off-schedule-out-.patch @@ -0,0 +1,208 @@ +From 502f2173fc850e92cb19743e6b215030158b9f87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 08:37:25 -0600 +Subject: io-wq: remove GFP_ATOMIC allocation off schedule out path + +From: Jens Axboe + +[ Upstream commit d3e9f732c415cf22faa33d6f195e291ad82dc92e ] + +Daniel reports that the v5.14-rc4-rt4 kernel throws a BUG when running +stress-ng: + +| [ 90.202543] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 +| [ 90.202549] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2047, name: iou-wrk-2041 +| [ 90.202555] CPU: 5 PID: 2047 Comm: iou-wrk-2041 Tainted: G W 5.14.0-rc4-rt4+ #89 +| [ 90.202559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +| [ 90.202561] Call Trace: +| [ 90.202577] dump_stack_lvl+0x34/0x44 +| [ 90.202584] ___might_sleep.cold+0x87/0x94 +| [ 90.202588] rt_spin_lock+0x19/0x70 +| [ 90.202593] ___slab_alloc+0xcb/0x7d0 +| [ 90.202598] ? newidle_balance.constprop.0+0xf5/0x3b0 +| [ 90.202603] ? dequeue_entity+0xc3/0x290 +| [ 90.202605] ? io_wqe_dec_running.isra.0+0x98/0xe0 +| [ 90.202610] ? pick_next_task_fair+0xb9/0x330 +| [ 90.202612] ? __schedule+0x670/0x1410 +| [ 90.202615] ? io_wqe_dec_running.isra.0+0x98/0xe0 +| [ 90.202618] kmem_cache_alloc_trace+0x79/0x1f0 +| [ 90.202621] io_wqe_dec_running.isra.0+0x98/0xe0 +| [ 90.202625] io_wq_worker_sleeping+0x37/0x50 +| [ 90.202628] schedule+0x30/0xd0 +| [ 90.202630] schedule_timeout+0x8f/0x1a0 +| [ 90.202634] ? __bpf_trace_tick_stop+0x10/0x10 +| [ 90.202637] io_wqe_worker+0xfd/0x320 +| [ 90.202641] ? finish_task_switch.isra.0+0xd3/0x290 +| [ 90.202644] ? io_worker_handle_work+0x670/0x670 +| [ 90.202646] ? io_worker_handle_work+0x670/0x670 +| [ 90.202649] ret_from_fork+0x22/0x30 + +which is due to the RT kernel not liking a GFP_ATOMIC allocation inside +a raw spinlock. Besides that not working on RT, doing any kind of +allocation from inside schedule() is kind of nasty and should be avoided +if at all possible. + +This particular path happens when an io-wq worker goes to sleep, and we +need a new worker to handle pending work. We currently allocate a small +data item to hold the information we need to create a new worker, but we +can instead include this data in the io_worker struct itself and just +protect it with a single bit lock. We only really need one per worker +anyway, as we will have run pending work between to sleep cycles. + +https://lore.kernel.org/lkml/20210804082418.fbibprcwtzyt5qax@beryllium.lan/ +Reported-by: Daniel Wagner +Tested-by: Daniel Wagner +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io-wq.c | 72 ++++++++++++++++++++++++++++++------------------------ + 1 file changed, 40 insertions(+), 32 deletions(-) + +diff --git a/fs/io-wq.c b/fs/io-wq.c +index 7d2ed8c7dd31..4ce83bb48021 100644 +--- a/fs/io-wq.c ++++ b/fs/io-wq.c +@@ -51,6 +51,10 @@ struct io_worker { + + struct completion ref_done; + ++ unsigned long create_state; ++ struct callback_head create_work; ++ int create_index; ++ + struct rcu_head rcu; + }; + +@@ -272,24 +276,18 @@ static void io_wqe_inc_running(struct io_worker *worker) + atomic_inc(&acct->nr_running); + } + +-struct create_worker_data { +- struct callback_head work; +- struct io_wqe *wqe; +- int index; +-}; +- + static void create_worker_cb(struct callback_head *cb) + { +- struct create_worker_data *cwd; ++ struct io_worker *worker; + struct io_wq *wq; + struct io_wqe *wqe; + struct io_wqe_acct *acct; + bool do_create = false, first = false; + +- cwd = container_of(cb, struct create_worker_data, work); +- wqe = cwd->wqe; ++ worker = container_of(cb, struct io_worker, create_work); ++ wqe = worker->wqe; + wq = wqe->wq; +- acct = &wqe->acct[cwd->index]; ++ acct = &wqe->acct[worker->create_index]; + raw_spin_lock_irq(&wqe->lock); + if (acct->nr_workers < acct->max_workers) { + if (!acct->nr_workers) +@@ -299,33 +297,42 @@ static void create_worker_cb(struct callback_head *cb) + } + raw_spin_unlock_irq(&wqe->lock); + if (do_create) { +- create_io_worker(wq, wqe, cwd->index, first); ++ create_io_worker(wq, wqe, worker->create_index, first); + } else { + atomic_dec(&acct->nr_running); + io_worker_ref_put(wq); + } +- kfree(cwd); ++ clear_bit_unlock(0, &worker->create_state); ++ io_worker_release(worker); + } + +-static void io_queue_worker_create(struct io_wqe *wqe, struct io_wqe_acct *acct) ++static void io_queue_worker_create(struct io_wqe *wqe, struct io_worker *worker, ++ struct io_wqe_acct *acct) + { +- struct create_worker_data *cwd; + struct io_wq *wq = wqe->wq; + + /* raced with exit, just ignore create call */ + if (test_bit(IO_WQ_BIT_EXIT, &wq->state)) + goto fail; ++ if (!io_worker_get(worker)) ++ goto fail; ++ /* ++ * create_state manages ownership of create_work/index. We should ++ * only need one entry per worker, as the worker going to sleep ++ * will trigger the condition, and waking will clear it once it ++ * runs the task_work. ++ */ ++ if (test_bit(0, &worker->create_state) || ++ test_and_set_bit_lock(0, &worker->create_state)) ++ goto fail_release; + +- cwd = kmalloc(sizeof(*cwd), GFP_ATOMIC); +- if (cwd) { +- init_task_work(&cwd->work, create_worker_cb); +- cwd->wqe = wqe; +- cwd->index = acct->index; +- if (!task_work_add(wq->task, &cwd->work, TWA_SIGNAL)) +- return; +- +- kfree(cwd); +- } ++ init_task_work(&worker->create_work, create_worker_cb); ++ worker->create_index = acct->index; ++ if (!task_work_add(wq->task, &worker->create_work, TWA_SIGNAL)) ++ return; ++ clear_bit_unlock(0, &worker->create_state); ++fail_release: ++ io_worker_release(worker); + fail: + atomic_dec(&acct->nr_running); + io_worker_ref_put(wq); +@@ -343,7 +350,7 @@ static void io_wqe_dec_running(struct io_worker *worker) + if (atomic_dec_and_test(&acct->nr_running) && io_wqe_run_queue(wqe)) { + atomic_inc(&acct->nr_running); + atomic_inc(&wqe->wq->worker_refs); +- io_queue_worker_create(wqe, acct); ++ io_queue_worker_create(wqe, worker, acct); + } + } + +@@ -1004,12 +1011,12 @@ err_wq: + + static bool io_task_work_match(struct callback_head *cb, void *data) + { +- struct create_worker_data *cwd; ++ struct io_worker *worker; + + if (cb->func != create_worker_cb) + return false; +- cwd = container_of(cb, struct create_worker_data, work); +- return cwd->wqe->wq == data; ++ worker = container_of(cb, struct io_worker, create_work); ++ return worker->wqe->wq == data; + } + + void io_wq_exit_start(struct io_wq *wq) +@@ -1026,12 +1033,13 @@ static void io_wq_exit_workers(struct io_wq *wq) + return; + + while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) { +- struct create_worker_data *cwd; ++ struct io_worker *worker; + +- cwd = container_of(cb, struct create_worker_data, work); +- atomic_dec(&cwd->wqe->acct[cwd->index].nr_running); ++ worker = container_of(cb, struct io_worker, create_work); ++ atomic_dec(&worker->wqe->acct[worker->create_index].nr_running); + io_worker_ref_put(wq); +- kfree(cwd); ++ clear_bit_unlock(0, &worker->create_state); ++ io_worker_release(worker); + } + + rcu_read_lock(); +-- +2.30.2 + diff --git a/queue-5.14/ionic-cleanly-release-devlink-instance.patch b/queue-5.14/ionic-cleanly-release-devlink-instance.patch new file mode 100644 index 00000000000..22a46fd4452 --- /dev/null +++ b/queue-5.14/ionic-cleanly-release-devlink-instance.patch @@ -0,0 +1,61 @@ +From 575b6158e46e27aab24680a4f5b3c0c2cb3b0052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 15:39:44 +0300 +Subject: ionic: cleanly release devlink instance + +From: Leon Romanovsky + +[ Upstream commit c2255ff47768c94a0ebc3968f007928bb47ea43b ] + +The failure to register devlink will leave the system with dangled +devlink resource, which is not cleaned if devlink_port_register() fails. + +In order to remove access to ".registered" field of struct devlink_port, +require both devlink_register and devlink_port_register to success and +check it through device pointer. + +Fixes: fbfb8031533c ("ionic: Add hardware init and device commands") +Reviewed-by: Moshe Shemesh +Signed-off-by: Leon Romanovsky +Acked-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/pensando/ionic/ionic_devlink.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c +index b41301a5b0df..cd520e4c5522 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c +@@ -91,20 +91,20 @@ int ionic_devlink_register(struct ionic *ionic) + attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL; + devlink_port_attrs_set(&ionic->dl_port, &attrs); + err = devlink_port_register(dl, &ionic->dl_port, 0); +- if (err) ++ if (err) { + dev_err(ionic->dev, "devlink_port_register failed: %d\n", err); +- else +- devlink_port_type_eth_set(&ionic->dl_port, +- ionic->lif->netdev); ++ devlink_unregister(dl); ++ return err; ++ } + +- return err; ++ devlink_port_type_eth_set(&ionic->dl_port, ionic->lif->netdev); ++ return 0; + } + + void ionic_devlink_unregister(struct ionic *ionic) + { + struct devlink *dl = priv_to_devlink(ionic); + +- if (ionic->dl_port.registered) +- devlink_port_unregister(&ionic->dl_port); ++ devlink_port_unregister(&ionic->dl_port); + devlink_unregister(dl); + } +-- +2.30.2 + diff --git a/queue-5.14/ipv4-fix-endianness-issue-in-inet_rtm_getroute_build.patch b/queue-5.14/ipv4-fix-endianness-issue-in-inet_rtm_getroute_build.patch new file mode 100644 index 00000000000..f90c7ddbbb3 --- /dev/null +++ b/queue-5.14/ipv4-fix-endianness-issue-in-inet_rtm_getroute_build.patch @@ -0,0 +1,43 @@ +From 94445592884a61b6ab0eb7a4e3c3e2aa36cf8452 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 19:02:10 -0700 +Subject: ipv4: fix endianness issue in inet_rtm_getroute_build_skb() + +From: Eric Dumazet + +[ Upstream commit 92548b0ee220e000d81c27ac9a80e0ede895a881 ] + +The UDP length field should be in network order. +This removes the following sparse error: + +net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types) +net/ipv4/route.c:3173:27: expected restricted __be16 [usertype] len +net/ipv4/route.c:3173:27: got unsigned long + +Fixes: 404eb77ea766 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE") +Signed-off-by: Eric Dumazet +Cc: Roopa Prabhu +Cc: David Ahern +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 225714b5efc0..94e33d3eaf62 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -3184,7 +3184,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst, + udph = skb_put_zero(skb, sizeof(struct udphdr)); + udph->source = sport; + udph->dest = dport; +- udph->len = sizeof(struct udphdr); ++ udph->len = htons(sizeof(struct udphdr)); + udph->check = 0; + break; + } +-- +2.30.2 + diff --git a/queue-5.14/ipv4-make-exception-cache-less-predictible.patch b/queue-5.14/ipv4-make-exception-cache-less-predictible.patch new file mode 100644 index 00000000000..8923b304809 --- /dev/null +++ b/queue-5.14/ipv4-make-exception-cache-less-predictible.patch @@ -0,0 +1,127 @@ +From fb2af91aae6b475f0de5db3d5593236a60fbc847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 15:16:15 -0700 +Subject: ipv4: make exception cache less predictible + +From: Eric Dumazet + +[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ] + +Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in +fnhe_hashfun()"), an attacker can still use brute force to learn +some secrets from a victim linux host. + +One way to defeat these attacks is to make the max depth of the hash +table bucket a random value. + +Before this patch, each bucket of the hash table used to store exceptions +could contain 6 items under attack. + +After the patch, each bucket would contains a random number of items, +between 6 and 10. The attacker can no longer infer secrets. + +This is slightly increasing memory size used by the hash table, +by 50% in average, we do not expect this to be a problem. + +This patch is more complex than the prior one (IPv6 equivalent), +because IPv4 was reusing the oldest entry. +Since we need to be able to evict more than one entry per +update_or_create_fnhe() call, I had to replace +fnhe_oldest() with fnhe_remove_oldest(). + +Also note that we will queue extra kfree_rcu() calls under stress, +which hopefully wont be a too big issue. + +Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.") +Signed-off-by: Eric Dumazet +Reported-by: Keyu Man +Cc: Willy Tarreau +Signed-off-by: David S. Miller +Reviewed-by: David Ahern +Tested-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 46 ++++++++++++++++++++++++++++++---------------- + 1 file changed, 30 insertions(+), 16 deletions(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index a6f20ee35335..225714b5efc0 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -586,18 +586,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) + } + } + +-static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash) ++static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) + { +- struct fib_nh_exception *fnhe, *oldest; ++ struct fib_nh_exception __rcu **fnhe_p, **oldest_p; ++ struct fib_nh_exception *fnhe, *oldest = NULL; + +- oldest = rcu_dereference(hash->chain); +- for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe; +- fnhe = rcu_dereference(fnhe->fnhe_next)) { +- if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) ++ for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { ++ fnhe = rcu_dereference_protected(*fnhe_p, ++ lockdep_is_held(&fnhe_lock)); ++ if (!fnhe) ++ break; ++ if (!oldest || ++ time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) { + oldest = fnhe; ++ oldest_p = fnhe_p; ++ } + } + fnhe_flush_routes(oldest); +- return oldest; ++ *oldest_p = oldest->fnhe_next; ++ kfree_rcu(oldest, rcu); + } + + static u32 fnhe_hashfun(__be32 daddr) +@@ -676,16 +683,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, + if (rt) + fill_route_from_fnhe(rt, fnhe); + } else { +- if (depth > FNHE_RECLAIM_DEPTH) +- fnhe = fnhe_oldest(hash); +- else { +- fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); +- if (!fnhe) +- goto out_unlock; +- +- fnhe->fnhe_next = hash->chain; +- rcu_assign_pointer(hash->chain, fnhe); ++ /* Randomize max depth to avoid some side channels attacks. */ ++ int max_depth = FNHE_RECLAIM_DEPTH + ++ prandom_u32_max(FNHE_RECLAIM_DEPTH); ++ ++ while (depth > max_depth) { ++ fnhe_remove_oldest(hash); ++ depth--; + } ++ ++ fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); ++ if (!fnhe) ++ goto out_unlock; ++ ++ fnhe->fnhe_next = hash->chain; ++ + fnhe->fnhe_genid = genid; + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; +@@ -693,6 +705,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, + fnhe->fnhe_mtu_locked = lock; + fnhe->fnhe_expires = max(1UL, expires); + ++ rcu_assign_pointer(hash->chain, fnhe); ++ + /* Exception created; mark the cached routes for the nexthop + * stale, so anyone caching it rechecks if this exception + * applies to them. +-- +2.30.2 + diff --git a/queue-5.14/ipv6-make-exception-cache-less-predictible.patch b/queue-5.14/ipv6-make-exception-cache-less-predictible.patch new file mode 100644 index 00000000000..dc3abed416c --- /dev/null +++ b/queue-5.14/ipv6-make-exception-cache-less-predictible.patch @@ -0,0 +1,65 @@ +From 2304acfa812865c07a2a8889973f732f8fd48604 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 15:16:14 -0700 +Subject: ipv6: make exception cache less predictible + +From: Eric Dumazet + +[ Upstream commit a00df2caffed3883c341d5685f830434312e4a43 ] + +Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), +an attacker can still use brute force to learn some secrets from a victim +linux host. + +One way to defeat these attacks is to make the max depth of the hash +table bucket a random value. + +Before this patch, each bucket of the hash table used to store exceptions +could contain 6 items under attack. + +After the patch, each bucket would contains a random number of items, +between 6 and 10. The attacker can no longer infer secrets. + +This is slightly increasing memory size used by the hash table, +we do not expect this to be a problem. + +Following patch is dealing with the same issue in IPv4. + +Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") +Signed-off-by: Eric Dumazet +Reported-by: Keyu Man +Cc: Wei Wang +Cc: Martin KaFai Lau +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c5e8ecb96426..603340302101 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt, + struct in6_addr *src_key = NULL; + struct rt6_exception *rt6_ex; + struct fib6_nh *nh = res->nh; ++ int max_depth; + int err = 0; + + spin_lock_bh(&rt6_exception_lock); +@@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt, + bucket->depth++; + net->ipv6.rt6_stats->fib_rt_cache++; + +- if (bucket->depth > FIB6_MAX_DEPTH) ++ /* Randomize max depth to avoid some side channels attacks. */ ++ max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH); ++ while (bucket->depth > max_depth) + rt6_exception_remove_oldest(bucket); + + out: +-- +2.30.2 + diff --git a/queue-5.14/irqchip-apple-aic-fix-irq_disable-from-within-irq-ha.patch b/queue-5.14/irqchip-apple-aic-fix-irq_disable-from-within-irq-ha.patch new file mode 100644 index 00000000000..d3ae70284f0 --- /dev/null +++ b/queue-5.14/irqchip-apple-aic-fix-irq_disable-from-within-irq-ha.patch @@ -0,0 +1,49 @@ +From 90cc658bf065df89aa0867dc3fcc624fd570d96c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 12:09:42 +0200 +Subject: irqchip/apple-aic: Fix irq_disable from within irq handlers + +From: Sven Peter + +[ Upstream commit 60a1cd10b222e004f860d14651e80089c77e8e6b ] + +When disable_irq_nosync for an interrupt is called from within its +interrupt handler, this interrupt is only marked as disabled with the +intention to mask it when it triggers again. +The AIC hardware however automatically masks the interrupt when it is read. +aic_irq_eoi then unmasks it again if it's not disabled *and* not masked. +This results in a state mismatch between the hardware state and the +state kept in irq_data: The hardware interrupt is masked but +IRQD_IRQ_MASKED is not set. Any further calls to unmask_irq will directly +return and the interrupt can never be enabled again. + +Fix this by keeping the hardware and irq_data state in sync by unmasking in +aic_irq_eoi if and only if the irq_data state also assumes the interrupt to +be unmasked. + +Fixes: 76cde2639411 ("irqchip/apple-aic: Add support for the Apple Interrupt Controller") +Signed-off-by: Sven Peter +Acked-by: Hector Martin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210812100942.17206-1-sven@svenpeter.dev +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-apple-aic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c +index b8c06bd8659e..6fc145aacaf0 100644 +--- a/drivers/irqchip/irq-apple-aic.c ++++ b/drivers/irqchip/irq-apple-aic.c +@@ -226,7 +226,7 @@ static void aic_irq_eoi(struct irq_data *d) + * Reading the interrupt reason automatically acknowledges and masks + * the IRQ, so we just unmask it here if needed. + */ +- if (!irqd_irq_disabled(d) && !irqd_irq_masked(d)) ++ if (!irqd_irq_masked(d)) + aic_irq_unmask(d); + } + +-- +2.30.2 + diff --git a/queue-5.14/irqchip-gic-v3-fix-priority-comparison-when-non-secu.patch b/queue-5.14/irqchip-gic-v3-fix-priority-comparison-when-non-secu.patch new file mode 100644 index 00000000000..ce3ee1a4eb7 --- /dev/null +++ b/queue-5.14/irqchip-gic-v3-fix-priority-comparison-when-non-secu.patch @@ -0,0 +1,76 @@ +From cb14099faed5ae818e7c999d8f6c10ee8510107f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 01:15:05 +0800 +Subject: irqchip/gic-v3: Fix priority comparison when non-secure priorities + are used + +From: Chen-Yu Tsai + +[ Upstream commit 8d474deaba2c4dd33a5e2f5be82e6798ffa6b8a5 ] + +When non-secure priorities are used, compared to the raw priority set, +the value read back from RPR is also right-shifted by one and the +highest bit set. + +Add a macro to do the modifications to the raw priority when doing the +comparison against the RPR value. This corrects the pseudo-NMI behavior +when non-secure priorities in the GIC are used. Tested on 5.10 with +the "IPI as pseudo-NMI" series [1] applied on MT8195. + +[1] https://lore.kernel.org/linux-arm-kernel/1604317487-14543-1-git-send-email-sumit.garg@linaro.org/ + +Fixes: 336780590990 ("irqchip/gic-v3: Support pseudo-NMIs when SCR_EL3.FIQ == 0") +Reviewed-by: Alexandru Elisei +Signed-off-by: Chen-Yu Tsai +[maz: Added comment contributed by Alex] +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210811171505.1502090-1-wenst@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index e0f4debe64e1..3e61210da04b 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -100,6 +100,27 @@ EXPORT_SYMBOL(gic_pmr_sync); + DEFINE_STATIC_KEY_FALSE(gic_nonsecure_priorities); + EXPORT_SYMBOL(gic_nonsecure_priorities); + ++/* ++ * When the Non-secure world has access to group 0 interrupts (as a ++ * consequence of SCR_EL3.FIQ == 0), reading the ICC_RPR_EL1 register will ++ * return the Distributor's view of the interrupt priority. ++ * ++ * When GIC security is enabled (GICD_CTLR.DS == 0), the interrupt priority ++ * written by software is moved to the Non-secure range by the Distributor. ++ * ++ * If both are true (which is when gic_nonsecure_priorities gets enabled), ++ * we need to shift down the priority programmed by software to match it ++ * against the value returned by ICC_RPR_EL1. ++ */ ++#define GICD_INT_RPR_PRI(priority) \ ++ ({ \ ++ u32 __priority = (priority); \ ++ if (static_branch_unlikely(&gic_nonsecure_priorities)) \ ++ __priority = 0x80 | (__priority >> 1); \ ++ \ ++ __priority; \ ++ }) ++ + /* ppi_nmi_refs[n] == number of cpus having ppi[n + 16] set as NMI */ + static refcount_t *ppi_nmi_refs; + +@@ -687,7 +708,7 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs + return; + + if (gic_supports_nmi() && +- unlikely(gic_read_rpr() == GICD_INT_NMI_PRI)) { ++ unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI))) { + gic_handle_nmi(irqnr, regs); + return; + } +-- +2.30.2 + diff --git a/queue-5.14/irqchip-loongson-pch-pic-improve-edge-triggered-inte.patch b/queue-5.14/irqchip-loongson-pch-pic-improve-edge-triggered-inte.patch new file mode 100644 index 00000000000..4221bd89b27 --- /dev/null +++ b/queue-5.14/irqchip-loongson-pch-pic-improve-edge-triggered-inte.patch @@ -0,0 +1,78 @@ +From adf115308379b52ecebe2cda1d1206d9dfcd4395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 21:22:16 +0800 +Subject: irqchip/loongson-pch-pic: Improve edge triggered interrupt support + +From: Huacai Chen + +[ Upstream commit e5dec38ac5d05d17a7110c8045aa101015281e4d ] + +Edge-triggered mode and level-triggered mode need different handlers, +and edge-triggered mode need a specific ack operation. So improve it. + +Fixes: ef8c01eb64ca6719da449dab0 ("irqchip: Add Loongson PCH PIC controller") +Signed-off-by: Chen Zhu +Signed-off-by: Huacai Chen +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210805132216.3539007-1-chenhuacai@loongson.cn +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-loongson-pch-pic.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-loongson-pch-pic.c b/drivers/irqchip/irq-loongson-pch-pic.c +index f790ca6d78aa..a4eb8a2181c7 100644 +--- a/drivers/irqchip/irq-loongson-pch-pic.c ++++ b/drivers/irqchip/irq-loongson-pch-pic.c +@@ -92,18 +92,22 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type) + case IRQ_TYPE_EDGE_RISING: + pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq); + pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq); ++ irq_set_handler_locked(d, handle_edge_irq); + break; + case IRQ_TYPE_EDGE_FALLING: + pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq); + pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq); ++ irq_set_handler_locked(d, handle_edge_irq); + break; + case IRQ_TYPE_LEVEL_HIGH: + pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq); + pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq); ++ irq_set_handler_locked(d, handle_level_irq); + break; + case IRQ_TYPE_LEVEL_LOW: + pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq); + pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq); ++ irq_set_handler_locked(d, handle_level_irq); + break; + default: + ret = -EINVAL; +@@ -113,11 +117,24 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type) + return ret; + } + ++static void pch_pic_ack_irq(struct irq_data *d) ++{ ++ unsigned int reg; ++ struct pch_pic *priv = irq_data_get_irq_chip_data(d); ++ ++ reg = readl(priv->base + PCH_PIC_EDGE + PIC_REG_IDX(d->hwirq) * 4); ++ if (reg & BIT(PIC_REG_BIT(d->hwirq))) { ++ writel(BIT(PIC_REG_BIT(d->hwirq)), ++ priv->base + PCH_PIC_CLR + PIC_REG_IDX(d->hwirq) * 4); ++ } ++ irq_chip_ack_parent(d); ++} ++ + static struct irq_chip pch_pic_irq_chip = { + .name = "PCH PIC", + .irq_mask = pch_pic_mask_irq, + .irq_unmask = pch_pic_unmask_irq, +- .irq_ack = irq_chip_ack_parent, ++ .irq_ack = pch_pic_ack_irq, + .irq_set_affinity = irq_chip_set_affinity_parent, + .irq_set_type = pch_pic_set_type, + }; +-- +2.30.2 + diff --git a/queue-5.14/isofs-joliet-fix-iocharset-utf8-mount-option.patch b/queue-5.14/isofs-joliet-fix-iocharset-utf8-mount-option.patch new file mode 100644 index 00000000000..c83afa31969 --- /dev/null +++ b/queue-5.14/isofs-joliet-fix-iocharset-utf8-mount-option.patch @@ -0,0 +1,153 @@ +From 29f7ade74d3d795b5058b93011396cddb7d6b75d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 18:24:37 +0200 +Subject: isofs: joliet: Fix iocharset=utf8 mount option +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ] + +Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, +it is required to use utf8 mount option. + +Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount +option. + +If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So +simplify code around, remove s_utf8 field as to distinguish between UTF-8 +and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL +or not. + +Link: https://lore.kernel.org/r/20210808162453.1653-5-pali@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/isofs/inode.c | 27 +++++++++++++-------------- + fs/isofs/isofs.h | 1 - + fs/isofs/joliet.c | 4 +--- + 3 files changed, 14 insertions(+), 18 deletions(-) + +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index 21edc423b79f..678e2c51b855 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -155,7 +155,6 @@ struct iso9660_options{ + unsigned int overriderockperm:1; + unsigned int uid_set:1; + unsigned int gid_set:1; +- unsigned int utf8:1; + unsigned char map; + unsigned char check; + unsigned int blocksize; +@@ -356,7 +355,6 @@ static int parse_options(char *options, struct iso9660_options *popt) + popt->gid = GLOBAL_ROOT_GID; + popt->uid = GLOBAL_ROOT_UID; + popt->iocharset = NULL; +- popt->utf8 = 0; + popt->overriderockperm = 0; + popt->session=-1; + popt->sbsector=-1; +@@ -389,10 +387,13 @@ static int parse_options(char *options, struct iso9660_options *popt) + case Opt_cruft: + popt->cruft = 1; + break; ++#ifdef CONFIG_JOLIET + case Opt_utf8: +- popt->utf8 = 1; ++ kfree(popt->iocharset); ++ popt->iocharset = kstrdup("utf8", GFP_KERNEL); ++ if (!popt->iocharset) ++ return 0; + break; +-#ifdef CONFIG_JOLIET + case Opt_iocharset: + kfree(popt->iocharset); + popt->iocharset = match_strdup(&args[0]); +@@ -495,7 +496,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root) + if (sbi->s_nocompress) seq_puts(m, ",nocompress"); + if (sbi->s_overriderockperm) seq_puts(m, ",overriderockperm"); + if (sbi->s_showassoc) seq_puts(m, ",showassoc"); +- if (sbi->s_utf8) seq_puts(m, ",utf8"); + + if (sbi->s_check) seq_printf(m, ",check=%c", sbi->s_check); + if (sbi->s_mapping) seq_printf(m, ",map=%c", sbi->s_mapping); +@@ -518,9 +518,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root) + seq_printf(m, ",fmode=%o", sbi->s_fmode); + + #ifdef CONFIG_JOLIET +- if (sbi->s_nls_iocharset && +- strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0) ++ if (sbi->s_nls_iocharset) + seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset); ++ else ++ seq_puts(m, ",iocharset=utf8"); + #endif + return 0; + } +@@ -863,14 +864,13 @@ root_found: + sbi->s_nls_iocharset = NULL; + + #ifdef CONFIG_JOLIET +- if (joliet_level && opt.utf8 == 0) { ++ if (joliet_level) { + char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT; +- sbi->s_nls_iocharset = load_nls(p); +- if (! sbi->s_nls_iocharset) { +- /* Fail only if explicit charset specified */ +- if (opt.iocharset) ++ if (strcmp(p, "utf8") != 0) { ++ sbi->s_nls_iocharset = opt.iocharset ? ++ load_nls(opt.iocharset) : load_nls_default(); ++ if (!sbi->s_nls_iocharset) + goto out_freesbi; +- sbi->s_nls_iocharset = load_nls_default(); + } + } + #endif +@@ -886,7 +886,6 @@ root_found: + sbi->s_gid = opt.gid; + sbi->s_uid_set = opt.uid_set; + sbi->s_gid_set = opt.gid_set; +- sbi->s_utf8 = opt.utf8; + sbi->s_nocompress = opt.nocompress; + sbi->s_overriderockperm = opt.overriderockperm; + /* +diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h +index 055ec6c586f7..dcdc191ed183 100644 +--- a/fs/isofs/isofs.h ++++ b/fs/isofs/isofs.h +@@ -44,7 +44,6 @@ struct isofs_sb_info { + unsigned char s_session; + unsigned int s_high_sierra:1; + unsigned int s_rock:2; +- unsigned int s_utf8:1; + unsigned int s_cruft:1; /* Broken disks with high byte of length + * containing junk */ + unsigned int s_nocompress:1; +diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c +index be8b6a9d0b92..c0f04a1e7f69 100644 +--- a/fs/isofs/joliet.c ++++ b/fs/isofs/joliet.c +@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls) + int + get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode) + { +- unsigned char utf8; + struct nls_table *nls; + unsigned char len = 0; + +- utf8 = ISOFS_SB(inode->i_sb)->s_utf8; + nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset; + +- if (utf8) { ++ if (!nls) { + len = utf16s_to_utf8s((const wchar_t *) de->name, + de->name_len[0] >> 1, UTF16_BIG_ENDIAN, + outname, PAGE_SIZE); +-- +2.30.2 + diff --git a/queue-5.14/iwlwifi-skip-first-element-in-the-wtas-acpi-table.patch b/queue-5.14/iwlwifi-skip-first-element-in-the-wtas-acpi-table.patch new file mode 100644 index 00000000000..694923b8b80 --- /dev/null +++ b/queue-5.14/iwlwifi-skip-first-element-in-the-wtas-acpi-table.patch @@ -0,0 +1,79 @@ +From 78c4b83587c7c4959b3a695adc12b71315ddb384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 14:21:53 +0300 +Subject: iwlwifi: skip first element in the WTAS ACPI table + +From: Abhishek Naik + +[ Upstream commit 19426d54302e199b3fd2d575f926a13af66be2b9 ] + +By mistake we were considering the first element of the WTAS wifi +package as part of the data we want to rid, but that element is the wifi +package signature (always 0x07), so it should be skipped. + +Change the code to read the data starting from element 1 instead. + +Signed-off-by: Abhishek Naik +Fixes: 28dd7ccdc56f ("iwlwifi: acpi: read TAS table from ACPI and send it to the FW") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20210805141826.ff8148197b15.I70636c04e37b2b57a5df3ce611511f62203d27a7@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +index 34933f133a0a..66f8d949c1e6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +@@ -264,7 +264,7 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt, + goto out_free; + } + +- enabled = !!wifi_pkg->package.elements[0].integer.value; ++ enabled = !!wifi_pkg->package.elements[1].integer.value; + + if (!enabled) { + *block_list_size = -1; +@@ -273,15 +273,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt, + goto out_free; + } + +- if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER || +- wifi_pkg->package.elements[1].integer.value > ++ if (wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER || ++ wifi_pkg->package.elements[2].integer.value > + APCI_WTAS_BLACK_LIST_MAX) { + IWL_DEBUG_RADIO(fwrt, "TAS invalid array size %llu\n", + wifi_pkg->package.elements[1].integer.value); + ret = -EINVAL; + goto out_free; + } +- *block_list_size = wifi_pkg->package.elements[1].integer.value; ++ *block_list_size = wifi_pkg->package.elements[2].integer.value; + + IWL_DEBUG_RADIO(fwrt, "TAS array size %d\n", *block_list_size); + if (*block_list_size > APCI_WTAS_BLACK_LIST_MAX) { +@@ -294,15 +294,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt, + for (i = 0; i < *block_list_size; i++) { + u32 country; + +- if (wifi_pkg->package.elements[2 + i].type != ++ if (wifi_pkg->package.elements[3 + i].type != + ACPI_TYPE_INTEGER) { + IWL_DEBUG_RADIO(fwrt, +- "TAS invalid array elem %d\n", 2 + i); ++ "TAS invalid array elem %d\n", 3 + i); + ret = -EINVAL; + goto out_free; + } + +- country = wifi_pkg->package.elements[2 + i].integer.value; ++ country = wifi_pkg->package.elements[3 + i].integer.value; + block_list_array[i] = cpu_to_le32(country); + IWL_DEBUG_RADIO(fwrt, "TAS block list country %d\n", country); + } +-- +2.30.2 + diff --git a/queue-5.14/leds-is31fl32xx-fix-missing-error-code-in-is31fl32xx.patch b/queue-5.14/leds-is31fl32xx-fix-missing-error-code-in-is31fl32xx.patch new file mode 100644 index 00000000000..a9195aef64e --- /dev/null +++ b/queue-5.14/leds-is31fl32xx-fix-missing-error-code-in-is31fl32xx.patch @@ -0,0 +1,42 @@ +From 85a65c07537ca6a40d77143faceb03e1ba1bb576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 19:09:03 +0800 +Subject: leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() + +From: Jiapeng Chong + +[ Upstream commit e642197562cd9781453f835e1406cfe0feeb917e ] + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'ret'. + +Eliminate the follow smatch warning: + +drivers/leds/leds-is31fl32xx.c:388 is31fl32xx_parse_dt() warn: missing +error code 'ret'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Fixes: 9d7cffaf99f5 ("leds: Add driver for the ISSI IS31FL32xx family of LED controllers") +Acked-by: David Rivshin +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-is31fl32xx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/leds-is31fl32xx.c b/drivers/leds/leds-is31fl32xx.c +index 3b55af9a8c58..22c092a4394a 100644 +--- a/drivers/leds/leds-is31fl32xx.c ++++ b/drivers/leds/leds-is31fl32xx.c +@@ -386,6 +386,7 @@ static int is31fl32xx_parse_dt(struct device *dev, + dev_err(dev, + "Node %pOF 'reg' conflicts with another LED\n", + child); ++ ret = -EINVAL; + goto err; + } + +-- +2.30.2 + diff --git a/queue-5.14/leds-lgm-sso-don-t-spam-logs-when-probe-is-deferred.patch b/queue-5.14/leds-lgm-sso-don-t-spam-logs-when-probe-is-deferred.patch new file mode 100644 index 00000000000..fd6a3353e9d --- /dev/null +++ b/queue-5.14/leds-lgm-sso-don-t-spam-logs-when-probe-is-deferred.patch @@ -0,0 +1,38 @@ +From befee2b5c6e80fa58898fc8cdef3b02c53d64c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 May 2021 14:19:27 +0300 +Subject: leds: lgm-sso: Don't spam logs when probe is deferred + +From: Andy Shevchenko + +[ Upstream commit 1ed4d05e0a0b23ba15e0affcff4008dd537ae3ee ] + +When requesting GPIO line the probe can be deferred. +In such case don't spam logs with an error message. +This can be achieved by switching to dev_err_probe(). + +Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC") +Cc: Amireddy Mallikarjuna reddy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/blink/leds-lgm-sso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c +index 62ce83cea553..ca9f88996819 100644 +--- a/drivers/leds/blink/leds-lgm-sso.c ++++ b/drivers/leds/blink/leds-lgm-sso.c +@@ -644,7 +644,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + fwnode_child, + GPIOD_ASIS, NULL); + if (IS_ERR(led->gpiod)) { +- dev_err(dev, "led: get gpio fail!\n"); ++ dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n"); + goto __dt_err; + } + +-- +2.30.2 + diff --git a/queue-5.14/leds-lgm-sso-propagate-error-codes-from-callee-to-ca.patch b/queue-5.14/leds-lgm-sso-propagate-error-codes-from-callee-to-ca.patch new file mode 100644 index 00000000000..57fa71c3ad6 --- /dev/null +++ b/queue-5.14/leds-lgm-sso-propagate-error-codes-from-callee-to-ca.patch @@ -0,0 +1,71 @@ +From 50d113116139ac6fedd89d3f6e5a02fba7b58985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 14:26:19 +0300 +Subject: leds: lgm-sso: Propagate error codes from callee to caller + +From: Andy Shevchenko + +[ Upstream commit 9cbc861095375793a69858f91f3ac4e817f320f0 ] + +The one of the latest change to the driver reveals the problem that +the error codes from callee aren't propagated to the caller of +__sso_led_dt_parse(). Fix this accordingly. + +Fixes: 9999908ca1ab ("leds: lgm-sso: Put fwnode in any case during ->probe()") +Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/blink/leds-lgm-sso.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c +index ca9f88996819..aa14f0ebe7a0 100644 +--- a/drivers/leds/blink/leds-lgm-sso.c ++++ b/drivers/leds/blink/leds-lgm-sso.c +@@ -644,7 +644,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + fwnode_child, + GPIOD_ASIS, NULL); + if (IS_ERR(led->gpiod)) { +- dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n"); ++ ret = dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n"); + goto __dt_err; + } + +@@ -664,8 +664,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + desc->panic_indicator = 1; + + ret = fwnode_property_read_u32(fwnode_child, "reg", &prop); +- if (ret != 0 || prop >= SSO_LED_MAX_NUM) { ++ if (ret) ++ goto __dt_err; ++ if (prop >= SSO_LED_MAX_NUM) { + dev_err(dev, "invalid LED pin:%u\n", prop); ++ ret = -EINVAL; + goto __dt_err; + } + desc->pin = prop; +@@ -701,7 +704,8 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + desc->brightness = LED_FULL; + } + +- if (sso_create_led(priv, led, fwnode_child)) ++ ret = sso_create_led(priv, led, fwnode_child); ++ if (ret) + goto __dt_err; + } + +@@ -715,7 +719,7 @@ __dt_err: + sso_led_shutdown(led); + } + +- return -EINVAL; ++ return ret; + } + + static int sso_led_dt_parse(struct sso_led_priv *priv) +-- +2.30.2 + diff --git a/queue-5.14/leds-lgm-sso-put-fwnode-in-any-case-during-probe.patch b/queue-5.14/leds-lgm-sso-put-fwnode-in-any-case-during-probe.patch new file mode 100644 index 00000000000..e58140c75d7 --- /dev/null +++ b/queue-5.14/leds-lgm-sso-put-fwnode-in-any-case-during-probe.patch @@ -0,0 +1,65 @@ +From 52d85b3ce0004093ef54e40cc6023f633a86f846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 May 2021 14:19:26 +0300 +Subject: leds: lgm-sso: Put fwnode in any case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 9999908ca1abee7aa518a4f6a3739517c137acbf ] + +fwnode_get_next_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +All the same in fwnode_for_each_child_node() case. + +Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC") +Cc: Amireddy Mallikarjuna reddy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/blink/leds-lgm-sso.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c +index 7eb2f44f16be..62ce83cea553 100644 +--- a/drivers/leds/blink/leds-lgm-sso.c ++++ b/drivers/leds/blink/leds-lgm-sso.c +@@ -631,8 +631,10 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + + fwnode_for_each_child_node(fw_ssoled, fwnode_child) { + led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL); +- if (!led) +- return -ENOMEM; ++ if (!led) { ++ ret = -ENOMEM; ++ goto __dt_err; ++ } + + INIT_LIST_HEAD(&led->list); + led->priv = priv; +@@ -702,11 +704,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled) + if (sso_create_led(priv, led, fwnode_child)) + goto __dt_err; + } +- fwnode_handle_put(fw_ssoled); + + return 0; ++ + __dt_err: +- fwnode_handle_put(fw_ssoled); ++ fwnode_handle_put(fwnode_child); + /* unregister leds */ + list_for_each(p, &priv->led_list) { + led = list_entry(p, struct sso_led, list); +@@ -731,6 +733,7 @@ static int sso_led_dt_parse(struct sso_led_priv *priv) + fw_ssoled = fwnode_get_named_child_node(fwnode, "ssoled"); + if (fw_ssoled) { + ret = __sso_led_dt_parse(priv, fw_ssoled); ++ fwnode_handle_put(fw_ssoled); + if (ret) + return ret; + } +-- +2.30.2 + diff --git a/queue-5.14/leds-lt3593-put-fwnode-in-any-case-during-probe.patch b/queue-5.14/leds-lt3593-put-fwnode-in-any-case-during-probe.patch new file mode 100644 index 00000000000..cb061baad78 --- /dev/null +++ b/queue-5.14/leds-lt3593-put-fwnode-in-any-case-during-probe.patch @@ -0,0 +1,41 @@ +From 2c1410835ac49c7f237809bcf48bb71ea0af3875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 May 2021 14:19:33 +0300 +Subject: leds: lt3593: Put fwnode in any case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 7e1baaaa2407a642ea19b58e214fab9a69cda1d7 ] + +device_get_next_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +Fixes: 8cd7d6daba93 ("leds: lt3593: Add device tree probing glue") +Cc: Daniel Mack +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lt3593.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c +index 3bb52d3165d9..d0160fde0f94 100644 +--- a/drivers/leds/leds-lt3593.c ++++ b/drivers/leds/leds-lt3593.c +@@ -97,10 +97,9 @@ static int lt3593_led_probe(struct platform_device *pdev) + init_data.default_label = ":"; + + ret = devm_led_classdev_register_ext(dev, &led_data->cdev, &init_data); +- if (ret < 0) { +- fwnode_handle_put(child); ++ fwnode_handle_put(child); ++ if (ret < 0) + return ret; +- } + + platform_set_drvdata(pdev, led_data); + +-- +2.30.2 + diff --git a/queue-5.14/leds-rt8515-put-fwnode-in-any-case-during-probe.patch b/queue-5.14/leds-rt8515-put-fwnode-in-any-case-during-probe.patch new file mode 100644 index 00000000000..b6b750e55f6 --- /dev/null +++ b/queue-5.14/leds-rt8515-put-fwnode-in-any-case-during-probe.patch @@ -0,0 +1,48 @@ +From 64b9b1bd9208a54369891ccf01e05b7b2194fdc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 May 2021 14:19:34 +0300 +Subject: leds: rt8515: Put fwnode in any case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 8aa41952ef245449df79100e1942b5e6288b098a ] + +fwnode_get_next_available_child_node() bumps a reference counting of +a returned variable. We have to balance it whenever we return to +the caller. + +Fixes: e1c6edcbea13 ("leds: rt8515: Add Richtek RT8515 LED driver") +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-rt8515.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/flash/leds-rt8515.c b/drivers/leds/flash/leds-rt8515.c +index 590bfa180d10..44904fdee3cc 100644 +--- a/drivers/leds/flash/leds-rt8515.c ++++ b/drivers/leds/flash/leds-rt8515.c +@@ -343,8 +343,9 @@ static int rt8515_probe(struct platform_device *pdev) + + ret = devm_led_classdev_flash_register_ext(dev, fled, &init_data); + if (ret) { +- dev_err(dev, "can't register LED %s\n", led->name); ++ fwnode_handle_put(child); + mutex_destroy(&rt->lock); ++ dev_err(dev, "can't register LED %s\n", led->name); + return ret; + } + +@@ -362,6 +363,7 @@ static int rt8515_probe(struct platform_device *pdev) + */ + } + ++ fwnode_handle_put(child); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/leds-trigger-audio-add-an-activate-callback-to-ensur.patch b/queue-5.14/leds-trigger-audio-add-an-activate-callback-to-ensur.patch new file mode 100644 index 00000000000..cfa6fd4c7df --- /dev/null +++ b/queue-5.14/leds-trigger-audio-add-an-activate-callback-to-ensur.patch @@ -0,0 +1,128 @@ +From 574ed08085973212b84946eb5fdf65258d24e460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Feb 2021 12:52:08 +0100 +Subject: leds: trigger: audio: Add an activate callback to ensure the initial + brightness is set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 64f67b5240db79eceb0bd57dae8e591fd3103ba0 ] + +Some 2-in-1s with a detachable (USB) keyboard(dock) have mute-LEDs in +the speaker- and/or mic-mute keys on the keyboard. + +Examples of this are the Lenovo Thinkpad10 tablet (with its USB kbd-dock) +and the HP x2 10 series. + +The detachable nature of these keyboards means that the keyboard and +thus the mute LEDs may show up after the user (or userspace restoring +old mixer settings) has muted the speaker and/or mic. + +Current LED-class devices with a default_trigger of "audio-mute" or +"audio-micmute" initialize the brightness member of led_classdev with +ledtrig_audio_get() before registering the LED. + +This makes the software state after attaching the keyboard match the +actual audio mute state, e.g. cat /sys/class/leds/foo/brightness will +show the right value. + +But before this commit nothing was actually calling the led_classdev's +brightness_set[_blocking] callback so the value returned by +ledtrig_audio_get() was never actually being sent to the hw, leading +to the mute LEDs staying in their default power-on state, after +attaching the keyboard, even if ledtrig_audio_get() returned a different +state. + +This could be fixed by having the individual LED drivers call +brightness_set[_blocking] themselves after registering the LED, +but this really is something which should be done by a led-trigger +activate callback. + +Add an activate callback for this, fixing the issue of the +mute LEDs being out of sync after (re)attaching the keyboard. + +Cc: Takashi Iwai +Fixes: faa2541f5b1a ("leds: trigger: Introduce audio mute LED trigger") +Reviewed-by: Marek Behún +Signed-off-by: Hans de Goede +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/trigger/ledtrig-audio.c | 37 ++++++++++++++++++++++------ + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/drivers/leds/trigger/ledtrig-audio.c b/drivers/leds/trigger/ledtrig-audio.c +index f76621e88482..c6b437e6369b 100644 +--- a/drivers/leds/trigger/ledtrig-audio.c ++++ b/drivers/leds/trigger/ledtrig-audio.c +@@ -6,10 +6,33 @@ + #include + #include + #include ++#include "../leds.h" + +-static struct led_trigger *ledtrig_audio[NUM_AUDIO_LEDS]; + static enum led_brightness audio_state[NUM_AUDIO_LEDS]; + ++static int ledtrig_audio_mute_activate(struct led_classdev *led_cdev) ++{ ++ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MUTE]); ++ return 0; ++} ++ ++static int ledtrig_audio_micmute_activate(struct led_classdev *led_cdev) ++{ ++ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MICMUTE]); ++ return 0; ++} ++ ++static struct led_trigger ledtrig_audio[NUM_AUDIO_LEDS] = { ++ [LED_AUDIO_MUTE] = { ++ .name = "audio-mute", ++ .activate = ledtrig_audio_mute_activate, ++ }, ++ [LED_AUDIO_MICMUTE] = { ++ .name = "audio-micmute", ++ .activate = ledtrig_audio_micmute_activate, ++ }, ++}; ++ + enum led_brightness ledtrig_audio_get(enum led_audio type) + { + return audio_state[type]; +@@ -19,24 +42,22 @@ EXPORT_SYMBOL_GPL(ledtrig_audio_get); + void ledtrig_audio_set(enum led_audio type, enum led_brightness state) + { + audio_state[type] = state; +- led_trigger_event(ledtrig_audio[type], state); ++ led_trigger_event(&ledtrig_audio[type], state); + } + EXPORT_SYMBOL_GPL(ledtrig_audio_set); + + static int __init ledtrig_audio_init(void) + { +- led_trigger_register_simple("audio-mute", +- &ledtrig_audio[LED_AUDIO_MUTE]); +- led_trigger_register_simple("audio-micmute", +- &ledtrig_audio[LED_AUDIO_MICMUTE]); ++ led_trigger_register(&ledtrig_audio[LED_AUDIO_MUTE]); ++ led_trigger_register(&ledtrig_audio[LED_AUDIO_MICMUTE]); + return 0; + } + module_init(ledtrig_audio_init); + + static void __exit ledtrig_audio_exit(void) + { +- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MUTE]); +- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MICMUTE]); ++ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MUTE]); ++ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MICMUTE]); + } + module_exit(ledtrig_audio_exit); + +-- +2.30.2 + diff --git a/queue-5.14/lib-mpi-use-kcalloc-in-mpi_resize.patch b/queue-5.14/lib-mpi-use-kcalloc-in-mpi_resize.patch new file mode 100644 index 00000000000..c21567e87be --- /dev/null +++ b/queue-5.14/lib-mpi-use-kcalloc-in-mpi_resize.patch @@ -0,0 +1,58 @@ +From 9608f57a9980eb1ec63c17f3192f2a812c28a47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 16:53:32 +0800 +Subject: lib/mpi: use kcalloc in mpi_resize + +From: Hongbo Li + +[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ] + +We should set the additional space to 0 in mpi_resize(). +So use kcalloc() instead of kmalloc_array(). + +In lib/mpi/ec.c: +/**************** + * Resize the array of A to NLIMBS. the additional space is cleared + * (set to 0) [done by m_realloc()] + */ +int mpi_resize(MPI a, unsigned nlimbs) + +Like the comment of kernel's mpi_resize() said, the additional space +need to be set to 0, but when a->d is not NULL, it does not set. + +The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt +is _gcry_mpi_resize() which set the additional space to 0. + +This bug may cause mpi api which use mpi_resize() get wrong result +under the condition of using the additional space without initiation. +If this condition is not met, the bug would not be triggered. +Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well, +so the bug is not triggered in these cases. + +add_points_edwards() use the additional space directly, so it will +get a wrong result. + +Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") +Signed-off-by: Hongbo Li +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + lib/mpi/mpiutil.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c +index 9a75ca3f7edf..bc81419f400c 100644 +--- a/lib/mpi/mpiutil.c ++++ b/lib/mpi/mpiutil.c +@@ -148,7 +148,7 @@ int mpi_resize(MPI a, unsigned nlimbs) + return 0; /* no need to do it */ + + if (a->d) { +- p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL); ++ p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL); + if (!p) + return -ENOMEM; + memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t)); +-- +2.30.2 + diff --git a/queue-5.14/lib-test_scanf-handle-n_bits-0-in-random-tests.patch b/queue-5.14/lib-test_scanf-handle-n_bits-0-in-random-tests.patch new file mode 100644 index 00000000000..b3773982280 --- /dev/null +++ b/queue-5.14/lib-test_scanf-handle-n_bits-0-in-random-tests.patch @@ -0,0 +1,53 @@ +From 29d31d78564c0f79aeb27e25e193ada661672eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 18:01:32 +0300 +Subject: lib/test_scanf: Handle n_bits == 0 in random tests + +From: Andy Shevchenko + +[ Upstream commit fe8e3ee0d588566c1f44f28a555042ef50eba491 ] + +UBSAN reported (via LKP) + +[ 11.021349][ T1] UBSAN: shift-out-of-bounds in lib/test_scanf.c:275:51 +[ 11.022782][ T1] shift exponent 32 is too large for 32-bit type 'unsigned int' + +When n_bits == 0, the shift is out of range. Switch code to use GENMASK +to handle this case. + +Fixes: 50f530e176ea ("lib: test_scanf: Add tests for sscanf number conversion") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Reviewed-by: Richard Fitzgerald +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20210727150132.28920-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +--- + lib/test_scanf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/test_scanf.c b/lib/test_scanf.c +index 84fe09eaf55e..abae88848972 100644 +--- a/lib/test_scanf.c ++++ b/lib/test_scanf.c +@@ -271,7 +271,7 @@ static u32 __init next_test_random(u32 max_bits) + { + u32 n_bits = hweight32(prandom_u32_state(&rnd_state)) % (max_bits + 1); + +- return prandom_u32_state(&rnd_state) & (UINT_MAX >> (32 - n_bits)); ++ return prandom_u32_state(&rnd_state) & GENMASK(n_bits, 0); + } + + static unsigned long long __init next_test_random_ull(void) +@@ -280,7 +280,7 @@ static unsigned long long __init next_test_random_ull(void) + u32 n_bits = (hweight32(rand1) * 3) % 64; + u64 val = (u64)prandom_u32_state(&rnd_state) * rand1; + +- return val & (ULLONG_MAX >> (64 - n_bits)); ++ return val & GENMASK_ULL(n_bits, 0); + } + + #define random_for_type(T) \ +-- +2.30.2 + diff --git a/queue-5.14/libata-fix-ata_host_start.patch b/queue-5.14/libata-fix-ata_host_start.patch new file mode 100644 index 00000000000..91cfe89f2d9 --- /dev/null +++ b/queue-5.14/libata-fix-ata_host_start.patch @@ -0,0 +1,39 @@ +From 785914f9e4718a052dc6bac3087e40be978e1594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 10:44:47 +0900 +Subject: libata: fix ata_host_start() + +From: Damien Le Moal + +[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ] + +The loop on entry of ata_host_start() may not initialize host->ops to a +non NULL value. The test on the host_stop field of host->ops must then +be preceded by a check that host->ops is not NULL. + +Reported-by: kernel test robot +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Link: https://lore.kernel.org/r/20210816014456.2191776-3-damien.lemoal@wdc.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 61c762961ca8..44f434acfce0 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5573,7 +5573,7 @@ int ata_host_start(struct ata_host *host) + have_stop = 1; + } + +- if (host->ops->host_stop) ++ if (host->ops && host->ops->host_stop) + have_stop = 1; + + if (have_stop) { +-- +2.30.2 + diff --git a/queue-5.14/libbpf-fix-removal-of-inner-map-in-bpf_object__creat.patch b/queue-5.14/libbpf-fix-removal-of-inner-map-in-bpf_object__creat.patch new file mode 100644 index 00000000000..4c6574044cf --- /dev/null +++ b/queue-5.14/libbpf-fix-removal-of-inner-map-in-bpf_object__creat.patch @@ -0,0 +1,80 @@ +From 12ed1362c5f8d83773c701843e8eedc19d140e95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 19:38:37 +0200 +Subject: libbpf: Fix removal of inner map in bpf_object__create_map + +From: Martynas Pumputis + +[ Upstream commit a21ab4c59e09c2a9994a6e393b7484e3b3f78a99 ] + +If creating an outer map of a BTF-defined map-in-map fails (via +bpf_object__create_map()), then the previously created its inner map +won't be destroyed. + +Fix this by ensuring that the destroy routines are not bypassed in the +case of a failure. + +Fixes: 646f02ffdd49c ("libbpf: Add BTF-defined map-in-map support") +Reported-by: Andrii Nakryiko +Signed-off-by: Martynas Pumputis +Signed-off-by: Andrii Nakryiko +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20210719173838.423148-2-m@lambda.lt +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 1bfd11de9be6..aa5ad6fc5f40 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -4479,6 +4479,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b + { + struct bpf_create_map_attr create_attr; + struct bpf_map_def *def = &map->def; ++ int err = 0; + + memset(&create_attr, 0, sizeof(create_attr)); + +@@ -4521,8 +4522,6 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b + + if (bpf_map_type__is_map_in_map(def->type)) { + if (map->inner_map) { +- int err; +- + err = bpf_object__create_map(obj, map->inner_map, true); + if (err) { + pr_warn("map '%s': failed to create inner map: %d\n", +@@ -4547,8 +4546,8 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b + if (map->fd < 0 && (create_attr.btf_key_type_id || + create_attr.btf_value_type_id)) { + char *cp, errmsg[STRERR_BUFSIZE]; +- int err = -errno; + ++ err = -errno; + cp = libbpf_strerror_r(err, errmsg, sizeof(errmsg)); + pr_warn("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n", + map->name, cp, err); +@@ -4560,8 +4559,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b + map->fd = bpf_create_map_xattr(&create_attr); + } + +- if (map->fd < 0) +- return -errno; ++ err = map->fd < 0 ? -errno : 0; + + if (bpf_map_type__is_map_in_map(def->type) && map->inner_map) { + if (obj->gen_loader) +@@ -4570,7 +4568,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b + zfree(&map->inner_map); + } + +- return 0; ++ return err; + } + + static int init_map_slots(struct bpf_object *obj, struct bpf_map *map) +-- +2.30.2 + diff --git a/queue-5.14/libbpf-fix-the-possible-memory-leak-on-error.patch b/queue-5.14/libbpf-fix-the-possible-memory-leak-on-error.patch new file mode 100644 index 00000000000..76aad62e180 --- /dev/null +++ b/queue-5.14/libbpf-fix-the-possible-memory-leak-on-error.patch @@ -0,0 +1,41 @@ +From 619c6459612418f208772fce6bc86ad3a223f01f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 20:42:38 +0800 +Subject: libbpf: Fix the possible memory leak on error + +From: Shuyi Cheng + +[ Upstream commit 18353c87e0e0440d4c7c746ed740738bbc1b538e ] + +If the strdup() fails then we need to call bpf_object__close(obj) to +avoid a resource leak. + +Fixes: 166750bc1dd2 ("libbpf: Support libbpf-provided extern variables") +Signed-off-by: Shuyi Cheng +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/1626180159-112996-3-git-send-email-chengshuyi@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 6f5e2757bb3c..1bfd11de9be6 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -7588,8 +7588,10 @@ __bpf_object__open(const char *path, const void *obj_buf, size_t obj_buf_sz, + kconfig = OPTS_GET(opts, kconfig, NULL); + if (kconfig) { + obj->kconfig = strdup(kconfig); +- if (!obj->kconfig) +- return ERR_PTR(-ENOMEM); ++ if (!obj->kconfig) { ++ err = -ENOMEM; ++ goto out; ++ } + } + + err = bpf_object__elf_init(obj); +-- +2.30.2 + diff --git a/queue-5.14/libbpf-re-build-libbpf.so-when-libbpf.map-changes.patch b/queue-5.14/libbpf-re-build-libbpf.so-when-libbpf.map-changes.patch new file mode 100644 index 00000000000..c90d420bddb --- /dev/null +++ b/queue-5.14/libbpf-re-build-libbpf.so-when-libbpf.map-changes.patch @@ -0,0 +1,72 @@ +From c9782bf58c89a0621a1a2d66467a8df2de9c31b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 00:06:00 -0700 +Subject: libbpf: Re-build libbpf.so when libbpf.map changes + +From: Andrii Nakryiko + +[ Upstream commit 61c7aa5020e98ac2fdcf07d07eec1baf2e9f0a08 ] + +Ensure libbpf.so is re-built whenever libbpf.map is modified. Without this, +changes to libbpf.map are not detected and versioned symbols mismatch error +will be reported until `make clean && make` is used, which is a suboptimal +developer experience. + +Fixes: 306b267cb3c4 ("libbpf: Verify versioned symbols") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20210815070609.987780-8-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index ec14aa725bb0..74c3b73a5fbe 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -4,8 +4,9 @@ + RM ?= rm + srctree = $(abs_srctree) + ++VERSION_SCRIPT := libbpf.map + LIBBPF_VERSION := $(shell \ +- grep -oE '^LIBBPF_([0-9.]+)' libbpf.map | \ ++ grep -oE '^LIBBPF_([0-9.]+)' $(VERSION_SCRIPT) | \ + sort -rV | head -n1 | cut -d'_' -f2) + LIBBPF_MAJOR_VERSION := $(firstword $(subst ., ,$(LIBBPF_VERSION))) + +@@ -110,7 +111,6 @@ SHARED_OBJDIR := $(OUTPUT)sharedobjs/ + STATIC_OBJDIR := $(OUTPUT)staticobjs/ + BPF_IN_SHARED := $(SHARED_OBJDIR)libbpf-in.o + BPF_IN_STATIC := $(STATIC_OBJDIR)libbpf-in.o +-VERSION_SCRIPT := libbpf.map + BPF_HELPER_DEFS := $(OUTPUT)bpf_helper_defs.h + + LIB_TARGET := $(addprefix $(OUTPUT),$(LIB_TARGET)) +@@ -163,10 +163,10 @@ $(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h + + $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION) + +-$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) ++$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) $(VERSION_SCRIPT) + $(QUIET_LINK)$(CC) $(LDFLAGS) \ + --shared -Wl,-soname,libbpf.so.$(LIBBPF_MAJOR_VERSION) \ +- -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -lz -o $@ ++ -Wl,--version-script=$(VERSION_SCRIPT) $< -lelf -lz -o $@ + @ln -sf $(@F) $(OUTPUT)libbpf.so + @ln -sf $(@F) $(OUTPUT)libbpf.so.$(LIBBPF_MAJOR_VERSION) + +@@ -181,7 +181,7 @@ $(OUTPUT)libbpf.pc: + + check: check_abi + +-check_abi: $(OUTPUT)libbpf.so ++check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT) + @if [ "$(GLOBAL_SYM_COUNT)" != "$(VERSIONED_SYM_COUNT)" ]; then \ + echo "Warning: Num of global symbols in $(BPF_IN_SHARED)" \ + "($(GLOBAL_SYM_COUNT)) does NOT match with num of" \ +-- +2.30.2 + diff --git a/queue-5.14/libbpf-return-non-null-error-on-failures-in-libbpf_f.patch b/queue-5.14/libbpf-return-non-null-error-on-failures-in-libbpf_f.patch new file mode 100644 index 00000000000..29b56f8cbe7 --- /dev/null +++ b/queue-5.14/libbpf-return-non-null-error-on-failures-in-libbpf_f.patch @@ -0,0 +1,53 @@ +From 82f4ea0be74c07f9803dc8a188889d1573924791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 17:20:21 +0100 +Subject: libbpf: Return non-null error on failures in + libbpf_find_prog_btf_id() + +From: Quentin Monnet + +[ Upstream commit 6d2d73cdd673d493f9f3751188757129b1d23fb7 ] + +Variable "err" is initialised to -EINVAL so that this error code is +returned when something goes wrong in libbpf_find_prog_btf_id(). +However, a recent change in the function made use of the variable in +such a way that it is set to 0 if retrieving linear information on the +program is successful, and this 0 value remains if we error out on +failures at later stages. + +Let's fix this by setting err to -EINVAL later in the function. + +Fixes: e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210729162028.29512-2-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index aa5ad6fc5f40..2234d5c33177 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -9515,7 +9515,7 @@ static int libbpf_find_prog_btf_id(const char *name, __u32 attach_prog_fd) + struct bpf_prog_info_linear *info_linear; + struct bpf_prog_info *info; + struct btf *btf = NULL; +- int err = -EINVAL; ++ int err; + + info_linear = bpf_program__get_prog_info_linear(attach_prog_fd, 0); + err = libbpf_get_error(info_linear); +@@ -9524,6 +9524,8 @@ static int libbpf_find_prog_btf_id(const char *name, __u32 attach_prog_fd) + attach_prog_fd); + return err; + } ++ ++ err = -EINVAL; + info = &info_linear->info; + if (!info->btf_id) { + pr_warn("The target program doesn't have BTF\n"); +-- +2.30.2 + diff --git a/queue-5.14/lkdtm-replace-scsi_dispatch_cmd-with-scsi_queue_rq.patch b/queue-5.14/lkdtm-replace-scsi_dispatch_cmd-with-scsi_queue_rq.patch new file mode 100644 index 00000000000..ac22410a753 --- /dev/null +++ b/queue-5.14/lkdtm-replace-scsi_dispatch_cmd-with-scsi_queue_rq.patch @@ -0,0 +1,59 @@ +From 246a89cebae3b823911c751da4a1b441bff512c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 19:29:39 -0700 +Subject: lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ + +From: Kevin Mitchell + +[ Upstream commit d1f278da6b11585f05b2755adfc8851cbf14a1ec ] + +When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some +compilers (i.e., at least gcc 8.4.0) decided to compile this +inline. This is a problem for lkdtm.ko, which inserted a kprobe +on this function for the SCSI_DISPATCH_CMD crashpoint. + +Move this crashpoint one function up the call chain to +scsi_queue_rq. Though this is also a static function, it should never be +inlined because it is assigned as a structure entry. Therefore, +kprobe_register should always be able to find it. + +Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c") +Acked-by: Kees Cook +Signed-off-by: Kevin Mitchell +Link: https://lore.kernel.org/r/20210819022940.561875-2-kevmitch@arista.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/fault-injection/provoke-crashes.rst | 2 +- + drivers/misc/lkdtm/core.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst +index a20ba5d93932..18de17354206 100644 +--- a/Documentation/fault-injection/provoke-crashes.rst ++++ b/Documentation/fault-injection/provoke-crashes.rst +@@ -29,7 +29,7 @@ recur_count + cpoint_name + Where in the kernel to trigger the action. It can be + one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY, +- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD, ++ FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, + IDE_CORE_CP, or DIRECT + + cpoint_type +diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c +index 9dda87c6b54a..016cb0b150fc 100644 +--- a/drivers/misc/lkdtm/core.c ++++ b/drivers/misc/lkdtm/core.c +@@ -82,7 +82,7 @@ static struct crashpoint crashpoints[] = { + CRASHPOINT("FS_DEVRW", "ll_rw_block"), + CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), + CRASHPOINT("TIMERADD", "hrtimer_start"), +- CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"), ++ CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"), + CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"), + #endif + }; +-- +2.30.2 + diff --git a/queue-5.14/lockd-fix-invalid-lockowner-cast-after-vfs_test_lock.patch b/queue-5.14/lockd-fix-invalid-lockowner-cast-after-vfs_test_lock.patch new file mode 100644 index 00000000000..a5a25088028 --- /dev/null +++ b/queue-5.14/lockd-fix-invalid-lockowner-cast-after-vfs_test_lock.patch @@ -0,0 +1,38 @@ +From 9a3f70517130a98b7a875e857098ba6c3912a288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 09:33:28 -0400 +Subject: lockd: Fix invalid lockowner cast after vfs_test_lock + +From: Benjamin Coddington + +[ Upstream commit cd2d644ddba183ec7b451b7c20d5c7cc06fcf0d7 ] + +After calling vfs_test_lock() the pointer to a conflicting lock can be +returned, and that lock is not guarunteed to be owned by nlm. In that +case, we cannot cast it to struct nlm_lockowner. Instead return the pid +of that conflicting lock. + +Fixes: 646d73e91b42 ("lockd: Show pid of lockd for remote locks") +Signed-off-by: Benjamin Coddington +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/lockd/svclock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c +index 61d3cc2283dc..498cb70c2c0d 100644 +--- a/fs/lockd/svclock.c ++++ b/fs/lockd/svclock.c +@@ -634,7 +634,7 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, + conflock->caller = "somehost"; /* FIXME */ + conflock->len = strlen(conflock->caller); + conflock->oh.len = 0; /* don't return OH info */ +- conflock->svid = ((struct nlm_lockowner *)lock->fl.fl_owner)->pid; ++ conflock->svid = lock->fl.fl_pid; + conflock->fl.fl_type = lock->fl.fl_type; + conflock->fl.fl_start = lock->fl.fl_start; + conflock->fl.fl_end = lock->fl.fl_end; +-- +2.30.2 + diff --git a/queue-5.14/locking-local_lock-add-missing-owner-initialization.patch b/queue-5.14/locking-local_lock-add-missing-owner-initialization.patch new file mode 100644 index 00000000000..b5a096683fd --- /dev/null +++ b/queue-5.14/locking-local_lock-add-missing-owner-initialization.patch @@ -0,0 +1,99 @@ +From 0d686c3edd862ecb42538ec5142853e043cbad4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 23:27:37 +0200 +Subject: locking/local_lock: Add missing owner initialization + +From: Thomas Gleixner + +[ Upstream commit d8bbd97ad0b99a9394f2cd8410b884c48e218cf0 ] + +If CONFIG_DEBUG_LOCK_ALLOC=y is enabled then local_lock_t has an 'owner' +member which is checked for consistency, but nothing initialized it to +zero explicitly. + +The static initializer does so implicit, and the run time allocated per CPU +storage is usually zero initialized as well, but relying on that is not +really good practice. + +Fixes: 91710728d172 ("locking: Introduce local_lock()") +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20210815211301.969975279@linutronix.de +Signed-off-by: Sasha Levin +--- + include/linux/local_lock_internal.h | 42 ++++++++++++++++------------- + 1 file changed, 23 insertions(+), 19 deletions(-) + +diff --git a/include/linux/local_lock_internal.h b/include/linux/local_lock_internal.h +index ded90b097e6e..3f02b818625e 100644 +--- a/include/linux/local_lock_internal.h ++++ b/include/linux/local_lock_internal.h +@@ -14,29 +14,14 @@ typedef struct { + } local_lock_t; + + #ifdef CONFIG_DEBUG_LOCK_ALLOC +-# define LL_DEP_MAP_INIT(lockname) \ ++# define LOCAL_LOCK_DEBUG_INIT(lockname) \ + .dep_map = { \ + .name = #lockname, \ + .wait_type_inner = LD_WAIT_CONFIG, \ +- .lock_type = LD_LOCK_PERCPU, \ +- } +-#else +-# define LL_DEP_MAP_INIT(lockname) +-#endif +- +-#define INIT_LOCAL_LOCK(lockname) { LL_DEP_MAP_INIT(lockname) } +- +-#define __local_lock_init(lock) \ +-do { \ +- static struct lock_class_key __key; \ +- \ +- debug_check_no_locks_freed((void *)lock, sizeof(*lock));\ +- lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, 0, \ +- LD_WAIT_CONFIG, LD_WAIT_INV, \ +- LD_LOCK_PERCPU); \ +-} while (0) ++ .lock_type = LD_LOCK_PERCPU, \ ++ }, \ ++ .owner = NULL, + +-#ifdef CONFIG_DEBUG_LOCK_ALLOC + static inline void local_lock_acquire(local_lock_t *l) + { + lock_map_acquire(&l->dep_map); +@@ -51,11 +36,30 @@ static inline void local_lock_release(local_lock_t *l) + lock_map_release(&l->dep_map); + } + ++static inline void local_lock_debug_init(local_lock_t *l) ++{ ++ l->owner = NULL; ++} + #else /* CONFIG_DEBUG_LOCK_ALLOC */ ++# define LOCAL_LOCK_DEBUG_INIT(lockname) + static inline void local_lock_acquire(local_lock_t *l) { } + static inline void local_lock_release(local_lock_t *l) { } ++static inline void local_lock_debug_init(local_lock_t *l) { } + #endif /* !CONFIG_DEBUG_LOCK_ALLOC */ + ++#define INIT_LOCAL_LOCK(lockname) { LOCAL_LOCK_DEBUG_INIT(lockname) } ++ ++#define __local_lock_init(lock) \ ++do { \ ++ static struct lock_class_key __key; \ ++ \ ++ debug_check_no_locks_freed((void *)lock, sizeof(*lock));\ ++ lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, \ ++ 0, LD_WAIT_CONFIG, LD_WAIT_INV, \ ++ LD_LOCK_PERCPU); \ ++ local_lock_debug_init(lock); \ ++} while (0) ++ + #define __local_lock(lock) \ + do { \ + preempt_disable(); \ +-- +2.30.2 + diff --git a/queue-5.14/locking-mutex-fix-handoff-condition.patch b/queue-5.14/locking-mutex-fix-handoff-condition.patch new file mode 100644 index 00000000000..6de6e293051 --- /dev/null +++ b/queue-5.14/locking-mutex-fix-handoff-condition.patch @@ -0,0 +1,73 @@ +From 345bc2ed19e71b5a709c0f8096a51b3a7dce2816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 17:35:18 +0200 +Subject: locking/mutex: Fix HANDOFF condition + +From: Peter Zijlstra + +[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ] + +Yanfei reported that setting HANDOFF should not depend on recomputing +@first, only on @first state. Which would then give: + + if (ww_ctx || !first) + first = __mutex_waiter_is_first(lock, &waiter); + if (first) + __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); + +But because 'ww_ctx || !first' is basically 'always' and the test for +first is relatively cheap, omit that first branch entirely. + +Reported-by: Yanfei Xu +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Waiman Long +Reviewed-by: Yanfei Xu +Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/locking/mutex.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c +index d2df5e68b503..fb30e1436dfb 100644 +--- a/kernel/locking/mutex.c ++++ b/kernel/locking/mutex.c +@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas + struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) + { + struct mutex_waiter waiter; +- bool first = false; + struct ww_mutex *ww; + int ret; + +@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas + + set_current_state(state); + for (;;) { ++ bool first; ++ + /* + * Once we hold wait_lock, we're serialized against + * mutex_unlock() handing the lock off to us, do a trylock +@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas + spin_unlock(&lock->wait_lock); + schedule_preempt_disabled(); + +- /* +- * ww_mutex needs to always recheck its position since its waiter +- * list is not FIFO ordered. +- */ +- if (ww_ctx || !first) { +- first = __mutex_waiter_is_first(lock, &waiter); +- if (first) +- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); +- } ++ first = __mutex_waiter_is_first(lock, &waiter); ++ if (first) ++ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); + + set_current_state(state); + /* +-- +2.30.2 + diff --git a/queue-5.14/m68k-coldfire-return-success-for-clk_enable-null.patch b/queue-5.14/m68k-coldfire-return-success-for-clk_enable-null.patch new file mode 100644 index 00000000000..67d42cc8a6d --- /dev/null +++ b/queue-5.14/m68k-coldfire-return-success-for-clk_enable-null.patch @@ -0,0 +1,40 @@ +From 06f2272497cebaefd8241da2977e7931e893f787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 15:27:03 +0300 +Subject: m68k: coldfire: return success for clk_enable(NULL) + +From: Dan Carpenter + +[ Upstream commit f6a4f0b424df957d84fa7b9f2d02981234ff5828 ] + +The clk_enable is supposed work when CONFIG_HAVE_CLK is false, but it +returns -EINVAL. That means some drivers fail during probe. + +[ 1.680000] flexcan: probe of flexcan.0 failed with error -22 + +Fixes: c1fb1bf64bb6 ("m68k: let clk_enable() return immediately if clk is NULL") +Fixes: bea8bcb12da0 ("m68knommu: Add support for the Coldfire m5441x.") +Signed-off-by: Dan Carpenter +Acked-by: Marc Kleine-Budde +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/coldfire/clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/m68k/coldfire/clk.c b/arch/m68k/coldfire/clk.c +index 2ed841e94111..d03b6c4aa86b 100644 +--- a/arch/m68k/coldfire/clk.c ++++ b/arch/m68k/coldfire/clk.c +@@ -78,7 +78,7 @@ int clk_enable(struct clk *clk) + unsigned long flags; + + if (!clk) +- return -EINVAL; ++ return 0; + + spin_lock_irqsave(&clk_lock, flags); + if ((clk->enabled++ == 0) && clk->clk_ops) +-- +2.30.2 + diff --git a/queue-5.14/m68k-emu-fix-invalid-free-in-nfeth_cleanup.patch b/queue-5.14/m68k-emu-fix-invalid-free-in-nfeth_cleanup.patch new file mode 100644 index 00000000000..5d5520b31e2 --- /dev/null +++ b/queue-5.14/m68k-emu-fix-invalid-free-in-nfeth_cleanup.patch @@ -0,0 +1,40 @@ +From c5406d4a07636a45c8548a23f57c00dc248ebddc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 23:47:27 +0300 +Subject: m68k: emu: Fix invalid free in nfeth_cleanup() + +From: Pavel Skripkin + +[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ] + +In the for loop all nfeth_dev array members should be freed, not only +the first one. Freeing only the first array member can cause +double-free bugs and memory leaks. + +Fixes: 9cd7b148312f ("m68k/atari: ARAnyM - Add support for network access") +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/20210705204727.10743-1-paskripkin@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/emu/nfeth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c +index d2875e32abfc..79e55421cfb1 100644 +--- a/arch/m68k/emu/nfeth.c ++++ b/arch/m68k/emu/nfeth.c +@@ -254,8 +254,8 @@ static void __exit nfeth_cleanup(void) + + for (i = 0; i < MAX_UNIT; i++) { + if (nfeth_dev[i]) { +- unregister_netdev(nfeth_dev[0]); +- free_netdev(nfeth_dev[0]); ++ unregister_netdev(nfeth_dev[i]); ++ free_netdev(nfeth_dev[i]); + } + } + free_irq(nfEtherIRQ, nfeth_interrupt); +-- +2.30.2 + diff --git a/queue-5.14/m68k-fix-asm-register-constraints-for-atomic-ops.patch b/queue-5.14/m68k-fix-asm-register-constraints-for-atomic-ops.patch new file mode 100644 index 00000000000..c0c5c00d573 --- /dev/null +++ b/queue-5.14/m68k-fix-asm-register-constraints-for-atomic-ops.patch @@ -0,0 +1,59 @@ +From 669898f15dd47a980edbcc10edd2d19999b58120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 13:29:03 +0200 +Subject: m68k: Fix asm register constraints for atomic ops + +From: Geert Uytterhoeven + +[ Upstream commit 87d93029fe83e326d5b906e12e95600b157d2c0d ] + +Depending on register assignment by the compiler: + + {standard input}:3084: Error: operands mismatch -- statement `andl %a1,%d1' ignored + {standard input}:3145: Error: operands mismatch -- statement `orl %a1,%d1' ignored + {standard input}:3195: Error: operands mismatch -- statement `eorl %a1,%d1' ignored + +Indeed, the first operand must not be an address register. However, it +can be an immediate value. Fix this by adjusting the register +constraint from "g" (general purpose register) to "di" (data register or +immediate). + +Fixes: e39d88ea3ce4a471 ("locking/atomic, arch/m68k: Implement atomic_fetch_{add,sub,and,or,xor}()") +Fixes: d839bae4269aea46 ("locking,arch,m68k: Fold atomic_ops") +Fixes: 1da177e4c3f41524 ("Linux-2.6.12-rc2") +Reported-by: kernel test robot +Reported-by: Arnd Bergmann +Reported-by: Alexander Viro +Signed-off-by: Geert Uytterhoeven +Tested-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210809112903.3898660-1-geert@linux-m68k.org +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/atomic.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/m68k/include/asm/atomic.h b/arch/m68k/include/asm/atomic.h +index 8637bf8a2f65..cfba83d230fd 100644 +--- a/arch/m68k/include/asm/atomic.h ++++ b/arch/m68k/include/asm/atomic.h +@@ -48,7 +48,7 @@ static inline int arch_atomic_##op##_return(int i, atomic_t *v) \ + " casl %2,%1,%0\n" \ + " jne 1b" \ + : "+m" (*v), "=&d" (t), "=&d" (tmp) \ +- : "g" (i), "2" (arch_atomic_read(v))); \ ++ : "di" (i), "2" (arch_atomic_read(v))); \ + return t; \ + } + +@@ -63,7 +63,7 @@ static inline int arch_atomic_fetch_##op(int i, atomic_t *v) \ + " casl %2,%1,%0\n" \ + " jne 1b" \ + : "+m" (*v), "=&d" (t), "=&d" (tmp) \ +- : "g" (i), "2" (arch_atomic_read(v))); \ ++ : "di" (i), "2" (arch_atomic_read(v))); \ + return tmp; \ + } + +-- +2.30.2 + diff --git a/queue-5.14/m68k-fix-invalid-rmw_insns-on-cpus-that-lack-cas.patch b/queue-5.14/m68k-fix-invalid-rmw_insns-on-cpus-that-lack-cas.patch new file mode 100644 index 00000000000..b5c010cd7bf --- /dev/null +++ b/queue-5.14/m68k-fix-invalid-rmw_insns-on-cpus-that-lack-cas.patch @@ -0,0 +1,78 @@ +From c98c81a38e60c8b9f9e23f4026c76bf5bf2354e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 12:44:13 +0200 +Subject: m68k: Fix invalid RMW_INSNS on CPUs that lack CAS + +From: Geert Uytterhoeven + +[ Upstream commit 2189e928b62e91d8efbc9826ae7c0968f0d55790 ] + +When enabling CONFIG_RMW_INSNS in e.g. a Coldfire build: + + {standard input}:3068: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `casl %d4,%d0,(%a6)' ignored + +Fix this by (a) adding a new config symbol to track if support for any +CPU that lacks the CAS instruction is enabled, and (b) making +CONFIG_RMW_INSNS depend on the new symbol not being set. + +Fixes: 0e152d80507b75c0 ("m68k: reorganize Kconfig options to improve mmu/non-mmu selections") +Reported-by: kernel test robot +Reported-by: Arnd Bergmann +Signed-off-by: Geert Uytterhoeven +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210725104413.318932-1-geert@linux-m68k.org +Signed-off-by: Sasha Levin +--- + arch/m68k/Kconfig.cpu | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu +index 29e946394fdb..277d61a09463 100644 +--- a/arch/m68k/Kconfig.cpu ++++ b/arch/m68k/Kconfig.cpu +@@ -26,6 +26,7 @@ config COLDFIRE + bool "Coldfire CPU family support" + select ARCH_HAVE_CUSTOM_GPIO_H + select CPU_HAS_NO_BITFIELDS ++ select CPU_HAS_NO_CAS + select CPU_HAS_NO_MULDIV64 + select GENERIC_CSUM + select GPIOLIB +@@ -39,6 +40,7 @@ config M68000 + bool + depends on !MMU + select CPU_HAS_NO_BITFIELDS ++ select CPU_HAS_NO_CAS + select CPU_HAS_NO_MULDIV64 + select CPU_HAS_NO_UNALIGNED + select GENERIC_CSUM +@@ -54,6 +56,7 @@ config M68000 + config MCPU32 + bool + select CPU_HAS_NO_BITFIELDS ++ select CPU_HAS_NO_CAS + select CPU_HAS_NO_UNALIGNED + select CPU_NO_EFFICIENT_FFS + help +@@ -383,7 +386,7 @@ config ADVANCED + + config RMW_INSNS + bool "Use read-modify-write instructions" +- depends on ADVANCED ++ depends on ADVANCED && !CPU_HAS_NO_CAS + help + This allows to use certain instructions that work with indivisible + read-modify-write bus cycles. While this is faster than the +@@ -450,6 +453,9 @@ config M68K_L2_CACHE + config CPU_HAS_NO_BITFIELDS + bool + ++config CPU_HAS_NO_CAS ++ bool ++ + config CPU_HAS_NO_MULDIV64 + bool + +-- +2.30.2 + diff --git a/queue-5.14/mac80211-fix-insufficient-headroom-issue-for-amsdu.patch b/queue-5.14/mac80211-fix-insufficient-headroom-issue-for-amsdu.patch new file mode 100644 index 00000000000..ca71271b9bb --- /dev/null +++ b/queue-5.14/mac80211-fix-insufficient-headroom-issue-for-amsdu.patch @@ -0,0 +1,42 @@ +From fed31396c9e435c22c0dde2f84afe8d9d78a0480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 16:51:28 +0800 +Subject: mac80211: Fix insufficient headroom issue for AMSDU + +From: Chih-Kang Chang + +[ Upstream commit f50d2ff8f016b79a2ff4acd5943a1eda40c545d4 ] + +ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom, +the original reserved headroom might be eaten. Add the necessary +extra_tx_headroom. + +Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support") +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://lore.kernel.org/r/20210816085128.10931-2-pkshih@realtek.com +[fix indentation] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 8509778ff31f..fa09a369214d 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3242,7 +3242,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata, + if (info->control.flags & IEEE80211_TX_CTRL_AMSDU) + return true; + +- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr))) ++ if (!ieee80211_amsdu_realloc_pad(local, skb, ++ sizeof(*amsdu_hdr) + ++ local->hw.extra_tx_headroom)) + return false; + + data = skb_push(skb, sizeof(*amsdu_hdr)); +-- +2.30.2 + diff --git a/queue-5.14/mac80211-remove-unnecessary-null-check-in-ieee80211_.patch b/queue-5.14/mac80211-remove-unnecessary-null-check-in-ieee80211_.patch new file mode 100644 index 00000000000..260441753f7 --- /dev/null +++ b/queue-5.14/mac80211-remove-unnecessary-null-check-in-ieee80211_.patch @@ -0,0 +1,37 @@ +From 826529ee1872ee6408dcb63afbbe1f988795e88a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 13:10:38 +0300 +Subject: mac80211: remove unnecessary NULL check in ieee80211_register_hw() + +From: Dan Carpenter + +[ Upstream commit 4a11174d6dbd0bde6d5a1d6efb0d70f58811db55 ] + +The address "&sband->iftype_data[i]" points to an array at the end of +struct. It can't be NULL and so the check can be removed. + +Fixes: bac2fd3d7534 ("mac80211: remove use of ieee80211_get_he_sta_cap()") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YNmgHi7Rh3SISdog@mwanda +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index fcae76ddd586..45fb517591ee 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1020,7 +1020,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + + iftd = &sband->iftype_data[i]; + +- supp_he = supp_he || (iftd && iftd->he_cap.has_he); ++ supp_he = supp_he || iftd->he_cap.has_he; + } + + /* HT, VHT, HE require QoS, thus >= 4 queues */ +-- +2.30.2 + diff --git a/queue-5.14/media-atmel-atmel-sama5d2-isc-fix-yuyv-format.patch b/queue-5.14/media-atmel-atmel-sama5d2-isc-fix-yuyv-format.patch new file mode 100644 index 00000000000..351f5085c88 --- /dev/null +++ b/queue-5.14/media-atmel-atmel-sama5d2-isc-fix-yuyv-format.patch @@ -0,0 +1,58 @@ +From d4044dbf0e7cc9a27f1b4c2bb0279f2a7f4108e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 15:00:28 +0200 +Subject: media: atmel: atmel-sama5d2-isc: fix YUYV format + +From: Eugen Hristev + +[ Upstream commit 123aaf816b952e5b6ee754335596b01ba1f6c830 ] + +SAMA5D2 does not have the YCYC field for the RLP (rounding, limiting, +packaging) module. +The YCYC field is supposed to work with interleaved YUV formats like YUYV. +In SAMA5D2, we have to use YYCC field, which is used for both planar +formats like YUV420 and interleaved formats like YUYV. +Fix the according rlp callback to replace the generic YCYC field (which +makes more sense from a logical point of view) with the required YYCC +field. + +Fixes: debfa496871c ("media: atmel: atmel-isc-base: add support for more formats and additional pipeline modules") +Signed-off-by: Eugen Hristev +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/platform/atmel/atmel-sama5d2-isc.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/media/platform/atmel/atmel-sama5d2-isc.c b/drivers/media/platform/atmel/atmel-sama5d2-isc.c +index 925aa80a139b..b66f1d174e9d 100644 +--- a/drivers/media/platform/atmel/atmel-sama5d2-isc.c ++++ b/drivers/media/platform/atmel/atmel-sama5d2-isc.c +@@ -255,6 +255,23 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc) + struct regmap *regmap = isc->regmap; + u32 rlp_mode = isc->config.rlp_cfg_mode; + ++ /* ++ * In sama5d2, the YUV planar modes and the YUYV modes are treated ++ * in the same way in RLP register. ++ * Normally, YYCC mode should be Luma(n) - Color B(n) - Color R (n) ++ * and YCYC should be Luma(n + 1) - Color B (n) - Luma (n) - Color R (n) ++ * but in sama5d2, the YCYC mode does not exist, and YYCC must be ++ * selected for both planar and interleaved modes, as in fact ++ * both modes are supported. ++ * ++ * Thus, if the YCYC mode is selected, replace it with the ++ * sama5d2-compliant mode which is YYCC . ++ */ ++ if ((rlp_mode & ISC_RLP_CFG_MODE_YCYC) == ISC_RLP_CFG_MODE_YCYC) { ++ rlp_mode &= ~ISC_RLP_CFG_MODE_MASK; ++ rlp_mode |= ISC_RLP_CFG_MODE_YYCC; ++ } ++ + regmap_update_bits(regmap, ISC_RLP_CFG + isc->offsets.rlp, + ISC_RLP_CFG_MODE_MASK, rlp_mode); + } +-- +2.30.2 + diff --git a/queue-5.14/media-atomisp-fix-the-uninitialized-use-and-rename-r.patch b/queue-5.14/media-atomisp-fix-the-uninitialized-use-and-rename-r.patch new file mode 100644 index 00000000000..f0fbbb2debd --- /dev/null +++ b/queue-5.14/media-atomisp-fix-the-uninitialized-use-and-rename-r.patch @@ -0,0 +1,56 @@ +From 2fe13719064dc13ad0d351ac7527a1dd1b8b5694 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 07:38:56 +0200 +Subject: media: atomisp: fix the uninitialized use and rename "retvalue" + +From: Yizhuo + +[ Upstream commit c275e5d349b0d2b1143607d28b9c7c14a8a0a9b4 ] + +Inside function mt9m114_detect(), variable "retvalue" could +be uninitialized if mt9m114_read_reg() returns error, however, it +is used in the later if statement, which is potentially unsafe. + +The local variable "retvalue" is renamed to "model" to avoid +confusion. + +Link: https://lore.kernel.org/linux-media/20210625053858.3862-1-yzhai003@ucr.edu +Fixes: ad85094 (media / atomisp: fix the uninitialized use of model ID) +Signed-off-by: Yizhuo +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c +index 11196180a206..34bf92de2f29 100644 +--- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c ++++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c +@@ -1545,16 +1545,19 @@ static struct v4l2_ctrl_config mt9m114_controls[] = { + static int mt9m114_detect(struct mt9m114_device *dev, struct i2c_client *client) + { + struct i2c_adapter *adapter = client->adapter; +- u32 retvalue; ++ u32 model; ++ int ret; + + if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) { + dev_err(&client->dev, "%s: i2c error", __func__); + return -ENODEV; + } +- mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue); +- dev->real_model_id = retvalue; ++ ret = mt9m114_read_reg(client, MISENSOR_16BIT, MT9M114_PID, &model); ++ if (ret) ++ return ret; ++ dev->real_model_id = model; + +- if (retvalue != MT9M114_MOD_ID) { ++ if (model != MT9M114_MOD_ID) { + dev_err(&client->dev, "%s: failed: client->addr = %x\n", + __func__, client->addr); + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.14/media-coda-fix-frame_mem_ctrl-for-yuv420-and-yvu420-.patch b/queue-5.14/media-coda-fix-frame_mem_ctrl-for-yuv420-and-yvu420-.patch new file mode 100644 index 00000000000..7995e5ba34f --- /dev/null +++ b/queue-5.14/media-coda-fix-frame_mem_ctrl-for-yuv420-and-yvu420-.patch @@ -0,0 +1,62 @@ +From 521c9595dae407f1d35762949b4d46904c819569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 16:57:08 +0200 +Subject: media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats + +From: Philipp Zabel + +[ Upstream commit 44693d74f5653f82cd7ca0fe730eed0f6b83306a ] + +The frame memory control register value is currently determined +before userspace selects the final capture format and never corrected. +Update ctx->frame_mem_ctrl in __coda_start_decoding() to fix decoding +into YUV420 or YVU420 capture buffers. + +Reported-by: Andrej Picej +Fixes: 497e6b8559a6 ("media: coda: add sequence initialization work") +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-bit.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c +index 2f42808c43a4..c484c008ab02 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -2053,17 +2053,25 @@ static int __coda_start_decoding(struct coda_ctx *ctx) + u32 src_fourcc, dst_fourcc; + int ret; + ++ q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT); ++ q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); ++ src_fourcc = q_data_src->fourcc; ++ dst_fourcc = q_data_dst->fourcc; ++ + if (!ctx->initialized) { + ret = __coda_decoder_seq_init(ctx); + if (ret < 0) + return ret; ++ } else { ++ ctx->frame_mem_ctrl &= ~(CODA_FRAME_CHROMA_INTERLEAVE | (0x3 << 9) | ++ CODA9_FRAME_TILED2LINEAR); ++ if (dst_fourcc == V4L2_PIX_FMT_NV12 || dst_fourcc == V4L2_PIX_FMT_YUYV) ++ ctx->frame_mem_ctrl |= CODA_FRAME_CHROMA_INTERLEAVE; ++ if (ctx->tiled_map_type == GDI_TILED_FRAME_MB_RASTER_MAP) ++ ctx->frame_mem_ctrl |= (0x3 << 9) | ++ ((ctx->use_vdoa) ? 0 : CODA9_FRAME_TILED2LINEAR); + } + +- q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT); +- q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); +- src_fourcc = q_data_src->fourcc; +- dst_fourcc = q_data_dst->fourcc; +- + coda_write(dev, ctx->parabuf.paddr, CODA_REG_BIT_PARA_BUF_ADDR); + + ret = coda_alloc_framebuffers(ctx, q_data_dst, src_fourcc); +-- +2.30.2 + diff --git a/queue-5.14/media-cxd2880-spi-fix-an-error-handling-path.patch b/queue-5.14/media-cxd2880-spi-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..0bd7385615f --- /dev/null +++ b/queue-5.14/media-cxd2880-spi-fix-an-error-handling-path.patch @@ -0,0 +1,56 @@ +From 3bb15768350521bc455875f19446a468353522b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 21:54:31 +0200 +Subject: media: cxd2880-spi: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit dcb0145821017e929a733e2271c85c6f82b9c9f8 ] + +If an error occurs after a successful 'regulator_enable()' call, +'regulator_disable()' must be called. + +Fix the error handling path of the probe accordingly. + +Fixes: cb496cd472af ("media: cxd2880-spi: Add optional vcc regulator") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/spi/cxd2880-spi.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c +index e5094fff04c5..b91a1e845b97 100644 +--- a/drivers/media/spi/cxd2880-spi.c ++++ b/drivers/media/spi/cxd2880-spi.c +@@ -524,13 +524,13 @@ cxd2880_spi_probe(struct spi_device *spi) + if (IS_ERR(dvb_spi->vcc_supply)) { + if (PTR_ERR(dvb_spi->vcc_supply) == -EPROBE_DEFER) { + ret = -EPROBE_DEFER; +- goto fail_adapter; ++ goto fail_regulator; + } + dvb_spi->vcc_supply = NULL; + } else { + ret = regulator_enable(dvb_spi->vcc_supply); + if (ret) +- goto fail_adapter; ++ goto fail_regulator; + } + + dvb_spi->spi = spi; +@@ -618,6 +618,9 @@ fail_frontend: + fail_attach: + dvb_unregister_adapter(&dvb_spi->adapter); + fail_adapter: ++ if (!dvb_spi->vcc_supply) ++ regulator_disable(dvb_spi->vcc_supply); ++fail_regulator: + kfree(dvb_spi); + return ret; + } +-- +2.30.2 + diff --git a/queue-5.14/media-dvb-usb-fix-error-handling-in-dvb_usb_i2c_init.patch b/queue-5.14/media-dvb-usb-fix-error-handling-in-dvb_usb_i2c_init.patch new file mode 100644 index 00000000000..1055feffbd7 --- /dev/null +++ b/queue-5.14/media-dvb-usb-fix-error-handling-in-dvb_usb_i2c_init.patch @@ -0,0 +1,75 @@ +From fce66f9b14a78dace3dcdfac7bf35f9fea534668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 07:07:28 +0200 +Subject: media: dvb-usb: Fix error handling in dvb_usb_i2c_init + +From: Dongliang Mu + +[ Upstream commit 131ae388b88e3daf4cb0721ed4b4cb8bfc201465 ] + +In dvb_usb_i2c_init, if i2c_add_adapter fails, it only prints an error +message, and then continues to set DVB_USB_STATE_I2C. This affects the +logic of dvb_usb_i2c_exit, which leads to that, the deletion of i2c_adap +even if the i2c_add_adapter fails. + +Fix this by returning at the failure of i2c_add_adapter and then move +dvb_usb_i2c_exit out of the error handling code of dvb_usb_i2c_init. + +Fixes: 13a79f14ab28 ("media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb-i2c.c | 9 +++++++-- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c +index 2e07106f4680..bc4b2abdde1a 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c +@@ -17,7 +17,8 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d) + + if (d->props.i2c_algo == NULL) { + err("no i2c algorithm specified"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err; + } + + strscpy(d->i2c_adap.name, d->desc->name, sizeof(d->i2c_adap.name)); +@@ -27,11 +28,15 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d) + + i2c_set_adapdata(&d->i2c_adap, d); + +- if ((ret = i2c_add_adapter(&d->i2c_adap)) < 0) ++ ret = i2c_add_adapter(&d->i2c_adap); ++ if (ret < 0) { + err("could not add i2c adapter"); ++ goto err; ++ } + + d->state |= DVB_USB_STATE_I2C; + ++err: + return ret; + } + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index 28e1fd64dd3c..61439c8f33ca 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -194,8 +194,8 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums) + + err_adapter_init: + dvb_usb_adapter_exit(d); +-err_i2c_init: + dvb_usb_i2c_exit(d); ++err_i2c_init: + if (d->priv && d->props.priv_destroy) + d->props.priv_destroy(d); + err_priv_init: +-- +2.30.2 + diff --git a/queue-5.14/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch b/queue-5.14/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch new file mode 100644 index 00000000000..b20ce1fa7d6 --- /dev/null +++ b/queue-5.14/media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch @@ -0,0 +1,52 @@ +From 0992ef21a020213f1f45732065deace4765f6dc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 07:33:27 +0200 +Subject: media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init + +From: Dongliang Mu + +[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ] + +If dibusb_read_eeprom_byte fails, the mac address is not initialized. +And nova_t_read_mac_address does not handle this failure, which leads to +the uninit-value in dvb_usb_adapter_dvb_init. + +Fix this by handling the failure of dibusb_read_eeprom_byte. + +Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com +Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c +index e7b290552b66..9c0eb0d40822 100644 +--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c ++++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c +@@ -130,7 +130,7 @@ ret: + + static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + { +- int i; ++ int i, ret; + u8 b; + + mac[0] = 0x00; +@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + + /* this is a complete guess, but works for my box */ + for (i = 136; i < 139; i++) { +- dibusb_read_eeprom_byte(d,i, &b); ++ ret = dibusb_read_eeprom_byte(d, i, &b); ++ if (ret) ++ return ret; + + mac[5 - (i - 136)] = b; + } +-- +2.30.2 + diff --git a/queue-5.14/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch b/queue-5.14/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch new file mode 100644 index 00000000000..13b0ce149bc --- /dev/null +++ b/queue-5.14/media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch @@ -0,0 +1,57 @@ +From 158a9e0f7db67749db7939e6ee708161b17a3043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 07:59:04 +0200 +Subject: media: dvb-usb: fix uninit-value in vp702x_read_mac_addr + +From: Dongliang Mu + +[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ] + +If vp702x_usb_in_op fails, the mac address is not initialized. +And vp702x_read_mac_addr does not handle this failure, which leads to +the uninit-value in dvb_usb_adapter_dvb_init. + +Fix this by handling the failure of vp702x_usb_in_op. + +Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c +index bf54747e2e01..a1d9e4801a2b 100644 +--- a/drivers/media/usb/dvb-usb/vp702x.c ++++ b/drivers/media/usb/dvb-usb/vp702x.c +@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6]) + { + u8 i, *buf; ++ int ret; + struct vp702x_device_state *st = d->priv; + + mutex_lock(&st->buf_mutex); + buf = st->buf; +- for (i = 6; i < 12; i++) +- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1); ++ for (i = 6; i < 12; i++) { ++ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, ++ &buf[i - 6], 1); ++ if (ret < 0) ++ goto err; ++ } + + memcpy(mac, buf, 6); ++err: + mutex_unlock(&st->buf_mutex); +- return 0; ++ return ret; + } + + static int vp702x_frontend_attach(struct dvb_usb_adapter *adap) +-- +2.30.2 + diff --git a/queue-5.14/media-em28xx-input-fix-refcount-bug-in-em28xx_usb_di.patch b/queue-5.14/media-em28xx-input-fix-refcount-bug-in-em28xx_usb_di.patch new file mode 100644 index 00000000000..ee78bec9ab3 --- /dev/null +++ b/queue-5.14/media-em28xx-input-fix-refcount-bug-in-em28xx_usb_di.patch @@ -0,0 +1,67 @@ +From 70659a95891018643999a02f5a0970abf31f7611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 11:34:09 +0200 +Subject: media: em28xx-input: fix refcount bug in em28xx_usb_disconnect + +From: Dongliang Mu + +[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ] + +If em28xx_ir_init fails, it would decrease the refcount of dev. However, +in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease +the refcount of dev. This will lead to a refcount bug. + +Fix this bug by removing the kref_put in the error handling code +of em28xx_ir_init. + +refcount_t: underflow; use-after-free. +WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 +Modules linked in: +CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3 +Workqueue: usb_hub_wq hub_event +RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 +Call Trace: + kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69 + em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150 + usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458 + __device_release_driver drivers/base/dd.c:1201 [inline] + device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232 + bus_remove_device+0x108/0x160 drivers/base/bus.c:529 + device_del+0x1fe/0x510 drivers/base/core.c:3540 + usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419 + usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221 + hub_port_connect drivers/usb/core/hub.c:5151 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5440 [inline] + port_event drivers/usb/core/hub.c:5586 [inline] + hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668 + process_one_work+0x2c9/0x610 kernel/workqueue.c:2276 + process_scheduled_works kernel/workqueue.c:2338 [inline] + worker_thread+0x333/0x5b0 kernel/workqueue.c:2424 + kthread+0x188/0x1d0 kernel/kthread.c:319 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 + +Reported-by: Dongliang Mu +Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct") +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-input.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c +index 59529cbf9cd0..0b6d77c3bec8 100644 +--- a/drivers/media/usb/em28xx/em28xx-input.c ++++ b/drivers/media/usb/em28xx/em28xx-input.c +@@ -842,7 +842,6 @@ error: + kfree(ir); + ref_put: + em28xx_shutdown_buttons(dev); +- kref_put(&dev->ref, em28xx_free_device); + return err; + } + +-- +2.30.2 + diff --git a/queue-5.14/media-go7007-fix-memory-leak-in-go7007_usb_probe.patch b/queue-5.14/media-go7007-fix-memory-leak-in-go7007_usb_probe.patch new file mode 100644 index 00000000000..3099e74cdf7 --- /dev/null +++ b/queue-5.14/media-go7007-fix-memory-leak-in-go7007_usb_probe.patch @@ -0,0 +1,67 @@ +From 1354481608cfe2e60c89535b3ae35b32c4b97044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Jun 2021 21:45:02 +0200 +Subject: media: go7007: fix memory leak in go7007_usb_probe + +From: Pavel Skripkin + +[ Upstream commit 47d94dad8e64b2fc1d8f66ce7acf714f9462c60f ] + +In commit 137641287eb4 ("go7007: add sanity checking for endpoints") +endpoint sanity check was introduced, but if check fails it simply +returns with leaked pointers. + +Cutted log from my local syzbot instance: + +BUG: memory leak +unreferenced object 0xffff8880209f0000 (size 8192): + comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s) + hex dump (first 32 bytes): + 30 b0 27 22 80 88 ff ff 75 73 62 2d 64 75 6d 6d 0.'"....usb-dumm + 79 5f 68 63 64 2e 33 2d 31 00 00 00 00 00 00 00 y_hcd.3-1....... + backtrace: + [] kmalloc include/linux/slab.h:556 [inline] + [] kzalloc include/linux/slab.h:686 [inline] + [] go7007_alloc+0x46/0xb40 drivers/media/usb/go7007/go7007-driver.c:696 + [] go7007_usb_probe+0x13e/0x2200 drivers/media/usb/go7007/go7007-usb.c:1114 + [] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 + [] really_probe+0x291/0xf60 drivers/base/dd.c:576 + +BUG: memory leak +unreferenced object 0xffff88801e2f2800 (size 512): + comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s) + hex dump (first 32 bytes): + 00 87 40 8a ff ff ff ff 00 00 00 00 00 00 00 00 ..@............. + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmalloc include/linux/slab.h:556 [inline] + [] kzalloc include/linux/slab.h:686 [inline] + [] go7007_usb_probe+0x184/0x2200 drivers/media/usb/go7007/go7007-usb.c:1118 + [] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 + [] really_probe+0x291/0xf60 drivers/base/dd.c:576 + +Fixes: 137641287eb4 ("go7007: add sanity checking for endpoints") +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/go7007/go7007-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c +index dbf0455d5d50..eeb85981e02b 100644 +--- a/drivers/media/usb/go7007/go7007-usb.c ++++ b/drivers/media/usb/go7007/go7007-usb.c +@@ -1134,7 +1134,7 @@ static int go7007_usb_probe(struct usb_interface *intf, + + ep = usb->usbdev->ep_in[4]; + if (!ep) +- return -ENODEV; ++ goto allocfail; + + /* Allocate the URB and buffer for receiving incoming interrupts */ + usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL); +-- +2.30.2 + diff --git a/queue-5.14/media-go7007-remove-redundant-initialization.patch b/queue-5.14/media-go7007-remove-redundant-initialization.patch new file mode 100644 index 00000000000..037a7edb2a4 --- /dev/null +++ b/queue-5.14/media-go7007-remove-redundant-initialization.patch @@ -0,0 +1,87 @@ +From 5a15f733c3a960933dd6ca797a51782d0739f233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Jun 2021 21:45:42 +0200 +Subject: media: go7007: remove redundant initialization + +From: Pavel Skripkin + +[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ] + +In go7007_alloc() kzalloc() is used for struct go7007 +allocation. It means that there is no need in zeroing +any members, because kzalloc will take care of it. + +Removing these reduntant initialization steps increases +execution speed a lot: + + Before: + + 86.802 us | go7007_alloc(); + After: + + 29.595 us | go7007_alloc(); + +Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------ + 1 file changed, 26 deletions(-) + +diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c +index f1767be9d868..6650eab913d8 100644 +--- a/drivers/media/usb/go7007/go7007-driver.c ++++ b/drivers/media/usb/go7007/go7007-driver.c +@@ -691,49 +691,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board, + struct device *dev) + { + struct go7007 *go; +- int i; + + go = kzalloc(sizeof(struct go7007), GFP_KERNEL); + if (go == NULL) + return NULL; + go->dev = dev; + go->board_info = board; +- go->board_id = 0; + go->tuner_type = -1; +- go->channel_number = 0; +- go->name[0] = 0; + mutex_init(&go->hw_lock); + init_waitqueue_head(&go->frame_waitq); + spin_lock_init(&go->spinlock); + go->status = STATUS_INIT; +- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter)); +- go->i2c_adapter_online = 0; +- go->interrupt_available = 0; + init_waitqueue_head(&go->interrupt_waitq); +- go->input = 0; + go7007_update_board(go); +- go->encoder_h_halve = 0; +- go->encoder_v_halve = 0; +- go->encoder_subsample = 0; + go->format = V4L2_PIX_FMT_MJPEG; + go->bitrate = 1500000; + go->fps_scale = 1; +- go->pali = 0; + go->aspect_ratio = GO7007_RATIO_1_1; +- go->gop_size = 0; +- go->ipb = 0; +- go->closed_gop = 0; +- go->repeat_seqhead = 0; +- go->seq_header_enable = 0; +- go->gop_header_enable = 0; +- go->dvd_mode = 0; +- go->interlace_coding = 0; +- for (i = 0; i < 4; ++i) +- go->modet[i].enable = 0; +- for (i = 0; i < 1624; ++i) +- go->modet_map[i] = 0; +- go->audio_deliver = NULL; +- go->audio_enabled = 0; + + return go; + } +-- +2.30.2 + diff --git a/queue-5.14/media-omap3isp-fix-missing-unlock-in-isp_subdev_noti.patch b/queue-5.14/media-omap3isp-fix-missing-unlock-in-isp_subdev_noti.patch new file mode 100644 index 00000000000..121e7ceea1b --- /dev/null +++ b/queue-5.14/media-omap3isp-fix-missing-unlock-in-isp_subdev_noti.patch @@ -0,0 +1,42 @@ +From 281ee8112be61e0d7b92711fd57e3649af0c4027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 16:37:33 +0200 +Subject: media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete() + +From: Wei Yongjun + +[ Upstream commit 0368e7d2cd84a90d0518753fac33795e13df553f ] + +Add the missing unlock before return from function +isp_subdev_notifier_complete() in the init error +handling case. + +Fixes: ba689d933361 ("media: omap3isp: Acquire graph mutex for graph traversal") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 53025c8c7531..20f59c59ff8a 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -2037,8 +2037,10 @@ static int isp_subdev_notifier_complete(struct v4l2_async_notifier *async) + mutex_lock(&isp->media_dev.graph_mutex); + + ret = media_entity_enum_init(&isp->crashed, &isp->media_dev); +- if (ret) ++ if (ret) { ++ mutex_unlock(&isp->media_dev.graph_mutex); + return ret; ++ } + + list_for_each_entry(sd, &v4l2_dev->subdevs, list) { + if (sd->notifier != &isp->notifier) +-- +2.30.2 + diff --git a/queue-5.14/media-rockchip-rga-fix-error-handling-in-probe.patch b/queue-5.14/media-rockchip-rga-fix-error-handling-in-probe.patch new file mode 100644 index 00000000000..d0992a2620c --- /dev/null +++ b/queue-5.14/media-rockchip-rga-fix-error-handling-in-probe.patch @@ -0,0 +1,99 @@ +From e0a45a5f907a99ba9e6bc913c92609319ae54d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 11:24:10 +0200 +Subject: media: rockchip/rga: fix error handling in probe + +From: Dan Carpenter + +[ Upstream commit e58430e1d4fd01b74475d2fbe2e25b5817b729a9 ] + +There are a few bugs in this code. 1) No checks for whether +dma_alloc_attrs() or __get_free_pages() failed. 2) If +video_register_device() fails it doesn't clean up the dma attrs or the +free pages. 3) The video_device_release() function frees "vfd" which +leads to a use after free on the next line. The call to +video_unregister_device() is not required so I have just removed that. + +Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support") +Reported-by: Dongliang Mu +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rga/rga.c | 27 ++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c +index bf3fd71ec3af..6759091b15e0 100644 +--- a/drivers/media/platform/rockchip/rga/rga.c ++++ b/drivers/media/platform/rockchip/rga/rga.c +@@ -863,12 +863,12 @@ static int rga_probe(struct platform_device *pdev) + if (IS_ERR(rga->m2m_dev)) { + v4l2_err(&rga->v4l2_dev, "Failed to init mem2mem device\n"); + ret = PTR_ERR(rga->m2m_dev); +- goto unreg_video_dev; ++ goto rel_vdev; + } + + ret = pm_runtime_resume_and_get(rga->dev); + if (ret < 0) +- goto unreg_video_dev; ++ goto rel_vdev; + + rga->version.major = (rga_read(rga, RGA_VERSION_INFO) >> 24) & 0xFF; + rga->version.minor = (rga_read(rga, RGA_VERSION_INFO) >> 20) & 0x0F; +@@ -882,11 +882,23 @@ static int rga_probe(struct platform_device *pdev) + rga->cmdbuf_virt = dma_alloc_attrs(rga->dev, RGA_CMDBUF_SIZE, + &rga->cmdbuf_phy, GFP_KERNEL, + DMA_ATTR_WRITE_COMBINE); ++ if (!rga->cmdbuf_virt) { ++ ret = -ENOMEM; ++ goto rel_vdev; ++ } + + rga->src_mmu_pages = + (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3); ++ if (!rga->src_mmu_pages) { ++ ret = -ENOMEM; ++ goto free_dma; ++ } + rga->dst_mmu_pages = + (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3); ++ if (rga->dst_mmu_pages) { ++ ret = -ENOMEM; ++ goto free_src_pages; ++ } + + def_frame.stride = (def_frame.width * def_frame.fmt->depth) >> 3; + def_frame.size = def_frame.stride * def_frame.height; +@@ -894,7 +906,7 @@ static int rga_probe(struct platform_device *pdev) + ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1); + if (ret) { + v4l2_err(&rga->v4l2_dev, "Failed to register video device\n"); +- goto rel_vdev; ++ goto free_dst_pages; + } + + v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n", +@@ -902,10 +914,15 @@ static int rga_probe(struct platform_device *pdev) + + return 0; + ++free_dst_pages: ++ free_pages((unsigned long)rga->dst_mmu_pages, 3); ++free_src_pages: ++ free_pages((unsigned long)rga->src_mmu_pages, 3); ++free_dma: ++ dma_free_attrs(rga->dev, RGA_CMDBUF_SIZE, rga->cmdbuf_virt, ++ rga->cmdbuf_phy, DMA_ATTR_WRITE_COMBINE); + rel_vdev: + video_device_release(vfd); +-unreg_video_dev: +- video_unregister_device(rga->vfd); + unreg_v4l2_dev: + v4l2_device_unregister(&rga->v4l2_dev); + err_put_clk: +-- +2.30.2 + diff --git a/queue-5.14/media-tda1997x-enable-edid-support.patch b/queue-5.14/media-tda1997x-enable-edid-support.patch new file mode 100644 index 00000000000..1cce088e1fd --- /dev/null +++ b/queue-5.14/media-tda1997x-enable-edid-support.patch @@ -0,0 +1,40 @@ +From 741cf17b92f095aaff391a6c2499c53b30ef8294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 07:13:55 +0200 +Subject: media: TDA1997x: enable EDID support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Hałasa + +[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ] + +Without this patch, the TDA19971 chip's EDID is inactive. +EDID never worked with this driver, it was all tested with HDMI signal +sources which don't need EDID support. + +Signed-off-by: Krzysztof Halasa +Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver") +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tda1997x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c +index 91e6db847bb5..3a191e257fad 100644 +--- a/drivers/media/i2c/tda1997x.c ++++ b/drivers/media/i2c/tda1997x.c +@@ -2233,6 +2233,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd) + /* get initial HDMI status */ + state->hdmi_status = io_read(sd, REG_HDMI_FLAGS); + ++ io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.14/media-v4l2-subdev-fix-some-null-vs-is_err-checks.patch b/queue-5.14/media-v4l2-subdev-fix-some-null-vs-is_err-checks.patch new file mode 100644 index 00000000000..ba631709555 --- /dev/null +++ b/queue-5.14/media-v4l2-subdev-fix-some-null-vs-is_err-checks.patch @@ -0,0 +1,74 @@ +From 89cbe5b3817366b6612e6602e1c2713fc0d3ad77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 16:31:53 +0200 +Subject: media: v4l2-subdev: fix some NULL vs IS_ERR() checks + +From: Dan Carpenter + +[ Upstream commit ba7a93e507f88306d7a19a1dcb53b857b790cfb8 ] + +The v4l2_subdev_alloc_state() function returns error pointers, it +doesn't return NULL. + +Fixes: 0d346d2a6f54 ("media: v4l2-subdev: add subdev-wide state struct") +Signed-off-by: Dan Carpenter +Reviewed-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar-vin/rcar-v4l2.c | 4 ++-- + drivers/media/platform/vsp1/vsp1_entity.c | 4 ++-- + drivers/staging/media/tegra-video/vi.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/platform/rcar-vin/rcar-v4l2.c b/drivers/media/platform/rcar-vin/rcar-v4l2.c +index cca15a10c0b3..0d141155f0e3 100644 +--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c ++++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c +@@ -253,8 +253,8 @@ static int rvin_try_format(struct rvin_dev *vin, u32 which, + int ret; + + sd_state = v4l2_subdev_alloc_state(sd); +- if (sd_state == NULL) +- return -ENOMEM; ++ if (IS_ERR(sd_state)) ++ return PTR_ERR(sd_state); + + if (!rvin_format_from_pixel(vin, pix->pixelformat)) + pix->pixelformat = RVIN_DEFAULT_FORMAT; +diff --git a/drivers/media/platform/vsp1/vsp1_entity.c b/drivers/media/platform/vsp1/vsp1_entity.c +index 6f51e5c75543..823c15facd1b 100644 +--- a/drivers/media/platform/vsp1/vsp1_entity.c ++++ b/drivers/media/platform/vsp1/vsp1_entity.c +@@ -676,9 +676,9 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity, + * rectangles. + */ + entity->config = v4l2_subdev_alloc_state(&entity->subdev); +- if (entity->config == NULL) { ++ if (IS_ERR(entity->config)) { + media_entity_cleanup(&entity->subdev.entity); +- return -ENOMEM; ++ return PTR_ERR(entity->config); + } + + return 0; +diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c +index 89709cd06d4d..d321790b07d9 100644 +--- a/drivers/staging/media/tegra-video/vi.c ++++ b/drivers/staging/media/tegra-video/vi.c +@@ -508,8 +508,8 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan, + return -ENODEV; + + sd_state = v4l2_subdev_alloc_state(subdev); +- if (!sd_state) +- return -ENOMEM; ++ if (IS_ERR(sd_state)) ++ return PTR_ERR(sd_state); + /* + * Retrieve the format information and if requested format isn't + * supported, keep the current format. +-- +2.30.2 + diff --git a/queue-5.14/media-venus-helper-do-not-set-constrained-parameters.patch b/queue-5.14/media-venus-helper-do-not-set-constrained-parameters.patch new file mode 100644 index 00000000000..27c8cf604e6 --- /dev/null +++ b/queue-5.14/media-venus-helper-do-not-set-constrained-parameters.patch @@ -0,0 +1,42 @@ +From 865c82319459e59673f848ca234697912e579262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 18:21:22 +0200 +Subject: media: venus: helper: do not set constrained parameters for UBWC + +From: Mansur Alisha Shaik + +[ Upstream commit 1ac61faf6ebbce59fccbb53d7faf25576e9897ab ] + +Plane constraints firmware interface is to override the default +alignment for a given color format. By default venus hardware has +alignments as 128x32, but NV12 was defined differently to meet +various usecases. Compressed NV12 has always been aligned as 128x32, +hence not needed to override the default alignment. + +Fixes: bc28936bbba9 ("media: venus: helpers, hfi, vdec: Set actual plane constraints to FW") +Signed-off-by: Mansur Alisha Shaik +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/helpers.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c +index 1fe6d463dc99..8012f5c7bf34 100644 +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -1137,6 +1137,9 @@ int venus_helper_set_format_constraints(struct venus_inst *inst) + if (!IS_V6(inst->core)) + return 0; + ++ if (inst->opb_fmt == HFI_COLOR_FORMAT_NV12_UBWC) ++ return 0; ++ + pconstraint.buffer_type = HFI_BUFFER_OUTPUT2; + pconstraint.num_planes = 2; + pconstraint.plane_format[0].stride_multiples = 128; +-- +2.30.2 + diff --git a/queue-5.14/media-venus-hfi-fix-return-value-check-in-sys_get_pr.patch b/queue-5.14/media-venus-hfi-fix-return-value-check-in-sys_get_pr.patch new file mode 100644 index 00000000000..fd1f62fb953 --- /dev/null +++ b/queue-5.14/media-venus-hfi-fix-return-value-check-in-sys_get_pr.patch @@ -0,0 +1,40 @@ +From 7064e4b97dffa0214e2d8dd49ce7d27c7b6756f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 09:45:17 +0200 +Subject: media: venus: hfi: fix return value check in + sys_get_prop_image_version() + +From: Zhen Lei + +[ Upstream commit 331e06bbde5856059b7a6bb183f12878ed4decb1 ] + +In case of error, the function qcom_smem_get() returns ERR_PTR() +and never returns NULL. The NULL test in the return value check +should be replaced with IS_ERR(). + +Fixes: d566e78dd6af ("media: venus : hfi: add venus image info into smem") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c +index d9fde66f6fa8..9a2bdb002edc 100644 +--- a/drivers/media/platform/qcom/venus/hfi_msgs.c ++++ b/drivers/media/platform/qcom/venus/hfi_msgs.c +@@ -261,7 +261,7 @@ sys_get_prop_image_version(struct device *dev, + + smem_tbl_ptr = qcom_smem_get(QCOM_SMEM_HOST_ANY, + SMEM_IMG_VER_TBL, &smem_blk_sz); +- if (smem_tbl_ptr && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ) ++ if (!IS_ERR(smem_tbl_ptr) && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ) + memcpy(smem_tbl_ptr + SMEM_IMG_OFFSET_VENUS, + img_ver, VER_STR_SZ); + } +-- +2.30.2 + diff --git a/queue-5.14/media-venus-venc-fix-potential-null-pointer-derefere.patch b/queue-5.14/media-venus-venc-fix-potential-null-pointer-derefere.patch new file mode 100644 index 00000000000..1caadb95f91 --- /dev/null +++ b/queue-5.14/media-venus-venc-fix-potential-null-pointer-derefere.patch @@ -0,0 +1,42 @@ +From 8dc16a2aefad617aa4b221f9948d01fd921d5914 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jul 2021 14:30:25 +0200 +Subject: media: venus: venc: Fix potential null pointer dereference on pointer + fmt + +From: Colin Ian King + +[ Upstream commit 09ea9719a423fc675d40dd05407165e161ea0c48 ] + +Currently the call to find_format can potentially return a NULL to +fmt and the nullpointer is later dereferenced on the assignment of +pixmp->num_planes = fmt->num_planes. Fix this by adding a NULL pointer +check and returning NULL for the failure case. + +Addresses-Coverity: ("Dereference null return") + +Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") +Signed-off-by: Colin Ian King +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/venc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c +index 8dd49d4f124c..1d62e38065d6 100644 +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -183,6 +183,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f) + else + return NULL; + fmt = find_format(inst, pixmp->pixelformat, f->type); ++ if (!fmt) ++ return NULL; + } + + pixmp->width = clamp(pixmp->width, frame_width_min(inst), +-- +2.30.2 + diff --git a/queue-5.14/misc-pvpanic-fix-set-driver-data.patch b/queue-5.14/misc-pvpanic-fix-set-driver-data.patch new file mode 100644 index 00000000000..a55db742224 --- /dev/null +++ b/queue-5.14/misc-pvpanic-fix-set-driver-data.patch @@ -0,0 +1,38 @@ +From cfcaf2befad551a7186ce34d2a721dd86e6cacf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 18:12:26 +0300 +Subject: misc/pvpanic: fix set driver data + +From: Mihai Carabas + +[ Upstream commit a99009bc4f2f0b46e6c553704fda0b67e04395f5 ] + +Add again dev_set_drvdata(), but this time in devm_pvpanic_probe(), in order +for dev_get_drvdata() to not return NULL. + +Fixes: 394febc9d0a6 ("misc/pvpanic: Make 'pvpanic_probe()' resource managed") +Reviewed-by: Andy Shevchenko +Signed-off-by: Mihai Carabas +Link: https://lore.kernel.org/r/1629385946-4584-2-git-send-email-mihai.carabas@oracle.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/pvpanic/pvpanic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/pvpanic/pvpanic.c b/drivers/misc/pvpanic/pvpanic.c +index 02b807c788c9..bb7aa6368538 100644 +--- a/drivers/misc/pvpanic/pvpanic.c ++++ b/drivers/misc/pvpanic/pvpanic.c +@@ -85,6 +85,8 @@ int devm_pvpanic_probe(struct device *dev, struct pvpanic_instance *pi) + list_add(&pi->list, &pvpanic_list); + spin_unlock(&pvpanic_lock); + ++ dev_set_drvdata(dev, pi); ++ + return devm_add_action_or_reset(dev, pvpanic_remove, pi); + } + EXPORT_SYMBOL_GPL(devm_pvpanic_probe); +-- +2.30.2 + diff --git a/queue-5.14/mm-swap-consider-max-pages-in-iomap_swapfile_add_ext.patch b/queue-5.14/mm-swap-consider-max-pages-in-iomap_swapfile_add_ext.patch new file mode 100644 index 00000000000..1a4838e630c --- /dev/null +++ b/queue-5.14/mm-swap-consider-max-pages-in-iomap_swapfile_add_ext.patch @@ -0,0 +1,148 @@ +From 0568aa87abcd94c9a994f70b550cdcc6cd84090c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 12:47:52 -0700 +Subject: mm/swap: consider max pages in iomap_swapfile_add_extent + +From: Xu Yu + +[ Upstream commit 36ca7943ac18aebf8aad4c50829eb2ea5ec847df ] + +When the max pages (last_page in the swap header + 1) is smaller than +the total pages (inode size) of the swapfile, iomap_swapfile_activate +overwrites sis->max with total pages. + +However, frontswap_map is a swap page state bitmap allocated using the +initial sis->max page count read from the swap header. If swapfile +activation increases sis->max, it's possible for the frontswap code to +walk off the end of the bitmap, thereby corrupting kernel memory. + +[djwong: modify the description a bit; the original paragraph reads: + +"However, frontswap_map is allocated using max pages. When test and clear +the sis offset, which is larger than max pages, of frontswap_map in +__frontswap_invalidate_page(), neighbors of frontswap_map may be +overwritten, i.e., slab is polluted." + +Note also that this bug resulted in a behavioral change: activating a +swap file that was formatted and later extended results in all pages +being activated, not the number of pages recorded in the swap header.] + +This fixes the issue by considering the limitation of max pages of swap +info in iomap_swapfile_add_extent(). + +To reproduce the case, compile kernel with slub RED ZONE, then run test: +$ sudo stress-ng -a 1 -x softlockup,resources -t 72h --metrics --times \ + --verify -v -Y /root/tmpdir/stress-ng/stress-statistic-12.yaml \ + --log-file /root/tmpdir/stress-ng/stress-logfile-12.txt \ + --temp-path /root/tmpdir/stress-ng/ + +We'll get the error log as below: + +[ 1151.015141] ============================================================================= +[ 1151.016489] BUG kmalloc-16 (Not tainted): Right Redzone overwritten +[ 1151.017486] ----------------------------------------------------------------------------- +[ 1151.017486] +[ 1151.018997] Disabling lock debugging due to kernel taint +[ 1151.019873] INFO: 0x0000000084e43932-0x0000000098d17cae @offset=7392. First byte 0x0 instead of 0xcc +[ 1151.021303] INFO: Allocated in __do_sys_swapon+0xcf6/0x1170 age=43417 cpu=9 pid=3816 +[ 1151.022538] __slab_alloc+0xe/0x20 +[ 1151.023069] __kmalloc_node+0xfd/0x4b0 +[ 1151.023704] __do_sys_swapon+0xcf6/0x1170 +[ 1151.024346] do_syscall_64+0x33/0x40 +[ 1151.024925] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 1151.025749] INFO: Freed in put_cred_rcu+0xa1/0xc0 age=43424 cpu=3 pid=2041 +[ 1151.026889] kfree+0x276/0x2b0 +[ 1151.027405] put_cred_rcu+0xa1/0xc0 +[ 1151.027949] rcu_do_batch+0x17d/0x410 +[ 1151.028566] rcu_core+0x14e/0x2b0 +[ 1151.029084] __do_softirq+0x101/0x29e +[ 1151.029645] asm_call_irq_on_stack+0x12/0x20 +[ 1151.030381] do_softirq_own_stack+0x37/0x40 +[ 1151.031037] do_softirq.part.15+0x2b/0x30 +[ 1151.031710] __local_bh_enable_ip+0x4b/0x50 +[ 1151.032412] copy_fpstate_to_sigframe+0x111/0x360 +[ 1151.033197] __setup_rt_frame+0xce/0x480 +[ 1151.033809] arch_do_signal+0x1a3/0x250 +[ 1151.034463] exit_to_user_mode_prepare+0xcf/0x110 +[ 1151.035242] syscall_exit_to_user_mode+0x27/0x190 +[ 1151.035970] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 1151.036795] INFO: Slab 0x000000003b9de4dc objects=44 used=9 fp=0x00000000539e349e flags=0xfffffc0010201 +[ 1151.038323] INFO: Object 0x000000004855ba01 @offset=7376 fp=0x0000000000000000 +[ 1151.038323] +[ 1151.039683] Redzone 000000008d0afd3d: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ +[ 1151.041180] Object 000000004855ba01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +[ 1151.042714] Redzone 0000000084e43932: 00 00 00 c0 cc cc cc cc ........ +[ 1151.044120] Padding 000000000864c042: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ +[ 1151.045615] CPU: 5 PID: 3816 Comm: stress-ng Tainted: G B 5.10.50+ #7 +[ 1151.046846] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 1151.048633] Call Trace: +[ 1151.049072] dump_stack+0x57/0x6a +[ 1151.049585] check_bytes_and_report+0xed/0x110 +[ 1151.050320] check_object+0x1eb/0x290 +[ 1151.050924] ? __x64_sys_swapoff+0x39a/0x540 +[ 1151.051646] free_debug_processing+0x151/0x350 +[ 1151.052333] __slab_free+0x21a/0x3a0 +[ 1151.052938] ? _cond_resched+0x2d/0x40 +[ 1151.053529] ? __vunmap+0x1de/0x220 +[ 1151.054139] ? __x64_sys_swapoff+0x39a/0x540 +[ 1151.054796] ? kfree+0x276/0x2b0 +[ 1151.055307] kfree+0x276/0x2b0 +[ 1151.055832] __x64_sys_swapoff+0x39a/0x540 +[ 1151.056466] do_syscall_64+0x33/0x40 +[ 1151.057084] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 1151.057866] RIP: 0033:0x150340b0ffb7 +[ 1151.058481] Code: Unable to access opcode bytes at RIP 0x150340b0ff8d. +[ 1151.059537] RSP: 002b:00007fff7f4ee238 EFLAGS: 00000246 ORIG_RAX: 00000000000000a8 +[ 1151.060768] RAX: ffffffffffffffda RBX: 00007fff7f4ee66c RCX: 0000150340b0ffb7 +[ 1151.061904] RDX: 000000000000000a RSI: 0000000000018094 RDI: 00007fff7f4ee860 +[ 1151.063033] RBP: 00007fff7f4ef980 R08: 0000000000000000 R09: 0000150340a672bd +[ 1151.064135] R10: 00007fff7f4edca0 R11: 0000000000000246 R12: 0000000000018094 +[ 1151.065253] R13: 0000000000000005 R14: 000000000160d930 R15: 00007fff7f4ee66c +[ 1151.066413] FIX kmalloc-16: Restoring 0x0000000084e43932-0x0000000098d17cae=0xcc +[ 1151.066413] +[ 1151.067890] FIX kmalloc-16: Object at 0x000000004855ba01 not freed + +Fixes: 67482129cdab ("iomap: add a swapfile activation function") +Fixes: a45c0eccc564 ("iomap: move the swapfile code into a separate file") +Signed-off-by: Gang Deng +Signed-off-by: Xu Yu +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/iomap/swapfile.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/iomap/swapfile.c b/fs/iomap/swapfile.c +index 6250ca6a1f85..4ecf4e1f68ef 100644 +--- a/fs/iomap/swapfile.c ++++ b/fs/iomap/swapfile.c +@@ -31,11 +31,16 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi) + { + struct iomap *iomap = &isi->iomap; + unsigned long nr_pages; ++ unsigned long max_pages; + uint64_t first_ppage; + uint64_t first_ppage_reported; + uint64_t next_ppage; + int error; + ++ if (unlikely(isi->nr_pages >= isi->sis->max)) ++ return 0; ++ max_pages = isi->sis->max - isi->nr_pages; ++ + /* + * Round the start up and the end down so that the physical + * extent aligns to a page boundary. +@@ -48,6 +53,7 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi) + if (first_ppage >= next_ppage) + return 0; + nr_pages = next_ppage - first_ppage; ++ nr_pages = min(nr_pages, max_pages); + + /* + * Calculate how much swap space we're adding; the first page contains +-- +2.30.2 + diff --git a/queue-5.14/mmc-dw_mmc-fix-issue-with-uninitialized-dma_slave_co.patch b/queue-5.14/mmc-dw_mmc-fix-issue-with-uninitialized-dma_slave_co.patch new file mode 100644 index 00000000000..4df4741912d --- /dev/null +++ b/queue-5.14/mmc-dw_mmc-fix-issue-with-uninitialized-dma_slave_co.patch @@ -0,0 +1,47 @@ +From eaedd1992887ee2e3a6bc96124ca13ef442f3a3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:16:43 +0300 +Subject: mmc: dw_mmc: Fix issue with uninitialized dma_slave_config + +From: Tony Lindgren + +[ Upstream commit c3ff0189d3bc9c03845fe37472c140f0fefd0c79 ] + +Depending on the DMA driver being used, the struct dma_slave_config may +need to be initialized to zero for the unused data. + +For example, we have three DMA drivers using src_port_window_size and +dst_port_window_size. If these are left uninitialized, it can cause DMA +failures. + +For dw_mmc, this is probably not currently an issue but is still good to +fix though. + +Fixes: 3fc7eaef44db ("mmc: dw_mmc: Add external dma interface support") +Cc: Shawn Lin +Cc: Jaehoon Chung +Cc: Peter Ujfalusi +Cc: Vinod Koul +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210810081644.19353-2-tony@atomide.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/dw_mmc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index c3229d8c7041..33cb70aa02aa 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -782,6 +782,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host, + int ret = 0; + + /* Set external dma config: burst size, burst width */ ++ memset(&cfg, 0, sizeof(cfg)); + cfg.dst_addr = host->phy_regs + fifo_offset; + cfg.src_addr = cfg.dst_addr; + cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +-- +2.30.2 + diff --git a/queue-5.14/mmc-moxart-fix-issue-with-uninitialized-dma_slave_co.patch b/queue-5.14/mmc-moxart-fix-issue-with-uninitialized-dma_slave_co.patch new file mode 100644 index 00000000000..b67289ead36 --- /dev/null +++ b/queue-5.14/mmc-moxart-fix-issue-with-uninitialized-dma_slave_co.patch @@ -0,0 +1,46 @@ +From c4644ad3dcc4668941446b5f56a4d27d99db8353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:16:44 +0300 +Subject: mmc: moxart: Fix issue with uninitialized dma_slave_config + +From: Tony Lindgren + +[ Upstream commit ee5165354d498e5bceb0b386e480ac84c5f8c28c ] + +Depending on the DMA driver being used, the struct dma_slave_config may +need to be initialized to zero for the unused data. + +For example, we have three DMA drivers using src_port_window_size and +dst_port_window_size. If these are left uninitialized, it can cause DMA +failures. + +For moxart, this is probably not currently an issue but is still good to +fix though. + +Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") +Cc: Jonas Jensen +Cc: Vinod Koul +Cc: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210810081644.19353-3-tony@atomide.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/moxart-mmc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c +index bde298887579..6c9d38132f74 100644 +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -628,6 +628,7 @@ static int moxart_probe(struct platform_device *pdev) + host->dma_chan_tx, host->dma_chan_rx); + host->have_dma = true; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + +-- +2.30.2 + diff --git a/queue-5.14/mmc-sdhci-fix-issue-with-uninitialized-dma_slave_con.patch b/queue-5.14/mmc-sdhci-fix-issue-with-uninitialized-dma_slave_con.patch new file mode 100644 index 00000000000..b9864e05af6 --- /dev/null +++ b/queue-5.14/mmc-sdhci-fix-issue-with-uninitialized-dma_slave_con.patch @@ -0,0 +1,50 @@ +From cbf87bb98975998094212c872ec61f19793c5b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:16:42 +0300 +Subject: mmc: sdhci: Fix issue with uninitialized dma_slave_config + +From: Tony Lindgren + +[ Upstream commit 522654d534d315d540710124c57b49ca22ac5f72 ] + +Depending on the DMA driver being used, the struct dma_slave_config may +need to be initialized to zero for the unused data. + +For example, we have three DMA drivers using src_port_window_size and +dst_port_window_size. If these are left uninitialized, it can cause DMA +failures at least if external TI SDMA is ever configured for sdhci. + +For other external DMA cases, this is probably not currently an issue but +is still good to fix though. + +Fixes: 18e762e3b7a7 ("mmc: sdhci: add support for using external DMA devices") +Cc: Adrian Hunter +Cc: Chunyan Zhang +Cc: Faiz Abbas +Cc: Peter Ujfalusi +Cc: Vinod Koul +Signed-off-by: Tony Lindgren +Acked-by: Adrian Hunter +Reviewed-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20210810081644.19353-1-tony@atomide.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index aba6e10b8605..fff6c39a343e 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1222,6 +1222,7 @@ static int sdhci_external_dma_setup(struct sdhci_host *host, + if (!host->mapbase) + return -EINVAL; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.src_addr = host->mapbase + SDHCI_BUFFER; + cfg.dst_addr = host->mapbase + SDHCI_BUFFER; + cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +-- +2.30.2 + diff --git a/queue-5.14/nbd-add-the-check-to-prevent-overflow-in-__nbd_ioctl.patch b/queue-5.14/nbd-add-the-check-to-prevent-overflow-in-__nbd_ioctl.patch new file mode 100644 index 00000000000..f11b661584c --- /dev/null +++ b/queue-5.14/nbd-add-the-check-to-prevent-overflow-in-__nbd_ioctl.patch @@ -0,0 +1,68 @@ +From 9bfa99e9ce9cbe2e4e2761e9710bfda7b3042abe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 10:12:12 +0800 +Subject: nbd: add the check to prevent overflow in __nbd_ioctl() + +From: Baokun Li + +[ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ] + +If user specify a large enough value of NBD blocks option, it may trigger +signed integer overflow which may lead to nbd->config->bytesize becomes a +large or small value, zero in particular. + +UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31 +signed integer overflow: +1024 * 4611686155866341414 cannot be represented in type 'long long int' +[...] +Call trace: +[...] + handle_overflow+0x188/0x1dc lib/ubsan.c:192 + __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213 + nbd_size_set drivers/block/nbd.c:325 [inline] + __nbd_ioctl drivers/block/nbd.c:1342 [inline] + nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395 + __blkdev_driver_ioctl block/ioctl.c:311 [inline] +[...] + +Although it is not a big deal, still silence the UBSAN by limit +the input value. + +Reported-by: Hulk Robot +Signed-off-by: Baokun Li +Reviewed-by: Josef Bacik +Link: https://lore.kernel.org/r/20210804021212.990223-1-libaokun1@huawei.com +[axboe: dropped unlikely()] +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 19f5d5a8b16a..acf3f85bf3c7 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, + unsigned int cmd, unsigned long arg) + { + struct nbd_config *config = nbd->config; ++ loff_t bytesize; + + switch (cmd) { + case NBD_DISCONNECT: +@@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, + case NBD_SET_SIZE: + return nbd_set_size(nbd, arg, config->blksize); + case NBD_SET_SIZE_BLOCKS: +- return nbd_set_size(nbd, arg * config->blksize, +- config->blksize); ++ if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize)) ++ return -EINVAL; ++ return nbd_set_size(nbd, bytesize, config->blksize); + case NBD_SET_TIMEOUT: + nbd_set_cmd_timeout(nbd, arg); + return 0; +-- +2.30.2 + diff --git a/queue-5.14/nbd-do-del_gendisk-asynchronously-for-nbd_destroy_on.patch b/queue-5.14/nbd-do-del_gendisk-asynchronously-for-nbd_destroy_on.patch new file mode 100644 index 00000000000..4ce9b00d602 --- /dev/null +++ b/queue-5.14/nbd-do-del_gendisk-asynchronously-for-nbd_destroy_on.patch @@ -0,0 +1,207 @@ +From f39db19f375fd51a23c93475b9a741da403cf11f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 14:44:23 +0200 +Subject: nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT + +From: Hou Tao + +[ Upstream commit 68c9417b193d0d174b0ada013602272177e61303 ] + +Now open_mutex is used to synchronize partition operations (e.g, +blk_drop_partitions() and blkdev_reread_part()), however it makes +nbd driver broken, because nbd may call del_gendisk() in nbd_release() +or nbd_genl_disconnect() if NBD_CFLAG_DESTROY_ON_DISCONNECT is enabled, +and deadlock occurs, as shown below: + +// AB-BA dead-lock +nbd_genl_disconnect blkdev_open + nbd_disconnect_and_put + lock bd_mutex + // last ref + nbd_put + lock nbd_index_mutex + del_gendisk + nbd_open + try lock nbd_index_mutex + try lock bd_mutex + + or + +// AA dead-lock +nbd_release + lock bd_mutex + nbd_put + try lock bd_mutex + +Instead of fixing block layer (e.g, introduce another lock), fixing +the nbd driver to call del_gendisk() in a kworker when +NBD_DESTROY_ON_DISCONNECT is enabled. When NBD_DESTROY_ON_DISCONNECT +is disabled, nbd device will always be destroy through module removal, +and there is no risky of deadlock. + +To ensure the reuse of nbd index succeeds, moving the calling of +idr_remove() after del_gendisk(), so if the reused index is not found +in nbd_index_idr, the old disk must have been deleted. And reusing +the existing destroy_complete mechanism to ensure nbd_genl_connect() +will wait for the completion of del_gendisk(). + +Also adding a new workqueue for nbd removal, so nbd_cleanup() +can ensure all removals complete before exits. + +Reported-by: syzbot+0fe7752e52337864d29b@syzkaller.appspotmail.com +Fixes: c76f48eb5c08 ("block: take bd_mutex around delete_partitions in del_gendisk") +Signed-off-by: Hou Tao +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20210811124428.2368491-2-hch@lst.de +Reviewed-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 70 +++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 61 insertions(+), 9 deletions(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index acf3f85bf3c7..7ed888e99f09 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -49,6 +49,7 @@ + + static DEFINE_IDR(nbd_index_idr); + static DEFINE_MUTEX(nbd_index_mutex); ++static struct workqueue_struct *nbd_del_wq; + static int nbd_total_devices = 0; + + struct nbd_sock { +@@ -113,6 +114,7 @@ struct nbd_device { + struct mutex config_lock; + struct gendisk *disk; + struct workqueue_struct *recv_workq; ++ struct work_struct remove_work; + + struct list_head list; + struct task_struct *task_recv; +@@ -233,7 +235,7 @@ static const struct device_attribute backend_attr = { + .show = backend_show, + }; + +-static void nbd_dev_remove(struct nbd_device *nbd) ++static void nbd_del_disk(struct nbd_device *nbd) + { + struct gendisk *disk = nbd->disk; + +@@ -242,24 +244,60 @@ static void nbd_dev_remove(struct nbd_device *nbd) + blk_cleanup_disk(disk); + blk_mq_free_tag_set(&nbd->tag_set); + } ++} + ++/* ++ * Place this in the last just before the nbd is freed to ++ * make sure that the disk and the related kobject are also ++ * totally removed to avoid duplicate creation of the same ++ * one. ++ */ ++static void nbd_notify_destroy_completion(struct nbd_device *nbd) ++{ ++ if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags) && ++ nbd->destroy_complete) ++ complete(nbd->destroy_complete); ++} ++ ++static void nbd_dev_remove_work(struct work_struct *work) ++{ ++ struct nbd_device *nbd = ++ container_of(work, struct nbd_device, remove_work); ++ ++ nbd_del_disk(nbd); ++ ++ mutex_lock(&nbd_index_mutex); + /* +- * Place this in the last just before the nbd is freed to +- * make sure that the disk and the related kobject are also +- * totally removed to avoid duplicate creation of the same +- * one. ++ * Remove from idr after del_gendisk() completes, ++ * so if the same id is reused, the following ++ * add_disk() will succeed. + */ +- if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags) && nbd->destroy_complete) +- complete(nbd->destroy_complete); ++ idr_remove(&nbd_index_idr, nbd->index); ++ ++ nbd_notify_destroy_completion(nbd); ++ mutex_unlock(&nbd_index_mutex); + + kfree(nbd); + } + ++static void nbd_dev_remove(struct nbd_device *nbd) ++{ ++ /* Call del_gendisk() asynchrounously to prevent deadlock */ ++ if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags)) { ++ queue_work(nbd_del_wq, &nbd->remove_work); ++ return; ++ } ++ ++ nbd_del_disk(nbd); ++ idr_remove(&nbd_index_idr, nbd->index); ++ nbd_notify_destroy_completion(nbd); ++ kfree(nbd); ++} ++ + static void nbd_put(struct nbd_device *nbd) + { + if (refcount_dec_and_mutex_lock(&nbd->refs, + &nbd_index_mutex)) { +- idr_remove(&nbd_index_idr, nbd->index); + nbd_dev_remove(nbd); + mutex_unlock(&nbd_index_mutex); + } +@@ -1685,6 +1723,7 @@ static int nbd_dev_add(int index) + nbd->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | + BLK_MQ_F_BLOCKING; + nbd->tag_set.driver_data = nbd; ++ INIT_WORK(&nbd->remove_work, nbd_dev_remove_work); + nbd->destroy_complete = NULL; + nbd->backend = NULL; + +@@ -2426,7 +2465,14 @@ static int __init nbd_init(void) + if (register_blkdev(NBD_MAJOR, "nbd")) + return -EIO; + ++ nbd_del_wq = alloc_workqueue("nbd-del", WQ_UNBOUND, 0); ++ if (!nbd_del_wq) { ++ unregister_blkdev(NBD_MAJOR, "nbd"); ++ return -ENOMEM; ++ } ++ + if (genl_register_family(&nbd_genl_family)) { ++ destroy_workqueue(nbd_del_wq); + unregister_blkdev(NBD_MAJOR, "nbd"); + return -EINVAL; + } +@@ -2444,7 +2490,10 @@ static int nbd_exit_cb(int id, void *ptr, void *data) + struct list_head *list = (struct list_head *)data; + struct nbd_device *nbd = ptr; + +- list_add_tail(&nbd->list, list); ++ /* Skip nbd that is being removed asynchronously */ ++ if (refcount_read(&nbd->refs)) ++ list_add_tail(&nbd->list, list); ++ + return 0; + } + +@@ -2467,6 +2516,9 @@ static void __exit nbd_cleanup(void) + nbd_put(nbd); + } + ++ /* Also wait for nbd_dev_remove_work() completes */ ++ destroy_workqueue(nbd_del_wq); ++ + idr_destroy(&nbd_index_idr); + genl_unregister_family(&nbd_genl_family); + unregister_blkdev(NBD_MAJOR, "nbd"); +-- +2.30.2 + diff --git a/queue-5.14/net-cipso-fix-warnings-in-netlbl_cipsov4_add_std.patch b/queue-5.14/net-cipso-fix-warnings-in-netlbl_cipsov4_add_std.patch new file mode 100644 index 00000000000..dc32d552db4 --- /dev/null +++ b/queue-5.14/net-cipso-fix-warnings-in-netlbl_cipsov4_add_std.patch @@ -0,0 +1,70 @@ +From 8dcf0229f84b705423af20c7655c07733e2dbb7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 19:35:30 +0300 +Subject: net: cipso: fix warnings in netlbl_cipsov4_add_std + +From: Pavel Skripkin + +[ Upstream commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 ] + +Syzbot reported warning in netlbl_cipsov4_add(). The +problem was in too big doi_def->map.std->lvl.local_size +passed to kcalloc(). Since this value comes from userpace there is +no need to warn if value is not correct. + +The same problem may occur with other kcalloc() calls in +this function, so, I've added __GFP_NOWARN flag to all +kcalloc() calls there. + +Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com +Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration") +Acked-by: Paul Moore +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlabel/netlabel_cipso_v4.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c +index baf235721c43..000bb3da4f77 100644 +--- a/net/netlabel/netlabel_cipso_v4.c ++++ b/net/netlabel/netlabel_cipso_v4.c +@@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + } + doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->lvl.local == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; + } + doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->lvl.cipso == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; +@@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + doi_def->map.std->cat.local = kcalloc( + doi_def->map.std->cat.local_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->cat.local == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; +@@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + doi_def->map.std->cat.cipso = kcalloc( + doi_def->map.std->cat.cipso_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->cat.cipso == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-build-tag_8021q.c-as-part-of-dsa-core.patch b/queue-5.14/net-dsa-build-tag_8021q.c-as-part-of-dsa-core.patch new file mode 100644 index 00000000000..fccb293c2b6 --- /dev/null +++ b/queue-5.14/net-dsa-build-tag_8021q.c-as-part-of-dsa-core.patch @@ -0,0 +1,98 @@ +From 8cf76b8de6826316cac3d9e0252495914a5bf671 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 20:14:47 +0300 +Subject: net: dsa: build tag_8021q.c as part of DSA core + +From: Vladimir Oltean + +[ Upstream commit 8b6e638b4be2ad77f61fb93b4e1776c6ccc2edab ] + +Upcoming patches will add tag_8021q related logic to switch.c and +port.c, in order to allow it to make use of cross-chip notifiers. +In addition, a struct dsa_8021q_context *ctx pointer will be added to +struct dsa_switch. + +It seems fairly low-reward to #ifdef the *ctx from struct dsa_switch and +to provide shim implementations of the entire tag_8021q.c calling +surface (not even clear what to do about the tag_8021q cross-chip +notifiers to avoid compiling them). The runtime overhead for switches +which don't use tag_8021q is fairly small because all helpers will check +for ds->tag_8021q_ctx being a NULL pointer and stop there. + +So let's make it part of dsa_core.o. + +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/Kconfig | 12 ------------ + net/dsa/Makefile | 3 +-- + net/dsa/tag_8021q.c | 2 -- + 3 files changed, 1 insertion(+), 16 deletions(-) + +diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig +index 00bb89b2d86f..bca1b5d66df2 100644 +--- a/net/dsa/Kconfig ++++ b/net/dsa/Kconfig +@@ -18,16 +18,6 @@ if NET_DSA + + # Drivers must select the appropriate tagging format(s) + +-config NET_DSA_TAG_8021Q +- tristate +- select VLAN_8021Q +- help +- Unlike the other tagging protocols, the 802.1Q config option simply +- provides helpers for other tagging implementations that might rely on +- VLAN in one way or another. It is not a complete solution. +- +- Drivers which use these helpers should select this as dependency. +- + config NET_DSA_TAG_AR9331 + tristate "Tag driver for Atheros AR9331 SoC with built-in switch" + help +@@ -126,7 +116,6 @@ config NET_DSA_TAG_OCELOT_8021Q + tristate "Tag driver for Ocelot family of switches, using VLAN" + depends on MSCC_OCELOT_SWITCH_LIB || \ + (MSCC_OCELOT_SWITCH_LIB=n && COMPILE_TEST) +- select NET_DSA_TAG_8021Q + help + Say Y or M if you want to enable support for tagging frames with a + custom VLAN-based header. Frames that require timestamping, such as +@@ -149,7 +138,6 @@ config NET_DSA_TAG_LAN9303 + + config NET_DSA_TAG_SJA1105 + tristate "Tag driver for NXP SJA1105 switches" +- select NET_DSA_TAG_8021Q + select PACKING + help + Say Y or M if you want to enable support for tagging frames with the +diff --git a/net/dsa/Makefile b/net/dsa/Makefile +index 44bc79952b8b..67ea009f242c 100644 +--- a/net/dsa/Makefile ++++ b/net/dsa/Makefile +@@ -1,10 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0 + # the core + obj-$(CONFIG_NET_DSA) += dsa_core.o +-dsa_core-y += dsa.o dsa2.o master.o port.o slave.o switch.o ++dsa_core-y += dsa.o dsa2.o master.o port.o slave.o switch.o tag_8021q.o + + # tagging formats +-obj-$(CONFIG_NET_DSA_TAG_8021Q) += tag_8021q.o + obj-$(CONFIG_NET_DSA_TAG_AR9331) += tag_ar9331.o + obj-$(CONFIG_NET_DSA_TAG_BRCM_COMMON) += tag_brcm.o + obj-$(CONFIG_NET_DSA_TAG_DSA_COMMON) += tag_dsa.o +diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c +index 4aa29f90ecea..0d1db3e37668 100644 +--- a/net/dsa/tag_8021q.c ++++ b/net/dsa/tag_8021q.c +@@ -493,5 +493,3 @@ void dsa_8021q_rcv(struct sk_buff *skb, int *source_port, int *switch_id, + skb->priority = (tci & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT; + } + EXPORT_SYMBOL_GPL(dsa_8021q_rcv); +- +-MODULE_LICENSE("GPL v2"); +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-don-t-disable-multicast-flooding-to-the-cpu-.patch b/queue-5.14/net-dsa-don-t-disable-multicast-flooding-to-the-cpu-.patch new file mode 100644 index 00000000000..ad726f6f7a7 --- /dev/null +++ b/queue-5.14/net-dsa-don-t-disable-multicast-flooding-to-the-cpu-.patch @@ -0,0 +1,219 @@ +From b1b0908d81d491a67fcd7c5a134b6b211177c1d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 03:20:08 +0300 +Subject: net: dsa: don't disable multicast flooding to the CPU even without an + IGMP querier + +From: Vladimir Oltean + +[ Upstream commit c73c57081b3d59aa99093fbedced32ea02620cd3 ] + +Commit 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER +attribute") added an option for users to turn off multicast flooding +towards the CPU if they turn off the IGMP querier on a bridge which +already has enslaved ports (echo 0 > /sys/class/net/br0/bridge/multicast_router). + +And commit a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags") +simply papered over that issue, because it moved the decision to flood +the CPU with multicast (or not) from the DSA core down to individual drivers, +instead of taking a more radical position then. + +The truth is that disabling multicast flooding to the CPU is simply +something we are not prepared to do now, if at all. Some reasons: + +- ICMP6 neighbor solicitation messages are unregistered multicast + packets as far as the bridge is concerned. So if we stop flooding + multicast, the outside world cannot ping the bridge device's IPv6 + link-local address. + +- There might be foreign interfaces bridged with our DSA switch ports + (sending a packet towards the host does not necessarily equal + termination, but maybe software forwarding). So if there is no one + interested in that multicast traffic in the local network stack, that + doesn't mean nobody is. + +- PTP over L4 (IPv4, IPv6) is multicast, but is unregistered as far as + the bridge is concerned. This should reach the CPU port. + +- The switch driver might not do FDB partitioning. And since we don't + even bother to do more fine-grained flood disabling (such as "disable + flooding _from_port_N_ towards the CPU port" as opposed to "disable + flooding _from_any_port_ towards the CPU port"), this breaks standalone + ports, or even multiple bridges where one has an IGMP querier and one + doesn't. + +Reverting the logic makes all of the above work. + +Fixes: a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags") +Fixes: 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER attribute") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 10 ---------- + drivers/net/dsa/b53/b53_priv.h | 2 -- + drivers/net/dsa/bcm_sf2.c | 1 - + drivers/net/dsa/mv88e6xxx/chip.c | 18 ------------------ + include/net/dsa.h | 2 -- + net/dsa/dsa_priv.h | 2 -- + net/dsa/port.c | 11 ----------- + net/dsa/slave.c | 6 ------ + 8 files changed, 52 deletions(-) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index b23e3488695b..bd1417a66cbf 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -2016,15 +2016,6 @@ int b53_br_flags(struct dsa_switch *ds, int port, + } + EXPORT_SYMBOL(b53_br_flags); + +-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter, +- struct netlink_ext_ack *extack) +-{ +- b53_port_set_mcast_flood(ds->priv, port, mrouter); +- +- return 0; +-} +-EXPORT_SYMBOL(b53_set_mrouter); +- + static bool b53_possible_cpu_port(struct dsa_switch *ds, int port) + { + /* Broadcom switches will accept enabling Broadcom tags on the +@@ -2268,7 +2259,6 @@ static const struct dsa_switch_ops b53_switch_ops = { + .port_bridge_leave = b53_br_leave, + .port_pre_bridge_flags = b53_br_flags_pre, + .port_bridge_flags = b53_br_flags, +- .port_set_mrouter = b53_set_mrouter, + .port_stp_state_set = b53_br_set_stp_state, + .port_fast_age = b53_br_fast_age, + .port_vlan_filtering = b53_vlan_filtering, +diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h +index 82700a5714c1..9bf8319342b0 100644 +--- a/drivers/net/dsa/b53/b53_priv.h ++++ b/drivers/net/dsa/b53/b53_priv.h +@@ -328,8 +328,6 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port, + int b53_br_flags(struct dsa_switch *ds, int port, + struct switchdev_brport_flags flags, + struct netlink_ext_ack *extack); +-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter, +- struct netlink_ext_ack *extack); + int b53_setup_devlink_resources(struct dsa_switch *ds); + void b53_port_event(struct dsa_switch *ds, int port); + void b53_phylink_validate(struct dsa_switch *ds, int port, +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index 3b018fcf4412..6ce9ec1283e0 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -1199,7 +1199,6 @@ static const struct dsa_switch_ops bcm_sf2_ops = { + .port_pre_bridge_flags = b53_br_flags_pre, + .port_bridge_flags = b53_br_flags, + .port_stp_state_set = b53_br_set_stp_state, +- .port_set_mrouter = b53_set_mrouter, + .port_fast_age = b53_br_fast_age, + .port_vlan_filtering = b53_vlan_filtering, + .port_vlan_add = b53_vlan_add, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 272b0535d946..111a6d5985da 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -5781,23 +5781,6 @@ out: + return err; + } + +-static int mv88e6xxx_port_set_mrouter(struct dsa_switch *ds, int port, +- bool mrouter, +- struct netlink_ext_ack *extack) +-{ +- struct mv88e6xxx_chip *chip = ds->priv; +- int err; +- +- if (!chip->info->ops->port_set_mcast_flood) +- return -EOPNOTSUPP; +- +- mv88e6xxx_reg_lock(chip); +- err = chip->info->ops->port_set_mcast_flood(chip, port, mrouter); +- mv88e6xxx_reg_unlock(chip); +- +- return err; +-} +- + static bool mv88e6xxx_lag_can_offload(struct dsa_switch *ds, + struct net_device *lag, + struct netdev_lag_upper_info *info) +@@ -6099,7 +6082,6 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = { + .port_bridge_leave = mv88e6xxx_port_bridge_leave, + .port_pre_bridge_flags = mv88e6xxx_port_pre_bridge_flags, + .port_bridge_flags = mv88e6xxx_port_bridge_flags, +- .port_set_mrouter = mv88e6xxx_port_set_mrouter, + .port_stp_state_set = mv88e6xxx_port_stp_state_set, + .port_fast_age = mv88e6xxx_port_fast_age, + .port_vlan_filtering = mv88e6xxx_port_vlan_filtering, +diff --git a/include/net/dsa.h b/include/net/dsa.h +index 33f40c1ec379..048d297623c9 100644 +--- a/include/net/dsa.h ++++ b/include/net/dsa.h +@@ -699,8 +699,6 @@ struct dsa_switch_ops { + int (*port_bridge_flags)(struct dsa_switch *ds, int port, + struct switchdev_brport_flags flags, + struct netlink_ext_ack *extack); +- int (*port_set_mrouter)(struct dsa_switch *ds, int port, bool mrouter, +- struct netlink_ext_ack *extack); + + /* + * VLAN support +diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h +index f201c33980bf..cddf7cb0f398 100644 +--- a/net/dsa/dsa_priv.h ++++ b/net/dsa/dsa_priv.h +@@ -234,8 +234,6 @@ int dsa_port_pre_bridge_flags(const struct dsa_port *dp, + int dsa_port_bridge_flags(const struct dsa_port *dp, + struct switchdev_brport_flags flags, + struct netlink_ext_ack *extack); +-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter, +- struct netlink_ext_ack *extack); + int dsa_port_vlan_add(struct dsa_port *dp, + const struct switchdev_obj_port_vlan *vlan, + struct netlink_ext_ack *extack); +diff --git a/net/dsa/port.c b/net/dsa/port.c +index d9ef2c2fbf88..23e30198a90e 100644 +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -597,17 +597,6 @@ int dsa_port_bridge_flags(const struct dsa_port *dp, + return ds->ops->port_bridge_flags(ds, dp->index, flags, extack); + } + +-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter, +- struct netlink_ext_ack *extack) +-{ +- struct dsa_switch *ds = dp->ds; +- +- if (!ds->ops->port_set_mrouter) +- return -EOPNOTSUPP; +- +- return ds->ops->port_set_mrouter(ds, dp->index, mrouter, extack); +-} +- + int dsa_port_mtu_change(struct dsa_port *dp, int new_mtu, + bool targeted_match) + { +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 23be8e01026b..b34116b15d43 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -314,12 +314,6 @@ static int dsa_slave_port_attr_set(struct net_device *dev, const void *ctx, + + ret = dsa_port_bridge_flags(dp, attr->u.brport_flags, extack); + break; +- case SWITCHDEV_ATTR_ID_BRIDGE_MROUTER: +- if (!dsa_port_offloads_bridge(dp, attr->orig_dev)) +- return -EOPNOTSUPP; +- +- ret = dsa_port_mrouter(dp->cpu_dp, attr->u.mrouter, extack); +- break; + default: + ret = -EOPNOTSUPP; + break; +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-mt7530-remove-the-.port_set_mrouter-implemen.patch b/queue-5.14/net-dsa-mt7530-remove-the-.port_set_mrouter-implemen.patch new file mode 100644 index 00000000000..4f5ce5ade64 --- /dev/null +++ b/queue-5.14/net-dsa-mt7530-remove-the-.port_set_mrouter-implemen.patch @@ -0,0 +1,60 @@ +From 879a8d1a0e08963a93209ae1d04c23984059d3ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 03:20:07 +0300 +Subject: net: dsa: mt7530: remove the .port_set_mrouter implementation + +From: Vladimir Oltean + +[ Upstream commit cbbf09b5771e6e9da268bc0d2fb6e428afa787bc ] + +DSA's idea of optimizing out multicast flooding to the CPU port leaves +quite a few holes open, so it should be reverted. + +The mt7530 driver is the only new driver which added a .port_set_mrouter +implementation after the reorg from commit a8b659e7ff75 ("net: dsa: act +as passthrough for bridge port flags"), so it needs to be reverted +separately so that the other revert commit can go a bit further down the +git history. + +Fixes: 5a30833b9a16 ("net: dsa: mt7530: support MDB and bridge flag operations") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mt7530.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index 05bc46634b36..0cea1572f826 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1185,18 +1185,6 @@ mt7530_port_bridge_flags(struct dsa_switch *ds, int port, + return 0; + } + +-static int +-mt7530_port_set_mrouter(struct dsa_switch *ds, int port, bool mrouter, +- struct netlink_ext_ack *extack) +-{ +- struct mt7530_priv *priv = ds->priv; +- +- mt7530_rmw(priv, MT7530_MFC, UNM_FFP(BIT(port)), +- mrouter ? UNM_FFP(BIT(port)) : 0); +- +- return 0; +-} +- + static int + mt7530_port_bridge_join(struct dsa_switch *ds, int port, + struct net_device *bridge) +@@ -3058,7 +3046,6 @@ static const struct dsa_switch_ops mt7530_switch_ops = { + .port_stp_state_set = mt7530_stp_state_set, + .port_pre_bridge_flags = mt7530_port_pre_bridge_flags, + .port_bridge_flags = mt7530_port_bridge_flags, +- .port_set_mrouter = mt7530_port_set_mrouter, + .port_bridge_join = mt7530_port_bridge_join, + .port_bridge_leave = mt7530_port_bridge_leave, + .port_fdb_add = mt7530_port_fdb_add, +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-stop-syncing-the-bridge-mcast_router-attribu.patch b/queue-5.14/net-dsa-stop-syncing-the-bridge-mcast_router-attribu.patch new file mode 100644 index 00000000000..57e647ccadc --- /dev/null +++ b/queue-5.14/net-dsa-stop-syncing-the-bridge-mcast_router-attribu.patch @@ -0,0 +1,85 @@ +From 5bbcf2ad01e0e90bcd2984bc32b718326030185e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 03:20:06 +0300 +Subject: net: dsa: stop syncing the bridge mcast_router attribute at join time + +From: Vladimir Oltean + +[ Upstream commit 7df4e7449489d82cee6813dccbb4ae4f3f26ef7b ] + +Qingfang points out that when a bridge with the default settings is +created and a port joins it: + +ip link add br0 type bridge +ip link set swp0 master br0 + +DSA calls br_multicast_router() on the bridge to see if the br0 device +is a multicast router port, and if it is, it enables multicast flooding +to the CPU port, otherwise it disables it. + +If we look through the multicast_router_show() sysfs or at the +IFLA_BR_MCAST_ROUTER netlink attribute, we see that the default mrouter +attribute for the bridge device is "1" (MDB_RTR_TYPE_TEMP_QUERY). + +However, br_multicast_router() will return "0" (MDB_RTR_TYPE_DISABLED), +because an mrouter port in the MDB_RTR_TYPE_TEMP_QUERY state may not be +actually _active_ until it receives an actual IGMP query. So, the +br_multicast_router() function should really have been called +br_multicast_router_active() perhaps. + +When/if an IGMP query is received, the bridge device will transition via +br_multicast_mark_router() into the active state until the +ip4_mc_router_timer expires after an multicast_querier_interval. + +Of course, this does not happen if the bridge is created with an +mcast_router attribute of "2" (MDB_RTR_TYPE_PERM). + +The point is that in lack of any IGMP query messages, and in the default +bridge configuration, unregistered multicast packets will not be able to +reach the CPU port through flooding, and this breaks many use cases +(most obviously, IPv6 ND, with its ICMP6 neighbor solicitation multicast +messages). + +Leave the multicast flooding setting towards the CPU port down to a driver +level decision. + +Fixes: 010e269f91be ("net: dsa: sync up switchdev objects and port attributes when joining the bridge") +Reported-by: DENG Qingfang +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/port.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/net/dsa/port.c b/net/dsa/port.c +index 28b45b7e66df..d9ef2c2fbf88 100644 +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -186,10 +186,6 @@ static int dsa_port_switchdev_sync(struct dsa_port *dp, + if (err && err != -EOPNOTSUPP) + return err; + +- err = dsa_port_mrouter(dp->cpu_dp, br_multicast_router(br), extack); +- if (err && err != -EOPNOTSUPP) +- return err; +- + err = dsa_port_ageing_time(dp, br_get_ageing_time(br)); + if (err && err != -EOPNOTSUPP) + return err; +@@ -272,12 +268,6 @@ static void dsa_port_switchdev_unsync_attrs(struct dsa_port *dp) + + /* VLAN filtering is handled by dsa_switch_bridge_leave */ + +- /* Some drivers treat the notification for having a local multicast +- * router by allowing multicast to be flooded to the CPU, so we should +- * allow this in standalone mode too. +- */ +- dsa_port_mrouter(dp->cpu_dp, true, NULL); +- + /* Ageing time may be global to the switch chip, so don't change it + * here because we have no good reason (or value) to change it to. + */ +-- +2.30.2 + diff --git a/queue-5.14/net-dsa-tag_sja1105-optionally-build-as-module-when-.patch b/queue-5.14/net-dsa-tag_sja1105-optionally-build-as-module-when-.patch new file mode 100644 index 00000000000..6308e2b6c00 --- /dev/null +++ b/queue-5.14/net-dsa-tag_sja1105-optionally-build-as-module-when-.patch @@ -0,0 +1,52 @@ +From ae982439ce0d2b3cc0dc1b9cc538679bc79e90bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 14:36:12 +0300 +Subject: net: dsa: tag_sja1105: optionally build as module when switch driver + is module if PTP is enabled + +From: Vladimir Oltean + +[ Upstream commit f8b17a0bd96065e4511858689916bb729dbb881b ] + +TX timestamps are sent by SJA1110 as Ethernet packets containing +metadata, so they are received by the tagging driver but must be +processed by the switch driver - the one that is stateful since it +keeps the TX timestamp queue. + +This means that there is an sja1110_process_meta_tstamp() symbol +exported by the switch driver which is called by the tagging driver. + +There is a shim definition for that function when the switch driver is +not compiled, which does nothing, but that shim is not effective when +the tagging protocol driver is built-in and the switch driver is a +module, because built-in code cannot call symbols exported by modules. + +So add an optional dependency between the tagger and the switch driver, +if PTP support is enabled in the switch driver. If PTP is not enabled, +sja1110_process_meta_tstamp() will translate into the shim "do nothing +with these meta frames" function. + +Fixes: 566b18c8b752 ("net: dsa: sja1105: implement TX timestamping for SJA1110") +Reported-by: Arnd Bergmann +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig +index bca1b5d66df2..970906eb5b2c 100644 +--- a/net/dsa/Kconfig ++++ b/net/dsa/Kconfig +@@ -138,6 +138,7 @@ config NET_DSA_TAG_LAN9303 + + config NET_DSA_TAG_SJA1105 + tristate "Tag driver for NXP SJA1105 switches" ++ depends on (NET_DSA_SJA1105 && NET_DSA_SJA1105_PTP) || !NET_DSA_SJA1105 || !NET_DSA_SJA1105_PTP + select PACKING + help + Say Y or M if you want to enable support for tagging frames with the +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5-e-switch-set-vhca-id-valid-flag-when-creati.patch b/queue-5.14/net-mlx5-e-switch-set-vhca-id-valid-flag-when-creati.patch new file mode 100644 index 00000000000..eac27aa2fd1 --- /dev/null +++ b/queue-5.14/net-mlx5-e-switch-set-vhca-id-valid-flag-when-creati.patch @@ -0,0 +1,39 @@ +From 58610beec841bc30b6fb04275ac5507ede7fee5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:30:39 +0300 +Subject: net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd + group + +From: Maor Dickman + +[ Upstream commit ca6891f9b27db7764bba0798202b0a21d0dc909c ] + +When indirect forward group is created, flow is added with vhca id but +without setting vhca id valid flag which violates the PRM. + +Fix by setting the missing flag, vhca id valid. + +Fixes: 34ca65352ddf ("net/mlx5: E-Switch, Indirect table infrastructure") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c +index 3da7becc1069..425c91814b34 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c +@@ -364,6 +364,7 @@ static int mlx5_create_indir_fwd_group(struct mlx5_eswitch *esw, + dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT; + dest.vport.num = e->vport; + dest.vport.vhca_id = MLX5_CAP_GEN(esw->dev, vhca_id); ++ dest.vport.flags = MLX5_FLOW_DEST_VPORT_VHCA_ID; + e->fwd_rule = mlx5_add_flow_rules(e->ft, spec, &flow_act, &dest, 1); + if (IS_ERR(e->fwd_rule)) { + mlx5_destroy_flow_group(e->fwd_grp); +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5-fix-missing-return-value-in-mlx5_devlink_es.patch b/queue-5.14/net-mlx5-fix-missing-return-value-in-mlx5_devlink_es.patch new file mode 100644 index 00000000000..7f3a0f85a12 --- /dev/null +++ b/queue-5.14/net-mlx5-fix-missing-return-value-in-mlx5_devlink_es.patch @@ -0,0 +1,48 @@ +From 1fab095b08cc0d8de7c3233c8450d5c1d6b7f632 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 17:58:16 +0800 +Subject: net/mlx5: Fix missing return value in + mlx5_devlink_eswitch_inline_mode_set() + +From: Jiapeng Chong + +[ Upstream commit bcd68c04c7692416206414dc8971730aa140eba7 ] + +The return value is missing in this code scenario, add the return value +'0' to the return value 'err'. + +Eliminate the follow smatch warning: + +drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c:3083 +mlx5_devlink_eswitch_inline_mode_set() warn: missing error code 'err'. + +Reported-by: Abaci Robot +Fixes: 8e0aa4bc959c ("net/mlx5: E-switch, Protect eswitch mode changes") +Signed-off-by: Jiapeng Chong +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 3bb71a186004..fc945945ae33 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -3091,8 +3091,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode, + + switch (MLX5_CAP_ETH(dev, wqe_inline_mode)) { + case MLX5_CAP_INLINE_MODE_NOT_REQUIRED: +- if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE) ++ if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE) { ++ err = 0; + goto out; ++ } ++ + fallthrough; + case MLX5_CAP_INLINE_MODE_L2: + NL_SET_ERR_MSG_MOD(extack, "Inline mode can't be set"); +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5-fix-unpublish-devlink-parameters.patch b/queue-5.14/net-mlx5-fix-unpublish-devlink-parameters.patch new file mode 100644 index 00000000000..71dc1a25650 --- /dev/null +++ b/queue-5.14/net-mlx5-fix-unpublish-devlink-parameters.patch @@ -0,0 +1,36 @@ +From a763df9b016f2ee217ae46c9b77b6d1d4631ffe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 16:24:21 +0300 +Subject: net/mlx5: Fix unpublish devlink parameters + +From: Parav Pandit + +[ Upstream commit 6f35723864b42ec9e9bb95a503449633395c4975 ] + +Cleanup routine missed to unpublish the parameters. Add it. + +Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter") +Signed-off-by: Parav Pandit +Reviewed-by: Jiri Pirko +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +index d791d351b489..be6b75bd10f1 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c +@@ -670,6 +670,7 @@ params_reg_err: + void mlx5_devlink_unregister(struct devlink *devlink) + { + mlx5_devlink_traps_unregister(devlink); ++ devlink_params_unpublish(devlink); + devlink_params_unregister(devlink, mlx5_devlink_params, + ARRAY_SIZE(mlx5_devlink_params)); + devlink_unregister(devlink); +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5-lag-fix-multipath-lag-activation.patch b/queue-5.14/net-mlx5-lag-fix-multipath-lag-activation.patch new file mode 100644 index 00000000000..e0d8d696dfb --- /dev/null +++ b/queue-5.14/net-mlx5-lag-fix-multipath-lag-activation.patch @@ -0,0 +1,85 @@ +From 9e0958e63c757c0dbdeb9576f7874422a02e034d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 14:56:32 +0300 +Subject: net/mlx5: Lag, fix multipath lag activation + +From: Dima Chumak + +[ Upstream commit 2f8b6161cca5fb34b0065e2eac8bb2b61b7bfe87 ] + +When handling FIB_EVENT_ENTRY_REPLACE event for a new multipath route, +lag activation can be missed if a stale (struct lag_mp)->mfi pointer +exists, which was associated with an older multipath route that had been +removed. + +Normally, when a route is removed, it triggers mlx5_lag_fib_event(), +which handles FIB_EVENT_ENTRY_DEL and clears mfi pointer. But, if +mlx5_lag_check_prereq() condition isn't met, for example when eswitch is +in legacy mode, the fib event is skipped and mfi pointer becomes stale. + +Fix by resetting mfi pointer to NULL in mlx5_deactivate_lag(). + +Fixes: 8a66e4585979 ("net/mlx5: Change ownership model for lag") +Signed-off-by: Dima Chumak +Reviewed-by: Roi Dayan +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 1 + + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 8 ++++++++ + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h | 2 ++ + 3 files changed, 11 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index 5c043c5cc403..40ef60f562b4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -277,6 +277,7 @@ static int mlx5_deactivate_lag(struct mlx5_lag *ldev) + int err; + + ldev->flags &= ~MLX5_LAG_MODE_FLAGS; ++ mlx5_lag_mp_reset(ldev); + + MLX5_SET(destroy_lag_in, in, opcode, MLX5_CMD_OP_DESTROY_LAG); + err = mlx5_cmd_exec_in(dev0, destroy_lag, in); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +index c4bf8b679541..516bfc2bd797 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +@@ -302,6 +302,14 @@ static int mlx5_lag_fib_event(struct notifier_block *nb, + return NOTIFY_DONE; + } + ++void mlx5_lag_mp_reset(struct mlx5_lag *ldev) ++{ ++ /* Clear mfi, as it might become stale when a route delete event ++ * has been missed, see mlx5_lag_fib_route_event(). ++ */ ++ ldev->lag_mp.mfi = NULL; ++} ++ + int mlx5_lag_mp_init(struct mlx5_lag *ldev) + { + struct lag_mp *mp = &ldev->lag_mp; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h +index 258ac7b2964e..729c839397a8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h +@@ -21,11 +21,13 @@ struct lag_mp { + + #ifdef CONFIG_MLX5_ESWITCH + ++void mlx5_lag_mp_reset(struct mlx5_lag *ldev); + int mlx5_lag_mp_init(struct mlx5_lag *ldev); + void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev); + + #else /* CONFIG_MLX5_ESWITCH */ + ++static inline void mlx5_lag_mp_reset(struct mlx5_lag *ldev) {}; + static inline int mlx5_lag_mp_init(struct mlx5_lag *ldev) { return 0; } + static inline void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev) {} + +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5-remove-all-auxiliary-devices-at-the-unregis.patch b/queue-5.14/net-mlx5-remove-all-auxiliary-devices-at-the-unregis.patch new file mode 100644 index 00000000000..1943f4f81e3 --- /dev/null +++ b/queue-5.14/net-mlx5-remove-all-auxiliary-devices-at-the-unregis.patch @@ -0,0 +1,38 @@ +From 6878fc181ad1c4ee1733e059b6cea8ffe47ebf15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 15:05:11 +0300 +Subject: net/mlx5: Remove all auxiliary devices at the unregister event + +From: Leon Romanovsky + +[ Upstream commit 8e7e2e8ed0e251138926838b7933f8eb6dd56b12 ] + +The call to mlx5_unregister_device() means that mlx5_core driver is +removed. In such scenario, we need to disregard all other flags like +attach/detach and forcibly remove all auxiliary devices. + +Fixes: a5ae8fc9058e ("net/mlx5e: Don't create devices during unload flow") +Tested-and-Reported-by: Yicong Yang +Signed-off-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index def2156e50ee..20bb37266254 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -397,7 +397,7 @@ int mlx5_register_device(struct mlx5_core_dev *dev) + void mlx5_unregister_device(struct mlx5_core_dev *dev) + { + mutex_lock(&mlx5_intf_mutex); +- dev->priv.flags |= MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV; ++ dev->priv.flags = MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV; + mlx5_rescan_drivers_locked(dev); + mutex_unlock(&mlx5_intf_mutex); + } +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5e-block-lro-if-firmware-asks-for-tunneled-lr.patch b/queue-5.14/net-mlx5e-block-lro-if-firmware-asks-for-tunneled-lr.patch new file mode 100644 index 00000000000..ae3891577c5 --- /dev/null +++ b/queue-5.14/net-mlx5e-block-lro-if-firmware-asks-for-tunneled-lr.patch @@ -0,0 +1,91 @@ +From ce4f803d2194613f5e3c70596f84611959e89f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 20:34:48 +0300 +Subject: net/mlx5e: Block LRO if firmware asks for tunneled LRO + +From: Maxim Mikityanskiy + +[ Upstream commit 26ab7b384525ccfa678c518577f7f0d841209c8b ] + +This commit does a cleanup in LRO configuration. + +LRO is a parameter of an RQ, but its state is changed by modifying a TIR +related to the RQ. + +The current status: LRO for tunneled packets is not supported in the +driver, inner TIRs may enable LRO on creation, but LRO status of inner +TIRs isn't changed in mlx5e_modify_tirs_lro(). This is inconsistent, but +as long as the firmware doesn't declare support for tunneled LRO, it +works, because the same RQs are shared between the inner and outer TIRs. + +This commit does two fixes: + +1. If the firmware has the tunneled LRO capability, LRO is blocked +altogether, because it's not possible to block it for inner TIRs only, +when the same RQs are shared between inner and outer TIRs, and the +driver won't be able to handle tunneled LRO traffic. + +2. mlx5e_modify_tirs_lro() is patched to modify LRO state for all TIRs, +including inner ones, because all TIRs related to an RQ should agree on +their LRO state. + +Fixes: 7b3722fa9ef6 ("net/mlx5e: Support RSS for GRE tunneled packets") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++++++ + include/linux/mlx5/mlx5_ifc.h | 3 ++- + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 24f919ef9b8e..b7be1ef4cbb2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2567,6 +2567,14 @@ static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv) + err = mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in); + if (err) + goto free_in; ++ ++ /* Verify inner tirs resources allocated */ ++ if (!priv->inner_indir_tir[0].tirn) ++ continue; ++ ++ err = mlx5_core_modify_tir(mdev, priv->inner_indir_tir[tt].tirn, in); ++ if (err) ++ goto free_in; + } + + for (ix = 0; ix < priv->max_nch; ix++) { +@@ -4812,7 +4820,14 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + netdev->hw_enc_features |= NETIF_F_HW_VLAN_CTAG_TX; + netdev->hw_enc_features |= NETIF_F_HW_VLAN_CTAG_RX; + ++ /* Tunneled LRO is not supported in the driver, and the same RQs are ++ * shared between inner and outer TIRs, so the driver can't disable LRO ++ * for inner TIRs while having it enabled for outer TIRs. Due to this, ++ * block LRO altogether if the firmware declares tunneled LRO support. ++ */ + if (!!MLX5_CAP_ETH(mdev, lro_cap) && ++ !MLX5_CAP_ETH(mdev, tunnel_lro_vxlan) && ++ !MLX5_CAP_ETH(mdev, tunnel_lro_gre) && + mlx5e_check_fragmented_striding_rq_cap(mdev)) + netdev->vlan_features |= NETIF_F_LRO; + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index b0009aa3647f..6bbae0c3bc0b 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -921,7 +921,8 @@ struct mlx5_ifc_per_protocol_networking_offload_caps_bits { + u8 scatter_fcs[0x1]; + u8 enhanced_multi_pkt_send_wqe[0x1]; + u8 tunnel_lso_const_out_ip_id[0x1]; +- u8 reserved_at_1c[0x2]; ++ u8 tunnel_lro_gre[0x1]; ++ u8 tunnel_lro_vxlan[0x1]; + u8 tunnel_stateless_gre[0x1]; + u8 tunnel_stateless_vxlan[0x1]; + +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5e-fix-possible-use-after-free-deleting-fdb-r.patch b/queue-5.14/net-mlx5e-fix-possible-use-after-free-deleting-fdb-r.patch new file mode 100644 index 00000000000..5a59b9ad2d1 --- /dev/null +++ b/queue-5.14/net-mlx5e-fix-possible-use-after-free-deleting-fdb-r.patch @@ -0,0 +1,48 @@ +From 39708710d6305bd74534fd90edd4c04f2c3005fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 10:14:58 +0300 +Subject: net/mlx5e: Fix possible use-after-free deleting fdb rule + +From: Roi Dayan + +[ Upstream commit 9a5f9cc794e17cf6ed2a5bb215d2e8b6832db444 ] + +After neigh-update-add failure we are still with a slow path rule but +the driver always assume the rule is an fdb rule. +Fix neigh-update-del by checking slow path tc flag on the flow. +Also fix neigh-update-add for when neigh-update-del fails the same. + +Fixes: 5dbe906ff1d5 ("net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available") +Signed-off-by: Roi Dayan +Reviewed-by: Paul Blakey +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +index 2e846b741280..1c44c6c345f5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +@@ -147,7 +147,7 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv, + mlx5e_rep_queue_neigh_stats_work(priv); + + list_for_each_entry(flow, flow_list, tmp_list) { +- if (!mlx5e_is_offloaded_flow(flow)) ++ if (!mlx5e_is_offloaded_flow(flow) || !flow_flag_test(flow, SLOW)) + continue; + attr = flow->attr; + esw_attr = attr->esw_attr; +@@ -188,7 +188,7 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv, + int err; + + list_for_each_entry(flow, flow_list, tmp_list) { +- if (!mlx5e_is_offloaded_flow(flow)) ++ if (!mlx5e_is_offloaded_flow(flow) || flow_flag_test(flow, SLOW)) + continue; + attr = flow->attr; + esw_attr = attr->esw_attr; +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5e-prohibit-inner-indir-tirs-in-ipoib.patch b/queue-5.14/net-mlx5e-prohibit-inner-indir-tirs-in-ipoib.patch new file mode 100644 index 00000000000..59340ca3852 --- /dev/null +++ b/queue-5.14/net-mlx5e-prohibit-inner-indir-tirs-in-ipoib.patch @@ -0,0 +1,152 @@ +From a552650100db129333865162f4d4db022dd0b386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 17:20:04 +0300 +Subject: net/mlx5e: Prohibit inner indir TIRs in IPoIB + +From: Maxim Mikityanskiy + +[ Upstream commit 9c43f3865c2a03be104f1c1d5e9129c2a2bdba88 ] + +TIR's rx_hash_field_selector_inner can be enabled only when +tunneled_offload_en = 1. tunneled_offload_en is filled according to the +tunneled_offload_en field in struct mlx5e_params, which is false in the +IPoIB profile. On the other hand, the IPoIB profile passes inner_ttc = +true to mlx5e_create_indirect_tirs, which potentially allows the latter +function to attempt to create inner indirect TIRs without having +tunneled_offload_en set. + +This commit prohibits this behavior by passing inner_ttc = false to +mlx5e_create_indirect_tirs. The latter function won't attempt to create +inner indirect TIRs. + +As inner indirect TIRs are not created in the IPoIB profile (this commit +blocks it explicitly, and even before they would have failed to be +created), the call to mlx5e_create_inner_ttc_table in +mlx5i_create_flow_steering is a no-op and can be removed. + +Fixes: 46dc933cee82 ("net/mlx5e: Provide explicit directive if to create inner indirect tirs") +Fixes: 458821c72bd0 ("net/mlx5e: IPoIB, Add inner TTC table to IPoIB flow steering") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en/fs.h | 6 ------ + .../net/ethernet/mellanox/mlx5/core/en_fs.c | 10 +++++----- + .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 18 ++---------------- + 3 files changed, 7 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +index 1d5ce07b83f4..43b092f5565a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +@@ -248,18 +248,12 @@ struct ttc_params { + + void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, struct ttc_params *ttc_params); + void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params); +-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params); + + int mlx5e_create_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, + struct mlx5e_ttc_table *ttc); + void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv, + struct mlx5e_ttc_table *ttc); + +-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, +- struct mlx5e_ttc_table *ttc); +-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, +- struct mlx5e_ttc_table *ttc); +- + void mlx5e_destroy_flow_table(struct mlx5e_flow_table *ft); + int mlx5e_ttc_fwd_dest(struct mlx5e_priv *priv, enum mlx5e_traffic_types type, + struct mlx5_flow_destination *new_dest); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +index 0b75fab41ae8..6464ac3f294e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -1324,7 +1324,7 @@ void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, + ttc_params->inner_ttc = &priv->fs.inner_ttc; + } + +-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params) ++static void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params) + { + struct mlx5_flow_table_attr *ft_attr = &ttc_params->ft_attr; + +@@ -1343,8 +1343,8 @@ void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params) + ft_attr->prio = MLX5E_NIC_PRIO; + } + +-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, +- struct mlx5e_ttc_table *ttc) ++static int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, ++ struct mlx5e_ttc_table *ttc) + { + struct mlx5e_flow_table *ft = &ttc->ft; + int err; +@@ -1374,8 +1374,8 @@ err: + return err; + } + +-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, +- struct mlx5e_ttc_table *ttc) ++static void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, ++ struct mlx5e_ttc_table *ttc) + { + if (!mlx5e_tunnel_inner_ft_supported(priv->mdev)) + return; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +index 7d7ed025db0d..620d638e1e8f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +@@ -331,17 +331,6 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv) + } + + mlx5e_set_ttc_basic_params(priv, &ttc_params); +- mlx5e_set_inner_ttc_ft_params(&ttc_params); +- for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) +- ttc_params.indir_tirn[tt] = priv->inner_indir_tir[tt].tirn; +- +- err = mlx5e_create_inner_ttc_table(priv, &ttc_params, &priv->fs.inner_ttc); +- if (err) { +- netdev_err(priv->netdev, "Failed to create inner ttc table, err=%d\n", +- err); +- goto err_destroy_arfs_tables; +- } +- + mlx5e_set_ttc_ft_params(&ttc_params); + for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) + ttc_params.indir_tirn[tt] = priv->indir_tir[tt].tirn; +@@ -350,13 +339,11 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv) + if (err) { + netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n", + err); +- goto err_destroy_inner_ttc_table; ++ goto err_destroy_arfs_tables; + } + + return 0; + +-err_destroy_inner_ttc_table: +- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc); + err_destroy_arfs_tables: + mlx5e_arfs_destroy_tables(priv); + +@@ -366,7 +353,6 @@ err_destroy_arfs_tables: + static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv) + { + mlx5e_destroy_ttc_table(priv, &priv->fs.ttc); +- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc); + mlx5e_arfs_destroy_tables(priv); + } + +@@ -392,7 +378,7 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv) + if (err) + goto err_destroy_indirect_rqts; + +- err = mlx5e_create_indirect_tirs(priv, true); ++ err = mlx5e_create_indirect_tirs(priv, false); + if (err) + goto err_destroy_direct_rqts; + +-- +2.30.2 + diff --git a/queue-5.14/net-mlx5e-use-correct-eswitch-for-stack-devices-with.patch b/queue-5.14/net-mlx5e-use-correct-eswitch-for-stack-devices-with.patch new file mode 100644 index 00000000000..2af5b368691 --- /dev/null +++ b/queue-5.14/net-mlx5e-use-correct-eswitch-for-stack-devices-with.patch @@ -0,0 +1,65 @@ +From 528e8895fc5f968431ee96aa26540133c6032da6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 13:37:36 +0300 +Subject: net/mlx5e: Use correct eswitch for stack devices with lag + +From: Dmytro Linkin + +[ Upstream commit f9d196bd632b8b79261ec3366c30ec3923ea9a02 ] + +If link aggregation is used within stack devices driver rejects encap +rules if PF of the VF tunnel device is down. This happens because route +resolved for other PF and its eswitch instance is used to determine +correct vport. +To fix that use devcom feature to retrieve other eswitch instance if +failed to find vport for the 1st eswitch and LAG is active. + +Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") +Signed-off-by: Dmytro Linkin +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index d273758255c3..6eba574c5a36 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -1338,6 +1338,7 @@ bool mlx5e_tc_is_vf_tunnel(struct net_device *out_dev, struct net_device *route_ + int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *route_dev, u16 *vport) + { + struct mlx5e_priv *out_priv, *route_priv; ++ struct mlx5_devcom *devcom = NULL; + struct mlx5_core_dev *route_mdev; + struct mlx5_eswitch *esw; + u16 vhca_id; +@@ -1349,7 +1350,24 @@ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *ro + route_mdev = route_priv->mdev; + + vhca_id = MLX5_CAP_GEN(route_mdev, vhca_id); ++ if (mlx5_lag_is_active(out_priv->mdev)) { ++ /* In lag case we may get devices from different eswitch instances. ++ * If we failed to get vport num, it means, mostly, that we on the wrong ++ * eswitch. ++ */ ++ err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport); ++ if (err != -ENOENT) ++ return err; ++ ++ devcom = out_priv->mdev->priv.devcom; ++ esw = mlx5_devcom_get_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS); ++ if (!esw) ++ return -ENODEV; ++ } ++ + err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport); ++ if (devcom) ++ mlx5_devcom_release_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS); + return err; + } + +-- +2.30.2 + diff --git a/queue-5.14/net-phy-marvell10g-fix-broken-phy-interrupts-for-any.patch b/queue-5.14/net-phy-marvell10g-fix-broken-phy-interrupts-for-any.patch new file mode 100644 index 00000000000..0743c7101aa --- /dev/null +++ b/queue-5.14/net-phy-marvell10g-fix-broken-phy-interrupts-for-any.patch @@ -0,0 +1,143 @@ +From b833e844ff8d580343ccab4c55f5156ee83a7078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 15:25:41 +0200 +Subject: net: phy: marvell10g: fix broken PHY interrupts for anyone after us + in the driver probe list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +[ Upstream commit 0d55649d2ad7296acfda9127e1d05518d025734a ] + +Enabling interrupts via device tree for the internal PHYs on the +mv88e6390 DSA switch does not work. The driver insists to use poll mode. + +Stage one debugging shows that the fwnode_mdiobus_phy_device_register +function calls fwnode_irq_get properly, and phy->irq is set to a valid +interrupt line initially. + +But it is then cleared. + +Stage two debugging shows that it is cleared here: + +phy_probe: + + /* Disable the interrupt if the PHY doesn't support it + * but the interrupt is still a valid one + */ + if (!phy_drv_supports_irq(phydrv) && phy_interrupt_is_valid(phydev)) + phydev->irq = PHY_POLL; + +Okay, so does the "Marvell 88E6390 Family" PHY driver not have the +.config_intr and .handle_interrupt function pointers? Yes it does. + +Stage three debugging shows that the PHY device does not attempt a probe +against the "Marvell 88E6390 Family" driver, but against the "mv88x3310" +driver. + +Okay, so why does the "mv88x3310" driver match on a mv88x6390 internal +PHY? The PHY IDs (MARVELL_PHY_ID_88E6390_FAMILY vs +MARVELL_PHY_ID_88X3310) are way different. + +Stage four debugging has us looking through: + +phy_device_register +-> device_add + -> bus_probe_device + -> device_initial_probe + -> __device_attach + -> bus_for_each_drv + -> driver_match_device + -> drv->bus->match + -> phy_bus_match + +Okay, so as we said, the MII_PHYSID1 of mv88e6390 does not match the +mv88x3310 driver's PHY mask & ID, so why would phy_bus_match return... + +Ahh, phy_bus_match calls a shortcircuit method, +phydrv->match_phy_device, and does not even bother to compare the PHY ID +if that is implemented. + +So of course, we go inside the marvell10g.c driver and sure enough, it +implements .match_phy_device and does not bother to check the PHY ID. + +What's interesting though is that at the end of the device_add() from +phy_device_register(), the driver for the internal PHYs _is_ the proper +"Marvell 88E6390 Family". This is because "mv88x3310" ends up failing to +probe after all, and __device_attach_driver(), to quote: + + /* + * Ignore errors returned by ->probe so that the next driver can try + * its luck. + */ + +The next (and only other) driver that matches is the 6390 driver. For +this one, phy_probe doesn't fail, and everything expects to work as +normal, EXCEPT phydev->irq has already been cleared by the previous +unsuccessful probe of a driver which did not implement PHY interrupts, +and therefore cleared that IRQ. + +Okay, so it is not just Marvell 6390 that has PHY interrupts broken. +Stuff like Atheros, Aquantia, Broadcom, Qualcomm work because they are +lexicographically before Marvell, and stuff like NXP, Realtek, Vitesse +are broken. + +This goes to show how fragile it is to reset phydev->irq = PHY_POLL from +the actual beginning of phy_probe itself. That seems like an actual bug +of its own too, since phy_probe has side effects which are not restored +on probe failure, but the line of thought probably was, the same driver +will attempt probe again, so it doesn't matter. Well, looks like it +does. + +Maybe it would make more sense to move the phydev->irq clearing after +the actual device_add() in phy_device_register() completes, and the +bound driver is the actual final one. + +(also, a bit frightening that drivers are permitted to bypass the MDIO +bus matching in such a trivial way and perform PHY reads and writes from +the .match_phy_device method, on devices that do not even belong to +them. In the general case it might not be guaranteed that the MDIO +accesses one driver needs to make to figure out whether to match on a +device is safe for all other PHY devices) + +Fixes: a5de4be0aaaa ("net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340") +Signed-off-by: Vladimir Oltean +Tested-by: Marek Behún +Signed-off-by: Marek Behún +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20210827132541.28953-1-kabel@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell10g.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c +index 53a433442803..f4d758f8a1ee 100644 +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -987,11 +987,19 @@ static int mv3310_get_number_of_ports(struct phy_device *phydev) + + static int mv3310_match_phy_device(struct phy_device *phydev) + { ++ if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] & ++ MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310) ++ return 0; ++ + return mv3310_get_number_of_ports(phydev) == 1; + } + + static int mv3340_match_phy_device(struct phy_device *phydev) + { ++ if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] & ++ MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310) ++ return 0; ++ + return mv3310_get_number_of_ports(phydev) == 4; + } + +-- +2.30.2 + diff --git a/queue-5.14/net-qrtr-make-checks-in-qrtr_endpoint_post-stricter.patch b/queue-5.14/net-qrtr-make-checks-in-qrtr_endpoint_post-stricter.patch new file mode 100644 index 00000000000..279e70af657 --- /dev/null +++ b/queue-5.14/net-qrtr-make-checks-in-qrtr_endpoint_post-stricter.patch @@ -0,0 +1,55 @@ +From 7c4056ea293214ce262c67805bcec837792647cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 11:37:17 +0300 +Subject: net: qrtr: make checks in qrtr_endpoint_post() stricter + +From: Dan Carpenter + +[ Upstream commit aaa8e4922c887ff47ad66ef918193682bccc1905 ] + +These checks are still not strict enough. The main problem is that if +"cb->type == QRTR_TYPE_NEW_SERVER" is true then "len - hdrlen" is +guaranteed to be 4 but we need to be at least 16 bytes. In fact, we +can reject everything smaller than sizeof(*pkt) which is 20 bytes. + +Also I don't like the ALIGN(size, 4). It's better to just insist that +data is needs to be aligned at the start. + +Fixes: 0baa99ee353c ("net: qrtr: Allow non-immediate node routing") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/qrtr.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index 0c30908628ba..bdbda61db8b9 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + goto err; + } + +- if (!size || len != ALIGN(size, 4) + hdrlen) ++ if (!size || size & 3 || len != size + hdrlen) + goto err; + + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA && +@@ -506,8 +506,12 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) + + if (cb->type == QRTR_TYPE_NEW_SERVER) { + /* Remote node endpoint can bridge other distant nodes */ +- const struct qrtr_ctrl_pkt *pkt = data + hdrlen; ++ const struct qrtr_ctrl_pkt *pkt; + ++ if (size < sizeof(*pkt)) ++ goto err; ++ ++ pkt = data + hdrlen; + qrtr_node_assign(node, le32_to_cpu(pkt->server.node)); + } + +-- +2.30.2 + diff --git a/queue-5.14/net-qualcomm-fix-qca7000-checksum-handling.patch b/queue-5.14/net-qualcomm-fix-qca7000-checksum-handling.patch new file mode 100644 index 00000000000..1829efe5251 --- /dev/null +++ b/queue-5.14/net-qualcomm-fix-qca7000-checksum-handling.patch @@ -0,0 +1,52 @@ +From ea519443b464447eaf0b5bde0328fec86bedb28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Aug 2021 16:23:15 +0200 +Subject: net: qualcomm: fix QCA7000 checksum handling + +From: Stefan Wahren + +[ Upstream commit 429205da6c834447a57279af128bdd56ccd5225e ] + +Based on tests the QCA7000 doesn't support checksum offloading. So assume +ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum +handling. This fixes data transfer issues in noisy environments. + +Reported-by: Michael Heimpold +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: Stefan Wahren +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- + drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index b64c254e00ba..8427fe1b8fd1 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -434,7 +434,7 @@ qcaspi_receive(struct qcaspi *qca) + skb_put(qca->rx_skb, retcode); + qca->rx_skb->protocol = eth_type_trans( + qca->rx_skb, qca->rx_skb->dev); +- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; ++ skb_checksum_none_assert(qca->rx_skb); + netif_rx_ni(qca->rx_skb); + qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, + net_dev->mtu + VLAN_ETH_HLEN); +diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c +index bcdeca7b3366..ce3f7ce31adc 100644 +--- a/drivers/net/ethernet/qualcomm/qca_uart.c ++++ b/drivers/net/ethernet/qualcomm/qca_uart.c +@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data, + skb_put(qca->rx_skb, retcode); + qca->rx_skb->protocol = eth_type_trans( + qca->rx_skb, qca->rx_skb->dev); +- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; ++ skb_checksum_none_assert(qca->rx_skb); + netif_rx_ni(qca->rx_skb); + qca->rx_skb = netdev_alloc_skb_ip_align(netdev, + netdev->mtu + +-- +2.30.2 + diff --git a/queue-5.14/net-sched-fix-qdisc_rate_table-refcount-leak-when-ge.patch b/queue-5.14/net-sched-fix-qdisc_rate_table-refcount-leak-when-ge.patch new file mode 100644 index 00000000000..6b4e863f25d --- /dev/null +++ b/queue-5.14/net-sched-fix-qdisc_rate_table-refcount-leak-when-ge.patch @@ -0,0 +1,43 @@ +From 55b589c37215f063a508eacb0d2a95ecf494d95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 23:58:01 +0800 +Subject: net: sched: Fix qdisc_rate_table refcount leak when get tcf_block + failed + +From: Xiyu Yang + +[ Upstream commit c66070125837900163b81a03063ddd657a7e9bfb ] + +The reference counting issue happens in one exception handling path of +cbq_change_class(). When failing to get tcf_block, the function forgets +to decrease the refcount of "rtab" increased by qdisc_put_rtab(), +causing a refcount leak. + +Fix this issue by jumping to "failure" label when get tcf_block failed. + +Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") +Signed-off-by: Xiyu Yang +Reviewed-by: Cong Wang +Link: https://lore.kernel.org/r/1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_cbq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c +index b79a7e27bb31..38a3a8394bbd 100644 +--- a/net/sched/sch_cbq.c ++++ b/net/sched/sch_cbq.c +@@ -1614,7 +1614,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t + err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack); + if (err) { + kfree(cl); +- return err; ++ goto failure; + } + + if (tca[TCA_RATE]) { +-- +2.30.2 + diff --git a/queue-5.14/net-stmmac-fix-intr-tbu-status-affecting-irq-count-s.patch b/queue-5.14/net-stmmac-fix-intr-tbu-status-affecting-irq-count-s.patch new file mode 100644 index 00000000000..3c59c19fdb4 --- /dev/null +++ b/queue-5.14/net-stmmac-fix-intr-tbu-status-affecting-irq-count-s.patch @@ -0,0 +1,44 @@ +From 2607f991df97691069c5582a28b5eb6902a0a422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 14:15:58 +0800 +Subject: net: stmmac: fix INTR TBU status affecting irq count statistic + +From: Voon Weifeng + +[ Upstream commit 1975df880b959e30f28d66148a12d77b458abd76 ] + +DMA channel status "Transmit buffer unavailable(TBU)" bit is not +considered as a successful dma tx. Hence, it should not affect +all the irq count statistic. + +Fixes: 1103d3a5531c ("net: stmmac: dwmac4: Also use TBU interrupt to clean TX path") +Signed-off-by: Voon Weifeng +Signed-off-by: Vijayakannan Ayyathurai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +index e63270267578..f83db62938dd 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +@@ -172,11 +172,12 @@ int dwmac4_dma_interrupt(void __iomem *ioaddr, + x->rx_normal_irq_n++; + ret |= handle_rx; + } +- if (likely(intr_status & (DMA_CHAN_STATUS_TI | +- DMA_CHAN_STATUS_TBU))) { ++ if (likely(intr_status & DMA_CHAN_STATUS_TI)) { + x->tx_normal_irq_n++; + ret |= handle_tx; + } ++ if (unlikely(intr_status & DMA_CHAN_STATUS_TBU)) ++ ret |= handle_tx; + if (unlikely(intr_status & DMA_CHAN_STATUS_ERI)) + x->rx_early_irq++; + +-- +2.30.2 + diff --git a/queue-5.14/net-ti-am65-cpsw-nuss-fix-rx-irq-state-after-.ndo_st.patch b/queue-5.14/net-ti-am65-cpsw-nuss-fix-rx-irq-state-after-.ndo_st.patch new file mode 100644 index 00000000000..7809b29ec2a --- /dev/null +++ b/queue-5.14/net-ti-am65-cpsw-nuss-fix-rx-irq-state-after-.ndo_st.patch @@ -0,0 +1,112 @@ +From ecd46bce53cc28a05a6b113b0b582099af1645f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 01:55:31 +0300 +Subject: net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop() + +From: Vignesh Raghavendra + +[ Upstream commit 47bfc4d128dedd9e828e33b70b87b591a6d59edf ] + +On TI K3 am64x platform the issue with RX IRQ is observed - it's become +disabled forever after .ndo_stop(). The K3 CPSW driver manipulates RX IRQ +by using standard Linux enable_irq()/disable_irq_nosync() API as there is +no IRQ enable/disable options in CPSW HW itself, as result during +.ndo_stop() following sequence happens + + phy_stop() + teardown TX/RX channels + wait for TX tdown complete + napi_disable(TX) + clean up TX channels + + (a) + + napi_disable(RX) + +At point (a) it's not possible to predict if RX IRQ was triggered or not. +if RX IRQ was triggered then it also not possible to definitely say if RX +NAPI was run or only scheduled and immediately canceled by +napi_disable(RX). Actually the last case causes RX IRQ to be permanently +disabled. + +Another observed issue is that RX IRQ enable counter become unbalanced if +(gro_flush_timeout =! 0) while (napi_defer_hard_irqs == 0): + +Unbalanced enable for IRQ 44 +WARNING: CPU: 0 PID: 10 at ../kernel/irq/manage.c:776 __enable_irq+0x38/0x80 +__enable_irq+0x38/0x80 +enable_irq+0x54/0xb0 +am65_cpsw_nuss_rx_poll+0x2f4/0x368 +__napi_poll+0x34/0x1b8 +net_rx_action+0xe4/0x220 +_stext+0x11c/0x284 +run_ksoftirqd+0x4c/0x60 + +To avoid above issues introduce flag indicating if RX was actually disabled +before enabling it in am65_cpsw_nuss_rx_poll() and restore RX IRQ state in +.ndo_open() + +Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g") +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 13 +++++++++++-- + drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 ++ + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index fb58fc470773..e967cd1ade36 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -518,6 +518,10 @@ static int am65_cpsw_nuss_common_open(struct am65_cpsw_common *common, + } + + napi_enable(&common->napi_rx); ++ if (common->rx_irq_disabled) { ++ common->rx_irq_disabled = false; ++ enable_irq(common->rx_chns.irq); ++ } + + dev_dbg(common->dev, "cpsw_nuss started\n"); + return 0; +@@ -871,8 +875,12 @@ static int am65_cpsw_nuss_rx_poll(struct napi_struct *napi_rx, int budget) + + dev_dbg(common->dev, "%s num_rx:%d %d\n", __func__, num_rx, budget); + +- if (num_rx < budget && napi_complete_done(napi_rx, num_rx)) +- enable_irq(common->rx_chns.irq); ++ if (num_rx < budget && napi_complete_done(napi_rx, num_rx)) { ++ if (common->rx_irq_disabled) { ++ common->rx_irq_disabled = false; ++ enable_irq(common->rx_chns.irq); ++ } ++ } + + return num_rx; + } +@@ -1090,6 +1098,7 @@ static irqreturn_t am65_cpsw_nuss_rx_irq(int irq, void *dev_id) + { + struct am65_cpsw_common *common = dev_id; + ++ common->rx_irq_disabled = true; + disable_irq_nosync(irq); + napi_schedule(&common->napi_rx); + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.h b/drivers/net/ethernet/ti/am65-cpsw-nuss.h +index 5d93e346f05e..048ed10143c1 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h +@@ -126,6 +126,8 @@ struct am65_cpsw_common { + struct am65_cpsw_rx_chn rx_chns; + struct napi_struct napi_rx; + ++ bool rx_irq_disabled; ++ + u32 nuss_ver; + u32 cpsw_ver; + unsigned long bus_freq; +-- +2.30.2 + diff --git a/queue-5.14/net-ti-am65-cpsw-nuss-fix-wrong-devlink-release-orde.patch b/queue-5.14/net-ti-am65-cpsw-nuss-fix-wrong-devlink-release-orde.patch new file mode 100644 index 00000000000..802fe93eb4c --- /dev/null +++ b/queue-5.14/net-ti-am65-cpsw-nuss-fix-wrong-devlink-release-orde.patch @@ -0,0 +1,94 @@ +From 4a97ec5c9a2f50dcf579c4bad5bb2b60a7b72b8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 10:33:45 +0300 +Subject: net: ti: am65-cpsw-nuss: fix wrong devlink release order + +From: Leon Romanovsky + +[ Upstream commit acf34954efd17d4f65c7bb3e614381e6afc33222 ] + +The commit that introduced devlink support released devlink resources in +wrong order, that made an unwind flow to be asymmetrical. In addition, +the am65-cpsw-nuss used internal to devlink core field - registered. + +In order to fix the unwind flow and remove such access to the +registered field, rewrite the code to call devlink_port_unregister only +on registered ports. + +Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support") +Signed-off-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 34 ++++++++++++------------ + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 67a08cbba859..fb58fc470773 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2388,21 +2388,6 @@ static const struct devlink_param am65_cpsw_devlink_params[] = { + am65_cpsw_dl_switch_mode_set, NULL), + }; + +-static void am65_cpsw_unregister_devlink_ports(struct am65_cpsw_common *common) +-{ +- struct devlink_port *dl_port; +- struct am65_cpsw_port *port; +- int i; +- +- for (i = 1; i <= common->port_num; i++) { +- port = am65_common_get_port(common, i); +- dl_port = &port->devlink_port; +- +- if (dl_port->registered) +- devlink_port_unregister(dl_port); +- } +-} +- + static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common) + { + struct devlink_port_attrs attrs = {}; +@@ -2464,7 +2449,12 @@ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common) + return ret; + + dl_port_unreg: +- am65_cpsw_unregister_devlink_ports(common); ++ for (i = i - 1; i >= 1; i--) { ++ port = am65_common_get_port(common, i); ++ dl_port = &port->devlink_port; ++ ++ devlink_port_unregister(dl_port); ++ } + dl_unreg: + devlink_unregister(common->devlink); + dl_free: +@@ -2475,6 +2465,17 @@ dl_free: + + static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common) + { ++ struct devlink_port *dl_port; ++ struct am65_cpsw_port *port; ++ int i; ++ ++ for (i = 1; i <= common->port_num; i++) { ++ port = am65_common_get_port(common, i); ++ dl_port = &port->devlink_port; ++ ++ devlink_port_unregister(dl_port); ++ } ++ + if (!AM65_CPSW_IS_CPSW2G(common) && + IS_ENABLED(CONFIG_TI_K3_AM65_CPSW_SWITCHDEV)) { + devlink_params_unpublish(common->devlink); +@@ -2482,7 +2483,6 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common) + ARRAY_SIZE(am65_cpsw_devlink_params)); + } + +- am65_cpsw_unregister_devlink_ports(common); + devlink_unregister(common->devlink); + devlink_free(common->devlink); + } +-- +2.30.2 + diff --git a/queue-5.14/net-usb-asix-ax88772-add-missing-stop.patch b/queue-5.14/net-usb-asix-ax88772-add-missing-stop.patch new file mode 100644 index 00000000000..b81929e81d1 --- /dev/null +++ b/queue-5.14/net-usb-asix-ax88772-add-missing-stop.patch @@ -0,0 +1,34 @@ +From a8a06a26af06da2b54436b3a10f42442ac911646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 09:32:24 +0200 +Subject: net: usb: asix: ax88772: add missing stop + +From: Oleksij Rempel + +[ Upstream commit 9c2670951ed03f8fc6c701d66f5c765929cf1f23 ] + +Add missing stop and let phylib framework suspend attached PHY. + +Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support") +Signed-off-by: Oleksij Rempel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix_devices.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index dc87e8caf954..53c3c680c083 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -1220,6 +1220,7 @@ static const struct driver_info ax88772b_info = { + .unbind = ax88772_unbind, + .status = asix_status, + .reset = ax88772_reset, ++ .stop = ax88772_stop, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | + FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, +-- +2.30.2 + diff --git a/queue-5.14/nfsd4-fix-forced-expiry-locking.patch b/queue-5.14/nfsd4-fix-forced-expiry-locking.patch new file mode 100644 index 00000000000..50f88dbf7e2 --- /dev/null +++ b/queue-5.14/nfsd4-fix-forced-expiry-locking.patch @@ -0,0 +1,42 @@ +From 1e9948fedeecc4d2a9543222845598d207cb451c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 16:41:43 -0400 +Subject: nfsd4: Fix forced-expiry locking + +From: J. Bruce Fields + +[ Upstream commit f7104cc1a9159cd0d3e8526cb638ae0301de4b61 ] + +This should use the network-namespace-wide client_lock, not the +per-client cl_lock. + +You shouldn't see any bugs unless you're actually using the +forced-expiry interface introduced by 89c905beccbb. + +Fixes: 89c905beccbb "nfsd: allow forced expiration of NFSv4 clients" +Signed-off-by: J. Bruce Fields +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index fa67ecd5fe63..2bedc7839ec5 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -2687,9 +2687,9 @@ static void force_expire_client(struct nfs4_client *clp) + + trace_nfsd_clid_admin_expired(&clp->cl_clientid); + +- spin_lock(&clp->cl_lock); ++ spin_lock(&nn->client_lock); + clp->cl_time = 0; +- spin_unlock(&clp->cl_lock); ++ spin_unlock(&nn->client_lock); + + wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0); + spin_lock(&nn->client_lock); +-- +2.30.2 + diff --git a/queue-5.14/nvme-rdma-don-t-update-queue-count-when-failing-to-s.patch b/queue-5.14/nvme-rdma-don-t-update-queue-count-when-failing-to-s.patch new file mode 100644 index 00000000000..f3ed6bb6612 --- /dev/null +++ b/queue-5.14/nvme-rdma-don-t-update-queue-count-when-failing-to-s.patch @@ -0,0 +1,47 @@ +From cf2b1ac926336d7792da4ab86592f4ffa976794a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 17:41:20 +0800 +Subject: nvme-rdma: don't update queue count when failing to set io queues + +From: Ruozhu Li + +[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ] + +We update ctrl->queue_count and schedule another reconnect when io queue +count is zero.But we will never try to create any io queue in next reco- +nnection, because ctrl->queue_count already set to zero.We will end up +having an admin-only session in Live state, which is exactly what we try +to avoid in the original patch. +Update ctrl->queue_count after queue_count zero checking to fix it. + +Signed-off-by: Ruozhu Li +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 7f6b3a991501..3bd9cbc80246 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -735,13 +735,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) + if (ret) + return ret; + +- ctrl->ctrl.queue_count = nr_io_queues + 1; +- if (ctrl->ctrl.queue_count < 2) { ++ if (nr_io_queues == 0) { + dev_err(ctrl->ctrl.device, + "unable to set any I/O queues\n"); + return -ENOMEM; + } + ++ ctrl->ctrl.queue_count = nr_io_queues + 1; + dev_info(ctrl->ctrl.device, + "creating %d I/O queues.\n", nr_io_queues); + +-- +2.30.2 + diff --git a/queue-5.14/nvme-tcp-don-t-update-queue-count-when-failing-to-se.patch b/queue-5.14/nvme-tcp-don-t-update-queue-count-when-failing-to-se.patch new file mode 100644 index 00000000000..22ba68ae905 --- /dev/null +++ b/queue-5.14/nvme-tcp-don-t-update-queue-count-when-failing-to-se.patch @@ -0,0 +1,46 @@ +From d60528ac32188fb43a2608a1cc600d4063c49948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Aug 2021 11:50:23 +0800 +Subject: nvme-tcp: don't update queue count when failing to set io queues + +From: Ruozhu Li + +[ Upstream commit 664227fde63844d69e9ec9e90a8a7801e6ff072d ] + +We update ctrl->queue_count and schedule another reconnect when io queue +count is zero.But we will never try to create any io queue in next reco- +nnection, because ctrl->queue_count already set to zero.We will end up +having an admin-only session in Live state, which is exactly what we try +to avoid in the original patch. +Update ctrl->queue_count after queue_count zero checking to fix it. + +Signed-off-by: Ruozhu Li +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 8cb15ee5b249..18bd68b82d78 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1769,13 +1769,13 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl) + if (ret) + return ret; + +- ctrl->queue_count = nr_io_queues + 1; +- if (ctrl->queue_count < 2) { ++ if (nr_io_queues == 0) { + dev_err(ctrl->device, + "unable to set any I/O queues\n"); + return -ENOMEM; + } + ++ ctrl->queue_count = nr_io_queues + 1; + dev_info(ctrl->device, + "creating %d I/O queues.\n", nr_io_queues); + +-- +2.30.2 + diff --git a/queue-5.14/nvmet-pass-back-cntlid-on-successful-completion.patch b/queue-5.14/nvmet-pass-back-cntlid-on-successful-completion.patch new file mode 100644 index 00000000000..4f5d8ed93dd --- /dev/null +++ b/queue-5.14/nvmet-pass-back-cntlid-on-successful-completion.patch @@ -0,0 +1,53 @@ +From 47b0613eb31a24b8974d0479fc6a2f77be872d69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 09:20:14 +0300 +Subject: nvmet: pass back cntlid on successful completion + +From: Amit Engel + +[ Upstream commit e804d5abe2d74cfe23f5f83be580d1cdc9307111 ] + +According to the NVMe specification, the response dword 0 value of the +Connect command is based on status code: return cntlid for successful +compeltion return IPO and IATTR for connect invalid parameters. Fix +a missing error information for a zero sized queue, and return the +cntlid also for I/O queue Connect commands. + +Signed-off-by: Amit Engel +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fabrics-cmd.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c +index 7d0f3523fdab..8ef564c3b32c 100644 +--- a/drivers/nvme/target/fabrics-cmd.c ++++ b/drivers/nvme/target/fabrics-cmd.c +@@ -120,6 +120,7 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req) + if (!sqsize) { + pr_warn("queue size zero!\n"); + req->error_loc = offsetof(struct nvmf_connect_command, sqsize); ++ req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize); + ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR; + goto err; + } +@@ -260,11 +261,11 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) + } + + status = nvmet_install_queue(ctrl, req); +- if (status) { +- /* pass back cntlid that had the issue of installing queue */ +- req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid); ++ if (status) + goto out_ctrl_put; +- } ++ ++ /* pass back cntlid for successful completion */ ++ req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid); + + pr_debug("adding queue %d to ctrl %d.\n", qid, ctrl->cntlid); + +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-check-capability-flag-while-freeing-ipo.patch b/queue-5.14/octeontx2-af-check-capability-flag-while-freeing-ipo.patch new file mode 100644 index 00000000000..767db98f72a --- /dev/null +++ b/queue-5.14/octeontx2-af-check-capability-flag-while-freeing-ipo.patch @@ -0,0 +1,64 @@ +From 548dbd7d79d29c7fbd3eeedcb1a7896eafbe54c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:24 +0530 +Subject: octeontx2-af: Check capability flag while freeing ipolicer memory + +From: Geetha sowjanya + +[ Upstream commit 07cccffdbdd37820ba13c645af8e74a78a266557 ] + +Bandwidth profiles (ipolicer structure)is implemented only on CN10K +platform. But current code try to free the ipolicer memory without +checking the capibility flag leading to driver crash on OCTEONTX2 +platform. This patch fixes the issue by add capability flag check. + +Fixes: e8e095b3b3700 ("octeontx2-af: cn10k: Bandwidth profiles config support") +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +index 4bfbbdf38770..c32195073e8a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -25,7 +25,7 @@ static int nix_update_mce_rule(struct rvu *rvu, u16 pcifunc, + int type, bool add); + static int nix_setup_ipolicers(struct rvu *rvu, + struct nix_hw *nix_hw, int blkaddr); +-static void nix_ipolicer_freemem(struct nix_hw *nix_hw); ++static void nix_ipolicer_freemem(struct rvu *rvu, struct nix_hw *nix_hw); + static int nix_verify_bandprof(struct nix_cn10k_aq_enq_req *req, + struct nix_hw *nix_hw, u16 pcifunc); + static int nix_free_all_bandprof(struct rvu *rvu, u16 pcifunc); +@@ -3849,7 +3849,7 @@ static void rvu_nix_block_freemem(struct rvu *rvu, int blkaddr, + kfree(txsch->schq.bmap); + } + +- nix_ipolicer_freemem(nix_hw); ++ nix_ipolicer_freemem(rvu, nix_hw); + + vlan = &nix_hw->txvlan; + kfree(vlan->rsrc.bmap); +@@ -4225,11 +4225,14 @@ static int nix_setup_ipolicers(struct rvu *rvu, + return 0; + } + +-static void nix_ipolicer_freemem(struct nix_hw *nix_hw) ++static void nix_ipolicer_freemem(struct rvu *rvu, struct nix_hw *nix_hw) + { + struct nix_ipolicer *ipolicer; + int layer; + ++ if (!rvu->hw->cap.ipolicer) ++ return; ++ + for (layer = 0; layer < BAND_PROF_NUM_LAYERS; layer++) { + ipolicer = &nix_hw->ipolicer[layer]; + +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-cn10k-fix-sdp-base-channel-number.patch b/queue-5.14/octeontx2-af-cn10k-fix-sdp-base-channel-number.patch new file mode 100644 index 00000000000..fd1ac1b7231 --- /dev/null +++ b/queue-5.14/octeontx2-af-cn10k-fix-sdp-base-channel-number.patch @@ -0,0 +1,118 @@ +From d9647a0d22835d85ffb54fdb402616fa1f2ac5ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:19 +0530 +Subject: octeontx2-af: cn10k: Fix SDP base channel number + +From: Subbaraya Sundeep + +[ Upstream commit 477b53f3f95ba5341b4320f8b7a92cedc5a67650 ] + +As per hardware the base channel number configured +for programmable channels of a block must be multiple +of number of channels of that block. This condition +is not met for SDP base channel currently. Hence this +patch ensures all the base channel numbers of all +blocks are multiple of number of channels present in +the blocks. Also instead of hardcoding SDP number +of channels the same is read from the NIX_AF_CONST1 +register. + +Fixes: 242da439214b ("octeontx2-af: cn10k: Add support for programmable") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/common.h | 2 -- + .../ethernet/marvell/octeontx2/af/rvu_cn10k.c | 31 +++++++++++++------ + 2 files changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h +index 47f5ed006a93..e0b43aad203c 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h +@@ -195,8 +195,6 @@ enum nix_scheduler { + #define NIX_CHAN_LBK_CHX(a, b) (0 + 0x100 * (a) + (b)) + #define NIX_CHAN_SDP_CH_START (0x700ull) + +-#define SDP_CHANNELS 256 +- + /* The mask is to extract lower 10-bits of channel number + * which CPT will pass to X2P. + */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +index 8d48b64485c6..28dcce7d575a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +@@ -212,9 +212,10 @@ void rvu_reset_lmt_map_tbl(struct rvu *rvu, u16 pcifunc) + + int rvu_set_channels_base(struct rvu *rvu) + { ++ u16 nr_lbk_chans, nr_sdp_chans, nr_cgx_chans, nr_cpt_chans; ++ u16 sdp_chan_base, cgx_chan_base, cpt_chan_base; + struct rvu_hwinfo *hw = rvu->hw; +- u16 cpt_chan_base; +- u64 nix_const; ++ u64 nix_const, nix_const1; + int blkaddr; + + blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, 0); +@@ -222,6 +223,7 @@ int rvu_set_channels_base(struct rvu *rvu) + return blkaddr; + + nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST); ++ nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1); + + hw->cgx = (nix_const >> 12) & 0xFULL; + hw->lmac_per_cgx = (nix_const >> 8) & 0xFULL; +@@ -244,14 +246,24 @@ int rvu_set_channels_base(struct rvu *rvu) + * channels such that all channel numbers are contiguous + * leaving no holes. This way the new CPT channels can be + * accomodated. The order of channel numbers assigned is +- * LBK, SDP, CGX and CPT. ++ * LBK, SDP, CGX and CPT. Also the base channel number ++ * of a block must be multiple of number of channels ++ * of the block. + */ +- hw->sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * +- ((nix_const >> 16) & 0xFFULL); +- hw->cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * SDP_CHANNELS; ++ nr_lbk_chans = (nix_const >> 16) & 0xFFULL; ++ nr_sdp_chans = nix_const1 & 0xFFFULL; ++ nr_cgx_chans = nix_const & 0xFFULL; ++ nr_cpt_chans = (nix_const >> 32) & 0xFFFULL; + +- cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * +- (nix_const & 0xFFULL); ++ sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * nr_lbk_chans; ++ /* Round up base channel to multiple of number of channels */ ++ hw->sdp_chan_base = ALIGN(sdp_chan_base, nr_sdp_chans); ++ ++ cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * nr_sdp_chans; ++ hw->cgx_chan_base = ALIGN(cgx_chan_base, nr_cgx_chans); ++ ++ cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * nr_cgx_chans; ++ hw->cpt_chan_base = ALIGN(cpt_chan_base, nr_cpt_chans); + + /* Out of 4096 channels start CPT from 2048 so + * that MSB for CPT channels is always set +@@ -355,6 +367,7 @@ err_put: + + static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr) + { ++ u64 nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1); + u64 nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST); + u16 cgx_chans, lbk_chans, sdp_chans, cpt_chans; + struct rvu_hwinfo *hw = rvu->hw; +@@ -364,7 +377,7 @@ static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr) + + cgx_chans = nix_const & 0xFFULL; + lbk_chans = (nix_const >> 16) & 0xFFULL; +- sdp_chans = SDP_CHANNELS; ++ sdp_chans = nix_const1 & 0xFFFULL; + cpt_chans = (nix_const >> 32) & 0xFFFULL; + + start = hw->cgx_chan_base; +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-cn10k-use-flit0-register-instead-of-fli.patch b/queue-5.14/octeontx2-af-cn10k-use-flit0-register-instead-of-fli.patch new file mode 100644 index 00000000000..c4ce8ddddb7 --- /dev/null +++ b/queue-5.14/octeontx2-af-cn10k-use-flit0-register-instead-of-fli.patch @@ -0,0 +1,56 @@ +From cfbe24a509351bb6217ea451677cc45138f558a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:27 +0530 +Subject: octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1 + +From: Geetha sowjanya + +[ Upstream commit 623da5ca70b70f01cd483585f5cd4c463cf2f2da ] + +RVU SMMU widget stores the final translated PA at +RVU_AF_SMMU_TLN_FLIT0<57:18> instead of FLIT1 register. This patch +fixes the address translation logic to use the correct register. + +Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions") +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 4 ++-- + drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +index 28dcce7d575a..dbe9149a215e 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +@@ -82,10 +82,10 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc, + dev_err(rvu->dev, "%s LMTLINE iova transulation failed err:%llx\n", __func__, val); + return -EIO; + } +- /* PA[51:12] = RVU_AF_SMMU_TLN_FLIT1[60:21] ++ /* PA[51:12] = RVU_AF_SMMU_TLN_FLIT0[57:18] + * PA[11:0] = IOVA[11:0] + */ +- pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT1) >> 21; ++ pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT0) >> 18; + pa &= GENMASK_ULL(39, 0); + *lmt_addr = (pa << 12) | (iova & 0xFFF); + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +index 8b01ef6e2c99..4215841c9f86 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h +@@ -53,7 +53,7 @@ + #define RVU_AF_SMMU_TXN_REQ (0x6008) + #define RVU_AF_SMMU_ADDR_RSP_STS (0x6010) + #define RVU_AF_SMMU_ADDR_TLN (0x6018) +-#define RVU_AF_SMMU_TLN_FLIT1 (0x6030) ++#define RVU_AF_SMMU_TLN_FLIT0 (0x6020) + + /* Admin function's privileged PF/VF registers */ + #define RVU_PRIV_CONST (0x8000000) +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-fix-loop-in-free-and-unmap-counter.patch b/queue-5.14/octeontx2-af-fix-loop-in-free-and-unmap-counter.patch new file mode 100644 index 00000000000..45798125068 --- /dev/null +++ b/queue-5.14/octeontx2-af-fix-loop-in-free-and-unmap-counter.patch @@ -0,0 +1,43 @@ +From b7c72e3d527b64355e6e9f14c60b87bd91b5fa23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 23:30:43 +0530 +Subject: octeontx2-af: Fix loop in free and unmap counter + +From: Subbaraya Sundeep + +[ Upstream commit 6537e96d743b89294b397b4865c6c061abae31b0 ] + +When the given counter does not belong to the entry +then code ends up in infinite loop because the loop +cursor, entry is not getting updated further. This +patch fixes that by updating entry for every iteration. + +Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 52b255426c22..38e8d58cf8a0 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -2990,10 +2990,11 @@ int rvu_mbox_handler_npc_mcam_unmap_counter(struct rvu *rvu, + index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); + if (index >= mcam->bmap_entries) + break; ++ entry = index + 1; ++ + if (mcam->entry2cntr_map[index] != req->cntr) + continue; + +- entry = index + 1; + npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, + index, req->cntr); + } +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-fix-mailbox-errors-in-nix_rss_flowkey_c.patch b/queue-5.14/octeontx2-af-fix-mailbox-errors-in-nix_rss_flowkey_c.patch new file mode 100644 index 00000000000..86535219316 --- /dev/null +++ b/queue-5.14/octeontx2-af-fix-mailbox-errors-in-nix_rss_flowkey_c.patch @@ -0,0 +1,59 @@ +From 1b9f2e3aa1e372c66b1f0d283bb82c1dd4a8b67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 23:30:44 +0530 +Subject: octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg + +From: Subbaraya Sundeep + +[ Upstream commit f2e4568ec95166605c77577953b2787c7f909978 ] + +In npc_update_vf_flow_entry function the loop cursor +'index' is being changed inside the loop causing +the loop to spin forever. This in turn hogs the kworker +thread forever and no other mbox message is processed +by AF driver after that. Fix this by using +another variable in the loop. + +Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 38e8d58cf8a0..0122310ee3a7 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -938,7 +938,7 @@ void rvu_npc_enable_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, + static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + int blkaddr, u16 pcifunc, u64 rx_action) + { +- int actindex, index, bank; ++ int actindex, index, bank, entry; + bool enable; + + if (!(pcifunc & RVU_PFVF_FUNC_MASK)) +@@ -949,7 +949,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + if (mcam->entry2target_pffunc[index] == pcifunc) { + bank = npc_get_bank(mcam, index); + actindex = index; +- index &= (mcam->banksize - 1); ++ entry = index & (mcam->banksize - 1); + + /* read vf flow entry enable status */ + enable = is_mcam_entry_enabled(rvu, mcam, blkaddr, +@@ -959,7 +959,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + false); + /* update 'action' */ + rvu_write64(rvu, blkaddr, +- NPC_AF_MCAMEX_BANKX_ACTION(index, bank), ++ NPC_AF_MCAMEX_BANKX_ACTION(entry, bank), + rx_action); + if (enable) + npc_enable_mcam_entry(rvu, mcam, blkaddr, +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-fix-static-code-analyzer-reported-issue.patch b/queue-5.14/octeontx2-af-fix-static-code-analyzer-reported-issue.patch new file mode 100644 index 00000000000..4e69326ebda --- /dev/null +++ b/queue-5.14/octeontx2-af-fix-static-code-analyzer-reported-issue.patch @@ -0,0 +1,57 @@ +From 078d6b86cbca959c064bed161ee13bc667a43599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 23:30:45 +0530 +Subject: octeontx2-af: Fix static code analyzer reported issues + +From: Subbaraya Sundeep + +[ Upstream commit 698a82ebfb4b2f2014baf31b7324b328a2a6366e ] + +This patch fixes the static code analyzer reported issues +in rvu_npc.c. The reported errors are different sizes of +operands in bitops and returning uninitialized values. + +Fixes: 651cd2652339 ("octeontx2-af: MCAM entry installation support") +Signed-off-by: Subbaraya Sundeep +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 0122310ee3a7..0a9ff2e0c9bb 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -23,7 +23,7 @@ + #define RSVD_MCAM_ENTRIES_PER_NIXLF 1 /* Ucast for LFs */ + + #define NPC_PARSE_RESULT_DMAC_OFFSET 8 +-#define NPC_HW_TSTAMP_OFFSET 8 ++#define NPC_HW_TSTAMP_OFFSET 8ULL + #define NPC_KEX_CHAN_MASK 0xFFFULL + #define NPC_KEX_PF_FUNC_MASK 0xFFFFULL + +@@ -2166,7 +2166,7 @@ static void npc_unmap_mcam_entry_and_cntr(struct rvu *rvu, + int blkaddr, u16 entry, u16 cntr) + { + u16 index = entry & (mcam->banksize - 1); +- u16 bank = npc_get_bank(mcam, entry); ++ u32 bank = npc_get_bank(mcam, entry); + + /* Remove mapping and reduce counter's refcnt */ + mcam->entry2cntr_map[entry] = NPC_MCAM_INVALID_MAP; +@@ -2788,8 +2788,8 @@ int rvu_mbox_handler_npc_mcam_shift_entry(struct rvu *rvu, + struct npc_mcam *mcam = &rvu->hw->mcam; + u16 pcifunc = req->hdr.pcifunc; + u16 old_entry, new_entry; ++ int blkaddr, rc = 0; + u16 index, cntr; +- int blkaddr, rc; + + blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NPC, 0); + if (blkaddr < 0) +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-af-set-proper-errorcode-for-ipv4-checksum-.patch b/queue-5.14/octeontx2-af-set-proper-errorcode-for-ipv4-checksum-.patch new file mode 100644 index 00000000000..9655a8ca269 --- /dev/null +++ b/queue-5.14/octeontx2-af-set-proper-errorcode-for-ipv4-checksum-.patch @@ -0,0 +1,51 @@ +From 2827eea4f991421b0f473b1f21bd38d837dd2467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 23:30:46 +0530 +Subject: octeontx2-af: Set proper errorcode for IPv4 checksum errors + +From: Sunil Goutham + +[ Upstream commit 1e4428b6dba9b683dc2ec0a56ed7879de3200cce ] + +With current config, for packets with IPv4 checksum errors, +errorcode is being set to UNKNOWN. Hence added a separate +errorcodes for outer and inner IPv4 checksum and changed +NPC configuration accordingly. + +Also turn on L2 multicast address check in NPC protocol check block. + +Fixes: 6b3321bacc5a ("octeontx2-af: Enable packet length and csum validation") +Signed-off-by: Sunil Goutham +Signed-off-by: Subbaraya Sundeep +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index 0a9ff2e0c9bb..26a792407c40 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -2030,14 +2030,15 @@ int rvu_npc_init(struct rvu *rvu) + + /* Enable below for Rx pkts. + * - Outer IPv4 header checksum validation. +- * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2M]. ++ * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2B]. ++ * - Detect outer L2 multicast address and set NPC_RESULT_S[L2M]. + * - Inner IPv4 header checksum validation. + * - Set non zero checksum error code value + */ + rvu_write64(rvu, blkaddr, NPC_AF_PCK_CFG, + rvu_read64(rvu, blkaddr, NPC_AF_PCK_CFG) | +- BIT_ULL(32) | BIT_ULL(24) | BIT_ULL(6) | +- BIT_ULL(2) | BIT_ULL(1)); ++ ((u64)NPC_EC_OIP4_CSUM << 32) | (NPC_EC_IIP4_CSUM << 24) | ++ BIT_ULL(7) | BIT_ULL(6) | BIT_ULL(2) | BIT_ULL(1)); + + rvu_npc_setup_interfaces(rvu, blkaddr); + +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-pf-cn10k-fix-error-return-code-in-otx2_set.patch b/queue-5.14/octeontx2-pf-cn10k-fix-error-return-code-in-otx2_set.patch new file mode 100644 index 00000000000..15583078dd0 --- /dev/null +++ b/queue-5.14/octeontx2-pf-cn10k-fix-error-return-code-in-otx2_set.patch @@ -0,0 +1,40 @@ +From df1bda5d8f1a6602beb757a4ebde7eaead280457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 14:34:47 +0800 +Subject: octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg() + +From: Yang Yingliang + +[ Upstream commit 5e8243e66b4d80eeaf9ed8cb0235ff133630a014 ] + +If otx2_mbox_get_rsp() fails, otx2_set_flowkey_cfg() need return an +error code. + +Fixes: e7938365459f ("octeontx2-pf: Fix algorithm index in MCAM rules with RSS action") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index a6210b020a57..94dfd64f526f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -289,8 +289,10 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) + + rsp = (struct nix_rss_flowkey_cfg_rsp *) + otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); +- if (IS_ERR(rsp)) ++ if (IS_ERR(rsp)) { ++ err = PTR_ERR(rsp); + goto fail; ++ } + + pfvf->hw.flowkey_alg_idx = rsp->alg_idx; + fail: +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-pf-don-t-install-vlan-offload-rule-if-netd.patch b/queue-5.14/octeontx2-pf-don-t-install-vlan-offload-rule-if-netd.patch new file mode 100644 index 00000000000..3e555d84207 --- /dev/null +++ b/queue-5.14/octeontx2-pf-don-t-install-vlan-offload-rule-if-netd.patch @@ -0,0 +1,45 @@ +From 70b702ce71912fd845580f61f7e415ad205d3adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:25 +0530 +Subject: octeontx2-pf: Don't install VLAN offload rule if netdev is down + +From: Sunil Goutham + +[ Upstream commit 05209e3570e452cdaa644e8398a8875b6a91051d ] + +Whenever user changes interface MAC address both default DMAC based +MCAM rule and VLAN offload (for strip) rules are updated with new +MAC address. To update or install VLAN offload rule PF driver needs +interface's receive channel info, which is retrieved from admin +function at the time of NIXLF initialization. + +If user changes MAC address before interface is UP, VLAN offload rule +installation will fail and throw error as receive channel is not valid. +To avoid this, skip VLAN offload rule installation if netdev is not UP. +This rule will anyway be reinslatted as part of open() call. + +Fixes: fd9d7859db6c ("octeontx2-pf: Implement ingress/egress VLAN offload") +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 70fcc1fd962f..692099793005 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -208,7 +208,8 @@ int otx2_set_mac_address(struct net_device *netdev, void *p) + if (!otx2_hw_set_mac_addr(pfvf, addr->sa_data)) { + memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len); + /* update dmac field in vlan offload rule */ +- if (pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT) ++ if (netif_running(netdev) && ++ pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT) + otx2_install_rxvlan_offload_flow(pfvf); + /* update dmac address in ntuple and DMAC filter list */ + if (pfvf->flags & OTX2_FLAG_DMACFLTR_SUPPORT) +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-pf-fix-algorithm-index-in-mcam-rules-with-.patch b/queue-5.14/octeontx2-pf-fix-algorithm-index-in-mcam-rules-with-.patch new file mode 100644 index 00000000000..8cd0962e04b --- /dev/null +++ b/queue-5.14/octeontx2-pf-fix-algorithm-index-in-mcam-rules-with-.patch @@ -0,0 +1,85 @@ +From d7a89f79e6def6aae9766dd59e396dfa0ede1d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:26 +0530 +Subject: octeontx2-pf: Fix algorithm index in MCAM rules with RSS action + +From: Sunil Goutham + +[ Upstream commit e7938365459f3a6d4edf212f435c4ad635621450 ] + +Otherthan setting action as RSS in NPC MCAM entry, RSS flowkey +algorithm index also needs to be set. Otherwise whatever algorithm +is defined at flowkey index '0' will be considered by HW and pkt +flows will be distributed as such. + +Fix this by saving the flowkey index sent by admin function while +initializing RSS and then use it when framing MCAM rules. + +Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/nic/otx2_common.c | 11 +++++++++++ + .../net/ethernet/marvell/octeontx2/nic/otx2_common.h | 3 +++ + .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 + + 3 files changed, 15 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 692099793005..a6210b020a57 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -269,6 +269,7 @@ unlock: + int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) + { + struct otx2_rss_info *rss = &pfvf->hw.rss_info; ++ struct nix_rss_flowkey_cfg_rsp *rsp; + struct nix_rss_flowkey_cfg *req; + int err; + +@@ -283,6 +284,16 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf) + req->group = DEFAULT_RSS_CONTEXT_GROUP; + + err = otx2_sync_mbox_msg(&pfvf->mbox); ++ if (err) ++ goto fail; ++ ++ rsp = (struct nix_rss_flowkey_cfg_rsp *) ++ otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); ++ if (IS_ERR(rsp)) ++ goto fail; ++ ++ pfvf->hw.flowkey_alg_idx = rsp->alg_idx; ++fail: + mutex_unlock(&pfvf->mbox.lock); + return err; + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +index 8fd58cd07f50..8c602d27108a 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +@@ -196,6 +196,9 @@ struct otx2_hw { + u8 lso_udpv4_idx; + u8 lso_udpv6_idx; + ++ /* RSS */ ++ u8 flowkey_alg_idx; ++ + /* MSI-X */ + u8 cint_cnt; /* CQ interrupt count */ + u16 npa_msixoff; /* Offset of NPA vectors */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +index 4d9de525802d..fdd27c4fea86 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +@@ -858,6 +858,7 @@ static int otx2_add_flow_msg(struct otx2_nic *pfvf, struct otx2_flow *flow) + if (flow->flow_spec.flow_type & FLOW_RSS) { + req->op = NIX_RX_ACTIONOP_RSS; + req->index = flow->rss_ctx_id; ++ req->flow_key_alg = pfvf->hw.flowkey_alg_idx; + } else { + req->op = NIX_RX_ACTIONOP_UCAST; + req->index = ethtool_get_flow_spec_ring(ring_cookie); +-- +2.30.2 + diff --git a/queue-5.14/octeontx2-pf-send-correct-vlan-priority-mask-to-npc_.patch b/queue-5.14/octeontx2-pf-send-correct-vlan-priority-mask-to-npc_.patch new file mode 100644 index 00000000000..0cbaa9339b3 --- /dev/null +++ b/queue-5.14/octeontx2-pf-send-correct-vlan-priority-mask-to-npc_.patch @@ -0,0 +1,39 @@ +From 80e7c52799215264a87c08ce032f9bbaa0f16d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 17:32:22 +0530 +Subject: octeontx2-pf: send correct vlan priority mask to npc_install_flow_req + +From: Naveen Mamindlapalli + +[ Upstream commit 10df5a13ac6785b409ad749c4b10d4b220cc7e71 ] + +This patch corrects the erroneous vlan priority mask field that was +send to npc_install_flow_req. + +Fixes: 1d4d9e42c240 ("octeontx2-pf: Add tc flower hardware offload on ingress traffic") +Signed-off-by: Naveen Mamindlapalli +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +index 972b202b9884..32d5c623fdfa 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +@@ -485,8 +485,8 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node, + match.key->vlan_priority << 13; + + vlan_tci_mask = match.mask->vlan_id | +- match.key->vlan_dei << 12 | +- match.key->vlan_priority << 13; ++ match.mask->vlan_dei << 12 | ++ match.mask->vlan_priority << 13; + + flow_spec->vlan_tci = htons(vlan_tci); + flow_mask->vlan_tci = htons(vlan_tci_mask); +-- +2.30.2 + diff --git a/queue-5.14/pci-pm-avoid-forcing-pci_d0-for-wakeup-reasons-incon.patch b/queue-5.14/pci-pm-avoid-forcing-pci_d0-for-wakeup-reasons-incon.patch new file mode 100644 index 00000000000..cfe6f1b6a81 --- /dev/null +++ b/queue-5.14/pci-pm-avoid-forcing-pci_d0-for-wakeup-reasons-incon.patch @@ -0,0 +1,66 @@ +From a4901a6ff5c53d467be323d96612eb1572ffa982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 17:54:28 +0200 +Subject: PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently + +From: Rafael J. Wysocki + +[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ] + +It is inconsistent to return PCI_D0 from pci_target_state() instead +of the original target state if 'wakeup' is true and the device +cannot signal PME from D0. + +This only happens when the device cannot signal PME from the original +target state and any shallower power states (including D0) and that +case is effectively equivalent to the one in which PME singaling is +not supported at all. Since the original target state is returned in +the latter case, make the function do that in the former one too. + +Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/ +Fixes: 666ff6f83e1d ("PCI/PM: Avoid using device_may_wakeup() for runtime PM") +Reported-by: Mika Westerberg +Reported-by: Utkarsh H Patel +Reported-by: Koba Ko +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Tested-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index aacf575c15cf..28bac63525b2 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2599,16 +2599,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup) + if (dev->current_state == PCI_D3cold) + target_state = PCI_D3cold; + +- if (wakeup) { ++ if (wakeup && dev->pme_support) { ++ pci_power_t state = target_state; ++ + /* + * Find the deepest state from which the device can generate + * PME#. + */ +- if (dev->pme_support) { +- while (target_state +- && !(dev->pme_support & (1 << target_state))) +- target_state--; +- } ++ while (state && !(dev->pme_support & (1 << state))) ++ state--; ++ ++ if (state) ++ return state; ++ else if (dev->pme_support & 1) ++ return PCI_D0; + } + + return target_state; +-- +2.30.2 + diff --git a/queue-5.14/pci-pm-enable-pme-if-it-can-be-signaled-from-d3cold.patch b/queue-5.14/pci-pm-enable-pme-if-it-can-be-signaled-from-d3cold.patch new file mode 100644 index 00000000000..8d8623350a8 --- /dev/null +++ b/queue-5.14/pci-pm-enable-pme-if-it-can-be-signaled-from-d3cold.patch @@ -0,0 +1,56 @@ +From 7b2be91caf94ecb049141f53faf3ecc71ed4946c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 16:49:10 +0200 +Subject: PCI: PM: Enable PME if it can be signaled from D3cold + +From: Rafael J. Wysocki + +[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ] + +PME signaling is only enabled by __pci_enable_wake() if the target +device can signal PME from the given target power state (to avoid +pointless reconfiguration of the device), but if the hierarchy above +the device goes into D3cold, the device itself will end up in D3cold +too, so if it can signal PME from D3cold, it should be enabled to +do so in __pci_enable_wake(). + +[Note that if the device does not end up in D3cold and it cannot + signal PME from the original target power state, it will not signal + PME, so in that case the behavior does not change.] + +Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/ +Fixes: 5bcc2fb4e815 ("PCI PM: Simplify PCI wake-up code") +Reported-by: Mika Westerberg +Reported-by: Utkarsh H Patel +Reported-by: Koba Ko +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Tested-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 28bac63525b2..3f353572588d 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2495,7 +2495,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable + if (enable) { + int error; + +- if (pci_pme_capable(dev, state)) ++ /* ++ * Enable PME signaling if the device can signal PME from ++ * D3cold regardless of whether or not it can signal PME from ++ * the current target state, because that will allow it to ++ * signal PME when the hierarchy above it goes into D3cold and ++ * the device itself ends up in D3cold as a result of that. ++ */ ++ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold)) + pci_pme_active(dev, true); + else + ret = 1; +-- +2.30.2 + diff --git a/queue-5.14/pm-cpu-make-notifier-chain-use-a-raw_spinlock_t.patch b/queue-5.14/pm-cpu-make-notifier-chain-use-a-raw_spinlock_t.patch new file mode 100644 index 00000000000..1a9d29bce10 --- /dev/null +++ b/queue-5.14/pm-cpu-make-notifier-chain-use-a-raw_spinlock_t.patch @@ -0,0 +1,132 @@ +From efa4323a28c309701ff971fa0e441c370a562ab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 21:14:31 +0100 +Subject: PM: cpu: Make notifier chain use a raw_spinlock_t + +From: Valentin Schneider + +[ Upstream commit b2f6662ac08d0e7c25574ce53623c71bdae9dd78 ] + +Invoking atomic_notifier_chain_notify() requires acquiring a spinlock_t, +which can block under CONFIG_PREEMPT_RT. Notifications for members of the +cpu_pm notification chain will be issued by the idle task, which can never +block. + +Making *all* atomic_notifiers use a raw_spinlock is too big of a hammer, as +only notifications issued by the idle task are problematic. + +Special-case cpu_pm_notifier_chain by kludging a raw_notifier and +raw_spinlock_t together, matching the atomic_notifier behavior with a +raw_spinlock_t. + +Fixes: 70d932985757 ("notifier: Fix broken error handling pattern") +Signed-off-by: Valentin Schneider +Acked-by: Sebastian Andrzej Siewior +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/cpu_pm.c | 50 +++++++++++++++++++++++++++++++++++++------------ + 1 file changed, 38 insertions(+), 12 deletions(-) + +diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c +index f7e1d0eccdbc..246efc74e3f3 100644 +--- a/kernel/cpu_pm.c ++++ b/kernel/cpu_pm.c +@@ -13,19 +13,32 @@ + #include + #include + +-static ATOMIC_NOTIFIER_HEAD(cpu_pm_notifier_chain); ++/* ++ * atomic_notifiers use a spinlock_t, which can block under PREEMPT_RT. ++ * Notifications for cpu_pm will be issued by the idle task itself, which can ++ * never block, IOW it requires using a raw_spinlock_t. ++ */ ++static struct { ++ struct raw_notifier_head chain; ++ raw_spinlock_t lock; ++} cpu_pm_notifier = { ++ .chain = RAW_NOTIFIER_INIT(cpu_pm_notifier.chain), ++ .lock = __RAW_SPIN_LOCK_UNLOCKED(cpu_pm_notifier.lock), ++}; + + static int cpu_pm_notify(enum cpu_pm_event event) + { + int ret; + + /* +- * atomic_notifier_call_chain has a RCU read critical section, which +- * could be disfunctional in cpu idle. Copy RCU_NONIDLE code to let +- * RCU know this. ++ * This introduces a RCU read critical section, which could be ++ * disfunctional in cpu idle. Copy RCU_NONIDLE code to let RCU know ++ * this. + */ + rcu_irq_enter_irqson(); +- ret = atomic_notifier_call_chain(&cpu_pm_notifier_chain, event, NULL); ++ rcu_read_lock(); ++ ret = raw_notifier_call_chain(&cpu_pm_notifier.chain, event, NULL); ++ rcu_read_unlock(); + rcu_irq_exit_irqson(); + + return notifier_to_errno(ret); +@@ -33,10 +46,13 @@ static int cpu_pm_notify(enum cpu_pm_event event) + + static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event event_down) + { ++ unsigned long flags; + int ret; + + rcu_irq_enter_irqson(); +- ret = atomic_notifier_call_chain_robust(&cpu_pm_notifier_chain, event_up, event_down, NULL); ++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags); ++ ret = raw_notifier_call_chain_robust(&cpu_pm_notifier.chain, event_up, event_down, NULL); ++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags); + rcu_irq_exit_irqson(); + + return notifier_to_errno(ret); +@@ -49,12 +65,17 @@ static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event ev + * Add a driver to a list of drivers that are notified about + * CPU and CPU cluster low power entry and exit. + * +- * This function may sleep, and has the same return conditions as +- * raw_notifier_chain_register. ++ * This function has the same return conditions as raw_notifier_chain_register. + */ + int cpu_pm_register_notifier(struct notifier_block *nb) + { +- return atomic_notifier_chain_register(&cpu_pm_notifier_chain, nb); ++ unsigned long flags; ++ int ret; ++ ++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags); ++ ret = raw_notifier_chain_register(&cpu_pm_notifier.chain, nb); ++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags); ++ return ret; + } + EXPORT_SYMBOL_GPL(cpu_pm_register_notifier); + +@@ -64,12 +85,17 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier); + * + * Remove a driver from the CPU PM notifier list. + * +- * This function may sleep, and has the same return conditions as +- * raw_notifier_chain_unregister. ++ * This function has the same return conditions as raw_notifier_chain_unregister. + */ + int cpu_pm_unregister_notifier(struct notifier_block *nb) + { +- return atomic_notifier_chain_unregister(&cpu_pm_notifier_chain, nb); ++ unsigned long flags; ++ int ret; ++ ++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags); ++ ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb); ++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags); ++ return ret; + } + EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier); + +-- +2.30.2 + diff --git a/queue-5.14/pm-em-increase-energy-calculation-precision.patch b/queue-5.14/pm-em-increase-energy-calculation-precision.patch new file mode 100644 index 00000000000..9a6e0d98ef4 --- /dev/null +++ b/queue-5.14/pm-em-increase-energy-calculation-precision.patch @@ -0,0 +1,152 @@ +From 99ded4e70f090992ed401cb35d09d61572fd668c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 11:27:43 +0100 +Subject: PM: EM: Increase energy calculation precision + +From: Lukasz Luba + +[ Upstream commit 7fcc17d0cb12938d2b3507973a6f93fc9ed2c7a1 ] + +The Energy Model (EM) provides useful information about device power in +each performance state to other subsystems like: Energy Aware Scheduler +(EAS). The energy calculation in EAS does arithmetic operation based on +the EM em_cpu_energy(). Current implementation of that function uses +em_perf_state::cost as a pre-computed cost coefficient equal to: +cost = power * max_frequency / frequency. +The 'power' is expressed in milli-Watts (or in abstract scale). + +There are corner cases when the EAS energy calculation for two Performance +Domains (PDs) return the same value. The EAS compares these values to +choose smaller one. It might happen that this values are equal due to +rounding error. In such scenario, we need better resolution, e.g. 1000 +times better. To provide this possibility increase the resolution in the +em_perf_state::cost for 64-bit architectures. The cost of increasing +resolution on 32-bit is pretty high (64-bit division) and is not justified +since there are no new 32bit big.LITTLE EAS systems expected which would +benefit from this higher resolution. + +This patch allows to avoid the rounding to milli-Watt errors, which might +occur in EAS energy estimation for each PD. The rounding error is common +for small tasks which have small utilization value. + +There are two places in the code where it makes a difference: +1. In the find_energy_efficient_cpu() where we are searching for +best_delta. We might suffer there when two PDs return the same result, +like in the example below. + +Scenario: +Low utilized system e.g. ~200 sum_util for PD0 and ~220 for PD1. There +are quite a few small tasks ~10-15 util. These tasks would suffer for +the rounding error. These utilization values are typical when running games +on Android. One of our partners has reported 5..10mA less battery drain +when running with increased resolution. + +Some details: +We have two PDs: PD0 (big) and PD1 (little) +Let's compare w/o patch set ('old') and w/ patch set ('new') +We are comparing energy w/ task and w/o task placed in the PDs + +a) 'old' w/o patch set, PD0 +task_util = 13 +cost = 480 +sum_util_w/o_task = 215 +sum_util_w_task = 228 +scale_cpu = 1024 +energy_w/o_task = 480 * 215 / 1024 = 100.78 => 100 +energy_w_task = 480 * 228 / 1024 = 106.87 => 106 +energy_diff = 106 - 100 = 6 +(this is equal to 'old' PD1's energy_diff in 'c)') + +b) 'new' w/ patch set, PD0 +task_util = 13 +cost = 480 * 1000 = 480000 +sum_util_w/o_task = 215 +sum_util_w_task = 228 +energy_w/o_task = 480000 * 215 / 1024 = 100781 +energy_w_task = 480000 * 228 / 1024 = 106875 +energy_diff = 106875 - 100781 = 6094 +(this is not equal to 'new' PD1's energy_diff in 'd)') + +c) 'old' w/o patch set, PD1 +task_util = 13 +cost = 160 +sum_util_w/o_task = 283 +sum_util_w_task = 293 +scale_cpu = 355 +energy_w/o_task = 160 * 283 / 355 = 127.55 => 127 +energy_w_task = 160 * 296 / 355 = 133.41 => 133 +energy_diff = 133 - 127 = 6 +(this is equal to 'old' PD0's energy_diff in 'a)') + +d) 'new' w/ patch set, PD1 +task_util = 13 +cost = 160 * 1000 = 160000 +sum_util_w/o_task = 283 +sum_util_w_task = 293 +scale_cpu = 355 +energy_w/o_task = 160000 * 283 / 355 = 127549 +energy_w_task = 160000 * 296 / 355 = 133408 +energy_diff = 133408 - 127549 = 5859 +(this is not equal to 'new' PD0's energy_diff in 'b)') + +2. Difference in the 6% energy margin filter at the end of +find_energy_efficient_cpu(). With this patch the margin comparison also +has better resolution, so it's possible to have better task placement +thanks to that. + +Fixes: 27871f7a8a341ef ("PM: Introduce an Energy Model management framework") +Reported-by: CCJ Yeh +Reviewed-by: Dietmar Eggemann +Signed-off-by: Lukasz Luba +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/energy_model.h | 16 ++++++++++++++++ + kernel/power/energy_model.c | 4 +++- + 2 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h +index 3f221dbf5f95..1834752c5617 100644 +--- a/include/linux/energy_model.h ++++ b/include/linux/energy_model.h +@@ -53,6 +53,22 @@ struct em_perf_domain { + #ifdef CONFIG_ENERGY_MODEL + #define EM_MAX_POWER 0xFFFF + ++/* ++ * Increase resolution of energy estimation calculations for 64-bit ++ * architectures. The extra resolution improves decision made by EAS for the ++ * task placement when two Performance Domains might provide similar energy ++ * estimation values (w/o better resolution the values could be equal). ++ * ++ * We increase resolution only if we have enough bits to allow this increased ++ * resolution (i.e. 64-bit). The costs for increasing resolution when 32-bit ++ * are pretty high and the returns do not justify the increased costs. ++ */ ++#ifdef CONFIG_64BIT ++#define em_scale_power(p) ((p) * 1000) ++#else ++#define em_scale_power(p) (p) ++#endif ++ + struct em_data_callback { + /** + * active_power() - Provide power at the next performance state of +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index 0f4530b3a8cd..a332ccd829e2 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -170,7 +170,9 @@ static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd, + /* Compute the cost of each performance state. */ + fmax = (u64) table[nr_states - 1].frequency; + for (i = 0; i < nr_states; i++) { +- table[i].cost = div64_u64(fmax * table[i].power, ++ unsigned long power_res = em_scale_power(table[i].power); ++ ++ table[i].cost = div64_u64(fmax * power_res, + table[i].frequency); + } + +-- +2.30.2 + diff --git a/queue-5.14/posix-cpu-timers-force-next-expiration-recalc-after-.patch b/queue-5.14/posix-cpu-timers-force-next-expiration-recalc-after-.patch new file mode 100644 index 00000000000..3e40f018e2c --- /dev/null +++ b/queue-5.14/posix-cpu-timers-force-next-expiration-recalc-after-.patch @@ -0,0 +1,54 @@ +From bb9824a82c0c439f15a09c989f1e160cba7334e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 14:55:10 +0200 +Subject: posix-cpu-timers: Force next expiration recalc after itimer reset + +From: Frederic Weisbecker + +[ Upstream commit 406dd42bd1ba0c01babf9cde169bb319e52f6147 ] + +When an itimer deactivates a previously armed expiration, it simply doesn't +do anything. As a result the process wide cputime counter keeps running and +the tick dependency stays set until it reaches the old ghost expiration +value. + +This can be reproduced with the following snippet: + + void trigger_process_counter(void) + { + struct itimerval n = {}; + + n.it_value.tv_sec = 100; + setitimer(ITIMER_VIRTUAL, &n, NULL); + n.it_value.tv_sec = 0; + setitimer(ITIMER_VIRTUAL, &n, NULL); + } + +Fix this with resetting the relevant base expiration. This is similar to +disarming a timer. + +Signed-off-by: Frederic Weisbecker +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210726125513.271824-4-frederic@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/time/posix-cpu-timers.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c +index 517be7fd175e..a002685f688d 100644 +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -1346,8 +1346,6 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid, + } + } + +- if (!*newval) +- return; + *newval += now; + } + +-- +2.30.2 + diff --git a/queue-5.14/power-supply-axp288_fuel_gauge-report-register-addre.patch b/queue-5.14/power-supply-axp288_fuel_gauge-report-register-addre.patch new file mode 100644 index 00000000000..72f59df77b2 --- /dev/null +++ b/queue-5.14/power-supply-axp288_fuel_gauge-report-register-addre.patch @@ -0,0 +1,50 @@ +From be599945945e10efa2a612b2d6ff398f5f072166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Aug 2021 15:30:59 +0200 +Subject: power: supply: axp288_fuel_gauge: Report register-address on readb / + writeb errors + +From: Hans de Goede + +[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ] + +When fuel_gauge_reg_readb()/_writeb() fails, report which register we +were trying to read / write when the error happened. + +Also reword the message a bit: +- Drop the axp288 prefix, dev_err() already prints this +- Switch from telegram / abbreviated style to a normal sentence, aligning + the message with those from fuel_gauge_read_*bit_word() + +Signed-off-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp288_fuel_gauge.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c +index 2ba2d8d6b8e6..d1bcc52e67c3 100644 +--- a/drivers/power/supply/axp288_fuel_gauge.c ++++ b/drivers/power/supply/axp288_fuel_gauge.c +@@ -147,7 +147,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg) + } + + if (ret < 0) { +- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret); ++ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret); + return ret; + } + +@@ -161,7 +161,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val) + ret = regmap_write(info->regmap, reg, (unsigned int)val); + + if (ret < 0) +- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret); ++ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret); + + return ret; + } +-- +2.30.2 + diff --git a/queue-5.14/power-supply-cw2015-use-dev_err_probe-to-allow-defer.patch b/queue-5.14/power-supply-cw2015-use-dev_err_probe-to-allow-defer.patch new file mode 100644 index 00000000000..5abff58fc7d --- /dev/null +++ b/queue-5.14/power-supply-cw2015-use-dev_err_probe-to-allow-defer.patch @@ -0,0 +1,42 @@ +From 54fa9345a71bf0f1ff9931fa3895f796af89d467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 23:05:16 +0100 +Subject: power: supply: cw2015: use dev_err_probe to allow deferred probe + +From: Peter Robinson + +[ Upstream commit ad1abe476995d97bfe7546ea91bb4f3dcdfbf3ab ] + +Deal with deferred probe using dev_err_probe so the error is handled +and avoid logging lots probe defer information like the following: + +[ 9.125121] cw2015 4-0062: Failed to register power supply +[ 9.211131] cw2015 4-0062: Failed to register power supply + +Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver") +Signed-off-by: Peter Robinson +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cw2015_battery.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index d110597746b0..091868e9e9e8 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -679,7 +679,9 @@ static int cw_bat_probe(struct i2c_client *client) + &cw2015_bat_desc, + &psy_cfg); + if (IS_ERR(cw_bat->rk_bat)) { +- dev_err(cw_bat->dev, "Failed to register power supply\n"); ++ /* try again if this happens */ ++ dev_err_probe(&client->dev, PTR_ERR(cw_bat->rk_bat), ++ "Failed to register power supply\n"); + return PTR_ERR(cw_bat->rk_bat); + } + +-- +2.30.2 + diff --git a/queue-5.14/power-supply-max17042_battery-fix-typo-in-max17042_t.patch b/queue-5.14/power-supply-max17042_battery-fix-typo-in-max17042_t.patch new file mode 100644 index 00000000000..ebab2899985 --- /dev/null +++ b/queue-5.14/power-supply-max17042_battery-fix-typo-in-max17042_t.patch @@ -0,0 +1,46 @@ +From 9fae2ceeeb811c9e7c42f02b4fe93da90872664f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 18:50:14 +0200 +Subject: power: supply: max17042_battery: fix typo in MAx17042_TOFF + +From: Sebastian Krzyszkowiak + +[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ] + +Signed-off-by: Sebastian Krzyszkowiak +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max17042_battery.c | 2 +- + include/linux/power/max17042_battery.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index ce2041b30a06..215e77d3b6d9 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -748,7 +748,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip) + struct max17042_config_data *config = chip->pdata->config_data; + + max17042_override_por(map, MAX17042_TGAIN, config->tgain); +- max17042_override_por(map, MAx17042_TOFF, config->toff); ++ max17042_override_por(map, MAX17042_TOFF, config->toff); + max17042_override_por(map, MAX17042_CGAIN, config->cgain); + max17042_override_por(map, MAX17042_COFF, config->coff); + +diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h +index d55c746ac56e..e00ad1cfb1f1 100644 +--- a/include/linux/power/max17042_battery.h ++++ b/include/linux/power/max17042_battery.h +@@ -69,7 +69,7 @@ enum max17042_register { + MAX17042_RelaxCFG = 0x2A, + MAX17042_MiscCFG = 0x2B, + MAX17042_TGAIN = 0x2C, +- MAx17042_TOFF = 0x2D, ++ MAX17042_TOFF = 0x2D, + MAX17042_CGAIN = 0x2E, + MAX17042_COFF = 0x2F, + +-- +2.30.2 + diff --git a/queue-5.14/power-supply-smb347-charger-add-missing-pin-control-.patch b/queue-5.14/power-supply-smb347-charger-add-missing-pin-control-.patch new file mode 100644 index 00000000000..657431ab3df --- /dev/null +++ b/queue-5.14/power-supply-smb347-charger-add-missing-pin-control-.patch @@ -0,0 +1,55 @@ +From 618ddd7411727418fb9798c9d190a65f92558243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jul 2021 20:38:38 +0300 +Subject: power: supply: smb347-charger: Add missing pin control activation + +From: Dmitry Osipenko + +[ Upstream commit efe2175478d5237949e33c84d9a722fc084b218c ] + +Pin control needs to be activated by setting the enable bit, otherwise +hardware rejects all pin changes. Previously this stayed unnoticed on +Nexus 7 because pin control was enabled by default after rebooting from +downstream kernel, which uses driver that enables the bit and charger +registers are non-volatile until power supply (battery) is disconnected. +Configure the pin control enable bit. This fixes the potentially +never-enabled charging on devices that use pin control. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/smb347-charger.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c +index df240420f2de..9d8c2fadd4d0 100644 +--- a/drivers/power/supply/smb347-charger.c ++++ b/drivers/power/supply/smb347-charger.c +@@ -55,6 +55,7 @@ + #define CFG_PIN_EN_CTRL_ACTIVE_LOW 0x60 + #define CFG_PIN_EN_APSD_IRQ BIT(1) + #define CFG_PIN_EN_CHARGER_ERROR BIT(2) ++#define CFG_PIN_EN_CTRL BIT(4) + #define CFG_THERM 0x07 + #define CFG_THERM_SOFT_HOT_COMPENSATION_MASK 0x03 + #define CFG_THERM_SOFT_HOT_COMPENSATION_SHIFT 0 +@@ -724,6 +725,15 @@ static int smb347_hw_init(struct smb347_charger *smb) + if (ret < 0) + goto fail; + ++ /* Activate pin control, making it writable. */ ++ switch (smb->enable_control) { ++ case SMB3XX_CHG_ENABLE_PIN_ACTIVE_LOW: ++ case SMB3XX_CHG_ENABLE_PIN_ACTIVE_HIGH: ++ ret = regmap_set_bits(smb->regmap, CFG_PIN, CFG_PIN_EN_CTRL); ++ if (ret < 0) ++ goto fail; ++ } ++ + /* + * Make the charging functionality controllable by a write to the + * command register unless pin control is specified in the platform +-- +2.30.2 + diff --git a/queue-5.14/rcu-fix-stall-warning-deadlock-due-to-non-release-of.patch b/queue-5.14/rcu-fix-stall-warning-deadlock-due-to-non-release-of.patch new file mode 100644 index 00000000000..82f941452a4 --- /dev/null +++ b/queue-5.14/rcu-fix-stall-warning-deadlock-due-to-non-release-of.patch @@ -0,0 +1,56 @@ +From aaab7bbc2c56857169413beb3dd84a3ff889e308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 17:50:10 +0800 +Subject: rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock + +From: Yanfei Xu + +[ Upstream commit dc87740c8a6806bd2162bfb441770e4e53be5601 ] + +If rcu_print_task_stall() is invoked on an rcu_node structure that does +not contain any tasks blocking the current grace period, it takes an +early exit that fails to release that rcu_node structure's lock. This +results in a self-deadlock, which is detected by lockdep. + +To reproduce this bug: + +tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 3 --trust-make --configs "TREE03" --kconfig "CONFIG_PROVE_LOCKING=y" --bootargs "rcutorture.stall_cpu=30 rcutorture.stall_cpu_block=1 rcutorture.fwd_progress=0 rcutorture.test_boost=0" + +This will also result in other complaints, including RCU's scheduler +hook complaining about blocking rather than preemption and an rcutorture +writer stall. + +Only a partial RCU CPU stall warning message will be printed because of +the self-deadlock. + +This commit therefore releases the lock on the rcu_print_task_stall() +function's early exit path. + +Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled") +Tested-by: Qais Yousef +Signed-off-by: Yanfei Xu +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_stall.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h +index d56b4ede1db3..0e7a60706d1c 100644 +--- a/kernel/rcu/tree_stall.h ++++ b/kernel/rcu/tree_stall.h +@@ -269,8 +269,10 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags) + struct task_struct *ts[8]; + + lockdep_assert_irqs_disabled(); +- if (!rcu_preempt_blocked_readers_cgp(rnp)) ++ if (!rcu_preempt_blocked_readers_cgp(rnp)) { ++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + return 0; ++ } + pr_err("\tTasks blocked on level-%d rcu_node (CPUs %d-%d):", + rnp->level, rnp->grplo, rnp->grphi); + t = list_entry(rnp->gp_tasks->prev, +-- +2.30.2 + diff --git a/queue-5.14/rcu-fix-to-include-first-blocked-task-in-stall-warni.patch b/queue-5.14/rcu-fix-to-include-first-blocked-task-in-stall-warni.patch new file mode 100644 index 00000000000..2042c888ede --- /dev/null +++ b/queue-5.14/rcu-fix-to-include-first-blocked-task-in-stall-warni.patch @@ -0,0 +1,64 @@ +From e37c0b6edf2b0a5b7fc19debac2349fad8dd9674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 00:45:11 +0800 +Subject: rcu: Fix to include first blocked task in stall warning + +From: Yanfei Xu + +[ Upstream commit e6a901a44f76878ed1653626c9ff4cfc5a3f58f8 ] + +The for loop in rcu_print_task_stall() always omits ts[0], which points +to the first task blocking the stalled grace period. This in turn fails +to count this first task, which means that ndetected will be equal to +zero when all CPUs have passed through their quiescent states and only +one task is blocking the stalled grace period. This zero value for +ndetected will in turn result in an incorrect "All QSes seen" message: + +rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: +rcu: Tasks blocked on level-1 rcu_node (CPUs 12-23): + (detected by 15, t=6504 jiffies, g=164777, q=9011209) +rcu: All QSes seen, last rcu_preempt kthread activity 1 (4295252379-4295252378), jiffies_till_next_fqs=1, root ->qsmask 0x2 +BUG: sleeping function called from invalid context at include/linux/uaccess.h:156 +in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 70613, name: msgstress04 +INFO: lockdep is turned off. +Preemption disabled at: +[] create_object.isra.0+0x204/0x4b0 +CPU: 15 PID: 70613 Comm: msgstress04 Kdump: loaded Not tainted +5.12.2-yoctodev-standard #1 +Hardware name: Marvell OcteonTX CN96XX board (DT) +Call trace: + dump_backtrace+0x0/0x2cc + show_stack+0x24/0x30 + dump_stack+0x110/0x188 + ___might_sleep+0x214/0x2d0 + __might_sleep+0x7c/0xe0 + +This commit therefore fixes the loop to include ts[0]. + +Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled") +Tested-by: Qais Yousef +Signed-off-by: Yanfei Xu +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_stall.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h +index 3d11155e0033..d56b4ede1db3 100644 +--- a/kernel/rcu/tree_stall.h ++++ b/kernel/rcu/tree_stall.h +@@ -282,8 +282,8 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags) + break; + } + raw_spin_unlock_irqrestore_rcu_node(rnp, flags); +- for (i--; i; i--) { +- t = ts[i]; ++ while (i) { ++ t = ts[--i]; + if (!try_invoke_on_locked_down_task(t, check_slow_task, &rscr)) + pr_cont(" P%d", t->pid); + else +-- +2.30.2 + diff --git a/queue-5.14/rcu-tree-handle-vm-stoppage-in-stall-detection.patch b/queue-5.14/rcu-tree-handle-vm-stoppage-in-stall-detection.patch new file mode 100644 index 00000000000..3c67f1572ff --- /dev/null +++ b/queue-5.14/rcu-tree-handle-vm-stoppage-in-stall-detection.patch @@ -0,0 +1,98 @@ +From 9466f4fe2a3429fa51f4566769228ba4127402d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 00:56:23 +0900 +Subject: rcu/tree: Handle VM stoppage in stall detection + +From: Sergey Senozhatsky + +[ Upstream commit ccfc9dd6914feaa9a81f10f9cce56eb0f7712264 ] + +The soft watchdog timer function checks if a virtual machine +was suspended and hence what looks like a lockup in fact +is a false positive. + +This is what kvm_check_and_clear_guest_paused() does: it +tests guest PVCLOCK_GUEST_STOPPED (which is set by the host) +and if it's set then we need to touch all watchdogs and bail +out. + +Watchdog timer function runs from IRQ, so PVCLOCK_GUEST_STOPPED +check works fine. + +There is, however, one more watchdog that runs from IRQ, so +watchdog timer fn races with it, and that watchdog is not aware +of PVCLOCK_GUEST_STOPPED - RCU stall detector. + +apic_timer_interrupt() + smp_apic_timer_interrupt() + hrtimer_interrupt() + __hrtimer_run_queues() + tick_sched_timer() + tick_sched_handle() + update_process_times() + rcu_sched_clock_irq() + +This triggers RCU stalls on our devices during VM resume. + +If tick_sched_handle()->rcu_sched_clock_irq() runs on a VCPU +before watchdog_timer_fn()->kvm_check_and_clear_guest_paused() +then there is nothing on this VCPU that touches watchdogs and +RCU reads stale gp stall timestamp and new jiffies value, which +makes it think that RCU has stalled. + +Make RCU stall watchdog aware of PVCLOCK_GUEST_STOPPED and +don't report RCU stalls when we resume the VM. + +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_stall.h | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h +index 6c76988cc019..3d11155e0033 100644 +--- a/kernel/rcu/tree_stall.h ++++ b/kernel/rcu/tree_stall.h +@@ -7,6 +7,8 @@ + * Author: Paul E. McKenney + */ + ++#include ++ + ////////////////////////////////////////////////////////////////////////////// + // + // Controlling CPU stall warnings, including delay calculation. +@@ -696,6 +698,14 @@ static void check_cpu_stall(struct rcu_data *rdp) + (READ_ONCE(rnp->qsmask) & rdp->grpmask) && + cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { + ++ /* ++ * If a virtual machine is stopped by the host it can look to ++ * the watchdog like an RCU stall. Check to see if the host ++ * stopped the vm. ++ */ ++ if (kvm_check_and_clear_guest_paused()) ++ return; ++ + /* We haven't checked in, so go dump stack. */ + print_cpu_stall(gps); + if (READ_ONCE(rcu_cpu_stall_ftrace_dump)) +@@ -705,6 +715,14 @@ static void check_cpu_stall(struct rcu_data *rdp) + ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) && + cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { + ++ /* ++ * If a virtual machine is stopped by the host it can look to ++ * the watchdog like an RCU stall. Check to see if the host ++ * stopped the vm. ++ */ ++ if (kvm_check_and_clear_guest_paused()) ++ return; ++ + /* They had a few time units to dump stack, so complain. */ + print_other_cpu_stall(gs2, gps); + if (READ_ONCE(rcu_cpu_stall_ftrace_dump)) +-- +2.30.2 + diff --git a/queue-5.14/regmap-fix-the-offset-of-register-error-log.patch b/queue-5.14/regmap-fix-the-offset-of-register-error-log.patch new file mode 100644 index 00000000000..adc03bc1606 --- /dev/null +++ b/queue-5.14/regmap-fix-the-offset-of-register-error-log.patch @@ -0,0 +1,36 @@ +From e455346fc90f3081dde74ae418bdce99301a41c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 23:26:30 +0900 +Subject: regmap: fix the offset of register error log + +From: Jeongtae Park + +[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ] + +This patch fixes the offset of register error log +by using regmap_get_offset(). + +Signed-off-by: Jeongtae Park +Link: https://lore.kernel.org/r/20210701142630.44936-1-jeongtae.park@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index fe3e38dd5324..2fc826e97591 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1667,7 +1667,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg, + if (ret) { + dev_err(map->dev, + "Error in caching of register: %x ret: %d\n", +- reg + i, ret); ++ reg + regmap_get_offset(map, i), ret); + return ret; + } + } +-- +2.30.2 + diff --git a/queue-5.14/regulator-tps65910-silence-deferred-probe-error.patch b/queue-5.14/regulator-tps65910-silence-deferred-probe-error.patch new file mode 100644 index 00000000000..6bb7fb481be --- /dev/null +++ b/queue-5.14/regulator-tps65910-silence-deferred-probe-error.patch @@ -0,0 +1,46 @@ +From 6cbdef6e25fdc4b45105daa820160cdc9e4c1948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 23:12:11 +0300 +Subject: regulator: tps65910: Silence deferred probe error + +From: Dmitry Osipenko + +[ Upstream commit e301df76472cc929fa62d923bc3892931f7ad71d ] + +The TPS65910 regulator now gets a deferred probe until supply regulator is +registered. Silence noisy error message about the deferred probe. + +Reported-by: Matt Merhar # Ouya T30 +Tested-by: Matt Merhar # Ouya T30 +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20210705201211.16082-1-digetx@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/tps65910-regulator.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c +index 1d5b0a1b86f7..06cbe60c990f 100644 +--- a/drivers/regulator/tps65910-regulator.c ++++ b/drivers/regulator/tps65910-regulator.c +@@ -1211,12 +1211,10 @@ static int tps65910_probe(struct platform_device *pdev) + + rdev = devm_regulator_register(&pdev->dev, &pmic->desc[i], + &config); +- if (IS_ERR(rdev)) { +- dev_err(tps65910->dev, +- "failed to register %s regulator\n", +- pdev->name); +- return PTR_ERR(rdev); +- } ++ if (IS_ERR(rdev)) ++ return dev_err_probe(tps65910->dev, PTR_ERR(rdev), ++ "failed to register %s regulator\n", ++ pdev->name); + + /* Save regulator for cleanup */ + pmic->rdev[i] = rdev; +-- +2.30.2 + diff --git a/queue-5.14/regulator-vctrl-avoid-lockdep-warning-in-enable-disa.patch b/queue-5.14/regulator-vctrl-avoid-lockdep-warning-in-enable-disa.patch new file mode 100644 index 00000000000..97270909366 --- /dev/null +++ b/queue-5.14/regulator-vctrl-avoid-lockdep-warning-in-enable-disa.patch @@ -0,0 +1,416 @@ +From e64b557c1d9641f3cc62e6d943f1fcb144db5944 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 11:37:04 +0800 +Subject: regulator: vctrl: Avoid lockdep warning in enable/disable ops + +From: Chen-Yu Tsai + +[ Upstream commit 21e39809fd7c4b8ff3662f23e0168e87594c8ca8 ] + +vctrl_enable() and vctrl_disable() call regulator_enable() and +regulator_disable(), respectively. However, vctrl_* are regulator ops +and should not be calling the locked regulator APIs. Doing so results in +a lockdep warning. + +Instead of exporting more internal regulator ops, model the ctrl supply +as an actual supply to vctrl-regulator. At probe time this driver still +needs to use the consumer API to fetch its constraints, but otherwise +lets the regulator core handle the upstream supply for it. + +The enable/disable/is_enabled ops are not removed, but now only track +state internally. This preserves the original behavior with the ops +being available, but one could argue that the original behavior was +already incorrect: the internal state would not match the upstream +supply if that supply had another consumer that enabled the supply, +while vctrl-regulator was not enabled. + +The lockdep warning is as follows: + + WARNING: possible circular locking dependency detected + 5.14.0-rc6 #2 Not tainted + ------------------------------------------------------ + swapper/0/1 is trying to acquire lock: + ffffffc011306d00 (regulator_list_mutex){+.+.}-{3:3}, at: + regulator_lock_dependent (arch/arm64/include/asm/current.h:19 + include/linux/ww_mutex.h:111 + drivers/regulator/core.c:329) + + but task is already holding lock: + ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at: + regulator_lock_recursive (drivers/regulator/core.c:156 + drivers/regulator/core.c:263) + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 (regulator_ww_class_mutex){+.+.}-{3:3}: + __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 + include/asm-generic/atomic-long.h:29 + kernel/locking/mutex.c:103 + kernel/locking/mutex.c:144 + kernel/locking/mutex.c:963) + ww_mutex_lock (kernel/locking/mutex.c:1199) + regulator_lock_recursive (drivers/regulator/core.c:156 + drivers/regulator/core.c:263) + regulator_lock_dependent (drivers/regulator/core.c:343) + regulator_enable (drivers/regulator/core.c:2808) + set_machine_constraints (drivers/regulator/core.c:1536) + regulator_register (drivers/regulator/core.c:5486) + devm_regulator_register (drivers/regulator/devres.c:196) + reg_fixed_voltage_probe (drivers/regulator/fixed.c:289) + platform_probe (drivers/base/platform.c:1427) + [...] + + -> #1 (regulator_ww_class_acquire){+.+.}-{0:0}: + regulator_lock_dependent (include/linux/ww_mutex.h:129 + drivers/regulator/core.c:329) + regulator_enable (drivers/regulator/core.c:2808) + set_machine_constraints (drivers/regulator/core.c:1536) + regulator_register (drivers/regulator/core.c:5486) + devm_regulator_register (drivers/regulator/devres.c:196) + reg_fixed_voltage_probe (drivers/regulator/fixed.c:289) + [...] + + -> #0 (regulator_list_mutex){+.+.}-{3:3}: + __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4) + kernel/locking/lockdep.c:3174 (discriminator 4) + kernel/locking/lockdep.c:3789 (discriminator 4) + kernel/locking/lockdep.c:5015 (discriminator 4)) + lock_acquire (arch/arm64/include/asm/percpu.h:39 + kernel/locking/lockdep.c:438 + kernel/locking/lockdep.c:5627) + __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 + include/asm-generic/atomic-long.h:29 + kernel/locking/mutex.c:103 + kernel/locking/mutex.c:144 + kernel/locking/mutex.c:963) + mutex_lock_nested (kernel/locking/mutex.c:1125) + regulator_lock_dependent (arch/arm64/include/asm/current.h:19 + include/linux/ww_mutex.h:111 + drivers/regulator/core.c:329) + regulator_enable (drivers/regulator/core.c:2808) + vctrl_enable (drivers/regulator/vctrl-regulator.c:400) + _regulator_do_enable (drivers/regulator/core.c:2617) + _regulator_enable (drivers/regulator/core.c:2764) + regulator_enable (drivers/regulator/core.c:308 + drivers/regulator/core.c:2809) + _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072) + dev_pm_opp_set_rate (drivers/opp/core.c:1164) + set_target (drivers/cpufreq/cpufreq-dt.c:62) + __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216 + drivers/cpufreq/cpufreq.c:2271) + cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2)) + cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563) + subsys_interface_register (drivers/base/bus.c:?) + cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819) + dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344) + [...] + + other info that might help us debug this: + + Chain exists of: + regulator_list_mutex --> regulator_ww_class_acquire --> regulator_ww_class_mutex + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(regulator_ww_class_mutex); + lock(regulator_ww_class_acquire); + lock(regulator_ww_class_mutex); + lock(regulator_list_mutex); + + *** DEADLOCK *** + + 6 locks held by swapper/0/1: + #0: ffffff8002d32188 (&dev->mutex){....}-{3:3}, at: + __device_driver_lock (drivers/base/dd.c:1030) + #1: ffffffc0111a0520 (cpu_hotplug_lock){++++}-{0:0}, at: + cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2792 (discriminator 2)) + #2: ffffff8002a8d918 (subsys mutex#9){+.+.}-{3:3}, at: + subsys_interface_register (drivers/base/bus.c:1033) + #3: ffffff800341bb90 (&policy->rwsem){+.+.}-{3:3}, at: + cpufreq_online (include/linux/bitmap.h:285 + include/linux/cpumask.h:405 + drivers/cpufreq/cpufreq.c:1399) + #4: ffffffc011f0b7b8 (regulator_ww_class_acquire){+.+.}-{0:0}, at: + regulator_enable (drivers/regulator/core.c:2808) + #5: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at: + regulator_lock_recursive (drivers/regulator/core.c:156 + drivers/regulator/core.c:263) + + stack backtrace: + CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6 #2 7c8f8996d021ed0f65271e6aeebf7999de74a9fa + Hardware name: Google Scarlet (DT) + Call trace: + dump_backtrace (arch/arm64/kernel/stacktrace.c:161) + show_stack (arch/arm64/kernel/stacktrace.c:218) + dump_stack_lvl (lib/dump_stack.c:106 (discriminator 2)) + dump_stack (lib/dump_stack.c:113) + print_circular_bug (kernel/locking/lockdep.c:?) + check_noncircular (kernel/locking/lockdep.c:?) + __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4) + kernel/locking/lockdep.c:3174 (discriminator 4) + kernel/locking/lockdep.c:3789 (discriminator 4) + kernel/locking/lockdep.c:5015 (discriminator 4)) + lock_acquire (arch/arm64/include/asm/percpu.h:39 + kernel/locking/lockdep.c:438 + kernel/locking/lockdep.c:5627) + __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 + include/asm-generic/atomic-long.h:29 + kernel/locking/mutex.c:103 + kernel/locking/mutex.c:144 + kernel/locking/mutex.c:963) + mutex_lock_nested (kernel/locking/mutex.c:1125) + regulator_lock_dependent (arch/arm64/include/asm/current.h:19 + include/linux/ww_mutex.h:111 + drivers/regulator/core.c:329) + regulator_enable (drivers/regulator/core.c:2808) + vctrl_enable (drivers/regulator/vctrl-regulator.c:400) + _regulator_do_enable (drivers/regulator/core.c:2617) + _regulator_enable (drivers/regulator/core.c:2764) + regulator_enable (drivers/regulator/core.c:308 + drivers/regulator/core.c:2809) + _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072) + dev_pm_opp_set_rate (drivers/opp/core.c:1164) + set_target (drivers/cpufreq/cpufreq-dt.c:62) + __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216 + drivers/cpufreq/cpufreq.c:2271) + cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2)) + cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563) + subsys_interface_register (drivers/base/bus.c:?) + cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819) + dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344) + [...] + +Reported-by: Brian Norris +Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") +Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20210825033704.3307263-3-wenst@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/vctrl-regulator.c | 72 +++++++++++++++++------------ + 1 file changed, 42 insertions(+), 30 deletions(-) + +diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c +index 93d33201ffe0..d2a37978fc3a 100644 +--- a/drivers/regulator/vctrl-regulator.c ++++ b/drivers/regulator/vctrl-regulator.c +@@ -37,7 +37,6 @@ struct vctrl_voltage_table { + struct vctrl_data { + struct regulator_dev *rdev; + struct regulator_desc desc; +- struct regulator *ctrl_reg; + bool enabled; + unsigned int min_slew_down_rate; + unsigned int ovp_threshold; +@@ -82,7 +81,12 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV) + static int vctrl_get_voltage(struct regulator_dev *rdev) + { + struct vctrl_data *vctrl = rdev_get_drvdata(rdev); +- int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev); ++ int ctrl_uV; ++ ++ if (!rdev->supply) ++ return -EPROBE_DEFER; ++ ++ ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev); + + return vctrl_calc_output_voltage(vctrl, ctrl_uV); + } +@@ -92,14 +96,19 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, + unsigned int *selector) + { + struct vctrl_data *vctrl = rdev_get_drvdata(rdev); +- struct regulator *ctrl_reg = vctrl->ctrl_reg; +- int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev); +- int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV); ++ int orig_ctrl_uV; ++ int uV; + int ret; + ++ if (!rdev->supply) ++ return -EPROBE_DEFER; ++ ++ orig_ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev); ++ uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV); ++ + if (req_min_uV >= uV || !vctrl->ovp_threshold) + /* voltage rising or no OVP */ +- return regulator_set_voltage_rdev(ctrl_reg->rdev, ++ return regulator_set_voltage_rdev(rdev->supply->rdev, + vctrl_calc_ctrl_voltage(vctrl, req_min_uV), + vctrl_calc_ctrl_voltage(vctrl, req_max_uV), + PM_SUSPEND_ON); +@@ -117,7 +126,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, + next_uV = max_t(int, req_min_uV, uV - max_drop_uV); + next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV); + +- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, ++ ret = regulator_set_voltage_rdev(rdev->supply->rdev, + next_ctrl_uV, + next_ctrl_uV, + PM_SUSPEND_ON); +@@ -134,7 +143,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, + + err: + /* Try to go back to original voltage */ +- regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV, ++ regulator_set_voltage_rdev(rdev->supply->rdev, orig_ctrl_uV, orig_ctrl_uV, + PM_SUSPEND_ON); + + return ret; +@@ -151,16 +160,18 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, + unsigned int selector) + { + struct vctrl_data *vctrl = rdev_get_drvdata(rdev); +- struct regulator *ctrl_reg = vctrl->ctrl_reg; + unsigned int orig_sel = vctrl->sel; + int ret; + ++ if (!rdev->supply) ++ return -EPROBE_DEFER; ++ + if (selector >= rdev->desc->n_voltages) + return -EINVAL; + + if (selector >= vctrl->sel || !vctrl->ovp_threshold) { + /* voltage rising or no OVP */ +- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, ++ ret = regulator_set_voltage_rdev(rdev->supply->rdev, + vctrl->vtable[selector].ctrl, + vctrl->vtable[selector].ctrl, + PM_SUSPEND_ON); +@@ -179,7 +190,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, + else + next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel; + +- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, ++ ret = regulator_set_voltage_rdev(rdev->supply->rdev, + vctrl->vtable[next_sel].ctrl, + vctrl->vtable[next_sel].ctrl, + PM_SUSPEND_ON); +@@ -202,7 +213,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, + err: + if (vctrl->sel != orig_sel) { + /* Try to go back to original voltage */ +- if (!regulator_set_voltage_rdev(ctrl_reg->rdev, ++ if (!regulator_set_voltage_rdev(rdev->supply->rdev, + vctrl->vtable[orig_sel].ctrl, + vctrl->vtable[orig_sel].ctrl, + PM_SUSPEND_ON)) +@@ -234,10 +245,6 @@ static int vctrl_parse_dt(struct platform_device *pdev, + u32 pval; + u32 vrange_ctrl[2]; + +- vctrl->ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl"); +- if (IS_ERR(vctrl->ctrl_reg)) +- return PTR_ERR(vctrl->ctrl_reg); +- + ret = of_property_read_u32(np, "ovp-threshold-percent", &pval); + if (!ret) { + vctrl->ovp_threshold = pval; +@@ -315,11 +322,11 @@ static int vctrl_cmp_ctrl_uV(const void *a, const void *b) + return at->ctrl - bt->ctrl; + } + +-static int vctrl_init_vtable(struct platform_device *pdev) ++static int vctrl_init_vtable(struct platform_device *pdev, ++ struct regulator *ctrl_reg) + { + struct vctrl_data *vctrl = platform_get_drvdata(pdev); + struct regulator_desc *rdesc = &vctrl->desc; +- struct regulator *ctrl_reg = vctrl->ctrl_reg; + struct vctrl_voltage_range *vrange_ctrl = &vctrl->vrange.ctrl; + int n_voltages; + int ctrl_uV; +@@ -395,23 +402,19 @@ static int vctrl_init_vtable(struct platform_device *pdev) + static int vctrl_enable(struct regulator_dev *rdev) + { + struct vctrl_data *vctrl = rdev_get_drvdata(rdev); +- int ret = regulator_enable(vctrl->ctrl_reg); + +- if (!ret) +- vctrl->enabled = true; ++ vctrl->enabled = true; + +- return ret; ++ return 0; + } + + static int vctrl_disable(struct regulator_dev *rdev) + { + struct vctrl_data *vctrl = rdev_get_drvdata(rdev); +- int ret = regulator_disable(vctrl->ctrl_reg); + +- if (!ret) +- vctrl->enabled = false; ++ vctrl->enabled = false; + +- return ret; ++ return 0; + } + + static int vctrl_is_enabled(struct regulator_dev *rdev) +@@ -447,6 +450,7 @@ static int vctrl_probe(struct platform_device *pdev) + struct regulator_desc *rdesc; + struct regulator_config cfg = { }; + struct vctrl_voltage_range *vrange_ctrl; ++ struct regulator *ctrl_reg; + int ctrl_uV; + int ret; + +@@ -461,15 +465,20 @@ static int vctrl_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl"); ++ if (IS_ERR(ctrl_reg)) ++ return PTR_ERR(ctrl_reg); ++ + vrange_ctrl = &vctrl->vrange.ctrl; + + rdesc = &vctrl->desc; + rdesc->name = "vctrl"; + rdesc->type = REGULATOR_VOLTAGE; + rdesc->owner = THIS_MODULE; ++ rdesc->supply_name = "ctrl"; + +- if ((regulator_get_linear_step(vctrl->ctrl_reg) == 1) || +- (regulator_count_voltages(vctrl->ctrl_reg) == -EINVAL)) { ++ if ((regulator_get_linear_step(ctrl_reg) == 1) || ++ (regulator_count_voltages(ctrl_reg) == -EINVAL)) { + rdesc->continuous_voltage_range = true; + rdesc->ops = &vctrl_ops_cont; + } else { +@@ -486,12 +495,12 @@ static int vctrl_probe(struct platform_device *pdev) + cfg.init_data = init_data; + + if (!rdesc->continuous_voltage_range) { +- ret = vctrl_init_vtable(pdev); ++ ret = vctrl_init_vtable(pdev, ctrl_reg); + if (ret) + return ret; + + /* Use locked consumer API when not in regulator framework */ +- ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg); ++ ctrl_uV = regulator_get_voltage(ctrl_reg); + if (ctrl_uV < 0) { + dev_err(&pdev->dev, "failed to get control voltage\n"); + return ctrl_uV; +@@ -514,6 +523,9 @@ static int vctrl_probe(struct platform_device *pdev) + } + } + ++ /* Drop ctrl-supply here in favor of regulator core managed supply */ ++ devm_regulator_put(ctrl_reg); ++ + vctrl->rdev = devm_regulator_register(&pdev->dev, rdesc, &cfg); + if (IS_ERR(vctrl->rdev)) { + ret = PTR_ERR(vctrl->rdev); +-- +2.30.2 + diff --git a/queue-5.14/regulator-vctrl-use-locked-regulator_get_voltage-in-.patch b/queue-5.14/regulator-vctrl-use-locked-regulator_get_voltage-in-.patch new file mode 100644 index 00000000000..0f2fed3f1f3 --- /dev/null +++ b/queue-5.14/regulator-vctrl-use-locked-regulator_get_voltage-in-.patch @@ -0,0 +1,44 @@ +From db6b4bf5fe1f409872d8746f78e0f5cc8329c52e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 11:37:03 +0800 +Subject: regulator: vctrl: Use locked regulator_get_voltage in probe path + +From: Chen-Yu Tsai + +[ Upstream commit 98e47570ba985f2310586c80409238200fa3170f ] + +In commit e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting +and setting the voltage"), all calls to get/set the voltage of the +control regulator were switched to unlocked versions to avoid deadlocks. +However, the call in the probe path is done without regulator locks +held. In this case the locked version should be used. + +Switch back to the locked regulator_get_voltage() in the probe path to +avoid any mishaps. + +Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20210825033704.3307263-2-wenst@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/vctrl-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c +index cbadb1c99679..93d33201ffe0 100644 +--- a/drivers/regulator/vctrl-regulator.c ++++ b/drivers/regulator/vctrl-regulator.c +@@ -490,7 +490,8 @@ static int vctrl_probe(struct platform_device *pdev) + if (ret) + return ret; + +- ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev); ++ /* Use locked consumer API when not in regulator framework */ ++ ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg); + if (ctrl_uV < 0) { + dev_err(&pdev->dev, "failed to get control voltage\n"); + return ctrl_uV; +-- +2.30.2 + diff --git a/queue-5.14/rsi-fix-an-error-code-in-rsi_probe.patch b/queue-5.14/rsi-fix-an-error-code-in-rsi_probe.patch new file mode 100644 index 00000000000..6a3eb9a8987 --- /dev/null +++ b/queue-5.14/rsi-fix-an-error-code-in-rsi_probe.patch @@ -0,0 +1,35 @@ +From 0f6f365c2feaaa8d701c4d23d069be3de7501528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 21:39:47 +0300 +Subject: rsi: fix an error code in rsi_probe() + +From: Dan Carpenter + +[ Upstream commit 9adcdf6758d7c4c9bdaf22d78eb9fcae260ed113 ] + +Return -ENODEV instead of success for unsupported devices. + +Fixes: 54fdb318c111 ("rsi: add new device model for 9116") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210816183947.GA2119@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c +index 3fbe2a3c1455..416976f09888 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -816,6 +816,7 @@ static int rsi_probe(struct usb_interface *pfunction, + } else { + rsi_dbg(ERR_ZONE, "%s: Unsupported RSI device id 0x%x\n", + __func__, id->idProduct); ++ status = -ENODEV; + goto err1; + } + +-- +2.30.2 + diff --git a/queue-5.14/rsi-fix-error-code-in-rsi_load_9116_firmware.patch b/queue-5.14/rsi-fix-error-code-in-rsi_load_9116_firmware.patch new file mode 100644 index 00000000000..f440831da55 --- /dev/null +++ b/queue-5.14/rsi-fix-error-code-in-rsi_load_9116_firmware.patch @@ -0,0 +1,40 @@ +From d8e2f7c04c5e7573d8784df25e58f78ab104b113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 13:37:46 +0300 +Subject: rsi: fix error code in rsi_load_9116_firmware() + +From: Dan Carpenter + +[ Upstream commit d0f8430332a16c7baa80ce2886339182c5d85f37 ] + +This code returns success if the kmemdup() fails, but obviously it +should return -ENOMEM instead. + +Fixes: e5a1ecc97e5f ("rsi: add firmware loading for 9116 device") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210805103746.GA26417@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c +index 99b21a2c8386..f4a26f16f00f 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter) + } + + ta_firmware = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); +- if (!ta_firmware) ++ if (!ta_firmware) { ++ status = -ENOMEM; + goto fail_release_fw; ++ } + fw_p = ta_firmware; + instructions_sz = fw_entry->size; + rsi_dbg(INFO_ZONE, "FW Length = %d bytes\n", instructions_sz); +-- +2.30.2 + diff --git a/queue-5.14/s390-ap-fix-state-machine-hang-after-failure-to-enab.patch b/queue-5.14/s390-ap-fix-state-machine-hang-after-failure-to-enab.patch new file mode 100644 index 00000000000..74667c0d532 --- /dev/null +++ b/queue-5.14/s390-ap-fix-state-machine-hang-after-failure-to-enab.patch @@ -0,0 +1,249 @@ +From 80cccded85dea603b2fdacfc30ae3e63938ca6d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 10:55:02 +0200 +Subject: s390/ap: fix state machine hang after failure to enable irq + +From: Harald Freudenberger + +[ Upstream commit cabebb697c98fb1f05cc950a747a9b6ec61a5b01 ] + +If for any reason the interrupt enable for an ap queue fails the +state machine run for the queue returned wrong return codes to the +caller. So the caller assumed interrupt support for this queue in +enabled and thus did not re-establish the high resolution timer used +for polling. In the end this let to a hang for the user space process +waiting "forever" for the reply. + +This patch reworks these return codes to return correct indications +for the caller to re-establish the timer when a queue runs without +interrupt support. + +Please note that this is fixing a wrong behavior after a first +failure (enable interrupt support for the queue) failed. However, +looks like this occasionally happens on KVM systems. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/ap_bus.c | 25 ++++++++----------------- + drivers/s390/crypto/ap_bus.h | 10 ++-------- + drivers/s390/crypto/ap_queue.c | 20 +++++++++++--------- + 3 files changed, 21 insertions(+), 34 deletions(-) + +diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c +index 8d3a1d84a757..9c4f3c388934 100644 +--- a/drivers/s390/crypto/ap_bus.c ++++ b/drivers/s390/crypto/ap_bus.c +@@ -127,22 +127,13 @@ static struct bus_type ap_bus_type; + /* Adapter interrupt definitions */ + static void ap_interrupt_handler(struct airq_struct *airq, bool floating); + +-static int ap_airq_flag; ++static bool ap_irq_flag; + + static struct airq_struct ap_airq = { + .handler = ap_interrupt_handler, + .isc = AP_ISC, + }; + +-/** +- * ap_using_interrupts() - Returns non-zero if interrupt support is +- * available. +- */ +-static inline int ap_using_interrupts(void) +-{ +- return ap_airq_flag; +-} +- + /** + * ap_airq_ptr() - Get the address of the adapter interrupt indicator + * +@@ -152,7 +143,7 @@ static inline int ap_using_interrupts(void) + */ + void *ap_airq_ptr(void) + { +- if (ap_using_interrupts()) ++ if (ap_irq_flag) + return ap_airq.lsi_ptr; + return NULL; + } +@@ -396,7 +387,7 @@ void ap_wait(enum ap_sm_wait wait) + switch (wait) { + case AP_SM_WAIT_AGAIN: + case AP_SM_WAIT_INTERRUPT: +- if (ap_using_interrupts()) ++ if (ap_irq_flag) + break; + if (ap_poll_kthread) { + wake_up(&ap_poll_wait); +@@ -471,7 +462,7 @@ static void ap_tasklet_fn(unsigned long dummy) + * be received. Doing it in the beginning of the tasklet is therefor + * important that no requests on any AP get lost. + */ +- if (ap_using_interrupts()) ++ if (ap_irq_flag) + xchg(ap_airq.lsi_ptr, 0); + + spin_lock_bh(&ap_queues_lock); +@@ -541,7 +532,7 @@ static int ap_poll_thread_start(void) + { + int rc; + +- if (ap_using_interrupts() || ap_poll_kthread) ++ if (ap_irq_flag || ap_poll_kthread) + return 0; + mutex_lock(&ap_poll_thread_mutex); + ap_poll_kthread = kthread_run(ap_poll_thread, NULL, "appoll"); +@@ -1187,7 +1178,7 @@ static BUS_ATTR_RO(ap_adapter_mask); + static ssize_t ap_interrupts_show(struct bus_type *bus, char *buf) + { + return scnprintf(buf, PAGE_SIZE, "%d\n", +- ap_using_interrupts() ? 1 : 0); ++ ap_irq_flag ? 1 : 0); + } + + static BUS_ATTR_RO(ap_interrupts); +@@ -1912,7 +1903,7 @@ static int __init ap_module_init(void) + /* enable interrupts if available */ + if (ap_interrupts_available()) { + rc = register_adapter_interrupt(&ap_airq); +- ap_airq_flag = (rc == 0); ++ ap_irq_flag = (rc == 0); + } + + /* Create /sys/bus/ap. */ +@@ -1956,7 +1947,7 @@ out_work: + out_bus: + bus_unregister(&ap_bus_type); + out: +- if (ap_using_interrupts()) ++ if (ap_irq_flag) + unregister_adapter_interrupt(&ap_airq); + kfree(ap_qci_info); + return rc; +diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h +index 8f18abdbbc2b..6dd5e8f0380c 100644 +--- a/drivers/s390/crypto/ap_bus.h ++++ b/drivers/s390/crypto/ap_bus.h +@@ -80,12 +80,6 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr) + #define AP_FUNC_EP11 5 + #define AP_FUNC_APXA 6 + +-/* +- * AP interrupt states +- */ +-#define AP_INTR_DISABLED 0 /* AP interrupt disabled */ +-#define AP_INTR_ENABLED 1 /* AP interrupt enabled */ +- + /* + * AP queue state machine states + */ +@@ -112,7 +106,7 @@ enum ap_sm_event { + * AP queue state wait behaviour + */ + enum ap_sm_wait { +- AP_SM_WAIT_AGAIN, /* retry immediately */ ++ AP_SM_WAIT_AGAIN = 0, /* retry immediately */ + AP_SM_WAIT_TIMEOUT, /* wait for timeout */ + AP_SM_WAIT_INTERRUPT, /* wait for thin interrupt (if available) */ + AP_SM_WAIT_NONE, /* no wait */ +@@ -186,7 +180,7 @@ struct ap_queue { + enum ap_dev_state dev_state; /* queue device state */ + bool config; /* configured state */ + ap_qid_t qid; /* AP queue id. */ +- int interrupt; /* indicate if interrupts are enabled */ ++ bool interrupt; /* indicate if interrupts are enabled */ + int queue_count; /* # messages currently on AP queue. */ + int pendingq_count; /* # requests on pendingq list. */ + int requestq_count; /* # requests on requestq list. */ +diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c +index 669f96fddad6..d70c4d3d0907 100644 +--- a/drivers/s390/crypto/ap_queue.c ++++ b/drivers/s390/crypto/ap_queue.c +@@ -19,7 +19,7 @@ + static void __ap_flush_queue(struct ap_queue *aq); + + /** +- * ap_queue_enable_interruption(): Enable interruption on an AP queue. ++ * ap_queue_enable_irq(): Enable interrupt support on this AP queue. + * @qid: The AP queue number + * @ind: the notification indicator byte + * +@@ -27,7 +27,7 @@ static void __ap_flush_queue(struct ap_queue *aq); + * value it waits a while and tests the AP queue if interrupts + * have been switched on using ap_test_queue(). + */ +-static int ap_queue_enable_interruption(struct ap_queue *aq, void *ind) ++static int ap_queue_enable_irq(struct ap_queue *aq, void *ind) + { + struct ap_queue_status status; + struct ap_qirq_ctrl qirqctrl = { 0 }; +@@ -218,7 +218,8 @@ static enum ap_sm_wait ap_sm_read(struct ap_queue *aq) + return AP_SM_WAIT_NONE; + case AP_RESPONSE_NO_PENDING_REPLY: + if (aq->queue_count > 0) +- return AP_SM_WAIT_INTERRUPT; ++ return aq->interrupt ? ++ AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT; + aq->sm_state = AP_SM_STATE_IDLE; + return AP_SM_WAIT_NONE; + default: +@@ -272,7 +273,8 @@ static enum ap_sm_wait ap_sm_write(struct ap_queue *aq) + fallthrough; + case AP_RESPONSE_Q_FULL: + aq->sm_state = AP_SM_STATE_QUEUE_FULL; +- return AP_SM_WAIT_INTERRUPT; ++ return aq->interrupt ? ++ AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT; + case AP_RESPONSE_RESET_IN_PROGRESS: + aq->sm_state = AP_SM_STATE_RESET_WAIT; + return AP_SM_WAIT_TIMEOUT; +@@ -322,7 +324,7 @@ static enum ap_sm_wait ap_sm_reset(struct ap_queue *aq) + case AP_RESPONSE_NORMAL: + case AP_RESPONSE_RESET_IN_PROGRESS: + aq->sm_state = AP_SM_STATE_RESET_WAIT; +- aq->interrupt = AP_INTR_DISABLED; ++ aq->interrupt = false; + return AP_SM_WAIT_TIMEOUT; + default: + aq->dev_state = AP_DEV_STATE_ERROR; +@@ -355,7 +357,7 @@ static enum ap_sm_wait ap_sm_reset_wait(struct ap_queue *aq) + switch (status.response_code) { + case AP_RESPONSE_NORMAL: + lsi_ptr = ap_airq_ptr(); +- if (lsi_ptr && ap_queue_enable_interruption(aq, lsi_ptr) == 0) ++ if (lsi_ptr && ap_queue_enable_irq(aq, lsi_ptr) == 0) + aq->sm_state = AP_SM_STATE_SETIRQ_WAIT; + else + aq->sm_state = (aq->queue_count > 0) ? +@@ -396,7 +398,7 @@ static enum ap_sm_wait ap_sm_setirq_wait(struct ap_queue *aq) + + if (status.irq_enabled == 1) { + /* Irqs are now enabled */ +- aq->interrupt = AP_INTR_ENABLED; ++ aq->interrupt = true; + aq->sm_state = (aq->queue_count > 0) ? + AP_SM_STATE_WORKING : AP_SM_STATE_IDLE; + } +@@ -586,7 +588,7 @@ static ssize_t interrupt_show(struct device *dev, + spin_lock_bh(&aq->lock); + if (aq->sm_state == AP_SM_STATE_SETIRQ_WAIT) + rc = scnprintf(buf, PAGE_SIZE, "Enable Interrupt pending.\n"); +- else if (aq->interrupt == AP_INTR_ENABLED) ++ else if (aq->interrupt) + rc = scnprintf(buf, PAGE_SIZE, "Interrupts enabled.\n"); + else + rc = scnprintf(buf, PAGE_SIZE, "Interrupts disabled.\n"); +@@ -767,7 +769,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type) + aq->ap_dev.device.type = &ap_queue_type; + aq->ap_dev.device_type = device_type; + aq->qid = qid; +- aq->interrupt = AP_INTR_DISABLED; ++ aq->interrupt = false; + spin_lock_init(&aq->lock); + INIT_LIST_HEAD(&aq->pendingq); + INIT_LIST_HEAD(&aq->requestq); +-- +2.30.2 + diff --git a/queue-5.14/s390-cio-add-dev_busid-sysfs-entry-for-each-subchann.patch b/queue-5.14/s390-cio-add-dev_busid-sysfs-entry-for-each-subchann.patch new file mode 100644 index 00000000000..7b596ebb2db --- /dev/null +++ b/queue-5.14/s390-cio-add-dev_busid-sysfs-entry-for-each-subchann.patch @@ -0,0 +1,65 @@ +From 63cb87c967ace49905d4ba32eb5aa404315a6494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Apr 2021 10:52:38 +0200 +Subject: s390/cio: add dev_busid sysfs entry for each subchannel + +From: Vineeth Vijayan + +[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ] + +Introduce dev_busid, which exports the device-id associated with the +io-subchannel (and message-subchannel). The dev_busid indicates that of +the device which may be physically installed on the corrosponding +subchannel. The dev_busid value "none" indicates that the subchannel +is not valid, there is no I/O device currently associated with the +subchannel. + +The dev_busid information would be helpful to write device-specific +udev-rules associated with the subchannel. The dev_busid interface would +be available even when the sch is not bound to any driver or if there is +no operational device connected on it. Hence this attribute can be used to +write udev-rules which are specific to the device associated with the +subchannel. + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index a974943c27da..9fcdb8d81eee 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -430,9 +430,26 @@ static ssize_t pimpampom_show(struct device *dev, + } + static DEVICE_ATTR_RO(pimpampom); + ++static ssize_t dev_busid_show(struct device *dev, ++ struct device_attribute *attr, ++ char *buf) ++{ ++ struct subchannel *sch = to_subchannel(dev); ++ struct pmcw *pmcw = &sch->schib.pmcw; ++ ++ if ((pmcw->st == SUBCHANNEL_TYPE_IO || ++ pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv) ++ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid, ++ pmcw->dev); ++ else ++ return sysfs_emit(buf, "none\n"); ++} ++static DEVICE_ATTR_RO(dev_busid); ++ + static struct attribute *io_subchannel_type_attrs[] = { + &dev_attr_chpids.attr, + &dev_attr_pimpampom.attr, ++ &dev_attr_dev_busid.attr, + NULL, + }; + ATTRIBUTE_GROUPS(io_subchannel_type); +-- +2.30.2 + diff --git a/queue-5.14/s390-debug-fix-debug-area-life-cycle.patch b/queue-5.14/s390-debug-fix-debug-area-life-cycle.patch new file mode 100644 index 00000000000..be6907a01bf --- /dev/null +++ b/queue-5.14/s390-debug-fix-debug-area-life-cycle.patch @@ -0,0 +1,181 @@ +From 481504345a95eb5fb219d5be70167806eab77250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:05:03 +0200 +Subject: s390/debug: fix debug area life cycle + +From: Peter Oberparleiter + +[ Upstream commit 9372a82892c2caa6bccab9a4081166fa769699f8 ] + +Currently allocation and registration of s390dbf debug areas are tied +together. As a result, a debug area cannot be unregistered and +re-registered while any process has an associated debugfs file open. + +Fix this by splitting alloc/release from register/unregister. + +Signed-off-by: Peter Oberparleiter +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/debug.c | 102 +++++++++++++++++++++------------------ + 1 file changed, 56 insertions(+), 46 deletions(-) + +diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c +index 0dbe48f550ff..05b765b8038e 100644 +--- a/arch/s390/kernel/debug.c ++++ b/arch/s390/kernel/debug.c +@@ -314,24 +314,6 @@ static debug_info_t *debug_info_create(const char *name, int pages_per_area, + goto out; + + rc->mode = mode & ~S_IFMT; +- +- /* create root directory */ +- rc->debugfs_root_entry = debugfs_create_dir(rc->name, +- debug_debugfs_root_entry); +- +- /* append new element to linked list */ +- if (!debug_area_first) { +- /* first element in list */ +- debug_area_first = rc; +- rc->prev = NULL; +- } else { +- /* append element to end of list */ +- debug_area_last->next = rc; +- rc->prev = debug_area_last; +- } +- debug_area_last = rc; +- rc->next = NULL; +- + refcount_set(&rc->ref_count, 1); + out: + return rc; +@@ -391,27 +373,10 @@ static void debug_info_get(debug_info_t *db_info) + */ + static void debug_info_put(debug_info_t *db_info) + { +- int i; +- + if (!db_info) + return; +- if (refcount_dec_and_test(&db_info->ref_count)) { +- for (i = 0; i < DEBUG_MAX_VIEWS; i++) { +- if (!db_info->views[i]) +- continue; +- debugfs_remove(db_info->debugfs_entries[i]); +- } +- debugfs_remove(db_info->debugfs_root_entry); +- if (db_info == debug_area_first) +- debug_area_first = db_info->next; +- if (db_info == debug_area_last) +- debug_area_last = db_info->prev; +- if (db_info->prev) +- db_info->prev->next = db_info->next; +- if (db_info->next) +- db_info->next->prev = db_info->prev; ++ if (refcount_dec_and_test(&db_info->ref_count)) + debug_info_free(db_info); +- } + } + + /* +@@ -635,6 +600,31 @@ static int debug_close(struct inode *inode, struct file *file) + return 0; /* success */ + } + ++/* Create debugfs entries and add to internal list. */ ++static void _debug_register(debug_info_t *id) ++{ ++ /* create root directory */ ++ id->debugfs_root_entry = debugfs_create_dir(id->name, ++ debug_debugfs_root_entry); ++ ++ /* append new element to linked list */ ++ if (!debug_area_first) { ++ /* first element in list */ ++ debug_area_first = id; ++ id->prev = NULL; ++ } else { ++ /* append element to end of list */ ++ debug_area_last->next = id; ++ id->prev = debug_area_last; ++ } ++ debug_area_last = id; ++ id->next = NULL; ++ ++ debug_register_view(id, &debug_level_view); ++ debug_register_view(id, &debug_flush_view); ++ debug_register_view(id, &debug_pages_view); ++} ++ + /** + * debug_register_mode() - creates and initializes debug area. + * +@@ -664,19 +654,16 @@ debug_info_t *debug_register_mode(const char *name, int pages_per_area, + if ((uid != 0) || (gid != 0)) + pr_warn("Root becomes the owner of all s390dbf files in sysfs\n"); + BUG_ON(!initialized); +- mutex_lock(&debug_mutex); + + /* create new debug_info */ + rc = debug_info_create(name, pages_per_area, nr_areas, buf_size, mode); +- if (!rc) +- goto out; +- debug_register_view(rc, &debug_level_view); +- debug_register_view(rc, &debug_flush_view); +- debug_register_view(rc, &debug_pages_view); +-out: +- if (!rc) ++ if (rc) { ++ mutex_lock(&debug_mutex); ++ _debug_register(rc); ++ mutex_unlock(&debug_mutex); ++ } else { + pr_err("Registering debug feature %s failed\n", name); +- mutex_unlock(&debug_mutex); ++ } + return rc; + } + EXPORT_SYMBOL(debug_register_mode); +@@ -705,6 +692,27 @@ debug_info_t *debug_register(const char *name, int pages_per_area, + } + EXPORT_SYMBOL(debug_register); + ++/* Remove debugfs entries and remove from internal list. */ ++static void _debug_unregister(debug_info_t *id) ++{ ++ int i; ++ ++ for (i = 0; i < DEBUG_MAX_VIEWS; i++) { ++ if (!id->views[i]) ++ continue; ++ debugfs_remove(id->debugfs_entries[i]); ++ } ++ debugfs_remove(id->debugfs_root_entry); ++ if (id == debug_area_first) ++ debug_area_first = id->next; ++ if (id == debug_area_last) ++ debug_area_last = id->prev; ++ if (id->prev) ++ id->prev->next = id->next; ++ if (id->next) ++ id->next->prev = id->prev; ++} ++ + /** + * debug_unregister() - give back debug area. + * +@@ -718,8 +726,10 @@ void debug_unregister(debug_info_t *id) + if (!id) + return; + mutex_lock(&debug_mutex); +- debug_info_put(id); ++ _debug_unregister(id); + mutex_unlock(&debug_mutex); ++ ++ debug_info_put(id); + } + EXPORT_SYMBOL(debug_unregister); + +-- +2.30.2 + diff --git a/queue-5.14/s390-debug-keep-debug-data-on-resize.patch b/queue-5.14/s390-debug-keep-debug-data-on-resize.patch new file mode 100644 index 00000000000..66f55606264 --- /dev/null +++ b/queue-5.14/s390-debug-keep-debug-data-on-resize.patch @@ -0,0 +1,140 @@ +From cbed2f429d6b82b4c51ff3b6bd74aaa2d36d4bb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 15:05:02 +0200 +Subject: s390/debug: keep debug data on resize + +From: Peter Oberparleiter + +[ Upstream commit 1204777867e8486a88dbb4793fe256b31ea05eeb ] + +Any previously recorded s390dbf debug data is reset when a debug area +is resized using the 'pages' sysfs attribute. This can make +live-debugging unnecessarily complex. + +Fix this by copying existing debug data to the newly allocated debug +area when resizing. + +Signed-off-by: Peter Oberparleiter +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/debug.c | 74 ++++++++++++++++++++++++++++------------ + 1 file changed, 53 insertions(+), 21 deletions(-) + +diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c +index 09b6c6402f9b..0dbe48f550ff 100644 +--- a/arch/s390/kernel/debug.c ++++ b/arch/s390/kernel/debug.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -92,6 +93,8 @@ static int debug_hex_ascii_format_fn(debug_info_t *id, struct debug_view *view, + char *out_buf, const char *in_buf); + static int debug_sprintf_format_fn(debug_info_t *id, struct debug_view *view, + char *out_buf, debug_sprintf_entry_t *curr_event); ++static void debug_areas_swap(debug_info_t *a, debug_info_t *b); ++static void debug_events_append(debug_info_t *dest, debug_info_t *src); + + /* globals */ + +@@ -726,35 +729,28 @@ EXPORT_SYMBOL(debug_unregister); + */ + static int debug_set_size(debug_info_t *id, int nr_areas, int pages_per_area) + { +- debug_entry_t ***new_areas; ++ debug_info_t *new_id; + unsigned long flags; +- int rc = 0; + + if (!id || (nr_areas <= 0) || (pages_per_area < 0)) + return -EINVAL; +- if (pages_per_area > 0) { +- new_areas = debug_areas_alloc(pages_per_area, nr_areas); +- if (!new_areas) { +- pr_info("Allocating memory for %i pages failed\n", +- pages_per_area); +- rc = -ENOMEM; +- goto out; +- } +- } else { +- new_areas = NULL; ++ ++ new_id = debug_info_alloc("", pages_per_area, nr_areas, id->buf_size, ++ id->level, ALL_AREAS); ++ if (!new_id) { ++ pr_info("Allocating memory for %i pages failed\n", ++ pages_per_area); ++ return -ENOMEM; + } ++ + spin_lock_irqsave(&id->lock, flags); +- debug_areas_free(id); +- id->areas = new_areas; +- id->nr_areas = nr_areas; +- id->pages_per_area = pages_per_area; +- id->active_area = 0; +- memset(id->active_entries, 0, sizeof(int)*id->nr_areas); +- memset(id->active_pages, 0, sizeof(int)*id->nr_areas); ++ debug_events_append(new_id, id); ++ debug_areas_swap(new_id, id); ++ debug_info_free(new_id); + spin_unlock_irqrestore(&id->lock, flags); + pr_info("%s: set new size (%i pages)\n", id->name, pages_per_area); +-out: +- return rc; ++ ++ return 0; + } + + /** +@@ -821,6 +817,42 @@ static inline debug_entry_t *get_active_entry(debug_info_t *id) + id->active_entries[id->active_area]); + } + ++/* Swap debug areas of a and b. */ ++static void debug_areas_swap(debug_info_t *a, debug_info_t *b) ++{ ++ swap(a->nr_areas, b->nr_areas); ++ swap(a->pages_per_area, b->pages_per_area); ++ swap(a->areas, b->areas); ++ swap(a->active_area, b->active_area); ++ swap(a->active_pages, b->active_pages); ++ swap(a->active_entries, b->active_entries); ++} ++ ++/* Append all debug events in active area from source to destination log. */ ++static void debug_events_append(debug_info_t *dest, debug_info_t *src) ++{ ++ debug_entry_t *from, *to, *last; ++ ++ if (!src->areas || !dest->areas) ++ return; ++ ++ /* Loop over all entries in src, starting with oldest. */ ++ from = get_active_entry(src); ++ last = from; ++ do { ++ if (from->clock != 0LL) { ++ to = get_active_entry(dest); ++ memset(to, 0, dest->entry_size); ++ memcpy(to, from, min(src->entry_size, ++ dest->entry_size)); ++ proceed_active_entry(dest); ++ } ++ ++ proceed_active_entry(src); ++ from = get_active_entry(src); ++ } while (from != last); ++} ++ + /* + * debug_finish_entry: + * - set timestamp, caller address, cpu number etc. +-- +2.30.2 + diff --git a/queue-5.14/s390-kasan-fix-large-pmd-pages-address-alignment-che.patch b/queue-5.14/s390-kasan-fix-large-pmd-pages-address-alignment-che.patch new file mode 100644 index 00000000000..d9aafb941f6 --- /dev/null +++ b/queue-5.14/s390-kasan-fix-large-pmd-pages-address-alignment-che.patch @@ -0,0 +1,86 @@ +From 29d6b27ad8f83ef31ed42b40ee377762bb01cbb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 12:55:08 +0200 +Subject: s390/kasan: fix large PMD pages address alignment check + +From: Alexander Gordeev + +[ Upstream commit ddd63c85ef67ea9ea7282ad35eafb6568047126e ] + +It is currently possible to initialize a large PMD page when +the address is not aligned on page boundary. + +Signed-off-by: Alexander Gordeev +Reviewed-by: Vasily Gorbik +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/mm/kasan_init.c | 41 +++++++++++++++++++-------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c +index a0fdc6dc5f9d..cc3af046c14e 100644 +--- a/arch/s390/mm/kasan_init.c ++++ b/arch/s390/mm/kasan_init.c +@@ -107,6 +107,9 @@ static void __init kasan_early_pgtable_populate(unsigned long address, + sgt_prot &= ~_SEGMENT_ENTRY_NOEXEC; + } + ++ /* ++ * The first 1MB of 1:1 mapping is mapped with 4KB pages ++ */ + while (address < end) { + pg_dir = pgd_offset_k(address); + if (pgd_none(*pg_dir)) { +@@ -157,30 +160,26 @@ static void __init kasan_early_pgtable_populate(unsigned long address, + + pm_dir = pmd_offset(pu_dir, address); + if (pmd_none(*pm_dir)) { +- if (mode == POPULATE_ZERO_SHADOW && +- IS_ALIGNED(address, PMD_SIZE) && ++ if (IS_ALIGNED(address, PMD_SIZE) && + end - address >= PMD_SIZE) { +- pmd_populate(&init_mm, pm_dir, +- kasan_early_shadow_pte); +- address = (address + PMD_SIZE) & PMD_MASK; +- continue; +- } +- /* the first megabyte of 1:1 is mapped with 4k pages */ +- if (has_edat && address && end - address >= PMD_SIZE && +- mode != POPULATE_ZERO_SHADOW) { +- void *page; +- +- if (mode == POPULATE_ONE2ONE) { +- page = (void *)address; +- } else { +- page = kasan_early_alloc_segment(); +- memset(page, 0, _SEGMENT_SIZE); ++ if (mode == POPULATE_ZERO_SHADOW) { ++ pmd_populate(&init_mm, pm_dir, kasan_early_shadow_pte); ++ address = (address + PMD_SIZE) & PMD_MASK; ++ continue; ++ } else if (has_edat && address) { ++ void *page; ++ ++ if (mode == POPULATE_ONE2ONE) { ++ page = (void *)address; ++ } else { ++ page = kasan_early_alloc_segment(); ++ memset(page, 0, _SEGMENT_SIZE); ++ } ++ pmd_val(*pm_dir) = __pa(page) | sgt_prot; ++ address = (address + PMD_SIZE) & PMD_MASK; ++ continue; + } +- pmd_val(*pm_dir) = __pa(page) | sgt_prot; +- address = (address + PMD_SIZE) & PMD_MASK; +- continue; + } +- + pt_dir = kasan_early_pte_alloc(); + pmd_populate(&init_mm, pm_dir, pt_dir); + } else if (pmd_large(*pm_dir)) { +-- +2.30.2 + diff --git a/queue-5.14/s390-pci-fix-misleading-rc-in-clp_set_pci_fn.patch b/queue-5.14/s390-pci-fix-misleading-rc-in-clp_set_pci_fn.patch new file mode 100644 index 00000000000..40121e7a595 --- /dev/null +++ b/queue-5.14/s390-pci-fix-misleading-rc-in-clp_set_pci_fn.patch @@ -0,0 +1,130 @@ +From 1678f2f69f4e24505f33c30e6843003942eca1cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 19:58:54 +0200 +Subject: s390/pci: fix misleading rc in clp_set_pci_fn() + +From: Niklas Schnelle + +[ Upstream commit f7addcdd527a6dddfebe20c358b87bdb95624612 ] + +Currently clp_set_pci_fn() always returns 0 as long as the CLP request +itself succeeds even if the operation itself returns a response code +other than CLP_RC_OK or CLP_RC_SETPCIFN_ALRDY. This is highly misleading +because calling code assumes that a zero rc means that the operation was +successful. + +Fix this by returning the response code or cc on failure with the +exception of the special handling for CLP_RC_SETPCIFN_ALRDY. Also let's +not assume that the returned function handle for CLP_RC_SETPCIFN_ALRDY +is 0, we don't need it anyway. + +Reviewed-by: Matthew Rosato +Signed-off-by: Niklas Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/pci/pci.c | 7 ++++--- + arch/s390/pci/pci_clp.c | 33 ++++++++++++++++----------------- + 2 files changed, 20 insertions(+), 20 deletions(-) + +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index 8fcb7ecb7225..77cd965cffef 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -661,9 +661,10 @@ int zpci_enable_device(struct zpci_dev *zdev) + { + int rc; + +- rc = clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES); +- if (rc) ++ if (clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES)) { ++ rc = -EIO; + goto out; ++ } + + rc = zpci_dma_init_device(zdev); + if (rc) +@@ -684,7 +685,7 @@ int zpci_disable_device(struct zpci_dev *zdev) + * The zPCI function may already be disabled by the platform, this is + * detected in clp_disable_fh() which becomes a no-op. + */ +- return clp_disable_fh(zdev); ++ return clp_disable_fh(zdev) ? -EIO : 0; + } + + /** +diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c +index d3331596ddbe..0a0e8b8293be 100644 +--- a/arch/s390/pci/pci_clp.c ++++ b/arch/s390/pci/pci_clp.c +@@ -213,15 +213,19 @@ out: + } + + static int clp_refresh_fh(u32 fid); +-/* +- * Enable/Disable a given PCI function and update its function handle if +- * necessary ++/** ++ * clp_set_pci_fn() - Execute a command on a PCI function ++ * @zdev: Function that will be affected ++ * @nr_dma_as: DMA address space number ++ * @command: The command code to execute ++ * ++ * Returns: 0 on success, < 0 for Linux errors (e.g. -ENOMEM), and ++ * > 0 for non-success platform responses + */ + static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command) + { + struct clp_req_rsp_set_pci *rrb; + int rc, retries = 100; +- u32 fid = zdev->fid; + + rrb = clp_alloc_block(GFP_KERNEL); + if (!rrb) +@@ -245,17 +249,16 @@ static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command) + } + } while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY); + +- if (rc || rrb->response.hdr.rsp != CLP_RC_OK) { +- zpci_err("Set PCI FN:\n"); +- zpci_err_clp(rrb->response.hdr.rsp, rc); +- } +- + if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) { + zdev->fh = rrb->response.fh; +- } else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY && +- rrb->response.fh == 0) { ++ } else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY) { + /* Function is already in desired state - update handle */ +- rc = clp_refresh_fh(fid); ++ rc = clp_refresh_fh(zdev->fid); ++ } else { ++ zpci_err("Set PCI FN:\n"); ++ zpci_err_clp(rrb->response.hdr.rsp, rc); ++ if (!rc) ++ rc = rrb->response.hdr.rsp; + } + clp_free_block(rrb); + return rc; +@@ -301,17 +304,13 @@ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as) + + rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_PCI_FN); + zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, zdev->fh, rc); +- if (rc) +- goto out; +- +- if (zpci_use_mio(zdev)) { ++ if (!rc && zpci_use_mio(zdev)) { + rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_MIO); + zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n", + zdev->fid, zdev->fh, rc); + if (rc) + clp_disable_fh(zdev); + } +-out: + return rc; + } + +-- +2.30.2 + diff --git a/queue-5.14/s390-smp-enable-dat-before-cpu-restart-callback-is-c.patch b/queue-5.14/s390-smp-enable-dat-before-cpu-restart-callback-is-c.patch new file mode 100644 index 00000000000..169f5d75865 --- /dev/null +++ b/queue-5.14/s390-smp-enable-dat-before-cpu-restart-callback-is-c.patch @@ -0,0 +1,294 @@ +From 35bb2ad2205b1f2e143be021c1b79130c4e5a756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 15:30:21 +0200 +Subject: s390/smp: enable DAT before CPU restart callback is called + +From: Alexander Gordeev + +[ Upstream commit 915fea04f9320d0f4ab6ecbb6bf759eebcd2c41d ] + +The restart interrupt is triggered whenever a secondary CPU is +brought online, a remote function call dispatched from another +CPU or a manual PSW restart is initiated and causes the system +to kdump. The handling routine is always called with DAT turned +off. It then initializes the stack frame and invokes a callback. + +The existing callbacks handle DAT as follows: + + * __do_restart() and __machine_kexec() turn in on upon entry; + * __ipl_run(), __reipl_run() and __dump_run() do not turn it + right away, but all of them call diag308() - which turns DAT + on, but only if kasan is enabled; + +In addition to the described complexity all callbacks (and the +functions they call) should avoid kasan instrumentation while +DAT is off. + +This update enables DAT in the assembler restart handler and +relieves any callbacks (which are mostly C functions) from +dealing with DAT altogether. + +There are four types of CPU restart that initialize control +registers in different ways: + + 1. Start of secondary CPU on boot - control registers are + inherited from the IPL CPU; + 2. Restart of online CPU - control registers of the CPU being + restarted are kept; + 3. Hotplug of offline CPU - control registers are inherited + from the starting CPU; + 4. Start of offline CPU triggered by manual PSW restart - + the control registers are read from the absolute lowcore + and contain the boot time IPL CPU values updated with all + follow-up calls of smp_ctl_set_bit() and smp_ctl_clear_bit() + routines; + +In first three cases contents of the control registers is the +most recent. In the latter case control registers are good +enough to facilitate successful completion of kdump operation. + +Suggested-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/lowcore.h | 3 ++- + arch/s390/include/asm/processor.h | 2 ++ + arch/s390/kernel/asm-offsets.c | 1 + + arch/s390/kernel/entry.S | 11 +++++++---- + arch/s390/kernel/ipl.c | 3 --- + arch/s390/kernel/machine_kexec.c | 1 - + arch/s390/kernel/setup.c | 9 ++++++++- + arch/s390/kernel/smp.c | 31 ++++++++++++++++++++++--------- + 8 files changed, 42 insertions(+), 19 deletions(-) + +diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h +index 47bde5a20a41..11213c8bfca5 100644 +--- a/arch/s390/include/asm/lowcore.h ++++ b/arch/s390/include/asm/lowcore.h +@@ -124,7 +124,8 @@ struct lowcore { + /* Restart function and parameter. */ + __u64 restart_fn; /* 0x0370 */ + __u64 restart_data; /* 0x0378 */ +- __u64 restart_source; /* 0x0380 */ ++ __u32 restart_source; /* 0x0380 */ ++ __u32 restart_flags; /* 0x0384 */ + + /* Address space pointer. */ + __u64 kernel_asce; /* 0x0388 */ +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index ddc7858bbce4..879b8e3f609c 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -26,6 +26,8 @@ + #define _CIF_MCCK_GUEST BIT(CIF_MCCK_GUEST) + #define _CIF_DEDICATED_CPU BIT(CIF_DEDICATED_CPU) + ++#define RESTART_FLAG_CTLREGS _AC(1 << 0, U) ++ + #ifndef __ASSEMBLY__ + + #include +diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c +index 77ff2130cb04..dc53b0452ce2 100644 +--- a/arch/s390/kernel/asm-offsets.c ++++ b/arch/s390/kernel/asm-offsets.c +@@ -116,6 +116,7 @@ int main(void) + OFFSET(__LC_RESTART_FN, lowcore, restart_fn); + OFFSET(__LC_RESTART_DATA, lowcore, restart_data); + OFFSET(__LC_RESTART_SOURCE, lowcore, restart_source); ++ OFFSET(__LC_RESTART_FLAGS, lowcore, restart_flags); + OFFSET(__LC_KERNEL_ASCE, lowcore, kernel_asce); + OFFSET(__LC_USER_ASCE, lowcore, user_asce); + OFFSET(__LC_LPP, lowcore, lpp); +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index 5a2f70cbd3a9..b9716a7e326d 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -624,12 +624,15 @@ ENTRY(mcck_int_handler) + 4: j 4b + ENDPROC(mcck_int_handler) + +-# +-# PSW restart interrupt handler +-# + ENTRY(restart_int_handler) + ALTERNATIVE "", ".insn s,0xb2800000,_LPP_OFFSET", 40 + stg %r15,__LC_SAVE_AREA_RESTART ++ TSTMSK __LC_RESTART_FLAGS,RESTART_FLAG_CTLREGS,4 ++ jz 0f ++ la %r15,4095 ++ lctlg %c0,%c15,__LC_CREGS_SAVE_AREA-4095(%r15) ++0: larl %r15,.Lstosm_tmp ++ stosm 0(%r15),0x04 # turn dat on, keep irqs off + lg %r15,__LC_RESTART_STACK + xc STACK_FRAME_OVERHEAD(__PT_SIZE,%r15),STACK_FRAME_OVERHEAD(%r15) + stmg %r0,%r14,STACK_FRAME_OVERHEAD+__PT_R0(%r15) +@@ -638,7 +641,7 @@ ENTRY(restart_int_handler) + xc 0(STACK_FRAME_OVERHEAD,%r15),0(%r15) + lg %r1,__LC_RESTART_FN # load fn, parm & source cpu + lg %r2,__LC_RESTART_DATA +- lg %r3,__LC_RESTART_SOURCE ++ lgf %r3,__LC_RESTART_SOURCE + ltgr %r3,%r3 # test source cpu address + jm 1f # negative -> skip source stop + 0: sigp %r4,%r3,SIGP_SENSE # sigp sense to source cpu +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 50e2c21e0ec9..911cd3912351 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -179,8 +179,6 @@ static inline int __diag308(unsigned long subcode, void *addr) + + int diag308(unsigned long subcode, void *addr) + { +- if (IS_ENABLED(CONFIG_KASAN)) +- __arch_local_irq_stosm(0x04); /* enable DAT */ + diag_stat_inc(DIAG_STAT_X308); + return __diag308(subcode, addr); + } +@@ -1843,7 +1841,6 @@ static struct kobj_attribute on_restart_attr = __ATTR_RW(on_restart); + + static void __do_restart(void *ignore) + { +- __arch_local_irq_stosm(0x04); /* enable DAT */ + smp_send_stop(); + #ifdef CONFIG_CRASH_DUMP + crash_kexec(NULL); +diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c +index 1005a6935fbe..c1fbc979e0e8 100644 +--- a/arch/s390/kernel/machine_kexec.c ++++ b/arch/s390/kernel/machine_kexec.c +@@ -263,7 +263,6 @@ static void __do_machine_kexec(void *data) + */ + static void __machine_kexec(void *data) + { +- __arch_local_irq_stosm(0x04); /* enable DAT */ + pfault_fini(); + tracing_off(); + debug_locks_off(); +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index ff0f9e838916..ee23908f1b96 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -421,7 +421,7 @@ static void __init setup_lowcore_dat_off(void) + lc->restart_stack = (unsigned long) restart_stack; + lc->restart_fn = (unsigned long) do_restart; + lc->restart_data = 0; +- lc->restart_source = -1UL; ++ lc->restart_source = -1U; + + mcck_stack = (unsigned long)memblock_alloc(THREAD_SIZE, THREAD_SIZE); + if (!mcck_stack) +@@ -450,12 +450,19 @@ static void __init setup_lowcore_dat_off(void) + + static void __init setup_lowcore_dat_on(void) + { ++ struct lowcore *lc = lowcore_ptr[0]; ++ + __ctl_clear_bit(0, 28); + S390_lowcore.external_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT; + S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT; ++ __ctl_store(S390_lowcore.cregs_save_area, 0, 15); + __ctl_set_bit(0, 28); ++ mem_assign_absolute(S390_lowcore.restart_flags, RESTART_FLAG_CTLREGS); ++ mem_assign_absolute(S390_lowcore.program_new_psw, lc->program_new_psw); ++ memcpy_absolute(&S390_lowcore.cregs_save_area, lc->cregs_save_area, ++ sizeof(S390_lowcore.cregs_save_area)); + } + + static struct resource code_resource = { +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 8984711f72ed..8e8ace899407 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -252,6 +252,7 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu) + cpumask_set_cpu(cpu, &init_mm.context.cpu_attach_mask); + cpumask_set_cpu(cpu, mm_cpumask(&init_mm)); + lc->cpu_nr = cpu; ++ lc->restart_flags = RESTART_FLAG_CTLREGS; + lc->spinlock_lockval = arch_spin_lockval(cpu); + lc->spinlock_index = 0; + lc->percpu_offset = __per_cpu_offset[cpu]; +@@ -297,7 +298,7 @@ static void pcpu_start_fn(struct pcpu *pcpu, void (*func)(void *), void *data) + lc->restart_stack = lc->nodat_stack; + lc->restart_fn = (unsigned long) func; + lc->restart_data = (unsigned long) data; +- lc->restart_source = -1UL; ++ lc->restart_source = -1U; + pcpu_sigp_retry(pcpu, SIGP_RESTART, 0); + } + +@@ -311,12 +312,12 @@ static void __pcpu_delegate(pcpu_delegate_fn *func, void *data) + func(data); /* should not return */ + } + +-static void __no_sanitize_address pcpu_delegate(struct pcpu *pcpu, +- pcpu_delegate_fn *func, +- void *data, unsigned long stack) ++static void pcpu_delegate(struct pcpu *pcpu, ++ pcpu_delegate_fn *func, ++ void *data, unsigned long stack) + { + struct lowcore *lc = lowcore_ptr[pcpu - pcpu_devices]; +- unsigned long source_cpu = stap(); ++ unsigned int source_cpu = stap(); + + __load_psw_mask(PSW_KERNEL_BITS | PSW_MASK_DAT); + if (pcpu->address == source_cpu) { +@@ -569,6 +570,9 @@ static void smp_ctl_bit_callback(void *info) + __ctl_load(cregs, 0, 15); + } + ++static DEFINE_SPINLOCK(ctl_lock); ++static unsigned long ctlreg; ++ + /* + * Set a bit in a control register of all cpus + */ +@@ -576,6 +580,11 @@ void smp_ctl_set_bit(int cr, int bit) + { + struct ec_creg_mask_parms parms = { 1UL << bit, -1UL, cr }; + ++ spin_lock(&ctl_lock); ++ memcpy_absolute(&ctlreg, &S390_lowcore.cregs_save_area[cr], sizeof(ctlreg)); ++ __set_bit(bit, &ctlreg); ++ memcpy_absolute(&S390_lowcore.cregs_save_area[cr], &ctlreg, sizeof(ctlreg)); ++ spin_unlock(&ctl_lock); + on_each_cpu(smp_ctl_bit_callback, &parms, 1); + } + EXPORT_SYMBOL(smp_ctl_set_bit); +@@ -587,6 +596,11 @@ void smp_ctl_clear_bit(int cr, int bit) + { + struct ec_creg_mask_parms parms = { 0, ~(1UL << bit), cr }; + ++ spin_lock(&ctl_lock); ++ memcpy_absolute(&ctlreg, &S390_lowcore.cregs_save_area[cr], sizeof(ctlreg)); ++ __clear_bit(bit, &ctlreg); ++ memcpy_absolute(&S390_lowcore.cregs_save_area[cr], &ctlreg, sizeof(ctlreg)); ++ spin_unlock(&ctl_lock); + on_each_cpu(smp_ctl_bit_callback, &parms, 1); + } + EXPORT_SYMBOL(smp_ctl_clear_bit); +@@ -895,14 +909,13 @@ static void smp_init_secondary(void) + /* + * Activate a secondary processor. + */ +-static void __no_sanitize_address smp_start_secondary(void *cpuvoid) ++static void smp_start_secondary(void *cpuvoid) + { + S390_lowcore.restart_stack = (unsigned long) restart_stack; + S390_lowcore.restart_fn = (unsigned long) do_restart; + S390_lowcore.restart_data = 0; +- S390_lowcore.restart_source = -1UL; +- __ctl_load(S390_lowcore.cregs_save_area, 0, 15); +- __load_psw_mask(PSW_KERNEL_BITS | PSW_MASK_DAT); ++ S390_lowcore.restart_source = -1U; ++ S390_lowcore.restart_flags = 0; + call_on_stack_noreturn(smp_init_secondary, S390_lowcore.kernel_stack); + } + +-- +2.30.2 + diff --git a/queue-5.14/s390-zcrypt-fix-wrong-offset-index-for-apka-master-k.patch b/queue-5.14/s390-zcrypt-fix-wrong-offset-index-for-apka-master-k.patch new file mode 100644 index 00000000000..8a76bad31d6 --- /dev/null +++ b/queue-5.14/s390-zcrypt-fix-wrong-offset-index-for-apka-master-k.patch @@ -0,0 +1,45 @@ +From ed061fb112f27cae7ea9e1d880efbee65703f59e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 12:02:00 +0200 +Subject: s390/zcrypt: fix wrong offset index for APKA master key valid state + +From: Harald Freudenberger + +[ Upstream commit 8617bb74006252cb2286008afe7d6575a6425857 ] + +Tests showed a mismatch between what the CCA tool reports about +the APKA master key state and what's displayed by the zcrypt dd +in sysfs. After some investigation, we found out that the +documentation which was the source for the zcrypt dd implementation +lacks the listing of 3 fields. So this patch now moves the +evaluation of the APKA master key state to the correct offset. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c +index bc34bedf9db8..6a3c2b460965 100644 +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -1724,10 +1724,10 @@ static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci) + rlen = vlen = PAGE_SIZE/2; + rc = cca_query_crypto_facility(cardnr, domain, "STATICSB", + rarray, &rlen, varray, &vlen); +- if (rc == 0 && rlen >= 10*8 && vlen >= 240) { +- ci->new_apka_mk_state = (char) rarray[7*8]; +- ci->cur_apka_mk_state = (char) rarray[8*8]; +- ci->old_apka_mk_state = (char) rarray[9*8]; ++ if (rc == 0 && rlen >= 13*8 && vlen >= 240) { ++ ci->new_apka_mk_state = (char) rarray[10*8]; ++ ci->cur_apka_mk_state = (char) rarray[11*8]; ++ ci->old_apka_mk_state = (char) rarray[12*8]; + if (ci->old_apka_mk_state == '2') + memcpy(&ci->old_apka_mkvp, varray + 208, 8); + if (ci->cur_apka_mk_state == '2') +-- +2.30.2 + diff --git a/queue-5.14/samples-pktgen-add-missing-ipv6-option-to-pktgen-scr.patch b/queue-5.14/samples-pktgen-add-missing-ipv6-option-to-pktgen-scr.patch new file mode 100644 index 00000000000..f4e824bc685 --- /dev/null +++ b/queue-5.14/samples-pktgen-add-missing-ipv6-option-to-pktgen-scr.patch @@ -0,0 +1,99 @@ +From a324a02149913cf30fcd5a9fcc3ae643d2db8a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 00:08:13 +0900 +Subject: samples: pktgen: add missing IPv6 option to pktgen scripts + +From: Juhee Kang + +[ Upstream commit 0f0c4f1b72e090b23131700bb155944cc28b2a7b ] + +Currently, "sample04" and "sample05" are not working properly when +running with an IPv6 option("-6"). The commit 0f06a6787e05 ("samples: +Add an IPv6 "-6" option to the pktgen scripts") has omitted the addition +of this option at "sample04" and "sample05". + +In order to support IPv6 option, this commit adds logic related to IPv6 +option. + +Fixes: 0f06a6787e05 ("samples: Add an IPv6 "-6" option to the pktgen scripts") + +Signed-off-by: Juhee Kang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + samples/pktgen/pktgen_sample04_many_flows.sh | 12 +++++++----- + samples/pktgen/pktgen_sample05_flow_per_thread.sh | 12 +++++++----- + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/samples/pktgen/pktgen_sample04_many_flows.sh b/samples/pktgen/pktgen_sample04_many_flows.sh +index 56c5f5af350f..cff51f861506 100755 +--- a/samples/pktgen/pktgen_sample04_many_flows.sh ++++ b/samples/pktgen/pktgen_sample04_many_flows.sh +@@ -13,13 +13,15 @@ root_check_run_with_sudo "$@" + # Parameter parsing via include + source ${basedir}/parameters.sh + # Set some default params, if they didn't get set +-[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42" ++if [ -z "$DEST_IP" ]; then ++ [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1" ++fi + [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff" + [ -z "$CLONE_SKB" ] && CLONE_SKB="0" + [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely + if [ -n "$DEST_IP" ]; then +- validate_addr $DEST_IP +- read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP) ++ validate_addr${IP6} $DEST_IP ++ read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP) + fi + if [ -n "$DST_PORT" ]; then + read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT) +@@ -62,8 +64,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do + + # Single destination + pg_set $dev "dst_mac $DST_MAC" +- pg_set $dev "dst_min $DST_MIN" +- pg_set $dev "dst_max $DST_MAX" ++ pg_set $dev "dst${IP6}_min $DST_MIN" ++ pg_set $dev "dst${IP6}_max $DST_MAX" + + if [ -n "$DST_PORT" ]; then + # Single destination port or random port range +diff --git a/samples/pktgen/pktgen_sample05_flow_per_thread.sh b/samples/pktgen/pktgen_sample05_flow_per_thread.sh +index 6e0effabca59..3578d0aa4ac5 100755 +--- a/samples/pktgen/pktgen_sample05_flow_per_thread.sh ++++ b/samples/pktgen/pktgen_sample05_flow_per_thread.sh +@@ -17,14 +17,16 @@ root_check_run_with_sudo "$@" + # Parameter parsing via include + source ${basedir}/parameters.sh + # Set some default params, if they didn't get set +-[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42" ++if [ -z "$DEST_IP" ]; then ++ [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1" ++fi + [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff" + [ -z "$CLONE_SKB" ] && CLONE_SKB="0" + [ -z "$BURST" ] && BURST=32 + [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely + if [ -n "$DEST_IP" ]; then +- validate_addr $DEST_IP +- read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP) ++ validate_addr${IP6} $DEST_IP ++ read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP) + fi + if [ -n "$DST_PORT" ]; then + read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT) +@@ -52,8 +54,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do + + # Single destination + pg_set $dev "dst_mac $DST_MAC" +- pg_set $dev "dst_min $DST_MIN" +- pg_set $dev "dst_max $DST_MAX" ++ pg_set $dev "dst${IP6}_min $DST_MIN" ++ pg_set $dev "dst${IP6}_max $DST_MAX" + + if [ -n "$DST_PORT" ]; then + # Single destination port or random port range +-- +2.30.2 + diff --git a/queue-5.14/sch_htb-fix-inconsistency-when-leaf-qdisc-creation-f.patch b/queue-5.14/sch_htb-fix-inconsistency-when-leaf-qdisc-creation-f.patch new file mode 100644 index 00000000000..f60e0eb0e42 --- /dev/null +++ b/queue-5.14/sch_htb-fix-inconsistency-when-leaf-qdisc-creation-f.patch @@ -0,0 +1,321 @@ +From 9cca6bf8a6cfb9b77f9a9cd67a32d3e3e2c8bcbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 14:54:25 +0300 +Subject: sch_htb: Fix inconsistency when leaf qdisc creation fails + +From: Maxim Mikityanskiy + +[ Upstream commit ca49bfd90a9dde175d2929dc1544b54841e33804 ] + +In HTB offload mode, qdiscs of leaf classes are grafted to netdev +queues. sch_htb expects the dev_queue field of these qdiscs to point to +the corresponding queues. However, qdisc creation may fail, and in that +case noop_qdisc is used instead. Its dev_queue doesn't point to the +right queue, so sch_htb can lose track of used netdev queues, which will +cause internal inconsistencies. + +This commit fixes this bug by keeping track of the netdev queue inside +struct htb_class. All reads of cl->leaf.q->dev_queue are replaced by the +new field, the two values are synced on writes, and WARNs are added to +assert equality of the two values. + +The driver API has changed: when TC_HTB_LEAF_DEL needs to move a queue, +the driver used to pass the old and new queue IDs to sch_htb. Now that +there is a new field (offload_queue) in struct htb_class that needs to +be updated on this operation, the driver will pass the old class ID to +sch_htb instead (it already knows the new class ID). + +Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20210826115425.1744053-1-maximmi@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en/qos.c | 15 ++- + .../net/ethernet/mellanox/mlx5/core/en/qos.h | 4 +- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 3 +- + include/net/pkt_cls.h | 3 +- + net/sched/sch_htb.c | 97 ++++++++++++------- + 5 files changed, 72 insertions(+), 50 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +index 5efe3278b0f6..1fd8baf19829 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c +@@ -733,8 +733,8 @@ static void mlx5e_reset_qdisc(struct net_device *dev, u16 qid) + spin_unlock_bh(qdisc_lock(qdisc)); + } + +-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, +- u16 *new_qid, struct netlink_ext_ack *extack) ++int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid, ++ struct netlink_ext_ack *extack) + { + struct mlx5e_qos_node *node; + struct netdev_queue *txq; +@@ -742,11 +742,9 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, + bool opened; + int err; + +- qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", classid); +- +- *old_qid = *new_qid = 0; ++ qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", *classid); + +- node = mlx5e_sw_node_find(priv, classid); ++ node = mlx5e_sw_node_find(priv, *classid); + if (!node) + return -ENOENT; + +@@ -764,7 +762,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, + err = mlx5_qos_destroy_node(priv->mdev, node->hw_id); + if (err) /* Not fatal. */ + qos_warn(priv->mdev, "Failed to destroy leaf node %u (class %04x), err = %d\n", +- node->hw_id, classid, err); ++ node->hw_id, *classid, err); + + mlx5e_sw_node_delete(priv, node); + +@@ -826,8 +824,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, + if (opened) + mlx5e_reactivate_qos_sq(priv, moved_qid, txq); + +- *old_qid = mlx5e_qid_from_qos(&priv->channels, moved_qid); +- *new_qid = mlx5e_qid_from_qos(&priv->channels, qid); ++ *classid = node->classid; + return 0; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h +index 5af7991fcd19..757682b7c0e0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h +@@ -34,8 +34,8 @@ int mlx5e_htb_leaf_alloc_queue(struct mlx5e_priv *priv, u16 classid, + struct netlink_ext_ack *extack); + int mlx5e_htb_leaf_to_inner(struct mlx5e_priv *priv, u16 classid, u16 child_classid, + u64 rate, u64 ceil, struct netlink_ext_ack *extack); +-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid, +- u16 *new_qid, struct netlink_ext_ack *extack); ++int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid, ++ struct netlink_ext_ack *extack); + int mlx5e_htb_leaf_del_last(struct mlx5e_priv *priv, u16 classid, bool force, + struct netlink_ext_ack *extack); + int mlx5e_htb_node_modify(struct mlx5e_priv *priv, u16 classid, u64 rate, u64 ceil, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index b7be1ef4cbb2..2d53eaf3b924 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3453,8 +3453,7 @@ static int mlx5e_setup_tc_htb(struct mlx5e_priv *priv, struct tc_htb_qopt_offloa + return mlx5e_htb_leaf_to_inner(priv, htb->parent_classid, htb->classid, + htb->rate, htb->ceil, htb->extack); + case TC_HTB_LEAF_DEL: +- return mlx5e_htb_leaf_del(priv, htb->classid, &htb->moved_qid, &htb->qid, +- htb->extack); ++ return mlx5e_htb_leaf_del(priv, &htb->classid, htb->extack); + case TC_HTB_LEAF_DEL_LAST: + case TC_HTB_LEAF_DEL_LAST_FORCE: + return mlx5e_htb_leaf_del_last(priv, htb->classid, +diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h +index 298a8d10168b..fb34b66aefa7 100644 +--- a/include/net/pkt_cls.h ++++ b/include/net/pkt_cls.h +@@ -824,10 +824,9 @@ enum tc_htb_command { + struct tc_htb_qopt_offload { + struct netlink_ext_ack *extack; + enum tc_htb_command command; +- u16 classid; + u32 parent_classid; ++ u16 classid; + u16 qid; +- u16 moved_qid; + u64 rate; + u64 ceil; + }; +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index 5f7ac27a5264..f22d26a2c89f 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -125,6 +125,7 @@ struct htb_class { + struct htb_class_leaf { + int deficit[TC_HTB_MAXDEPTH]; + struct Qdisc *q; ++ struct netdev_queue *offload_queue; + } leaf; + struct htb_class_inner { + struct htb_prio clprio[TC_HTB_NUMPRIO]; +@@ -1411,24 +1412,47 @@ htb_graft_helper(struct netdev_queue *dev_queue, struct Qdisc *new_q) + return old_q; + } + +-static void htb_offload_move_qdisc(struct Qdisc *sch, u16 qid_old, u16 qid_new) ++static struct netdev_queue *htb_offload_get_queue(struct htb_class *cl) ++{ ++ struct netdev_queue *queue; ++ ++ queue = cl->leaf.offload_queue; ++ if (!(cl->leaf.q->flags & TCQ_F_BUILTIN)) ++ WARN_ON(cl->leaf.q->dev_queue != queue); ++ ++ return queue; ++} ++ ++static void htb_offload_move_qdisc(struct Qdisc *sch, struct htb_class *cl_old, ++ struct htb_class *cl_new, bool destroying) + { + struct netdev_queue *queue_old, *queue_new; + struct net_device *dev = qdisc_dev(sch); +- struct Qdisc *qdisc; + +- queue_old = netdev_get_tx_queue(dev, qid_old); +- queue_new = netdev_get_tx_queue(dev, qid_new); ++ queue_old = htb_offload_get_queue(cl_old); ++ queue_new = htb_offload_get_queue(cl_new); + +- if (dev->flags & IFF_UP) +- dev_deactivate(dev); +- qdisc = dev_graft_qdisc(queue_old, NULL); +- qdisc->dev_queue = queue_new; +- qdisc = dev_graft_qdisc(queue_new, qdisc); +- if (dev->flags & IFF_UP) +- dev_activate(dev); ++ if (!destroying) { ++ struct Qdisc *qdisc; + +- WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN)); ++ if (dev->flags & IFF_UP) ++ dev_deactivate(dev); ++ qdisc = dev_graft_qdisc(queue_old, NULL); ++ WARN_ON(qdisc != cl_old->leaf.q); ++ } ++ ++ if (!(cl_old->leaf.q->flags & TCQ_F_BUILTIN)) ++ cl_old->leaf.q->dev_queue = queue_new; ++ cl_old->leaf.offload_queue = queue_new; ++ ++ if (!destroying) { ++ struct Qdisc *qdisc; ++ ++ qdisc = dev_graft_qdisc(queue_new, cl_old->leaf.q); ++ if (dev->flags & IFF_UP) ++ dev_activate(dev); ++ WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN)); ++ } + } + + static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, +@@ -1442,10 +1466,8 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, + if (cl->level) + return -EINVAL; + +- if (q->offload) { +- dev_queue = new->dev_queue; +- WARN_ON(dev_queue != cl->leaf.q->dev_queue); +- } ++ if (q->offload) ++ dev_queue = htb_offload_get_queue(cl); + + if (!new) { + new = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops, +@@ -1514,6 +1536,8 @@ static void htb_parent_to_leaf(struct Qdisc *sch, struct htb_class *cl, + parent->ctokens = parent->cbuffer; + parent->t_c = ktime_get_ns(); + parent->cmode = HTB_CAN_SEND; ++ if (q->offload) ++ parent->leaf.offload_queue = cl->leaf.offload_queue; + } + + static void htb_parent_to_leaf_offload(struct Qdisc *sch, +@@ -1534,6 +1558,7 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + struct netlink_ext_ack *extack) + { + struct tc_htb_qopt_offload offload_opt; ++ struct netdev_queue *dev_queue; + struct Qdisc *q = cl->leaf.q; + struct Qdisc *old = NULL; + int err; +@@ -1542,16 +1567,15 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + return -EINVAL; + + WARN_ON(!q); +- if (!destroying) { +- /* On destroy of HTB, two cases are possible: +- * 1. q is a normal qdisc, but q->dev_queue has noop qdisc. +- * 2. q is a noop qdisc (for nodes that were inner), +- * q->dev_queue is noop_netdev_queue. ++ dev_queue = htb_offload_get_queue(cl); ++ old = htb_graft_helper(dev_queue, NULL); ++ if (destroying) ++ /* Before HTB is destroyed, the kernel grafts noop_qdisc to ++ * all queues. + */ +- old = htb_graft_helper(q->dev_queue, NULL); +- WARN_ON(!old); ++ WARN_ON(!(old->flags & TCQ_F_BUILTIN)); ++ else + WARN_ON(old != q); +- } + + if (cl->parent) { + cl->parent->bstats_bias.bytes += q->bstats.bytes; +@@ -1570,18 +1594,17 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + if (!err || destroying) + qdisc_put(old); + else +- htb_graft_helper(q->dev_queue, old); ++ htb_graft_helper(dev_queue, old); + + if (last_child) + return err; + +- if (!err && offload_opt.moved_qid != 0) { +- if (destroying) +- q->dev_queue = netdev_get_tx_queue(qdisc_dev(sch), +- offload_opt.qid); +- else +- htb_offload_move_qdisc(sch, offload_opt.moved_qid, +- offload_opt.qid); ++ if (!err && offload_opt.classid != TC_H_MIN(cl->common.classid)) { ++ u32 classid = TC_H_MAJ(sch->handle) | ++ TC_H_MIN(offload_opt.classid); ++ struct htb_class *moved_cl = htb_find(classid, sch); ++ ++ htb_offload_move_qdisc(sch, moved_cl, cl, destroying); + } + + return err; +@@ -1704,9 +1727,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg, + } + + if (last_child) { +- struct netdev_queue *dev_queue; ++ struct netdev_queue *dev_queue = sch->dev_queue; ++ ++ if (q->offload) ++ dev_queue = htb_offload_get_queue(cl); + +- dev_queue = q->offload ? cl->leaf.q->dev_queue : sch->dev_queue; + new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops, + cl->parent->common.classid, + NULL); +@@ -1878,7 +1903,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, + } + dev_queue = netdev_get_tx_queue(dev, offload_opt.qid); + } else { /* First child. */ +- dev_queue = parent->leaf.q->dev_queue; ++ dev_queue = htb_offload_get_queue(parent); + old_q = htb_graft_helper(dev_queue, NULL); + WARN_ON(old_q != parent->leaf.q); + offload_opt = (struct tc_htb_qopt_offload) { +@@ -1935,6 +1960,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, + + /* leaf (we) needs elementary qdisc */ + cl->leaf.q = new_q ? new_q : &noop_qdisc; ++ if (q->offload) ++ cl->leaf.offload_queue = dev_queue; + + cl->parent = parent; + +-- +2.30.2 + diff --git a/queue-5.14/sched-deadline-fix-missing-clock-update-in-migrate_t.patch b/queue-5.14/sched-deadline-fix-missing-clock-update-in-migrate_t.patch new file mode 100644 index 00000000000..a117109b3dd --- /dev/null +++ b/queue-5.14/sched-deadline-fix-missing-clock-update-in-migrate_t.patch @@ -0,0 +1,81 @@ +From e0b44b280eed0148117815827b4fd913129e32d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 15:59:25 +0200 +Subject: sched/deadline: Fix missing clock update in migrate_task_rq_dl() + +From: Dietmar Eggemann + +[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ] + +A missing clock update is causing the following warning: + +rq->clock_update_flags < RQCF_ACT_SKIP +WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453 +sub_running_bw.isra.0+0x190/0x1a0 +... +CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1 +Hardware name: WIWYNN Mt.Jade Server System +B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP: +1.06.20210526) 2021/05/26 +... +Call trace: + sub_running_bw.isra.0+0x190/0x1a0 + migrate_task_rq_dl+0xf8/0x1e0 + set_task_cpu+0xa8/0x1f0 + try_to_wake_up+0x150/0x3d4 + wake_up_q+0x64/0xc0 + __up_write+0xd0/0x1c0 + up_write+0x4c/0x2b0 + cppc_set_perf+0x120/0x2d0 + cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq] + __cpufreq_driver_target+0x74/0x140 + sugov_work+0x64/0x80 + kthread_worker_fn+0xe0/0x230 + kthread+0x138/0x140 + ret_from_fork+0x10/0x18 + +The task causing this is the `cppc_fie` DL task introduced by +commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency +invariance"). + +With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on +slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm +Server): + +DL task `curr=sugov:112` lets `p=cppc_fie` migrate and since the latter +is in `non_contending` state, migrate_task_rq_dl() calls + + sub_running_bw()->__sub_running_bw()->cpufreq_update_util()-> + rq_clock()->assert_clock_updated() + +on p. + +Fix this by updating the clock for a non_contending task in +migrate_task_rq_dl() before calling sub_running_bw(). + +Reported-by: Bruno Goncalves +Signed-off-by: Dietmar Eggemann +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Bristot de Oliveira +Acked-by: Juri Lelli +Link: https://lore.kernel.org/r/20210804135925.3734605-1-dietmar.eggemann@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 5cafc642e647..e94314633b39 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1733,6 +1733,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused + */ + raw_spin_rq_lock(rq); + if (p->dl.dl_non_contending) { ++ update_rq_clock(rq); + sub_running_bw(&p->dl, &rq->dl); + p->dl.dl_non_contending = 0; + /* +-- +2.30.2 + diff --git a/queue-5.14/sched-deadline-fix-reset_on_fork-reporting-of-dl-tas.patch b/queue-5.14/sched-deadline-fix-reset_on_fork-reporting-of-dl-tas.patch new file mode 100644 index 00000000000..485893d2c10 --- /dev/null +++ b/queue-5.14/sched-deadline-fix-reset_on_fork-reporting-of-dl-tas.patch @@ -0,0 +1,81 @@ +From 40e453a354feb2b90cce46de8d665bc62cefd8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 11:11:01 +0100 +Subject: sched/deadline: Fix reset_on_fork reporting of DL tasks + +From: Quentin Perret + +[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ] + +It is possible for sched_getattr() to incorrectly report the state of +the reset_on_fork flag when called on a deadline task. + +Indeed, if the flag was set on a deadline task using sched_setattr() +with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then +p->sched_reset_on_fork will be set, but __setscheduler() will bail out +early, which means that the dl_se->flags will not get updated by +__setscheduler_params()->__setparam_dl(). Consequently, if +sched_getattr() is then called on the task, __getparam_dl() will +override kattr.sched_flags with the now out-of-date copy in dl_se->flags +and report the stale value to userspace. + +To fix this, make sure to only copy the flags that are relevant to +sched_deadline to and from the dl_se->flags field. + +Signed-off-by: Quentin Perret +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210727101103.2729607-2-qperret@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 7 ++++--- + kernel/sched/sched.h | 2 ++ + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index aaacd6cfd42f..5cafc642e647 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2741,7 +2741,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr) + dl_se->dl_runtime = attr->sched_runtime; + dl_se->dl_deadline = attr->sched_deadline; + dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline; +- dl_se->flags = attr->sched_flags; ++ dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS; + dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime); + dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime); + } +@@ -2754,7 +2754,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr) + attr->sched_runtime = dl_se->dl_runtime; + attr->sched_deadline = dl_se->dl_deadline; + attr->sched_period = dl_se->dl_period; +- attr->sched_flags = dl_se->flags; ++ attr->sched_flags &= ~SCHED_DL_FLAGS; ++ attr->sched_flags |= dl_se->flags; + } + + /* +@@ -2851,7 +2852,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr) + if (dl_se->dl_runtime != attr->sched_runtime || + dl_se->dl_deadline != attr->sched_deadline || + dl_se->dl_period != attr->sched_period || +- dl_se->flags != attr->sched_flags) ++ dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS)) + return true; + + return false; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index ddefb0419d7a..d53d19770866 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -227,6 +227,8 @@ static inline void update_avg(u64 *avg, u64 sample) + */ + #define SCHED_FLAG_SUGOV 0x10000000 + ++#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV) ++ + static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se) + { + #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL +-- +2.30.2 + diff --git a/queue-5.14/sched-debug-don-t-update-sched_domain-debug-director.patch b/queue-5.14/sched-debug-don-t-update-sched_domain-debug-director.patch new file mode 100644 index 00000000000..a67e5fa4049 --- /dev/null +++ b/queue-5.14/sched-debug-don-t-update-sched_domain-debug-director.patch @@ -0,0 +1,65 @@ +From 4cc1309a140dea78fe5187428135b38f9bba3e48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 14:07:25 +0100 +Subject: sched/debug: Don't update sched_domain debug directories before + sched_debug_init() + +From: Valentin Schneider + +[ Upstream commit 459b09b5a3254008b63382bf41a9b36d0b590f57 ] + +Since CPU capacity asymmetry can stem purely from maximum frequency +differences (e.g. Pixel 1), a rebuild of the scheduler topology can be +issued upon loading cpufreq, see: + + arch_topology.c::init_cpu_capacity_callback() + +Turns out that if this rebuild happens *before* sched_debug_init() is +run (which is a late initcall), we end up messing up the sched_domain debug +directory: passing a NULL parent to debugfs_create_dir() ends up creating +the directory at the debugfs root, which in this case creates +/sys/kernel/debug/domains (instead of /sys/kernel/debug/sched/domains). + +This currently doesn't happen on asymmetric systems which use cpufreq-scpi +or cpufreq-dt drivers, as those are loaded via +deferred_probe_initcall() (it is also a late initcall, but appears to be +ordered *after* sched_debug_init()). + +Ionela has been working on detecting maximum frequency asymmetry via ACPI, +and that actually happens via a *device* initcall, thus before +sched_debug_init(), and causes the aforementionned debugfs mayhem. + +One option would be to punt sched_debug_init() down to +fs_initcall_sync(). Preventing update_sched_domain_debugfs() from running +before sched_debug_init() appears to be the safer option. + +Fixes: 3b87f136f8fc ("sched,debug: Convert sysctl sched_domains to debugfs") +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Link: http://lore.kernel.org/r/20210514095339.12979-1-ionela.voinescu@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 0c5ec2776ddf..7e08e3d947c2 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -388,6 +388,13 @@ void update_sched_domain_debugfs(void) + { + int cpu, i; + ++ /* ++ * This can unfortunately be invoked before sched_debug_init() creates ++ * the debug directory. Don't touch sd_sysctl_cpus until then. ++ */ ++ if (!debugfs_sched) ++ return; ++ + if (!cpumask_available(sd_sysctl_cpus)) { + if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL)) + return; +-- +2.30.2 + diff --git a/queue-5.14/sched-fix-uclamp_flag_idle-setting.patch b/queue-5.14/sched-fix-uclamp_flag_idle-setting.patch new file mode 100644 index 00000000000..683b3326365 --- /dev/null +++ b/queue-5.14/sched-fix-uclamp_flag_idle-setting.patch @@ -0,0 +1,83 @@ +From e75d43f86e7dd116ce34cfaf5124e2bc42ec6a51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 11:21:53 +0100 +Subject: sched: Fix UCLAMP_FLAG_IDLE setting + +From: Quentin Perret + +[ Upstream commit ca4984a7dd863f3e1c0df775ae3e744bff24c303 ] + +The UCLAMP_FLAG_IDLE flag is set on a runqueue when dequeueing the last +uclamp active task (that is, when buckets.tasks reaches 0 for all +buckets) to maintain the last uclamp.max and prevent blocked util from +suddenly becoming visible. + +However, there is an asymmetry in how the flag is set and cleared which +can lead to having the flag set whilst there are active tasks on the rq. +Specifically, the flag is cleared in the uclamp_rq_inc() path, which is +called at enqueue time, but set in uclamp_rq_dec_id() which is called +both when dequeueing a task _and_ in the update_uclamp_active() path. As +a result, when both uclamp_rq_{dec,ind}_id() are called from +update_uclamp_active(), the flag ends up being set but not cleared, +hence leaving the runqueue in a broken state. + +Fix this by clearing the flag in update_uclamp_active() as well. + +Fixes: e496187da710 ("sched/uclamp: Enforce last task's UCLAMP_MAX") +Reported-by: Rick Yiu +Signed-off-by: Quentin Perret +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Qais Yousef +Tested-by: Dietmar Eggemann +Link: https://lore.kernel.org/r/20210805102154.590709-2-qperret@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f3b27c6c5153..a2403432f3ab 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1633,6 +1633,23 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p) + uclamp_rq_dec_id(rq, p, clamp_id); + } + ++static inline void uclamp_rq_reinc_id(struct rq *rq, struct task_struct *p, ++ enum uclamp_id clamp_id) ++{ ++ if (!p->uclamp[clamp_id].active) ++ return; ++ ++ uclamp_rq_dec_id(rq, p, clamp_id); ++ uclamp_rq_inc_id(rq, p, clamp_id); ++ ++ /* ++ * Make sure to clear the idle flag if we've transiently reached 0 ++ * active tasks on rq. ++ */ ++ if (clamp_id == UCLAMP_MAX && (rq->uclamp_flags & UCLAMP_FLAG_IDLE)) ++ rq->uclamp_flags &= ~UCLAMP_FLAG_IDLE; ++} ++ + static inline void + uclamp_update_active(struct task_struct *p) + { +@@ -1656,12 +1673,8 @@ uclamp_update_active(struct task_struct *p) + * affecting a valid clamp bucket, the next time it's enqueued, + * it will already see the updated clamp bucket value. + */ +- for_each_clamp_id(clamp_id) { +- if (p->uclamp[clamp_id].active) { +- uclamp_rq_dec_id(rq, p, clamp_id); +- uclamp_rq_inc_id(rq, p, clamp_id); +- } +- } ++ for_each_clamp_id(clamp_id) ++ uclamp_rq_reinc_id(rq, p, clamp_id); + + task_rq_unlock(rq, p, &rf); + } +-- +2.30.2 + diff --git a/queue-5.14/sched-numa-fix-is_core_idle.patch b/queue-5.14/sched-numa-fix-is_core_idle.patch new file mode 100644 index 00000000000..7c1d7763708 --- /dev/null +++ b/queue-5.14/sched-numa-fix-is_core_idle.patch @@ -0,0 +1,42 @@ +From 4eb16d3b3b997d7c3c6b65e0e7a102474efb1d0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 09:39:46 +0300 +Subject: sched/numa: Fix is_core_idle() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mika Penttilä + +[ Upstream commit 1c6829cfd3d5124b125e6df41158665aea413b35 ] + +Use the loop variable instead of the function argument to test the +other SMT siblings for idle. + +Fixes: ff7db0bf24db ("sched/numa: Prefer using an idle CPU as a migration target instead of comparing tasks") +Signed-off-by: Mika Penttilä +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Mel Gorman +Acked-by: Pankaj Gupta +Link: https://lkml.kernel.org/r/20210722063946.28951-1-mika.penttila@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 44c452072a1b..30a6984a58f7 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -1486,7 +1486,7 @@ static inline bool is_core_idle(int cpu) + if (cpu == sibling) + continue; + +- if (!idle_cpu(cpu)) ++ if (!idle_cpu(sibling)) + return false; + } + #endif +-- +2.30.2 + diff --git a/queue-5.14/sched-topology-skip-updating-masks-for-non-online-no.patch b/queue-5.14/sched-topology-skip-updating-masks-for-non-online-no.patch new file mode 100644 index 00000000000..53505561809 --- /dev/null +++ b/queue-5.14/sched-topology-skip-updating-masks-for-non-online-no.patch @@ -0,0 +1,132 @@ +From a05ccc9de8416adfe07b15a4bc2858cce00d6e68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 13:13:33 +0530 +Subject: sched/topology: Skip updating masks for non-online nodes + +From: Valentin Schneider + +[ Upstream commit 0083242c93759dde353a963a90cb351c5c283379 ] + +The scheduler currently expects NUMA node distances to be stable from +init onwards, and as a consequence builds the related data structures +once-and-for-all at init (see sched_init_numa()). + +Unfortunately, on some architectures node distance is unreliable for +offline nodes and may very well change upon onlining. + +Skip over offline nodes during sched_init_numa(). Track nodes that have +been onlined at least once, and trigger a build of a node's NUMA masks +when it is first onlined post-init. + +Reported-by: Geetika Moolchandani +Signed-off-by: Srikar Dronamraju +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210818074333.48645-1-srikar@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/topology.c | 65 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index b77ad49dc14f..4e8698e62f07 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1482,6 +1482,8 @@ int sched_max_numa_distance; + static int *sched_domains_numa_distance; + static struct cpumask ***sched_domains_numa_masks; + int __read_mostly node_reclaim_distance = RECLAIM_DISTANCE; ++ ++static unsigned long __read_mostly *sched_numa_onlined_nodes; + #endif + + /* +@@ -1833,6 +1835,16 @@ void sched_init_numa(void) + sched_domains_numa_masks[i][j] = mask; + + for_each_node(k) { ++ /* ++ * Distance information can be unreliable for ++ * offline nodes, defer building the node ++ * masks to its bringup. ++ * This relies on all unique distance values ++ * still being visible at init time. ++ */ ++ if (!node_online(j)) ++ continue; ++ + if (sched_debug() && (node_distance(j, k) != node_distance(k, j))) + sched_numa_warn("Node-distance not symmetric"); + +@@ -1886,6 +1898,53 @@ void sched_init_numa(void) + sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1]; + + init_numa_topology_type(); ++ ++ sched_numa_onlined_nodes = bitmap_alloc(nr_node_ids, GFP_KERNEL); ++ if (!sched_numa_onlined_nodes) ++ return; ++ ++ bitmap_zero(sched_numa_onlined_nodes, nr_node_ids); ++ for_each_online_node(i) ++ bitmap_set(sched_numa_onlined_nodes, i, 1); ++} ++ ++static void __sched_domains_numa_masks_set(unsigned int node) ++{ ++ int i, j; ++ ++ /* ++ * NUMA masks are not built for offline nodes in sched_init_numa(). ++ * Thus, when a CPU of a never-onlined-before node gets plugged in, ++ * adding that new CPU to the right NUMA masks is not sufficient: the ++ * masks of that CPU's node must also be updated. ++ */ ++ if (test_bit(node, sched_numa_onlined_nodes)) ++ return; ++ ++ bitmap_set(sched_numa_onlined_nodes, node, 1); ++ ++ for (i = 0; i < sched_domains_numa_levels; i++) { ++ for (j = 0; j < nr_node_ids; j++) { ++ if (!node_online(j) || node == j) ++ continue; ++ ++ if (node_distance(j, node) > sched_domains_numa_distance[i]) ++ continue; ++ ++ /* Add remote nodes in our masks */ ++ cpumask_or(sched_domains_numa_masks[i][node], ++ sched_domains_numa_masks[i][node], ++ sched_domains_numa_masks[0][j]); ++ } ++ } ++ ++ /* ++ * A new node has been brought up, potentially changing the topology ++ * classification. ++ * ++ * Note that this is racy vs any use of sched_numa_topology_type :/ ++ */ ++ init_numa_topology_type(); + } + + void sched_domains_numa_masks_set(unsigned int cpu) +@@ -1893,8 +1952,14 @@ void sched_domains_numa_masks_set(unsigned int cpu) + int node = cpu_to_node(cpu); + int i, j; + ++ __sched_domains_numa_masks_set(node); ++ + for (i = 0; i < sched_domains_numa_levels; i++) { + for (j = 0; j < nr_node_ids; j++) { ++ if (!node_online(j)) ++ continue; ++ ++ /* Set ourselves in the remote node's masks */ + if (node_distance(j, node) <= sched_domains_numa_distance[i]) + cpumask_set_cpu(cpu, sched_domains_numa_masks[i][j]); + } +-- +2.30.2 + diff --git a/queue-5.14/selftests-bpf-fix-bpf-iter-tcp4-test-to-print-correc.patch b/queue-5.14/selftests-bpf-fix-bpf-iter-tcp4-test-to-print-correc.patch new file mode 100644 index 00000000000..ff92eab22f5 --- /dev/null +++ b/queue-5.14/selftests-bpf-fix-bpf-iter-tcp4-test-to-print-correc.patch @@ -0,0 +1,38 @@ +From 8af87ca148d081d22479ea4b1119aa6168aa7d13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 18:40:36 +0200 +Subject: selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP + +From: Jose Blanquicet + +[ Upstream commit 277b134057036df8c657079ca92c3e5e7d10aeaf ] + +Currently, this test is incorrectly printing the destination port in +place of the destination IP. + +Fixes: 2767c97765cb ("selftests/bpf: Implement sample tcp/tcp6 bpf_iter programs") +Signed-off-by: Jose Blanquicet +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20210805164044.527903-1-josebl@microsoft.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c +index 2e4775c35414..92267abb462f 100644 +--- a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c ++++ b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c +@@ -121,7 +121,7 @@ static int dump_tcp_sock(struct seq_file *seq, struct tcp_sock *tp, + } + + BPF_SEQ_PRINTF(seq, "%4d: %08X:%04X %08X:%04X ", +- seq_num, src, srcp, destp, destp); ++ seq_num, src, srcp, dest, destp); + BPF_SEQ_PRINTF(seq, "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d ", + state, + tp->write_seq - tp->snd_una, rx_queue, +-- +2.30.2 + diff --git a/queue-5.14/selftests-bpf-fix-test_core_autosize-on-big-endian-m.patch b/queue-5.14/selftests-bpf-fix-test_core_autosize-on-big-endian-m.patch new file mode 100644 index 00000000000..c9aa5873edd --- /dev/null +++ b/queue-5.14/selftests-bpf-fix-test_core_autosize-on-big-endian-m.patch @@ -0,0 +1,76 @@ +From abaf63d05a45776df1e3852ce46ec9b57350cd11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 00:48:14 +0200 +Subject: selftests/bpf: Fix test_core_autosize on big-endian machines + +From: Ilya Leoshkevich + +[ Upstream commit d164dd9a5c08c16a883b3de97d13948c7be7fa4d ] + +The "probed" part of test_core_autosize copies an integer using +bpf_core_read() into an integer of a potentially different size. +On big-endian machines a destination offset is required for this to +produce a sensible result. + +Fixes: 888d83b961f6 ("selftests/bpf: Validate libbpf's auto-sizing of LD/ST/STX instructions") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210812224814.187460-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_core_autosize.c | 20 ++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_core_autosize.c b/tools/testing/selftests/bpf/progs/test_core_autosize.c +index 44f5aa2e8956..9a7829c5e4a7 100644 +--- a/tools/testing/selftests/bpf/progs/test_core_autosize.c ++++ b/tools/testing/selftests/bpf/progs/test_core_autosize.c +@@ -125,6 +125,16 @@ int handle_downsize(void *ctx) + return 0; + } + ++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ ++#define bpf_core_read_int bpf_core_read ++#else ++#define bpf_core_read_int(dst, sz, src) ({ \ ++ /* Prevent "subtraction from stack pointer prohibited" */ \ ++ volatile long __off = sizeof(*dst) - (sz); \ ++ bpf_core_read((char *)(dst) + __off, sz, src); \ ++}) ++#endif ++ + SEC("raw_tp/sys_enter") + int handle_probed(void *ctx) + { +@@ -132,23 +142,23 @@ int handle_probed(void *ctx) + __u64 tmp; + + tmp = 0; +- bpf_core_read(&tmp, bpf_core_field_size(in->ptr), &in->ptr); ++ bpf_core_read_int(&tmp, bpf_core_field_size(in->ptr), &in->ptr); + ptr_probed = tmp; + + tmp = 0; +- bpf_core_read(&tmp, bpf_core_field_size(in->val1), &in->val1); ++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val1), &in->val1); + val1_probed = tmp; + + tmp = 0; +- bpf_core_read(&tmp, bpf_core_field_size(in->val2), &in->val2); ++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val2), &in->val2); + val2_probed = tmp; + + tmp = 0; +- bpf_core_read(&tmp, bpf_core_field_size(in->val3), &in->val3); ++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val3), &in->val3); + val3_probed = tmp; + + tmp = 0; +- bpf_core_read(&tmp, bpf_core_field_size(in->val4), &in->val4); ++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val4), &in->val4); + val4_probed = tmp; + + return 0; +-- +2.30.2 + diff --git a/queue-5.14/series b/queue-5.14/series new file mode 100644 index 00000000000..831c2f0d919 --- /dev/null +++ b/queue-5.14/series @@ -0,0 +1,294 @@ +locking-mutex-fix-handoff-condition.patch +regmap-fix-the-offset-of-register-error-log.patch +regulator-tps65910-silence-deferred-probe-error.patch +crypto-mxs-dcp-check-for-dma-mapping-errors.patch +sched-deadline-fix-reset_on_fork-reporting-of-dl-tas.patch +power-supply-axp288_fuel_gauge-report-register-addre.patch +crypto-omap-sham-clear-dma-flags-only-after-omap_sha.patch +sched-deadline-fix-missing-clock-update-in-migrate_t.patch +rcu-tree-handle-vm-stoppage-in-stall-detection.patch +edac-mce_amd-do-not-load-edac_mce_amd-module-on-gues.patch +posix-cpu-timers-force-next-expiration-recalc-after-.patch +hrtimer-avoid-double-reprogramming-in-__hrtimer_star.patch +hrtimer-ensure-timerfd-notification-for-highres-n.patch +udf-check-lvid-earlier.patch +udf-fix-iocharset-utf8-mount-option.patch +isofs-joliet-fix-iocharset-utf8-mount-option.patch +bcache-add-proper-error-unwinding-in-bcache_device_i.patch +nbd-add-the-check-to-prevent-overflow-in-__nbd_ioctl.patch +blk-throtl-optimize-iops-throttle-for-large-io-scena.patch +nvme-tcp-don-t-update-queue-count-when-failing-to-se.patch +nvme-rdma-don-t-update-queue-count-when-failing-to-s.patch +nvmet-pass-back-cntlid-on-successful-completion.patch +power-supply-smb347-charger-add-missing-pin-control-.patch +power-supply-max17042_battery-fix-typo-in-max17042_t.patch +s390-cio-add-dev_busid-sysfs-entry-for-each-subchann.patch +s390-zcrypt-fix-wrong-offset-index-for-apka-master-k.patch +libata-fix-ata_host_start.patch +sched-topology-skip-updating-masks-for-non-online-no.patch +crypto-omap-fix-inconsistent-locking-of-device-lists.patch +crypto-qat-do-not-ignore-errors-from-enable_vf2pf_co.patch +crypto-qat-handle-both-source-of-interrupt-in-vf-isr.patch +crypto-qat-fix-reuse-of-completion-variable.patch +crypto-qat-fix-naming-for-init-shutdown-vf-to-pf-not.patch +crypto-qat-do-not-export-adf_iov_putmsg.patch +crypto-hisilicon-sec-fix-the-abnormal-exiting-proces.patch +crypto-hisilicon-sec-modify-the-hardware-endian-conf.patch +crypto-tcrypt-fix-missing-return-value-check.patch +fcntl-fix-potential-deadlocks-for-fown_struct.lock.patch +fcntl-fix-potential-deadlock-for-fasync_struct.fa_lo.patch +udf_get_extendedattr-had-no-boundary-checks.patch +io-wq-remove-gfp_atomic-allocation-off-schedule-out-.patch +s390-kasan-fix-large-pmd-pages-address-alignment-che.patch +s390-pci-fix-misleading-rc-in-clp_set_pci_fn.patch +s390-debug-keep-debug-data-on-resize.patch +s390-debug-fix-debug-area-life-cycle.patch +s390-ap-fix-state-machine-hang-after-failure-to-enab.patch +s390-smp-enable-dat-before-cpu-restart-callback-is-c.patch +sched-debug-don-t-update-sched_domain-debug-director.patch +power-supply-cw2015-use-dev_err_probe-to-allow-defer.patch +m68k-emu-fix-invalid-free-in-nfeth_cleanup.patch +crypto-x86-aes-ni-add-missing-error-checks-in-xts-co.patch +crypto-ecc-handle-unaligned-input-buffer-in-ecc_swap.patch +sched-numa-fix-is_core_idle.patch +sched-fix-uclamp_flag_idle-setting.patch +rcu-fix-to-include-first-blocked-task-in-stall-warni.patch +rcu-fix-stall-warning-deadlock-due-to-non-release-of.patch +m68k-fix-invalid-rmw_insns-on-cpus-that-lack-cas.patch +block-return-elevator_discard_merge-if-possible.patch +spi-spi-fsl-dspi-fix-issue-with-uninitialized-dma_sl.patch +spi-spi-pic32-fix-issue-with-uninitialized-dma_slave.patch +genirq-timings-fix-error-return-code-in-irq_timings_.patch +irqchip-loongson-pch-pic-improve-edge-triggered-inte.patch +lib-mpi-use-kcalloc-in-mpi_resize.patch +clocksource-drivers-sh_cmt-fix-wrong-setting-if-don-.patch +nbd-do-del_gendisk-asynchronously-for-nbd_destroy_on.patch +block-nbd-add-sanity-check-for-first_minor.patch +spi-coldfire-qspi-use-clk_disable_unprepare-in-the-r.patch +irqchip-apple-aic-fix-irq_disable-from-within-irq-ha.patch +irqchip-gic-v3-fix-priority-comparison-when-non-secu.patch +crypto-qat-use-proper-type-for-vf_mask.patch +m68k-fix-asm-register-constraints-for-atomic-ops.patch +certs-trigger-creation-of-rsa-module-signing-key-if-.patch +tpm-ibmvtpm-avoid-error-message-when-process-gets-si.patch +edac-i10nm-fix-nvdimm-detection.patch +x86-mce-defer-processing-of-early-errors.patch +spi-davinci-invoke-chipselect-callback.patch +blk-crypto-fix-check-for-too-large-dun_bytes.patch +regulator-vctrl-use-locked-regulator_get_voltage-in-.patch +regulator-vctrl-avoid-lockdep-warning-in-enable-disa.patch +spi-sprd-fix-the-wrong-wdg_load_val.patch +spi-spi-zynq-qspi-use-wait_for_completion_timeout-to.patch +drm-panfrost-fix-missing-clk_disable_unprepare-on-er.patch +drm-gma500-fix-end-of-loop-tests-for-list_for_each_e.patch +asoc-mediatek-mt8192-fix-unbalanced-pm_runtime_enabl.patch +asoc-mediatek-mt8183-fix-unbalanced-pm_runtime_enabl.patch +asoc-tlv320aic32x4-fix-tas2505-tas2521-channel-count.patch +media-atmel-atmel-sama5d2-isc-fix-yuyv-format.patch +media-tda1997x-enable-edid-support.patch +leds-is31fl32xx-fix-missing-error-code-in-is31fl32xx.patch +soc-rockchip-rockchip_grf-should-not-default-to-y-un.patch +media-cxd2880-spi-fix-an-error-handling-path.patch +drm-of-free-the-right-object.patch +bpf-fix-a-typo-of-reuseport-map-in-bpf.h.patch +bpf-fix-potential-memleak-and-uaf-in-the-verifier.patch +drm-of-free-the-iterator-object-on-failure.patch +gve-fix-the-wrong-adminq-buffer-overflow-check.patch +libbpf-fix-the-possible-memory-leak-on-error.patch +arm-dts-aspeed-g6-fix-hvi3c-function-group-in-pinctr.patch +arm-dts-everest-add-phase-corrections-for-emmc.patch +arm64-dts-renesas-r8a77995-draak-remove-bogus-adv751.patch +i40e-improve-locking-of-mac_filter_hash.patch +arm64-dts-qcom-sc7180-set-adau-wakeup-delay-to-80-ms.patch +soc-qcom-rpmhpd-use-corner-in-power_off.patch +libbpf-fix-removal-of-inner-map-in-bpf_object__creat.patch +gfs2-fix-memory-leak-of-object-lsi-on-error-return-p.patch +arm64-dts-qcom-sm8250-fix-usb2-qmp-phy-node.patch +bpf-selftests-fix-test_maps-now-that-sockmap-support.patch +firmware-fix-theoretical-uaf-race-with-firmware-cach.patch +driver-core-fix-error-return-code-in-really_probe.patch +ionic-cleanly-release-devlink-instance.patch +media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch +media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch +media-dvb-usb-fix-error-handling-in-dvb_usb_i2c_init.patch +net-usb-asix-ax88772-add-missing-stop.patch +media-go7007-fix-memory-leak-in-go7007_usb_probe.patch +media-go7007-remove-redundant-initialization.patch +media-v4l2-subdev-fix-some-null-vs-is_err-checks.patch +media-rockchip-rga-fix-error-handling-in-probe.patch +media-coda-fix-frame_mem_ctrl-for-yuv420-and-yvu420-.patch +media-atomisp-fix-the-uninitialized-use-and-rename-r.patch +bluetooth-sco-prevent-information-leak-in-sco_conn_d.patch +bluetooth-btusb-fix-a-unspported-condition-to-set-av.patch +6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch +drm-amdgpu-acp-make-pm-domain-really-work.patch +drm-amd-pm-fix-a-bug-communicating-with-the-smu-v5.patch +tcp-seq_file-avoid-skipping-sk-during-tcp_seek_last_.patch +arm-dts-meson8-use-a-higher-default-gpu-clock-freque.patch +arm-dts-meson8b-odroidc1-fix-the-pwm-regulator-suppl.patch +arm-dts-meson8b-mxq-fix-the-pwm-regulator-supply-pro.patch +arm-dts-meson8b-ec100-fix-the-pwm-regulator-supply-p.patch +net-mlx5e-prohibit-inner-indir-tirs-in-ipoib.patch +net-mlx5e-block-lro-if-firmware-asks-for-tunneled-lr.patch +cgroup-cpuset-fix-a-partition-bug-with-hotplug.patch +drm-mxsfb-enable-recovery-on-underflow.patch +drm-mxsfb-increase-number-of-outstanding-requests-on.patch +drm-mxsfb-clear-fifo_clear-bit.patch +net-cipso-fix-warnings-in-netlbl_cipsov4_add_std.patch +net-ti-am65-cpsw-nuss-fix-wrong-devlink-release-orde.patch +drm-rcar-du-don-t-put-reference-to-drm_device-in-rca.patch +bluetooth-mgmt-fix-wrong-opcode-in-the-response-for-.patch +drm-amd-pm-fix-a-bug-in-semaphore-double-lock.patch +lib-test_scanf-handle-n_bits-0-in-random-tests.patch +libbpf-return-non-null-error-on-failures-in-libbpf_f.patch +tools-free-btf-objects-at-various-locations.patch +arm64-dts-renesas-hihope-rzg2-ex-add-etheravb-intern.patch +devlink-break-parameter-notification-sequence-to-be-.patch +drm-bridge-ti-sn65dsi86-don-t-read-edid-blob-over-dd.patch +drm-bridge-ti-sn65dsi86-improve-probe-errors-with-de.patch +drm-bridge-ti-sn65dsi86-wrap-panel-with-panel-bridge.patch +drm-bridge-ti-sn65dsi86-fix-power-off-sequence.patch +drm-bridge-ti-sn65dsi86-add-some-100-us-delays.patch +net-mlx5-fix-missing-return-value-in-mlx5_devlink_es.patch +i2c-highlander-add-irq-check.patch +leds-lgm-sso-put-fwnode-in-any-case-during-probe.patch +leds-lgm-sso-don-t-spam-logs-when-probe-is-deferred.patch +leds-lt3593-put-fwnode-in-any-case-during-probe.patch +leds-rt8515-put-fwnode-in-any-case-during-probe.patch +leds-trigger-audio-add-an-activate-callback-to-ensur.patch +media-em28xx-input-fix-refcount-bug-in-em28xx_usb_di.patch +media-omap3isp-fix-missing-unlock-in-isp_subdev_noti.patch +media-venus-hfi-fix-return-value-check-in-sys_get_pr.patch +media-venus-venc-fix-potential-null-pointer-derefere.patch +media-venus-helper-do-not-set-constrained-parameters.patch +soc-mmsys-mediatek-add-mask-to-mmsys-routes.patch +pci-pm-avoid-forcing-pci_d0-for-wakeup-reasons-incon.patch +pci-pm-enable-pme-if-it-can-be-signaled-from-d3cold.patch +bpf-samples-add-missing-mprog-disable-to-xdp_redirec.patch +soc-qcom-smsm-fix-missed-interrupts-if-state-changes.patch +net-dsa-build-tag_8021q.c-as-part-of-dsa-core.patch +net-dsa-tag_sja1105-optionally-build-as-module-when-.patch +debugfs-return-error-during-full-open-_proxy_open-on.patch +bluetooth-increase-btnamsiz-to-21-chars-to-fix-poten.patch +arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch +arm64-dts-qcom-sm8350-fix-ipa-interconnects.patch +drm-bridge-it66121-check-drm_bridge_attach-retval.patch +net-ti-am65-cpsw-nuss-fix-rx-irq-state-after-.ndo_st.patch +net-dsa-stop-syncing-the-bridge-mcast_router-attribu.patch +net-dsa-mt7530-remove-the-.port_set_mrouter-implemen.patch +net-dsa-don-t-disable-multicast-flooding-to-the-cpu-.patch +pm-em-increase-energy-calculation-precision.patch +selftests-bpf-fix-bpf-iter-tcp4-test-to-print-correc.patch +leds-lgm-sso-propagate-error-codes-from-callee-to-ca.patch +drm-msm-fix-error-return-code-in-msm_drm_init.patch +drm-msm-mdp4-refactor-hw-revision-detection-into-rea.patch +drm-msm-mdp4-move-hw-revision-detection-to-earlier-p.patch +drm-msm-dp-update-is_connected-status-base-on-sink-c.patch +drm-msm-dpu-make-dpu_hw_ctl_clear_all_blendstages-cl.patch +arm64-dts-exynos-correct-gic-cpu-interfaces-address-.patch +counter-104-quad-8-return-error-when-invalid-mode-du.patch +cgroup-cpuset-miscellaneous-code-cleanup.patch +cgroup-cpuset-fix-violation-of-cpuset-locking-rule.patch +asoc-intel-fix-platform-id-matching.patch +bluetooth-fix-repeated-calls-to-sco_sock_kill.patch +drm-msm-dsi-fix-some-reference-counted-resource-leak.patch +drm-msm-dp-replug-event-is-converted-into-an-unplug-.patch +net-mlx5-fix-unpublish-devlink-parameters.patch +asoc-rt5682-properly-turn-off-regulators-if-wrong-de.patch +drm-bridge-ti-sn65dsi86-avoid-creating-multiple-conn.patch +usb-dwc3-meson-g12a-add-irq-check.patch +usb-dwc3-qcom-add-irq-check.patch +usb-gadget-udc-at91-add-irq-check.patch +usb-gadget-udc-s3c2410-add-irq-check.patch +mac80211-remove-unnecessary-null-check-in-ieee80211_.patch +usb-misc-brcmstb-usb-pinmap-add-irq-check.patch +usb-phy-fsl-usb-add-irq-check.patch +usb-phy-twl6030-add-irq-checks.patch +usb-gadget-udc-renesas_usb3-fix-soc_device_match-abu.patch +selftests-bpf-fix-test_core_autosize-on-big-endian-m.patch +devlink-clear-whole-devlink_flash_notify-struct.patch +samples-pktgen-add-missing-ipv6-option-to-pktgen-scr.patch +net-stmmac-fix-intr-tbu-status-affecting-irq-count-s.patch +bluetooth-move-shutdown-callback-before-flushing-tx-.patch +pm-cpu-make-notifier-chain-use-a-raw_spinlock_t.patch +usb-host-ohci-tmio-add-irq-check.patch +usb-phy-tahvo-add-irq-check.patch +libbpf-re-build-libbpf.so-when-libbpf.map-changes.patch +mac80211-fix-insufficient-headroom-issue-for-amsdu.patch +locking-local_lock-add-missing-owner-initialization.patch +lockd-fix-invalid-lockowner-cast-after-vfs_test_lock.patch +sunrpc-fix-a-null-pointer-deref-in-trace_svc_stats_l.patch +nfsd4-fix-forced-expiry-locking.patch +arm64-dts-marvell-armada-37xx-extend-pcie-mem-space.patch +clk-staging-correct-reference-to-config-iomem-to-con.patch +i2c-synquacer-fix-deferred-probing.patch +hwmon-pmbus-bpa-rs600-don-t-use-rated-limits-as-warn.patch +hwmon-remove-amd_energy-driver-in-makefile.patch +asoc-fsl_rpmsg-check-eprobe_defer-for-getting-clocks.patch +firmware-raspberrypi-fix-a-leak-in-rpi_firmware_get.patch +usb-gadget-mv_u3d-request_irq-after-initializing-udc.patch +mm-swap-consider-max-pages-in-iomap_swapfile_add_ext.patch +lkdtm-replace-scsi_dispatch_cmd-with-scsi_queue_rq.patch +bluetooth-add-timeout-sanity-check-to-hci_inquiry.patch +i2c-iop3xx-fix-deferred-probing.patch +i2c-s3c2410-fix-irq-check.patch +i2c-hix5hd2-fix-irq-check.patch +gfs2-init-system-threads-before-freeze-lock.patch +drm-exynos-g2d-fix-missing-unlock-on-error-in-g2d_ru.patch +rsi-fix-error-code-in-rsi_load_9116_firmware.patch +rsi-fix-an-error-code-in-rsi_probe.patch +octeontx2-af-cn10k-fix-sdp-base-channel-number.patch +octeontx2-pf-send-correct-vlan-priority-mask-to-npc_.patch +octeontx2-af-check-capability-flag-while-freeing-ipo.patch +octeontx2-pf-don-t-install-vlan-offload-rule-if-netd.patch +octeontx2-pf-fix-algorithm-index-in-mcam-rules-with-.patch +octeontx2-af-cn10k-use-flit0-register-instead-of-fli.patch +m68k-coldfire-return-success-for-clk_enable-null.patch +asoc-intel-kbl_da7219_max98927-fix-format-selection-.patch +asoc-intel-skylake-leave-data-as-is-when-invoking-tl.patch +asoc-intel-skylake-fix-module-resource-and-format-se.patch +mmc-sdhci-fix-issue-with-uninitialized-dma_slave_con.patch +mmc-dw_mmc-fix-issue-with-uninitialized-dma_slave_co.patch +mmc-moxart-fix-issue-with-uninitialized-dma_slave_co.patch +asoc-wm_adsp-put-debugfs_remove_recursive-back-in.patch +bpf-fix-possible-out-of-bound-write-in-narrow-load-h.patch +hv_utils-set-the-maximum-packet-size-for-vss-driver-.patch +cifs-fix-a-potencially-linear-read-overflow.patch +i2c-mt65xx-fix-irq-check.patch +i2c-xlp9xx-fix-main-irq-check.patch +octeontx2-pf-cn10k-fix-error-return-code-in-otx2_set.patch +usb-ehci-orion-handle-errors-of-clk_prepare_enable-i.patch +usb-bdc-fix-an-error-handling-path-in-bdc_probe-when.patch +usb-bdc-fix-a-resource-leak-in-the-error-handling-pa.patch +tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch +asoc-wcd9335-fix-a-double-irq-free-in-the-remove-fun.patch +asoc-wcd9335-fix-a-memory-leak-in-the-error-handling.patch +asoc-wcd9335-disable-irq-on-slave-ports-in-the-remov.patch +iwlwifi-skip-first-element-in-the-wtas-acpi-table.patch +net-mlx5-lag-fix-multipath-lag-activation.patch +net-mlx5-remove-all-auxiliary-devices-at-the-unregis.patch +net-mlx5e-fix-possible-use-after-free-deleting-fdb-r.patch +net-mlx5-e-switch-set-vhca-id-valid-flag-when-creati.patch +net-mlx5e-use-correct-eswitch-for-stack-devices-with.patch +misc-pvpanic-fix-set-driver-data.patch +ice-fix-tx-queue-iteration-for-tx-timestamp-enableme.patch +ice-add-lock-around-tx-timestamp-tracker-flush.patch +ice-restart-periodic-outputs-around-time-changes.patch +ice-only-lock-to-update-netdev-dev_addr.patch +net-phy-marvell10g-fix-broken-phy-interrupts-for-any.patch +ath6kl-wmi-fix-an-error-code-in-ath6kl_wmi_sync_poin.patch +alsa-usb-audio-add-lowlatency-module-option.patch +atlantic-fix-driver-resume-flow.patch +bcma-fix-memory-leak-for-internally-handled-cores.patch +brcmfmac-pcie-fix-oops-on-failure-to-resume-and-repr.patch +ipv6-make-exception-cache-less-predictible.patch +ipv4-make-exception-cache-less-predictible.patch +net-qrtr-make-checks-in-qrtr_endpoint_post-stricter.patch +sch_htb-fix-inconsistency-when-leaf-qdisc-creation-f.patch +net-sched-fix-qdisc_rate_table-refcount-leak-when-ge.patch +net-qualcomm-fix-qca7000-checksum-handling.patch +octeontx2-af-fix-loop-in-free-and-unmap-counter.patch +octeontx2-af-fix-mailbox-errors-in-nix_rss_flowkey_c.patch +octeontx2-af-fix-static-code-analyzer-reported-issue.patch +octeontx2-af-set-proper-errorcode-for-ipv4-checksum-.patch +ipv4-fix-endianness-issue-in-inet_rtm_getroute_build.patch diff --git a/queue-5.14/soc-mmsys-mediatek-add-mask-to-mmsys-routes.patch b/queue-5.14/soc-mmsys-mediatek-add-mask-to-mmsys-routes.patch new file mode 100644 index 00000000000..00925bded2e --- /dev/null +++ b/queue-5.14/soc-mmsys-mediatek-add-mask-to-mmsys-routes.patch @@ -0,0 +1,365 @@ +From a28039de816471c88e6bb4a448777c81a3899c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 09:05:49 +0200 +Subject: soc: mmsys: mediatek: add mask to mmsys routes + +From: CK Hu + +[ Upstream commit 7bdcead7a75e3eab5e711c2da78c2a0360e7f2a4 ] + +SOUT has many bits and need to be cleared before set new value. +Write only could do the clear, but for MOUT, it clears bits that +should not be cleared. So use a mask to reset only the needed bits. + +this fixes HDMI issues on MT7623/BPI-R2 since 5.13 + +Fixes: 440147639ac7 ("soc: mediatek: mmsys: Use an array for setting the routing registers") +Signed-off-by: Frank Wunderlich +Signed-off-by: CK Hu +Reviewed-by: Chun-Kuang Hu +Reviewed-by: Hsin-Yi Wang +Link: https://lore.kernel.org/r/20210729070549.5514-1-linux@fw-web.de +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mt8183-mmsys.h | 21 +++-- + drivers/soc/mediatek/mtk-mmsys.c | 7 +- + drivers/soc/mediatek/mtk-mmsys.h | 133 +++++++++++++++++++--------- + 3 files changed, 112 insertions(+), 49 deletions(-) + +diff --git a/drivers/soc/mediatek/mt8183-mmsys.h b/drivers/soc/mediatek/mt8183-mmsys.h +index 579dfc8dc8fc..9dee485807c9 100644 +--- a/drivers/soc/mediatek/mt8183-mmsys.h ++++ b/drivers/soc/mediatek/mt8183-mmsys.h +@@ -28,25 +28,32 @@ + static const struct mtk_mmsys_routes mmsys_mt8183_routing_table[] = { + { + DDP_COMPONENT_OVL0, DDP_COMPONENT_OVL_2L0, +- MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L ++ MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L, ++ MT8183_OVL0_MOUT_EN_OVL0_2L + }, { + DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0, +- MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0 ++ MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0, ++ MT8183_OVL0_2L_MOUT_EN_DISP_PATH0 + }, { + DDP_COMPONENT_OVL_2L1, DDP_COMPONENT_RDMA1, +- MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1 ++ MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1, ++ MT8183_OVL1_2L_MOUT_EN_RDMA1 + }, { + DDP_COMPONENT_DITHER, DDP_COMPONENT_DSI0, +- MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0 ++ MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0, ++ MT8183_DITHER0_MOUT_IN_DSI0 + }, { + DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0, +- MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L ++ MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L, ++ MT8183_DISP_PATH0_SEL_IN_OVL0_2L + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0, +- MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1 ++ MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1, ++ MT8183_DPI0_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_COLOR0, +- MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0 ++ MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0, ++ MT8183_RDMA0_SOUT_COLOR0 + } + }; + +diff --git a/drivers/soc/mediatek/mtk-mmsys.c b/drivers/soc/mediatek/mtk-mmsys.c +index 080660ef11bf..0f949896fd06 100644 +--- a/drivers/soc/mediatek/mtk-mmsys.c ++++ b/drivers/soc/mediatek/mtk-mmsys.c +@@ -68,7 +68,9 @@ void mtk_mmsys_ddp_connect(struct device *dev, + + for (i = 0; i < mmsys->data->num_routes; i++) + if (cur == routes[i].from_comp && next == routes[i].to_comp) { +- reg = readl_relaxed(mmsys->regs + routes[i].addr) | routes[i].val; ++ reg = readl_relaxed(mmsys->regs + routes[i].addr); ++ reg &= ~routes[i].mask; ++ reg |= routes[i].val; + writel_relaxed(reg, mmsys->regs + routes[i].addr); + } + } +@@ -85,7 +87,8 @@ void mtk_mmsys_ddp_disconnect(struct device *dev, + + for (i = 0; i < mmsys->data->num_routes; i++) + if (cur == routes[i].from_comp && next == routes[i].to_comp) { +- reg = readl_relaxed(mmsys->regs + routes[i].addr) & ~routes[i].val; ++ reg = readl_relaxed(mmsys->regs + routes[i].addr); ++ reg &= ~routes[i].mask; + writel_relaxed(reg, mmsys->regs + routes[i].addr); + } + } +diff --git a/drivers/soc/mediatek/mtk-mmsys.h b/drivers/soc/mediatek/mtk-mmsys.h +index a760a34e6eca..5f3e2bf0c40b 100644 +--- a/drivers/soc/mediatek/mtk-mmsys.h ++++ b/drivers/soc/mediatek/mtk-mmsys.h +@@ -35,41 +35,54 @@ + #define RDMA0_SOUT_DSI1 0x1 + #define RDMA0_SOUT_DSI2 0x4 + #define RDMA0_SOUT_DSI3 0x5 ++#define RDMA0_SOUT_MASK 0x7 + #define RDMA1_SOUT_DPI0 0x2 + #define RDMA1_SOUT_DPI1 0x3 + #define RDMA1_SOUT_DSI1 0x1 + #define RDMA1_SOUT_DSI2 0x4 + #define RDMA1_SOUT_DSI3 0x5 ++#define RDMA1_SOUT_MASK 0x7 + #define RDMA2_SOUT_DPI0 0x2 + #define RDMA2_SOUT_DPI1 0x3 + #define RDMA2_SOUT_DSI1 0x1 + #define RDMA2_SOUT_DSI2 0x4 + #define RDMA2_SOUT_DSI3 0x5 ++#define RDMA2_SOUT_MASK 0x7 + #define DPI0_SEL_IN_RDMA1 0x1 + #define DPI0_SEL_IN_RDMA2 0x3 ++#define DPI0_SEL_IN_MASK 0x3 + #define DPI1_SEL_IN_RDMA1 (0x1 << 8) + #define DPI1_SEL_IN_RDMA2 (0x3 << 8) ++#define DPI1_SEL_IN_MASK (0x3 << 8) + #define DSI0_SEL_IN_RDMA1 0x1 + #define DSI0_SEL_IN_RDMA2 0x4 ++#define DSI0_SEL_IN_MASK 0x7 + #define DSI1_SEL_IN_RDMA1 0x1 + #define DSI1_SEL_IN_RDMA2 0x4 ++#define DSI1_SEL_IN_MASK 0x7 + #define DSI2_SEL_IN_RDMA1 (0x1 << 16) + #define DSI2_SEL_IN_RDMA2 (0x4 << 16) ++#define DSI2_SEL_IN_MASK (0x7 << 16) + #define DSI3_SEL_IN_RDMA1 (0x1 << 16) + #define DSI3_SEL_IN_RDMA2 (0x4 << 16) ++#define DSI3_SEL_IN_MASK (0x7 << 16) + #define COLOR1_SEL_IN_OVL1 0x1 + + #define OVL_MOUT_EN_RDMA 0x1 + #define BLS_TO_DSI_RDMA1_TO_DPI1 0x8 + #define BLS_TO_DPI_RDMA1_TO_DSI 0x2 ++#define BLS_RDMA1_DSI_DPI_MASK 0xf + #define DSI_SEL_IN_BLS 0x0 + #define DPI_SEL_IN_BLS 0x0 ++#define DPI_SEL_IN_MASK 0x1 + #define DSI_SEL_IN_RDMA 0x1 ++#define DSI_SEL_IN_MASK 0x1 + + struct mtk_mmsys_routes { + u32 from_comp; + u32 to_comp; + u32 addr; ++ u32 mask; + u32 val; + }; + +@@ -91,124 +104,164 @@ struct mtk_mmsys_driver_data { + static const struct mtk_mmsys_routes mmsys_default_routing_table[] = { + { + DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0, +- DISP_REG_CONFIG_OUT_SEL, BLS_TO_DSI_RDMA1_TO_DPI1 ++ DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK, ++ BLS_TO_DSI_RDMA1_TO_DPI1 + }, { + DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0, +- DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_BLS ++ DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK, ++ DSI_SEL_IN_BLS + }, { + DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_OUT_SEL, BLS_TO_DPI_RDMA1_TO_DSI ++ DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK, ++ BLS_TO_DPI_RDMA1_TO_DSI + }, { + DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_RDMA ++ DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK, ++ DSI_SEL_IN_RDMA + }, { + DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_BLS ++ DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_MASK, ++ DPI_SEL_IN_BLS + }, { + DDP_COMPONENT_GAMMA, DDP_COMPONENT_RDMA1, +- DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1 ++ DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1, ++ GAMMA_MOUT_EN_RDMA1 + }, { + DDP_COMPONENT_OD0, DDP_COMPONENT_RDMA0, +- DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0 ++ DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0, ++ OD_MOUT_EN_RDMA0 + }, { + DDP_COMPONENT_OD1, DDP_COMPONENT_RDMA1, +- DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1 ++ DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1, ++ OD1_MOUT_EN_RDMA1 + }, { + DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0, +- DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0 ++ DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0, ++ OVL0_MOUT_EN_COLOR0 + }, { + DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0, +- DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0 ++ DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0, ++ COLOR0_SEL_IN_OVL0 + }, { + DDP_COMPONENT_OVL0, DDP_COMPONENT_RDMA0, +- DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA ++ DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA, ++ OVL_MOUT_EN_RDMA + }, { + DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1, +- DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1 ++ DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1, ++ OVL1_MOUT_EN_COLOR1 + }, { + DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1, +- DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1 ++ DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1, ++ COLOR1_SEL_IN_OVL1 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI0 ++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK, ++ RDMA0_SOUT_DPI0 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI1, +- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI1 ++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK, ++ RDMA0_SOUT_DPI1 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI1, +- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI1 ++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK, ++ RDMA0_SOUT_DSI1 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI2, +- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI2 ++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK, ++ RDMA0_SOUT_DSI2 + }, { + DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI3, +- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI3 ++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK, ++ RDMA0_SOUT_DSI3 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI0 ++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK, ++ RDMA1_SOUT_DPI0 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK, ++ DPI0_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1, +- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI1 ++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK, ++ RDMA1_SOUT_DPI1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1, +- DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK, ++ DPI1_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI0, +- DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK, ++ DSI0_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1, +- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI1 ++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK, ++ RDMA1_SOUT_DSI1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1, +- DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK, ++ DSI1_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2, +- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI2 ++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK, ++ RDMA1_SOUT_DSI2 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2, +- DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK, ++ DSI2_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3, +- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI3 ++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK, ++ RDMA1_SOUT_DSI3 + }, { + DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3, +- DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA1 ++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK, ++ DSI3_SEL_IN_RDMA1 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI0 ++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK, ++ RDMA2_SOUT_DPI0 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0, +- DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK, ++ DPI0_SEL_IN_RDMA2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1, +- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI1 ++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK, ++ RDMA2_SOUT_DPI1 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1, +- DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK, ++ DPI1_SEL_IN_RDMA2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI0, +- DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK, ++ DSI0_SEL_IN_RDMA2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1, +- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI1 ++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK, ++ RDMA2_SOUT_DSI1 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1, +- DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK, ++ DSI1_SEL_IN_RDMA2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2, +- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI2 ++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK, ++ RDMA2_SOUT_DSI2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2, +- DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK, ++ DSI2_SEL_IN_RDMA2 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3, +- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI3 ++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK, ++ RDMA2_SOUT_DSI3 + }, { + DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3, +- DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA2 ++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK, ++ DSI3_SEL_IN_RDMA2 + } + }; + +-- +2.30.2 + diff --git a/queue-5.14/soc-qcom-rpmhpd-use-corner-in-power_off.patch b/queue-5.14/soc-qcom-rpmhpd-use-corner-in-power_off.patch new file mode 100644 index 00000000000..0562744267c --- /dev/null +++ b/queue-5.14/soc-qcom-rpmhpd-use-corner-in-power_off.patch @@ -0,0 +1,56 @@ +From 4d8546ab2eafd5b82239bfaafd4cd12633f52afe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 17:54:15 -0700 +Subject: soc: qcom: rpmhpd: Use corner in power_off + +From: Bjorn Andersson + +[ Upstream commit d43b3a989bc8c06fd4bbb69a7500d180db2d68e8 ] + +rpmhpd_aggregate_corner() takes a corner as parameter, but in +rpmhpd_power_off() the code requests the level of the first corner +instead. + +In all (known) current cases the first corner has level 0, so this +change should be a nop, but in case that there's a power domain with a +non-zero lowest level this makes sure that rpmhpd_power_off() actually +requests the lowest level - which is the closest to "power off" we can +get. + +While touching the code, also skip the unnecessary zero-initialization +of "ret". + +Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver") +Reviewed-by: Rajendra Nayak +Reviewed-by: Stephen Boyd +Reviewed-by: Sibi Sankar +Tested-by: Sibi Sankar +Link: https://lore.kernel.org/r/20210703005416.2668319-2-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmhpd.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c +index 2daa17ba54a3..fa209b479ab3 100644 +--- a/drivers/soc/qcom/rpmhpd.c ++++ b/drivers/soc/qcom/rpmhpd.c +@@ -403,12 +403,11 @@ static int rpmhpd_power_on(struct generic_pm_domain *domain) + static int rpmhpd_power_off(struct generic_pm_domain *domain) + { + struct rpmhpd *pd = domain_to_rpmhpd(domain); +- int ret = 0; ++ int ret; + + mutex_lock(&rpmhpd_lock); + +- ret = rpmhpd_aggregate_corner(pd, pd->level[0]); +- ++ ret = rpmhpd_aggregate_corner(pd, 0); + if (!ret) + pd->enabled = false; + +-- +2.30.2 + diff --git a/queue-5.14/soc-qcom-smsm-fix-missed-interrupts-if-state-changes.patch b/queue-5.14/soc-qcom-smsm-fix-missed-interrupts-if-state-changes.patch new file mode 100644 index 00000000000..af2fed67290 --- /dev/null +++ b/queue-5.14/soc-qcom-smsm-fix-missed-interrupts-if-state-changes.patch @@ -0,0 +1,78 @@ +From 4065203d835eda3b5c6aed64130b1e4381f0f2df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jul 2021 15:57:03 +0200 +Subject: soc: qcom: smsm: Fix missed interrupts if state changes while masked + +From: Stephan Gerhold + +[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ] + +The SMSM driver detects interrupt edges by tracking the last state +it has seen (and has triggered the interrupt handler for). This works +fine, but only if the interrupt does not change state while masked. + +For example, if an interrupt is unmasked while the state is HIGH, +the stored last_value for that interrupt might still be LOW. Then, +when the remote processor triggers smsm_intr() we assume that nothing +has changed, even though the state might have changed from HIGH to LOW. + +Attempt to fix this by checking the current remote state before +unmasking an IRQ. Use atomic operations to avoid the interrupt handler +from interfering with the unmask function. + +This fixes modem crashes in some edge cases with the BAM-DMUX driver. +Specifically, the BAM-DMUX interrupt handler is not called for the +HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded +(and therefore unmasks the interrupt) after the modem was already started: + +qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188: + Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK + +Fixes: c97c4090ff72 ("soc: qcom: smsm: Add driver for Qualcomm SMSM") +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20210712135703.324748-2-stephan@gerhold.net +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/smsm.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c +index 1d3d5e3ec2b0..6e9a9cd28b17 100644 +--- a/drivers/soc/qcom/smsm.c ++++ b/drivers/soc/qcom/smsm.c +@@ -109,7 +109,7 @@ struct smsm_entry { + DECLARE_BITMAP(irq_enabled, 32); + DECLARE_BITMAP(irq_rising, 32); + DECLARE_BITMAP(irq_falling, 32); +- u32 last_value; ++ unsigned long last_value; + + u32 *remote_state; + u32 *subscription; +@@ -204,8 +204,7 @@ static irqreturn_t smsm_intr(int irq, void *data) + u32 val; + + val = readl(entry->remote_state); +- changed = val ^ entry->last_value; +- entry->last_value = val; ++ changed = val ^ xchg(&entry->last_value, val); + + for_each_set_bit(i, entry->irq_enabled, 32) { + if (!(changed & BIT(i))) +@@ -264,6 +263,12 @@ static void smsm_unmask_irq(struct irq_data *irqd) + struct qcom_smsm *smsm = entry->smsm; + u32 val; + ++ /* Make sure our last cached state is up-to-date */ ++ if (readl(entry->remote_state) & BIT(irq)) ++ set_bit(irq, &entry->last_value); ++ else ++ clear_bit(irq, &entry->last_value); ++ + set_bit(irq, entry->irq_enabled); + + if (entry->subscription) { +-- +2.30.2 + diff --git a/queue-5.14/soc-rockchip-rockchip_grf-should-not-default-to-y-un.patch b/queue-5.14/soc-rockchip-rockchip_grf-should-not-default-to-y-un.patch new file mode 100644 index 00000000000..925aae054be --- /dev/null +++ b/queue-5.14/soc-rockchip-rockchip_grf-should-not-default-to-y-un.patch @@ -0,0 +1,40 @@ +From 69ed3227528d2b892cbc4ea3107404167736fef1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 15:38:55 +0100 +Subject: soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally + +From: Geert Uytterhoeven + +[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ] + +Merely enabling CONFIG_COMPILE_TEST should not enable additional code. +To fix this, restrict the automatic enabling of ROCKCHIP_GRF to +ARCH_ROCKCHIP, and ask the user in case of compile-testing. + +Fixes: 4c58063d4258f6be ("soc: rockchip: add driver handling grf setup") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20210208143855.418374-1-geert+renesas@glider.be +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/soc/rockchip/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig +index 2c13bf4dd5db..25eb2c1e31bb 100644 +--- a/drivers/soc/rockchip/Kconfig ++++ b/drivers/soc/rockchip/Kconfig +@@ -6,8 +6,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST + # + + config ROCKCHIP_GRF +- bool +- default y ++ bool "Rockchip General Register Files support" if COMPILE_TEST ++ default y if ARCH_ROCKCHIP + help + The General Register Files are a central component providing + special additional settings registers for a lot of soc-components. +-- +2.30.2 + diff --git a/queue-5.14/spi-coldfire-qspi-use-clk_disable_unprepare-in-the-r.patch b/queue-5.14/spi-coldfire-qspi-use-clk_disable_unprepare-in-the-r.patch new file mode 100644 index 00000000000..657501dfca9 --- /dev/null +++ b/queue-5.14/spi-coldfire-qspi-use-clk_disable_unprepare-in-the-r.patch @@ -0,0 +1,37 @@ +From 51cb42248dacfb220be06fc6210efbc9932d395d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 22:55:56 +0200 +Subject: spi: coldfire-qspi: Use clk_disable_unprepare in the remove function + +From: Christophe JAILLET + +[ Upstream commit d68f4c73d729245a47e70eb216fa24bc174ed2e2 ] + +'clk_prepare_enable()' is used in the probe, so 'clk_disable_unprepare()' +should be used in the remove function to be consistent. + +Fixes: 499de01c5c0b ("spi: coldfire-qspi: Use clk_prepare_enable and clk_disable_unprepare") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ee91792ddba61342b0d3284cd4558a2b0016c4e7.1629319838.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-coldfire-qspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c +index 8996115ce736..263ce9047327 100644 +--- a/drivers/spi/spi-coldfire-qspi.c ++++ b/drivers/spi/spi-coldfire-qspi.c +@@ -444,7 +444,7 @@ static int mcfqspi_remove(struct platform_device *pdev) + mcfqspi_wr_qmr(mcfqspi, MCFQSPI_QMR_MSTR); + + mcfqspi_cs_teardown(mcfqspi); +- clk_disable(mcfqspi->clk); ++ clk_disable_unprepare(mcfqspi->clk); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.14/spi-davinci-invoke-chipselect-callback.patch b/queue-5.14/spi-davinci-invoke-chipselect-callback.patch new file mode 100644 index 00000000000..4047422e743 --- /dev/null +++ b/queue-5.14/spi-davinci-invoke-chipselect-callback.patch @@ -0,0 +1,50 @@ +From 10211e4dc1a27a7610a93fe760ec52ed0c12f327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 11:25:56 +0200 +Subject: spi: davinci: invoke chipselect callback + +From: Matija Glavinic Pecotic + +[ Upstream commit ea4ab99cb58cc9f8d64c0961ff9a059825f304cf ] + +Davinci needs to configure chipselect on transfer. + +Fixes: 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional") +Signed-off-by: Matija Glavinic Pecotic +Reviewed-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/735fb7b0-82aa-5b9b-85e4-53f0c348cc0e@nokia.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-davinci.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c +index e114e6fe5ea5..d112c2cac042 100644 +--- a/drivers/spi/spi-davinci.c ++++ b/drivers/spi/spi-davinci.c +@@ -213,12 +213,6 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value) + * line for the controller + */ + if (spi->cs_gpiod) { +- /* +- * FIXME: is this code ever executed? This host does not +- * set SPI_MASTER_GPIO_SS so this chipselect callback should +- * not get called from the SPI core when we are using +- * GPIOs for chip select. +- */ + if (value == BITBANG_CS_ACTIVE) + gpiod_set_value(spi->cs_gpiod, 1); + else +@@ -945,7 +939,7 @@ static int davinci_spi_probe(struct platform_device *pdev) + master->bus_num = pdev->id; + master->num_chipselect = pdata->num_chipselect; + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 16); +- master->flags = SPI_MASTER_MUST_RX; ++ master->flags = SPI_MASTER_MUST_RX | SPI_MASTER_GPIO_SS; + master->setup = davinci_spi_setup; + master->cleanup = davinci_spi_cleanup; + master->can_dma = davinci_spi_can_dma; +-- +2.30.2 + diff --git a/queue-5.14/spi-spi-fsl-dspi-fix-issue-with-uninitialized-dma_sl.patch b/queue-5.14/spi-spi-fsl-dspi-fix-issue-with-uninitialized-dma_sl.patch new file mode 100644 index 00000000000..8e94c22c9c6 --- /dev/null +++ b/queue-5.14/spi-spi-fsl-dspi-fix-issue-with-uninitialized-dma_sl.patch @@ -0,0 +1,48 @@ +From 33e6391f6e64268f953239b3ec7b465cb2550a91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:17:26 +0300 +Subject: spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config + +From: Tony Lindgren + +[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ] + +Depending on the DMA driver being used, the struct dma_slave_config may +need to be initialized to zero for the unused data. + +For example, we have three DMA drivers using src_port_window_size and +dst_port_window_size. If these are left uninitialized, it can cause DMA +failures. + +For spi-fsl-dspi, this is probably not currently an issue but is still +good to fix though. + +Fixes: 90ba37033cb9 ("spi: spi-fsl-dspi: Add DMA support for Vybrid") +Cc: Sanchayan Maity +Cc: Vladimir Oltean +Cc: Peter Ujfalusi +Cc: Vinod Koul +Signed-off-by: Tony Lindgren +Acked-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20210810081727.19491-1-tony@atomide.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index fb45e6af6638..fd004c9db9dc 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -530,6 +530,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr) + goto err_rx_dma_buf; + } + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.src_addr = phy_addr + SPI_POPR; + cfg.dst_addr = phy_addr + SPI_PUSHR; + cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +-- +2.30.2 + diff --git a/queue-5.14/spi-spi-pic32-fix-issue-with-uninitialized-dma_slave.patch b/queue-5.14/spi-spi-pic32-fix-issue-with-uninitialized-dma_slave.patch new file mode 100644 index 00000000000..4c999af3243 --- /dev/null +++ b/queue-5.14/spi-spi-pic32-fix-issue-with-uninitialized-dma_slave.patch @@ -0,0 +1,46 @@ +From 7d0c79d0e3400f13f448873448380c841028b6f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 11:17:27 +0300 +Subject: spi: spi-pic32: Fix issue with uninitialized dma_slave_config + +From: Tony Lindgren + +[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ] + +Depending on the DMA driver being used, the struct dma_slave_config may +need to be initialized to zero for the unused data. + +For example, we have three DMA drivers using src_port_window_size and +dst_port_window_size. If these are left uninitialized, it can cause DMA +failures. + +For spi-pic32, this is probably not currently an issue but is still good to +fix though. + +Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver") +Cc: Purna Chandra Mandal +Cc: Peter Ujfalusi +Cc: Vinod Koul +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210810081727.19491-2-tony@atomide.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pic32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c +index 104bde153efd..5eb7b61bbb4d 100644 +--- a/drivers/spi/spi-pic32.c ++++ b/drivers/spi/spi-pic32.c +@@ -361,6 +361,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width) + struct dma_slave_config cfg; + int ret; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.device_fc = true; + cfg.src_addr = pic32s->dma_base + buf_offset; + cfg.dst_addr = pic32s->dma_base + buf_offset; +-- +2.30.2 + diff --git a/queue-5.14/spi-spi-zynq-qspi-use-wait_for_completion_timeout-to.patch b/queue-5.14/spi-spi-zynq-qspi-use-wait_for_completion_timeout-to.patch new file mode 100644 index 00000000000..b3d5f1a1370 --- /dev/null +++ b/queue-5.14/spi-spi-zynq-qspi-use-wait_for_completion_timeout-to.patch @@ -0,0 +1,69 @@ +From cf80c49de199daa3615ffaec736c3029524be403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 08:59:30 +0800 +Subject: spi: spi-zynq-qspi: use wait_for_completion_timeout to make + zynq_qspi_exec_mem_op not interruptible + +From: Quanyang Wang + +[ Upstream commit 26cfc0dbe43aae60dc03af27077775244f26c167 ] + +The function wait_for_completion_interruptible_timeout will return +-ERESTARTSYS immediately when receiving SIGKILL signal which is sent +by "jffs2_gcd_mtd" during umounting jffs2. This will break the SPI memory +operation because the data transmitting may begin before the command or +address transmitting completes. Use wait_for_completion_timeout to prevent +the process from being interruptible. + +Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller") +Signed-off-by: Quanyang Wang +Link: https://lore.kernel.org/r/20210826005930.20572-1-quanyang.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynq-qspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c +index 9262c6418463..cfa222c9bd5e 100644 +--- a/drivers/spi/spi-zynq-qspi.c ++++ b/drivers/spi/spi-zynq-qspi.c +@@ -545,7 +545,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, + zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); + zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, + ZYNQ_QSPI_IXR_RXTX_MASK); +- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, ++ if (!wait_for_completion_timeout(&xqspi->data_completion, + msecs_to_jiffies(1000))) + err = -ETIMEDOUT; + } +@@ -563,7 +563,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, + zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); + zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, + ZYNQ_QSPI_IXR_RXTX_MASK); +- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, ++ if (!wait_for_completion_timeout(&xqspi->data_completion, + msecs_to_jiffies(1000))) + err = -ETIMEDOUT; + } +@@ -579,7 +579,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, + zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); + zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, + ZYNQ_QSPI_IXR_RXTX_MASK); +- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, ++ if (!wait_for_completion_timeout(&xqspi->data_completion, + msecs_to_jiffies(1000))) + err = -ETIMEDOUT; + +@@ -603,7 +603,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, + zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); + zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, + ZYNQ_QSPI_IXR_RXTX_MASK); +- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, ++ if (!wait_for_completion_timeout(&xqspi->data_completion, + msecs_to_jiffies(1000))) + err = -ETIMEDOUT; + } +-- +2.30.2 + diff --git a/queue-5.14/spi-sprd-fix-the-wrong-wdg_load_val.patch b/queue-5.14/spi-sprd-fix-the-wrong-wdg_load_val.patch new file mode 100644 index 00000000000..20c23d815fe --- /dev/null +++ b/queue-5.14/spi-sprd-fix-the-wrong-wdg_load_val.patch @@ -0,0 +1,38 @@ +From 9faff4ef400fb739954184d9495ad1efb2c9a4d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 17:15:46 +0800 +Subject: spi: sprd: Fix the wrong WDG_LOAD_VAL + +From: Chunyan Zhang + +[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ] + +Use 50ms as default timeout value and the time clock is 32768HZ. +The original value of WDG_LOAD_VAL is not correct, so this patch +fixes it. + +Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system") +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20210826091549.2138125-2-zhang.lyra@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sprd-adi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c +index ab19068be867..98ef17389952 100644 +--- a/drivers/spi/spi-sprd-adi.c ++++ b/drivers/spi/spi-sprd-adi.c +@@ -103,7 +103,7 @@ + #define HWRST_STATUS_WATCHDOG 0xf0 + + /* Use default timeout 50 ms that converts to watchdog values */ +-#define WDG_LOAD_VAL ((50 * 1000) / 32768) ++#define WDG_LOAD_VAL ((50 * 32768) / 1000) + #define WDG_LOAD_MASK GENMASK(15, 0) + #define WDG_UNLOCK_KEY 0xe551 + +-- +2.30.2 + diff --git a/queue-5.14/sunrpc-fix-a-null-pointer-deref-in-trace_svc_stats_l.patch b/queue-5.14/sunrpc-fix-a-null-pointer-deref-in-trace_svc_stats_l.patch new file mode 100644 index 00000000000..3a9fe0f034e --- /dev/null +++ b/queue-5.14/sunrpc-fix-a-null-pointer-deref-in-trace_svc_stats_l.patch @@ -0,0 +1,102 @@ +From e859f135b5a37c30b186690980a6e25cf8473c36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 15:11:24 -0400 +Subject: SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() + +From: Chuck Lever + +[ Upstream commit 5c11720767f70d34357d00a15ba5a0ad052c40fe ] + +Some paths through svc_process() leave rqst->rq_procinfo set to +NULL, which triggers a crash if tracing happens to be enabled. + +Fixes: 89ff87494c6e ("SUNRPC: Display RPC procedure names instead of proc numbers") +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/svc.h | 1 + + include/trace/events/sunrpc.h | 8 ++++---- + net/sunrpc/svc.c | 15 +++++++++++++++ + 3 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h +index e91d51ea028b..65185d1e07ea 100644 +--- a/include/linux/sunrpc/svc.h ++++ b/include/linux/sunrpc/svc.h +@@ -523,6 +523,7 @@ void svc_wake_up(struct svc_serv *); + void svc_reserve(struct svc_rqst *rqstp, int space); + struct svc_pool * svc_pool_for_cpu(struct svc_serv *serv, int cpu); + char * svc_print_addr(struct svc_rqst *, char *, size_t); ++const char * svc_proc_name(const struct svc_rqst *rqstp); + int svc_encode_result_payload(struct svc_rqst *rqstp, + unsigned int offset, + unsigned int length); +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 861f199896c6..d323f5a049c8 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -1642,7 +1642,7 @@ TRACE_EVENT(svc_process, + __field(u32, vers) + __field(u32, proc) + __string(service, name) +- __string(procedure, rqst->rq_procinfo->pc_name) ++ __string(procedure, svc_proc_name(rqst)) + __string(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)") + ), +@@ -1652,7 +1652,7 @@ TRACE_EVENT(svc_process, + __entry->vers = rqst->rq_vers; + __entry->proc = rqst->rq_proc; + __assign_str(service, name); +- __assign_str(procedure, rqst->rq_procinfo->pc_name); ++ __assign_str(procedure, svc_proc_name(rqst)); + __assign_str(addr, rqst->rq_xprt ? + rqst->rq_xprt->xpt_remotebuf : "(null)"); + ), +@@ -1918,7 +1918,7 @@ TRACE_EVENT(svc_stats_latency, + TP_STRUCT__entry( + __field(u32, xid) + __field(unsigned long, execute) +- __string(procedure, rqst->rq_procinfo->pc_name) ++ __string(procedure, svc_proc_name(rqst)) + __string(addr, rqst->rq_xprt->xpt_remotebuf) + ), + +@@ -1926,7 +1926,7 @@ TRACE_EVENT(svc_stats_latency, + __entry->xid = be32_to_cpu(rqst->rq_xid); + __entry->execute = ktime_to_us(ktime_sub(ktime_get(), + rqst->rq_stime)); +- __assign_str(procedure, rqst->rq_procinfo->pc_name); ++ __assign_str(procedure, svc_proc_name(rqst)); + __assign_str(addr, rqst->rq_xprt->xpt_remotebuf); + ), + +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index 0de918cb3d90..a47e290b0668 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1629,6 +1629,21 @@ u32 svc_max_payload(const struct svc_rqst *rqstp) + } + EXPORT_SYMBOL_GPL(svc_max_payload); + ++/** ++ * svc_proc_name - Return RPC procedure name in string form ++ * @rqstp: svc_rqst to operate on ++ * ++ * Return value: ++ * Pointer to a NUL-terminated string ++ */ ++const char *svc_proc_name(const struct svc_rqst *rqstp) ++{ ++ if (rqstp && rqstp->rq_procinfo) ++ return rqstp->rq_procinfo->pc_name; ++ return "unknown"; ++} ++ ++ + /** + * svc_encode_result_payload - mark a range of bytes as a result payload + * @rqstp: svc_rqst to operate on +-- +2.30.2 + diff --git a/queue-5.14/tcp-seq_file-avoid-skipping-sk-during-tcp_seek_last_.patch b/queue-5.14/tcp-seq_file-avoid-skipping-sk-during-tcp_seek_last_.patch new file mode 100644 index 00000000000..8b9a0a7f174 --- /dev/null +++ b/queue-5.14/tcp-seq_file-avoid-skipping-sk-during-tcp_seek_last_.patch @@ -0,0 +1,75 @@ +From a9995428bc92578595e694825d93ae02fa05fb68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 13:05:41 -0700 +Subject: tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos + +From: Martin KaFai Lau + +[ Upstream commit 525e2f9fd0229eb10cb460a9e6d978257f24804e ] + +st->bucket stores the current bucket number. +st->offset stores the offset within this bucket that is the sk to be +seq_show(). Thus, st->offset only makes sense within the same +st->bucket. + +These two variables are an optimization for the common no-lseek case. +When resuming the seq_file iteration (i.e. seq_start()), +tcp_seek_last_pos() tries to continue from the st->offset +at bucket st->bucket. + +However, it is possible that the bucket pointed by st->bucket +has changed and st->offset may end up skipping the whole st->bucket +without finding a sk. In this case, tcp_seek_last_pos() currently +continues to satisfy the offset condition in the next (and incorrect) +bucket. Instead, regardless of the offset value, the first sk of the +next bucket should be returned. Thus, "bucket == st->bucket" check is +added to tcp_seek_last_pos(). + +The chance of hitting this is small and the issue is a decade old, +so targeting for the next tree. + +Fixes: a8b690f98baf ("tcp: Fix slowness in read /proc/net/tcp") +Signed-off-by: Martin KaFai Lau +Signed-off-by: Andrii Nakryiko +Reviewed-by: Eric Dumazet +Acked-by: Kuniyuki Iwashima +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20210701200541.1033917-1-kafai@fb.com +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index a692626c19e4..db07c05736b2 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2451,6 +2451,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos) + static void *tcp_seek_last_pos(struct seq_file *seq) + { + struct tcp_iter_state *st = seq->private; ++ int bucket = st->bucket; + int offset = st->offset; + int orig_num = st->num; + void *rc = NULL; +@@ -2461,7 +2462,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) + break; + st->state = TCP_SEQ_STATE_LISTENING; + rc = listening_get_next(seq, NULL); +- while (offset-- && rc) ++ while (offset-- && rc && bucket == st->bucket) + rc = listening_get_next(seq, rc); + if (rc) + break; +@@ -2472,7 +2473,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) + if (st->bucket > tcp_hashinfo.ehash_mask) + break; + rc = established_get_first(seq); +- while (offset-- && rc) ++ while (offset-- && rc && bucket == st->bucket) + rc = established_get_next(seq, rc); + } + +-- +2.30.2 + diff --git a/queue-5.14/tools-free-btf-objects-at-various-locations.patch b/queue-5.14/tools-free-btf-objects-at-various-locations.patch new file mode 100644 index 00000000000..ffa47a56b58 --- /dev/null +++ b/queue-5.14/tools-free-btf-objects-at-various-locations.patch @@ -0,0 +1,122 @@ +From ee6e0f9610f7e86f30664cb7c7ae6f0f95a0438f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 17:20:24 +0100 +Subject: tools: Free BTF objects at various locations + +From: Quentin Monnet + +[ Upstream commit 369e955b3d1c12f6ec2e51a95911bb80ada55d79 ] + +Make sure to call btf__free() (and not simply free(), which does not +free all pointers stored in the struct) on pointers to struct btf +objects retrieved at various locations. + +These were found while updating the calls to btf__get_from_id(). + +Fixes: 999d82cbc044 ("tools/bpf: enhance test_btf file testing to test func info") +Fixes: 254471e57a86 ("tools/bpf: bpftool: add support for func types") +Fixes: 7b612e291a5a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") +Fixes: d56354dc4909 ("perf tools: Save bpf_prog_info and BTF of new BPF programs") +Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") +Fixes: fa853c4b839e ("perf stat: Enable counting events for BPF programs") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210729162028.29512-5-quentin@isovalent.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 5 ++++- + tools/perf/util/bpf-event.c | 4 ++-- + tools/perf/util/bpf_counter.c | 3 ++- + tools/testing/selftests/bpf/prog_tests/btf.c | 1 + + 4 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index cc48726740ad..9d709b427665 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -781,6 +781,8 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode, + kernel_syms_destroy(&dd); + } + ++ btf__free(btf); ++ + return 0; + } + +@@ -2002,8 +2004,8 @@ static char *profile_target_name(int tgt_fd) + struct bpf_prog_info_linear *info_linear; + struct bpf_func_info *func_info; + const struct btf_type *t; ++ struct btf *btf = NULL; + char *name = NULL; +- struct btf *btf; + + info_linear = bpf_program__get_prog_info_linear( + tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO); +@@ -2027,6 +2029,7 @@ static char *profile_target_name(int tgt_fd) + } + name = strdup(btf__name_by_offset(btf, t->name_off)); + out: ++ btf__free(btf); + free(info_linear); + return name; + } +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index cdecda1ddd36..17a9844e4fbf 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -296,7 +296,7 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session, + + out: + free(info_linear); +- free(btf); ++ btf__free(btf); + return err ? -1 : 0; + } + +@@ -486,7 +486,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id) + perf_env__fetch_btf(env, btf_id, btf); + + out: +- free(btf); ++ btf__free(btf); + close(fd); + } + +diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c +index 8150e03367bb..beca55129b0b 100644 +--- a/tools/perf/util/bpf_counter.c ++++ b/tools/perf/util/bpf_counter.c +@@ -64,8 +64,8 @@ static char *bpf_target_prog_name(int tgt_fd) + struct bpf_prog_info_linear *info_linear; + struct bpf_func_info *func_info; + const struct btf_type *t; ++ struct btf *btf = NULL; + char *name = NULL; +- struct btf *btf; + + info_linear = bpf_program__get_prog_info_linear( + tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO); +@@ -89,6 +89,7 @@ static char *bpf_target_prog_name(int tgt_fd) + } + name = strdup(btf__name_by_offset(btf, t->name_off)); + out: ++ btf__free(btf); + free(info_linear); + return name; + } +diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c +index 857e3f26086f..68e415f4d33c 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf.c +@@ -4386,6 +4386,7 @@ skip: + fprintf(stderr, "OK"); + + done: ++ btf__free(btf); + free(func_info); + bpf_object__close(obj); + } +-- +2.30.2 + diff --git a/queue-5.14/tpm-ibmvtpm-avoid-error-message-when-process-gets-si.patch b/queue-5.14/tpm-ibmvtpm-avoid-error-message-when-process-gets-si.patch new file mode 100644 index 00000000000..7bc78a472d3 --- /dev/null +++ b/queue-5.14/tpm-ibmvtpm-avoid-error-message-when-process-gets-si.patch @@ -0,0 +1,152 @@ +From 61c86af6158cedd8a294be16d633a87b9c098b70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 22:45:48 +0300 +Subject: tpm: ibmvtpm: Avoid error message when process gets signal while + waiting + +From: Stefan Berger + +[ Upstream commit 047d4226b0bca1cda5267dc68bc8291cce5364ac ] + +When rngd is run as root then lots of these types of message will appear +in the kernel log if the TPM has been configured to provide random bytes: + +[ 7406.275163] tpm tpm0: tpm_transmit: tpm_recv: error -4 + +The issue is caused by the following call that is interrupted while +waiting for the TPM's response. + +sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd); + +Rather than waiting for the response in the low level driver, have it use +the polling loop in tpm_try_transmit() that uses a command's duration to +poll until a result has been returned by the TPM, thus ending when the +timeout has occurred but not responding to signals and ctrl-c anymore. To +stay in this polling loop extend tpm_ibmvtpm_status() to return +'true' for as long as the vTPM is indicated as being busy in +tpm_processing_cmd. Since the loop requires the TPM's timeouts, get them +now using tpm_get_timeouts() after setting the TPM2 version flag on the +chip. + +To recreat the resolved issue start rngd like this: + +sudo rngd -r /dev/hwrng -t +sudo rngd -r /dev/tpm0 -t + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1981473 +Fixes: 6674ff145eef ("tpm_ibmvtpm: properly handle interrupted packet receptions") +Cc: Nayna Jain +Cc: George Wilson +Reported-by: Nageswara R Sastry +Signed-off-by: Stefan Berger +Tested-by: Nageswara R Sastry +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_ibmvtpm.c | 26 +++++++++++++++----------- + drivers/char/tpm/tpm_ibmvtpm.h | 2 +- + 2 files changed, 16 insertions(+), 12 deletions(-) + +diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c +index 903604769de9..3af4c07a9342 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.c ++++ b/drivers/char/tpm/tpm_ibmvtpm.c +@@ -106,17 +106,12 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); + u16 len; +- int sig; + + if (!ibmvtpm->rtce_buf) { + dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n"); + return 0; + } + +- sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd); +- if (sig) +- return -EINTR; +- + len = ibmvtpm->res_len; + + if (count < len) { +@@ -237,7 +232,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) + * set the processing flag before the Hcall, since we may get the + * result (interrupt) before even being able to check rc. + */ +- ibmvtpm->tpm_processing_cmd = true; ++ ibmvtpm->tpm_processing_cmd = 1; + + again: + rc = ibmvtpm_send_crq(ibmvtpm->vdev, +@@ -255,7 +250,7 @@ again: + goto again; + } + dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc); +- ibmvtpm->tpm_processing_cmd = false; ++ ibmvtpm->tpm_processing_cmd = 0; + } + + spin_unlock(&ibmvtpm->rtce_lock); +@@ -269,7 +264,9 @@ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip) + + static u8 tpm_ibmvtpm_status(struct tpm_chip *chip) + { +- return 0; ++ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); ++ ++ return ibmvtpm->tpm_processing_cmd; + } + + /** +@@ -457,7 +454,7 @@ static const struct tpm_class_ops tpm_ibmvtpm = { + .send = tpm_ibmvtpm_send, + .cancel = tpm_ibmvtpm_cancel, + .status = tpm_ibmvtpm_status, +- .req_complete_mask = 0, ++ .req_complete_mask = 1, + .req_complete_val = 0, + .req_canceled = tpm_ibmvtpm_req_canceled, + }; +@@ -550,7 +547,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq, + case VTPM_TPM_COMMAND_RES: + /* len of the data in rtce buffer */ + ibmvtpm->res_len = be16_to_cpu(crq->len); +- ibmvtpm->tpm_processing_cmd = false; ++ ibmvtpm->tpm_processing_cmd = 0; + wake_up_interruptible(&ibmvtpm->wq); + return; + default: +@@ -688,8 +685,15 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, + goto init_irq_cleanup; + } + +- if (!strcmp(id->compat, "IBM,vtpm20")) { ++ ++ if (!strcmp(id->compat, "IBM,vtpm20")) + chip->flags |= TPM_CHIP_FLAG_TPM2; ++ ++ rc = tpm_get_timeouts(chip); ++ if (rc) ++ goto init_irq_cleanup; ++ ++ if (chip->flags & TPM_CHIP_FLAG_TPM2) { + rc = tpm2_get_cc_attrs_tbl(chip); + if (rc) + goto init_irq_cleanup; +diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h +index b92aa7d3e93e..51198b137461 100644 +--- a/drivers/char/tpm/tpm_ibmvtpm.h ++++ b/drivers/char/tpm/tpm_ibmvtpm.h +@@ -41,7 +41,7 @@ struct ibmvtpm_dev { + wait_queue_head_t wq; + u16 res_len; + u32 vtpm_version; +- bool tpm_processing_cmd; ++ u8 tpm_processing_cmd; + }; + + #define CRQ_RES_BUF_SIZE PAGE_SIZE +-- +2.30.2 + diff --git a/queue-5.14/tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch b/queue-5.14/tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch new file mode 100644 index 00000000000..8eca6521de9 --- /dev/null +++ b/queue-5.14/tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch @@ -0,0 +1,42 @@ +From 205b143688fc3df69e3afdec444b412fd86aed05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 10:10:33 +0800 +Subject: tty: serial: fsl_lpuart: fix the wrong mapbase value + +From: Andy Duan + +[ Upstream commit d5c38948448abc2bb6b36dbf85a554bf4748885e ] + +Register offset needs to be applied on mapbase also. +dma_tx/rx_request use the physical address of UARTDATA. +Register offset is currently only applied to membase (the +corresponding virtual addr) but not on mapbase. + +Fixes: 24b1e5f0e83c ("tty: serial: lpuart: add imx7ulp support") +Reviewed-by: Leonard Crestez +Signed-off-by: Adriana Reus +Signed-off-by: Sherry Sun +Signed-off-by: Andy Duan +Link: https://lore.kernel.org/r/20210819021033.32606-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index f0e5da77ed6d..460e428b7592 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2611,7 +2611,7 @@ static int lpuart_probe(struct platform_device *pdev) + return PTR_ERR(sport->port.membase); + + sport->port.membase += sdata->reg_off; +- sport->port.mapbase = res->start; ++ sport->port.mapbase = res->start + sdata->reg_off; + sport->port.dev = &pdev->dev; + sport->port.type = PORT_LPUART; + sport->devtype = sdata->devtype; +-- +2.30.2 + diff --git a/queue-5.14/udf-check-lvid-earlier.patch b/queue-5.14/udf-check-lvid-earlier.patch new file mode 100644 index 00000000000..cec51dc2b5b --- /dev/null +++ b/queue-5.14/udf-check-lvid-earlier.patch @@ -0,0 +1,86 @@ +From 86b5469ba58bcb59cce5fec3d504fe6c4eef6757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 11:39:03 +0200 +Subject: udf: Check LVID earlier + +From: Jan Kara + +[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ] + +We were checking validity of LVID entries only when getting +implementation use information from LVID in udf_sb_lvidiu(). However if +the LVID is suitably corrupted, it can cause problems also to code such +as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity +of LVID already when loading it from the disk and just disable LVID +altogether when it is not valid. + +Reported-by: syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/super.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 2f83c1204e20..1eeb75a1efd2 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -108,16 +108,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb) + return NULL; + lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data; + partnum = le32_to_cpu(lvid->numOfPartitions); +- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) - +- offsetof(struct logicalVolIntegrityDesc, impUse)) / +- (2 * sizeof(uint32_t)) < partnum) { +- udf_err(sb, "Logical volume integrity descriptor corrupted " +- "(numOfPartitions = %u)!\n", partnum); +- return NULL; +- } + /* The offset is to skip freeSpaceTable and sizeTable arrays */ + offset = partnum * 2 * sizeof(uint32_t); +- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]); ++ return (struct logicalVolIntegrityDescImpUse *) ++ (((uint8_t *)(lvid + 1)) + offset); + } + + /* UDF filesystem type */ +@@ -1542,6 +1536,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ + struct udf_sb_info *sbi = UDF_SB(sb); + struct logicalVolIntegrityDesc *lvid; + int indirections = 0; ++ u32 parts, impuselen; + + while (++indirections <= UDF_MAX_LVID_NESTING) { + final_bh = NULL; +@@ -1568,15 +1563,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ + + lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data; + if (lvid->nextIntegrityExt.extLength == 0) +- return; ++ goto check; + + loc = leea_to_cpu(lvid->nextIntegrityExt); + } + + udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n", + UDF_MAX_LVID_NESTING); ++out_err: + brelse(sbi->s_lvid_bh); + sbi->s_lvid_bh = NULL; ++ return; ++check: ++ parts = le32_to_cpu(lvid->numOfPartitions); ++ impuselen = le32_to_cpu(lvid->lengthOfImpUse); ++ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize || ++ sizeof(struct logicalVolIntegrityDesc) + impuselen + ++ 2 * parts * sizeof(u32) > sb->s_blocksize) { ++ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), " ++ "ignoring.\n", parts, impuselen); ++ goto out_err; ++ } + } + + /* +-- +2.30.2 + diff --git a/queue-5.14/udf-fix-iocharset-utf8-mount-option.patch b/queue-5.14/udf-fix-iocharset-utf8-mount-option.patch new file mode 100644 index 00000000000..7b8fc6ef538 --- /dev/null +++ b/queue-5.14/udf-fix-iocharset-utf8-mount-option.patch @@ -0,0 +1,165 @@ +From 387f8793f1414cf0323543327cc1500443f5925c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 18:24:36 +0200 +Subject: udf: Fix iocharset=utf8 mount option +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b645333443712d2613e4e863f81090d5dc509657 ] + +Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, +it is required to use utf8 mount option. + +Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount +option. + +If UTF-8 as iocharset is used then s_nls_map is set to NULL. So simplify +code around, remove UDF_FLAG_NLS_MAP and UDF_FLAG_UTF8 flags as to +distinguish between UTF-8 and non-UTF-8 it is needed just to check if +s_nls_map set to NULL or not. + +Link: https://lore.kernel.org/r/20210808162453.1653-4-pali@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/super.c | 50 ++++++++++++++++++------------------------------ + fs/udf/udf_sb.h | 2 -- + fs/udf/unicode.c | 4 ++-- + 3 files changed, 21 insertions(+), 35 deletions(-) + +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 1eeb75a1efd2..b2d7c57d0688 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -343,10 +343,10 @@ static int udf_show_options(struct seq_file *seq, struct dentry *root) + seq_printf(seq, ",lastblock=%u", sbi->s_last_block); + if (sbi->s_anchor != 0) + seq_printf(seq, ",anchor=%u", sbi->s_anchor); +- if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) +- seq_puts(seq, ",utf8"); +- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP) && sbi->s_nls_map) ++ if (sbi->s_nls_map) + seq_printf(seq, ",iocharset=%s", sbi->s_nls_map->charset); ++ else ++ seq_puts(seq, ",iocharset=utf8"); + + return 0; + } +@@ -552,19 +552,24 @@ static int udf_parse_options(char *options, struct udf_options *uopt, + /* Ignored (never implemented properly) */ + break; + case Opt_utf8: +- uopt->flags |= (1 << UDF_FLAG_UTF8); ++ if (!remount) { ++ unload_nls(uopt->nls_map); ++ uopt->nls_map = NULL; ++ } + break; + case Opt_iocharset: + if (!remount) { +- if (uopt->nls_map) +- unload_nls(uopt->nls_map); +- /* +- * load_nls() failure is handled later in +- * udf_fill_super() after all options are +- * parsed. +- */ ++ unload_nls(uopt->nls_map); ++ uopt->nls_map = NULL; ++ } ++ /* When nls_map is not loaded then UTF-8 is used */ ++ if (!remount && strcmp(args[0].from, "utf8") != 0) { + uopt->nls_map = load_nls(args[0].from); +- uopt->flags |= (1 << UDF_FLAG_NLS_MAP); ++ if (!uopt->nls_map) { ++ pr_err("iocharset %s not found\n", ++ args[0].from); ++ return 0; ++ } + } + break; + case Opt_uforget: +@@ -2146,21 +2151,6 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + if (!udf_parse_options((char *)options, &uopt, false)) + goto parse_options_failure; + +- if (uopt.flags & (1 << UDF_FLAG_UTF8) && +- uopt.flags & (1 << UDF_FLAG_NLS_MAP)) { +- udf_err(sb, "utf8 cannot be combined with iocharset\n"); +- goto parse_options_failure; +- } +- if ((uopt.flags & (1 << UDF_FLAG_NLS_MAP)) && !uopt.nls_map) { +- uopt.nls_map = load_nls_default(); +- if (!uopt.nls_map) +- uopt.flags &= ~(1 << UDF_FLAG_NLS_MAP); +- else +- udf_debug("Using default NLS map\n"); +- } +- if (!(uopt.flags & (1 << UDF_FLAG_NLS_MAP))) +- uopt.flags |= (1 << UDF_FLAG_UTF8); +- + fileset.logicalBlockNum = 0xFFFFFFFF; + fileset.partitionReferenceNum = 0xFFFF; + +@@ -2315,8 +2305,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + error_out: + iput(sbi->s_vat_inode); + parse_options_failure: +- if (uopt.nls_map) +- unload_nls(uopt.nls_map); ++ unload_nls(uopt.nls_map); + if (lvid_open) + udf_close_lvid(sb); + brelse(sbi->s_lvid_bh); +@@ -2366,8 +2355,7 @@ static void udf_put_super(struct super_block *sb) + sbi = UDF_SB(sb); + + iput(sbi->s_vat_inode); +- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) +- unload_nls(sbi->s_nls_map); ++ unload_nls(sbi->s_nls_map); + if (!sb_rdonly(sb)) + udf_close_lvid(sb); + brelse(sbi->s_lvid_bh); +diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h +index 758efe557a19..4fa620543d30 100644 +--- a/fs/udf/udf_sb.h ++++ b/fs/udf/udf_sb.h +@@ -20,8 +20,6 @@ + #define UDF_FLAG_UNDELETE 6 + #define UDF_FLAG_UNHIDE 7 + #define UDF_FLAG_VARCONV 8 +-#define UDF_FLAG_NLS_MAP 9 +-#define UDF_FLAG_UTF8 10 + #define UDF_FLAG_UID_FORGET 11 /* save -1 for uid to disk */ + #define UDF_FLAG_GID_FORGET 12 + #define UDF_FLAG_UID_SET 13 +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 5fcfa96463eb..622569007b53 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -177,7 +177,7 @@ static int udf_name_from_CS0(struct super_block *sb, + return 0; + } + +- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) ++ if (UDF_SB(sb)->s_nls_map) + conv_f = UDF_SB(sb)->s_nls_map->uni2char; + else + conv_f = NULL; +@@ -285,7 +285,7 @@ static int udf_name_to_CS0(struct super_block *sb, + if (ocu_max_len <= 0) + return 0; + +- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) ++ if (UDF_SB(sb)->s_nls_map) + conv_f = UDF_SB(sb)->s_nls_map->char2uni; + else + conv_f = NULL; +-- +2.30.2 + diff --git a/queue-5.14/udf_get_extendedattr-had-no-boundary-checks.patch b/queue-5.14/udf_get_extendedattr-had-no-boundary-checks.patch new file mode 100644 index 00000000000..f9ffce9337f --- /dev/null +++ b/queue-5.14/udf_get_extendedattr-had-no-boundary-checks.patch @@ -0,0 +1,52 @@ +From 792aff67c40799c9d4e3927408c4739a43a8042c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Aug 2021 11:33:32 +0200 +Subject: udf_get_extendedattr() had no boundary checks. + +From: Stian Skjelstad + +[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ] + +When parsing the ExtendedAttr data, malicous or corrupt attribute length +could cause kernel hangs and buffer overruns in some special cases. + +Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com +Signed-off-by: Stian Skjelstad +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/misc.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/fs/udf/misc.c b/fs/udf/misc.c +index eab94527340d..1614d308d0f0 100644 +--- a/fs/udf/misc.c ++++ b/fs/udf/misc.c +@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type, + else + offset = le32_to_cpu(eahd->appAttrLocation); + +- while (offset < iinfo->i_lenEAttr) { ++ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) { ++ uint32_t attrLength; ++ + gaf = (struct genericFormat *)&ea[offset]; ++ attrLength = le32_to_cpu(gaf->attrLength); ++ ++ /* Detect undersized elements and buffer overflows */ ++ if ((attrLength < sizeof(*gaf)) || ++ (attrLength > (iinfo->i_lenEAttr - offset))) ++ break; ++ + if (le32_to_cpu(gaf->attrType) == type && + gaf->attrSubtype == subtype) + return gaf; + else +- offset += le32_to_cpu(gaf->attrLength); ++ offset += attrLength; + } + } + +-- +2.30.2 + diff --git a/queue-5.14/usb-bdc-fix-a-resource-leak-in-the-error-handling-pa.patch b/queue-5.14/usb-bdc-fix-a-resource-leak-in-the-error-handling-pa.patch new file mode 100644 index 00000000000..257caa806d5 --- /dev/null +++ b/queue-5.14/usb-bdc-fix-a-resource-leak-in-the-error-handling-pa.patch @@ -0,0 +1,98 @@ +From 84e0ce144d9779ad484214e9d8cc767a886aab03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 21:32:49 +0200 +Subject: usb: bdc: Fix a resource leak in the error handling path of + 'bdc_probe()' + +From: Christophe JAILLET + +[ Upstream commit 6f15a2a09cecb7a2faba4a75bbd101f6f962294b ] + +If an error occurs after a successful 'clk_prepare_enable()' call, it must +be undone by a corresponding 'clk_disable_unprepare()' call. +This call is already present in the remove function. + +Add this call in the error handling path and reorder the code so that the +'clk_prepare_enable()' call happens later in the function. +The goal is to have as much managed resources functions as possible +before the 'clk_prepare_enable()' call in order to keep the error handling +path simple. + +While at it, remove the now unneeded 'clk' variable. + +Fixes: c87dca047849 ("usb: bdc: Add clock enable for new chips with a separate BDC clock") +Acked-by: Florian Fainelli +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/f8a4a6897deb0c8cb2e576580790303550f15fcd.1629314734.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/bdc/bdc_core.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index 251db57e51fa..fa1a3908ec3b 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -488,27 +488,14 @@ static int bdc_probe(struct platform_device *pdev) + int irq; + u32 temp; + struct device *dev = &pdev->dev; +- struct clk *clk; + int phy_num; + + dev_dbg(dev, "%s()\n", __func__); + +- clk = devm_clk_get_optional(dev, "sw_usbd"); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); +- +- ret = clk_prepare_enable(clk); +- if (ret) { +- dev_err(dev, "could not enable clock\n"); +- return ret; +- } +- + bdc = devm_kzalloc(dev, sizeof(*bdc), GFP_KERNEL); + if (!bdc) + return -ENOMEM; + +- bdc->clk = clk; +- + bdc->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(bdc->regs)) + return PTR_ERR(bdc->regs); +@@ -545,10 +532,20 @@ static int bdc_probe(struct platform_device *pdev) + } + } + ++ bdc->clk = devm_clk_get_optional(dev, "sw_usbd"); ++ if (IS_ERR(bdc->clk)) ++ return PTR_ERR(bdc->clk); ++ ++ ret = clk_prepare_enable(bdc->clk); ++ if (ret) { ++ dev_err(dev, "could not enable clock\n"); ++ return ret; ++ } ++ + ret = bdc_phy_init(bdc); + if (ret) { + dev_err(bdc->dev, "BDC phy init failure:%d\n", ret); +- return ret; ++ goto disable_clk; + } + + temp = bdc_readl(bdc->regs, BDC_BDCCAP1); +@@ -581,6 +578,8 @@ cleanup: + bdc_hw_exit(bdc); + phycleanup: + bdc_phy_exit(bdc); ++disable_clk: ++ clk_disable_unprepare(bdc->clk); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.14/usb-bdc-fix-an-error-handling-path-in-bdc_probe-when.patch b/queue-5.14/usb-bdc-fix-an-error-handling-path-in-bdc_probe-when.patch new file mode 100644 index 00000000000..c595730e651 --- /dev/null +++ b/queue-5.14/usb-bdc-fix-an-error-handling-path-in-bdc_probe-when.patch @@ -0,0 +1,43 @@ +From f3c65bfc90c8752dbbe713efd73a4fa38f951043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 21:32:38 +0200 +Subject: usb: bdc: Fix an error handling path in 'bdc_probe()' when no + suitable DMA config is available + +From: Christophe JAILLET + +[ Upstream commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 ] + +If no suitable DMA configuration is available, a previous 'bdc_phy_init()' +call must be undone by a corresponding 'bdc_phy_exit()' call. + +Branch to the existing error handling path instead of returning +directly. + +Fixes: cc29d4f67757 ("usb: bdc: Add support for USB phy") +Acked-by: Florian Fainelli +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0c5910979f39225d5d8fe68c9ab1c147c68ddee1.1629314734.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/bdc/bdc_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index 0bef6b3f049b..251db57e51fa 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -560,7 +560,8 @@ static int bdc_probe(struct platform_device *pdev) + if (ret) { + dev_err(dev, + "No suitable DMA config available, abort\n"); +- return -ENOTSUPP; ++ ret = -ENOTSUPP; ++ goto phycleanup; + } + dev_dbg(dev, "Using 32-bit address\n"); + } +-- +2.30.2 + diff --git a/queue-5.14/usb-dwc3-meson-g12a-add-irq-check.patch b/queue-5.14/usb-dwc3-meson-g12a-add-irq-check.patch new file mode 100644 index 00000000000..43d07ab4c88 --- /dev/null +++ b/queue-5.14/usb-dwc3-meson-g12a-add-irq-check.patch @@ -0,0 +1,42 @@ +From fdfd4a43617df4a258da7e6cddf1a19d19234919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:21:14 +0300 +Subject: usb: dwc3: meson-g12a: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit baa2986bda3f7b2386607587a4185e3dff8f98df ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_threaded_irq() +(which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_threaded_irq() with the +invalid IRQ #s. + +Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching") +Reviewed-by: Martin Blumenstingl +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/96106462-5538-0b2f-f2ab-ee56e4853912@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c +index ffe301d6ea35..d0f9b7c296b0 100644 +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -598,6 +598,8 @@ static int dwc3_meson_g12a_otg_init(struct platform_device *pdev, + USB_R5_ID_DIG_IRQ, 0); + + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, + dwc3_meson_g12a_irq_thread, + IRQF_ONESHOT, pdev->name, priv); +-- +2.30.2 + diff --git a/queue-5.14/usb-dwc3-qcom-add-irq-check.patch b/queue-5.14/usb-dwc3-qcom-add-irq-check.patch new file mode 100644 index 00000000000..9ef4e48b901 --- /dev/null +++ b/queue-5.14/usb-dwc3-qcom-add-irq-check.patch @@ -0,0 +1,44 @@ +From d9a7a1bc5c2f27b87af7542f03ee6bbeb38f7d7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:23:51 +0300 +Subject: usb: dwc3: qcom: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 175006956740f70ca23394c58f8d7804776741bd ] + +In dwc3_qcom_acpi_register_core(), the driver neglects to check the result +of platform_get_irq()'s call and blithely assigns the negative error codes +to the allocated child device's IRQ resource and then passing this resource +to platform_device_add_resources() and later causing dwc3_otg_get_irq() to +fail anyway. Stop calling platform_device_add_resources() with the invalid +IRQ #s, so that there's less complexity in the IRQ error checking. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/45fec3da-1679-5bfe-5d74-219ca3fb28e7@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 49e6ca94486d..cfbb96f6627e 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -614,6 +614,10 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev) + qcom->acpi_pdata->dwc3_core_base_size; + + irq = platform_get_irq(pdev_irq, 0); ++ if (irq < 0) { ++ ret = irq; ++ goto out; ++ } + child_res[1].flags = IORESOURCE_IRQ; + child_res[1].start = child_res[1].end = irq; + +-- +2.30.2 + diff --git a/queue-5.14/usb-ehci-orion-handle-errors-of-clk_prepare_enable-i.patch b/queue-5.14/usb-ehci-orion-handle-errors-of-clk_prepare_enable-i.patch new file mode 100644 index 00000000000..b85dfbc44e9 --- /dev/null +++ b/queue-5.14/usb-ehci-orion-handle-errors-of-clk_prepare_enable-i.patch @@ -0,0 +1,64 @@ +From 9020ddc10dae6204a560bc8121f0cc64c3c64cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 20:09:02 +0300 +Subject: usb: ehci-orion: Handle errors of clk_prepare_enable() in probe + +From: Evgeny Novikov + +[ Upstream commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 ] + +ehci_orion_drv_probe() did not account for possible errors of +clk_prepare_enable() that in particular could cause invocation of +clk_disable_unprepare() on clocks that were not prepared/enabled yet, +e.g. in remove or on handling errors of usb_add_hcd() in probe. Though, +there were several patches fixing different issues with clocks in this +driver, they did not solve this problem. + +Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe() +to avoid calls of clk_disable_unprepare() without previous successful +invocation of clk_prepare_enable(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 8c869edaee07 ("ARM: Orion: EHCI: Add support for enabling clocks") +Co-developed-by: Kirill Shilimanov +Reviewed-by: Andrew Lunn +Acked-by: Alan Stern +Signed-off-by: Evgeny Novikov +Signed-off-by: Kirill Shilimanov +Link: https://lore.kernel.org/r/20210825170902.11234-1-novikov@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-orion.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c +index a319b1df3011..3626758b3e2a 100644 +--- a/drivers/usb/host/ehci-orion.c ++++ b/drivers/usb/host/ehci-orion.c +@@ -264,8 +264,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) + * the clock does not exists. + */ + priv->clk = devm_clk_get(&pdev->dev, NULL); +- if (!IS_ERR(priv->clk)) +- clk_prepare_enable(priv->clk); ++ if (!IS_ERR(priv->clk)) { ++ err = clk_prepare_enable(priv->clk); ++ if (err) ++ goto err_put_hcd; ++ } + + priv->phy = devm_phy_optional_get(&pdev->dev, "usb"); + if (IS_ERR(priv->phy)) { +@@ -311,6 +314,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) + err_dis_clk: + if (!IS_ERR(priv->clk)) + clk_disable_unprepare(priv->clk); ++err_put_hcd: + usb_put_hcd(hcd); + err: + dev_err(&pdev->dev, "init %s fail, %d\n", +-- +2.30.2 + diff --git a/queue-5.14/usb-gadget-mv_u3d-request_irq-after-initializing-udc.patch b/queue-5.14/usb-gadget-mv_u3d-request_irq-after-initializing-udc.patch new file mode 100644 index 00000000000..b75baa63000 --- /dev/null +++ b/queue-5.14/usb-gadget-mv_u3d-request_irq-after-initializing-udc.patch @@ -0,0 +1,76 @@ +From c0478f2e1e26765574a24d50852fcd492d4f149a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 17:12:47 +0300 +Subject: usb: gadget: mv_u3d: request_irq() after initializing UDC + +From: Nadezda Lutovinova + +[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ] + +If IRQ occurs between calling request_irq() and mv_u3d_eps_init(), +then null pointer dereference occurs since u3d->eps[] wasn't +initialized yet but used in mv_u3d_nuke(). + +The patch puts registration of the interrupt handler after +initializing of neccesery data. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers") +Acked-by: Felipe Balbi +Signed-off-by: Nadezda Lutovinova +Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c +index ce3d7a3eb7e3..a1057ddfbda3 100644 +--- a/drivers/usb/gadget/udc/mv_u3d_core.c ++++ b/drivers/usb/gadget/udc/mv_u3d_core.c +@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev) + goto err_get_irq; + } + u3d->irq = r->start; +- if (request_irq(u3d->irq, mv_u3d_irq, +- IRQF_SHARED, driver_name, u3d)) { +- u3d->irq = 0; +- dev_err(&dev->dev, "Request irq %d for u3d failed\n", +- u3d->irq); +- retval = -ENODEV; +- goto err_request_irq; +- } + + /* initialize gadget structure */ + u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */ +@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev) + + mv_u3d_eps_init(u3d); + ++ if (request_irq(u3d->irq, mv_u3d_irq, ++ IRQF_SHARED, driver_name, u3d)) { ++ u3d->irq = 0; ++ dev_err(&dev->dev, "Request irq %d for u3d failed\n", ++ u3d->irq); ++ retval = -ENODEV; ++ goto err_request_irq; ++ } ++ + /* external vbus detection */ + if (u3d->vbus) { + u3d->clock_gating = 1; +@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev) + + err_unregister: + free_irq(u3d->irq, u3d); +-err_request_irq: + err_get_irq: ++err_request_irq: + kfree(u3d->status_req); + err_alloc_status_req: + kfree(u3d->eps); +-- +2.30.2 + diff --git a/queue-5.14/usb-gadget-udc-at91-add-irq-check.patch b/queue-5.14/usb-gadget-udc-at91-add-irq-check.patch new file mode 100644 index 00000000000..1a7fe47c73c --- /dev/null +++ b/queue-5.14/usb-gadget-udc-at91-add-irq-check.patch @@ -0,0 +1,42 @@ +From 6281d614537b79a68fd219ca0a2d138f055fd971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:27:28 +0300 +Subject: usb: gadget: udc: at91: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 50855c31573b02963f0aa2aacfd4ea41c31ae0e0 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original +error code. Stop calling devm_request_irq() with the invalid IRQ #s. + +Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management") +Signed-off-by: Sergey Shtylyov +Acked-by: Felipe Balbi +Link: https://lore.kernel.org/r/6654a224-739a-1a80-12f0-76d920f87b6c@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/at91_udc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c +index eede5cedacb4..d9ad9adf7348 100644 +--- a/drivers/usb/gadget/udc/at91_udc.c ++++ b/drivers/usb/gadget/udc/at91_udc.c +@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform_device *pdev) + clk_disable(udc->iclk); + + /* request UDC and maybe VBUS irqs */ +- udc->udp_irq = platform_get_irq(pdev, 0); ++ udc->udp_irq = retval = platform_get_irq(pdev, 0); ++ if (retval < 0) ++ goto err_unprepare_iclk; + retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0, + driver_name, udc); + if (retval) { +-- +2.30.2 + diff --git a/queue-5.14/usb-gadget-udc-renesas_usb3-fix-soc_device_match-abu.patch b/queue-5.14/usb-gadget-udc-renesas_usb3-fix-soc_device_match-abu.patch new file mode 100644 index 00000000000..0bc54519ccf --- /dev/null +++ b/queue-5.14/usb-gadget-udc-renesas_usb3-fix-soc_device_match-abu.patch @@ -0,0 +1,78 @@ +From ac895780ff228f37733089714ed9ccfbca164f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 17:52:54 +0200 +Subject: usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit cea45a3bd2dd4d9c35581328f571afd32b3c9f48 ] + +soc_device_match() is intended as a last resort, to handle e.g. quirks +that cannot be handled by matching based on a compatible value. + +As the device nodes for the Renesas USB 3.0 Peripheral Controller on +R-Car E3 and RZ/G2E do have SoC-specific compatible values, the latter +can and should be used to match against these devices. + +This also fixes support for the USB 3.0 Peripheral Controller on the +R-Car E3e (R8A779M6) SoC, which is a different grading of the R-Car E3 +(R8A77990) SoC, using the same SoC-specific compatible value. + +Fixes: 30025efa8b5e75f5 ("usb: gadget: udc: renesas_usb3: add support for r8a77990") +Fixes: 546970fdab1da5fe ("usb: gadget: udc: renesas_usb3: add support for r8a774c0") +Reviewed-by: Niklas Söderlund +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/760981fb4cd110d7cbfc9dcffa365e7c8b25c6e5.1628696960.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/renesas_usb3.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index f1b35a39d1ba..57d417a7c3e0 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2707,10 +2707,15 @@ static const struct renesas_usb3_priv renesas_usb3_priv_r8a77990 = { + + static const struct of_device_id usb3_of_match[] = { + { ++ .compatible = "renesas,r8a774c0-usb3-peri", ++ .data = &renesas_usb3_priv_r8a77990, ++ }, { + .compatible = "renesas,r8a7795-usb3-peri", + .data = &renesas_usb3_priv_gen3, +- }, +- { ++ }, { ++ .compatible = "renesas,r8a77990-usb3-peri", ++ .data = &renesas_usb3_priv_r8a77990, ++ }, { + .compatible = "renesas,rcar-gen3-usb3-peri", + .data = &renesas_usb3_priv_gen3, + }, +@@ -2719,18 +2724,10 @@ static const struct of_device_id usb3_of_match[] = { + MODULE_DEVICE_TABLE(of, usb3_of_match); + + static const struct soc_device_attribute renesas_usb3_quirks_match[] = { +- { +- .soc_id = "r8a774c0", +- .data = &renesas_usb3_priv_r8a77990, +- }, + { + .soc_id = "r8a7795", .revision = "ES1.*", + .data = &renesas_usb3_priv_r8a7795_es1, + }, +- { +- .soc_id = "r8a77990", +- .data = &renesas_usb3_priv_r8a77990, +- }, + { /* sentinel */ }, + }; + +-- +2.30.2 + diff --git a/queue-5.14/usb-gadget-udc-s3c2410-add-irq-check.patch b/queue-5.14/usb-gadget-udc-s3c2410-add-irq-check.patch new file mode 100644 index 00000000000..3b1e236ca01 --- /dev/null +++ b/queue-5.14/usb-gadget-udc-s3c2410-add-irq-check.patch @@ -0,0 +1,43 @@ +From 54abece7ad075fb13c2f4d57f713b53ce71e44f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:35:11 +0300 +Subject: usb: gadget: udc: s3c2410: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit ecff88e819e31081d41cd05bb199b9bd10e13e90 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original +error code. Stop calling request_irq() with the invalid IRQ #s. + +Fixes: 188db4435ac6 ("usb: gadget: s3c: use platform resources") +Reviewed-by: Krzysztof Kozlowski +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/bd69b22c-b484-5a1f-c798-78d4b78405f2@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/s3c2410_udc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c +index 179777cb699f..e3931da24277 100644 +--- a/drivers/usb/gadget/udc/s3c2410_udc.c ++++ b/drivers/usb/gadget/udc/s3c2410_udc.c +@@ -1784,6 +1784,10 @@ static int s3c2410_udc_probe(struct platform_device *pdev) + s3c2410_udc_reinit(udc); + + irq_usbd = platform_get_irq(pdev, 0); ++ if (irq_usbd < 0) { ++ retval = irq_usbd; ++ goto err_udc_clk; ++ } + + /* irq setup after old hardware state is cleaned up */ + retval = request_irq(irq_usbd, s3c2410_udc_irq, +-- +2.30.2 + diff --git a/queue-5.14/usb-host-ohci-tmio-add-irq-check.patch b/queue-5.14/usb-host-ohci-tmio-add-irq-check.patch new file mode 100644 index 00000000000..4434e512d2a --- /dev/null +++ b/queue-5.14/usb-host-ohci-tmio-add-irq-check.patch @@ -0,0 +1,42 @@ +From eeae6c1940d686344a2d5c7580d8f42d0ece2501 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 23:30:18 +0300 +Subject: usb: host: ohci-tmio: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 4ac5132e8a4300637a2da8f5d6bc7650db735b8a ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to usb_add_hcd() (which takes +*unsigned* IRQ #), causing request_irq() that it calls to fail with +-EINVAL, overriding an original error code. Stop calling usb_add_hcd() +with the invalid IRQ #s. + +Fixes: 78c73414f4f6 ("USB: ohci: add support for tmio-ohci cell") +Acked-by: Alan Stern +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/402e1a45-a0a4-0e08-566a-7ca1331506b1@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-tmio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index 7f857bad9e95..08ec2ab0d95a 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -202,6 +202,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (!cell) + return -EINVAL; + ++ if (irq < 0) ++ return irq; ++ + hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev)); + if (!hcd) { + ret = -ENOMEM; +-- +2.30.2 + diff --git a/queue-5.14/usb-misc-brcmstb-usb-pinmap-add-irq-check.patch b/queue-5.14/usb-misc-brcmstb-usb-pinmap-add-irq-check.patch new file mode 100644 index 00000000000..54d3c754338 --- /dev/null +++ b/queue-5.14/usb-misc-brcmstb-usb-pinmap-add-irq-check.patch @@ -0,0 +1,40 @@ +From 318acae94a7966df512401c73dd4d84287ef42b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:45:15 +0300 +Subject: usb: misc: brcmstb-usb-pinmap: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 711087f342914e831269438ff42cf59bb0142c71 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original +error code. Stop calling devm_request_irq() with the invalid IRQ #s. + +Fixes: 517c4c44b323 ("usb: Add driver to allow any GPIO to be used for 7211 USB signals") +Reviewed-by: Florian Fainelli +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/806d0b1a-365b-93d9-3fc1-922105ca5e61@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/brcmstb-usb-pinmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/misc/brcmstb-usb-pinmap.c b/drivers/usb/misc/brcmstb-usb-pinmap.c +index 336653091e3b..2b2019c19cde 100644 +--- a/drivers/usb/misc/brcmstb-usb-pinmap.c ++++ b/drivers/usb/misc/brcmstb-usb-pinmap.c +@@ -293,6 +293,8 @@ static int __init brcmstb_usb_pinmap_probe(struct platform_device *pdev) + + /* Enable interrupt for out pins */ + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + err = devm_request_irq(&pdev->dev, irq, + brcmstb_usb_pinmap_ovr_isr, + IRQF_TRIGGER_RISING, +-- +2.30.2 + diff --git a/queue-5.14/usb-phy-fsl-usb-add-irq-check.patch b/queue-5.14/usb-phy-fsl-usb-add-irq-check.patch new file mode 100644 index 00000000000..0ffb3322c35 --- /dev/null +++ b/queue-5.14/usb-phy-fsl-usb-add-irq-check.patch @@ -0,0 +1,40 @@ +From 36947541dbea44a4ab5b1a9a07c9b6b5d95dbf5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:50:18 +0300 +Subject: usb: phy: fsl-usb: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit ecc2f30dbb25969908115c81ec23650ed982b004 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original +error code. Stop calling request_irq() with the invalid IRQ #s. + +Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver") +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/b0a86089-8b8b-122e-fd6d-73e8c2304964@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-fsl-usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c +index f34c9437a182..972704262b02 100644 +--- a/drivers/usb/phy/phy-fsl-usb.c ++++ b/drivers/usb/phy/phy-fsl-usb.c +@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev) + + /* request irq */ + p_otg->irq = platform_get_irq(pdev, 0); ++ if (p_otg->irq < 0) ++ return p_otg->irq; + status = request_irq(p_otg->irq, fsl_otg_isr, + IRQF_SHARED, driver_name, p_otg); + if (status) { +-- +2.30.2 + diff --git a/queue-5.14/usb-phy-tahvo-add-irq-check.patch b/queue-5.14/usb-phy-tahvo-add-irq-check.patch new file mode 100644 index 00000000000..786c957e20e --- /dev/null +++ b/queue-5.14/usb-phy-tahvo-add-irq-check.patch @@ -0,0 +1,43 @@ +From eca0b0458e13af1193e2dcf3778eef6bd0130541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 23:32:38 +0300 +Subject: usb: phy: tahvo: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 0d45a1373e669880b8beaecc8765f44cb0241e47 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_threaded_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an +original error code. Stop calling request_threaded_irq() with the invalid +IRQ #s. + +Fixes: 9ba96ae5074c ("usb: omap1: Tahvo USB transceiver driver") +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/8280d6a4-8e9a-7cfe-1aa9-db586dc9afdf@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-tahvo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index baebb1f5a973..a3e043e3e4aa 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -393,7 +393,9 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + dev_set_drvdata(&pdev->dev, tu); + +- tu->irq = platform_get_irq(pdev, 0); ++ tu->irq = ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +-- +2.30.2 + diff --git a/queue-5.14/usb-phy-twl6030-add-irq-checks.patch b/queue-5.14/usb-phy-twl6030-add-irq-checks.patch new file mode 100644 index 00000000000..f86e3ff3fa5 --- /dev/null +++ b/queue-5.14/usb-phy-twl6030-add-irq-checks.patch @@ -0,0 +1,44 @@ +From d0db6ab279ec5dc11683d5c561cd9ba55eba3902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Aug 2021 23:53:16 +0300 +Subject: usb: phy: twl6030: add IRQ checks + +From: Sergey Shtylyov + +[ Upstream commit 0881e22c06e66af0b64773c91c8868ead3d01aa1 ] + +The driver neglects to check the result of platform_get_irq()'s calls and +blithely passes the negative error codes to request_threaded_irq() (which +takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding +an original error code. Stop calling request_threaded_irq() with the +invalid IRQ #s. + +Fixes: c33fad0c3748 ("usb: otg: Adding twl6030-usb transceiver driver for OMAP4430") +Acked-by: Felipe Balbi +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/9507f50b-50f1-6dc4-f57c-3ed4e53a1c25@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index 8ba6c5a91557..ab3c38a7d8ac 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -348,6 +348,11 @@ static int twl6030_usb_probe(struct platform_device *pdev) + twl->irq2 = platform_get_irq(pdev, 1); + twl->linkstat = MUSB_UNKNOWN; + ++ if (twl->irq1 < 0) ++ return twl->irq1; ++ if (twl->irq2 < 0) ++ return twl->irq2; ++ + twl->comparator.set_vbus = twl6030_set_vbus; + twl->comparator.start_srp = twl6030_start_srp; + +-- +2.30.2 + diff --git a/queue-5.14/x86-mce-defer-processing-of-early-errors.patch b/queue-5.14/x86-mce-defer-processing-of-early-errors.patch new file mode 100644 index 00000000000..65d1fa8c5a1 --- /dev/null +++ b/queue-5.14/x86-mce-defer-processing-of-early-errors.patch @@ -0,0 +1,100 @@ +From 2af22b7a292e7a7bec68a2bb2a9586e09d630e16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 17:31:29 -0700 +Subject: x86/mce: Defer processing of early errors + +From: Borislav Petkov + +[ Upstream commit 3bff147b187d5dfccfca1ee231b0761a89f1eff5 ] + +When a fatal machine check results in a system reset, Linux does not +clear the error(s) from machine check bank(s) - hardware preserves the +machine check banks across a warm reset. + +During initialization of the kernel after the reboot, Linux reads, logs, +and clears all machine check banks. + +But there is a problem. In: + + 5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver") + +the call to mce_register_decode_chain() moved later in the boot +sequence. This means that /dev/mcelog doesn't see those early error +logs. + +This was partially fixed by: + + cd9c57cad3fe ("x86/MCE: Dump MCE to dmesg if no consumers") + +which made sure that the logs were not lost completely by printing +to the console. But parsing console logs is error prone. Users of +/dev/mcelog should expect to find any early errors logged to standard +places. + +Add a new flag MCP_QUEUE_LOG to machine_check_poll() to be used in early +machine check initialization to indicate that any errors found should +just be queued to genpool. When mcheck_late_init() is called it will +call mce_schedule_work() to actually log and flush any errors queued in +the genpool. + + [ Based on an original patch, commit message by and completely + productized by Tony Luck. ] + +Fixes: 5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver") +Reported-by: Sumanth Kamatala +Signed-off-by: Borislav Petkov +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210824003129.GA1642753@agluck-desk2.amr.corp.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/mce.h | 1 + + arch/x86/kernel/cpu/mce/core.c | 11 ++++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index 0607ec4f5091..da9321548f6f 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -265,6 +265,7 @@ enum mcp_flags { + MCP_TIMESTAMP = BIT(0), /* log time stamp */ + MCP_UC = BIT(1), /* log uncorrected errors */ + MCP_DONTLOG = BIT(2), /* only clear, don't log */ ++ MCP_QUEUE_LOG = BIT(3), /* only queue to genpool */ + }; + bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b); + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 22791aadc085..8cb7816d03b4 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -817,7 +817,10 @@ log_it: + if (mca_cfg.dont_log_ce && !mce_usable_address(&m)) + goto clear_it; + +- mce_log(&m); ++ if (flags & MCP_QUEUE_LOG) ++ mce_gen_pool_add(&m); ++ else ++ mce_log(&m); + + clear_it: + /* +@@ -1639,10 +1642,12 @@ static void __mcheck_cpu_init_generic(void) + m_fl = MCP_DONTLOG; + + /* +- * Log the machine checks left over from the previous reset. ++ * Log the machine checks left over from the previous reset. Log them ++ * only, do not start processing them. That will happen in mcheck_late_init() ++ * when all consumers have been registered on the notifier chain. + */ + bitmap_fill(all_banks, MAX_NR_BANKS); +- machine_check_poll(MCP_UC | m_fl, &all_banks); ++ machine_check_poll(MCP_UC | MCP_QUEUE_LOG | m_fl, &all_banks); + + cr4_set_bits(X86_CR4_MCE); + +-- +2.30.2 +