From: Sasha Levin Date: Mon, 30 Nov 2020 03:21:45 +0000 (-0500) Subject: Fixes for 4.9 X-Git-Tag: v4.4.247~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bde588c9111f835ba79eaaf826bd2ff65729b07b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/batman-adv-set-.owner-to-this_module.patch b/queue-4.9/batman-adv-set-.owner-to-this_module.patch new file mode 100644 index 00000000000..fd122531285 --- /dev/null +++ b/queue-4.9/batman-adv-set-.owner-to-this_module.patch @@ -0,0 +1,37 @@ +From 9a8587fce13134a7f5c5ec0c63718ddaec87bc51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 10:30:04 +0000 +Subject: batman-adv: set .owner to THIS_MODULE + +From: Taehee Yoo + +[ Upstream commit 14a2e551faea53d45bc11629a9dac88f88950ca7 ] + +If THIS_MODULE is not set, the module would be removed while debugfs is +being used. +It eventually makes kernel panic. + +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Signed-off-by: Taehee Yoo +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/log.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c +index 56dc532f7a2c2..b422a8b34b9f5 100644 +--- a/net/batman-adv/log.c ++++ b/net/batman-adv/log.c +@@ -196,6 +196,7 @@ static const struct file_operations batadv_log_fops = { + .read = batadv_log_read, + .poll = batadv_log_poll, + .llseek = no_llseek, ++ .owner = THIS_MODULE, + }; + + int batadv_debug_log_setup(struct batadv_priv *bat_priv) +-- +2.27.0 + diff --git a/queue-4.9/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch b/queue-4.9/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch new file mode 100644 index 00000000000..eb2bc835930 --- /dev/null +++ b/queue-4.9/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch @@ -0,0 +1,38 @@ +From 192dbe1d8d93b31c7c2eaf80e5001311634a9473 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 21:30:21 +0800 +Subject: bnxt_en: fix error return code in bnxt_init_board() + +From: Zhang Changzhong + +[ Upstream commit 3383176efc0fb0c0900a191026468a58668b4214 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Edwin Peer +Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index dc34cfa2a58fc..63c043e8824fc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6319,6 +6319,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); ++ rc = -EIO; + goto init_err_disable; + } + +-- +2.27.0 + diff --git a/queue-4.9/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch b/queue-4.9/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch new file mode 100644 index 00000000000..73617e8fb80 --- /dev/null +++ b/queue-4.9/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch @@ -0,0 +1,38 @@ +From fe6e2fe2358ef4e82bb6df7cf82b818273969ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 02:44:31 -0500 +Subject: bnxt_en: Release PCI regions when DMA mask setup fails during probe. + +From: Michael Chan + +[ Upstream commit c54bc3ced5106663c2f2b44071800621f505b00e ] + +Jump to init_err_release to cleanup. bnxt_unmap_bars() will also be +called but it will do nothing if the BARs are not mapped yet. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Jakub Kicinski +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 63c043e8824fc..f9610f860e6d1 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6320,7 +6320,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); + rc = -EIO; +- goto init_err_disable; ++ goto init_err_release; + } + + pci_set_master(pdev); +-- +2.27.0 + diff --git a/queue-4.9/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch b/queue-4.9/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch new file mode 100644 index 00000000000..1207645d588 --- /dev/null +++ b/queue-4.9/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch @@ -0,0 +1,320 @@ +From e48f7f2deb601689bc8fbec2b98f9cd8528cbcca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 14:03:17 +0100 +Subject: can: gs_usb: fix endianess problem with candleLight firmware + +From: Marc Kleine-Budde + +[ Upstream commit 4ba1cb39fce4464151517a37ce0ac0a1a3f580d6 ] + +The firmware on the original USB2CAN by Geschwister Schneider Technologie +Entwicklungs- und Vertriebs UG exchanges all data between the host and the +device in host byte order. This is done with the struct +gs_host_config::byte_order member, which is sent first to indicate the desired +byte order. + +The widely used open source firmware candleLight doesn't support this feature +and exchanges the data in little endian byte order. This breaks if a device +with candleLight firmware is used on big endianess systems. + +To fix this problem, all u32 (but not the struct gs_host_frame::echo_id, which +is a transparent cookie) are converted to __le32. + +Cc: Maximilian Schneider +Cc: Hubert Denkmair +Reported-by: Michael Rausch +Link: https://lore.kernel.org/r/b58aace7-61f3-6df7-c6df-69fee2c66906@netadair.de +Tested-by: Oleksij Rempel +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/r/20201120103818.3386964-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/gs_usb.c | 131 +++++++++++++++++++---------------- + 1 file changed, 70 insertions(+), 61 deletions(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index a65203e6ea5f4..d21c68882e867 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -71,21 +71,27 @@ enum gs_can_identify_mode { + }; + + /* data types passed between host and device */ ++ ++/* The firmware on the original USB2CAN by Geschwister Schneider ++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data ++ * between the host and the device in host byte order. This is done ++ * with the struct gs_host_config::byte_order member, which is sent ++ * first to indicate the desired byte order. ++ * ++ * The widely used open source firmware candleLight doesn't support ++ * this feature and exchanges the data in little endian byte order. ++ */ + struct gs_host_config { +- u32 byte_order; ++ __le32 byte_order; + } __packed; +-/* All data exchanged between host and device is exchanged in host byte order, +- * thanks to the struct gs_host_config byte_order member, which is sent first +- * to indicate the desired byte order. +- */ + + struct gs_device_config { + u8 reserved1; + u8 reserved2; + u8 reserved3; + u8 icount; +- u32 sw_version; +- u32 hw_version; ++ __le32 sw_version; ++ __le32 hw_version; + } __packed; + + #define GS_CAN_MODE_NORMAL 0 +@@ -95,26 +101,26 @@ struct gs_device_config { + #define GS_CAN_MODE_ONE_SHOT BIT(3) + + struct gs_device_mode { +- u32 mode; +- u32 flags; ++ __le32 mode; ++ __le32 flags; + } __packed; + + struct gs_device_state { +- u32 state; +- u32 rxerr; +- u32 txerr; ++ __le32 state; ++ __le32 rxerr; ++ __le32 txerr; + } __packed; + + struct gs_device_bittiming { +- u32 prop_seg; +- u32 phase_seg1; +- u32 phase_seg2; +- u32 sjw; +- u32 brp; ++ __le32 prop_seg; ++ __le32 phase_seg1; ++ __le32 phase_seg2; ++ __le32 sjw; ++ __le32 brp; + } __packed; + + struct gs_identify_mode { +- u32 mode; ++ __le32 mode; + } __packed; + + #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0) +@@ -125,23 +131,23 @@ struct gs_identify_mode { + #define GS_CAN_FEATURE_IDENTIFY BIT(5) + + struct gs_device_bt_const { +- u32 feature; +- u32 fclk_can; +- u32 tseg1_min; +- u32 tseg1_max; +- u32 tseg2_min; +- u32 tseg2_max; +- u32 sjw_max; +- u32 brp_min; +- u32 brp_max; +- u32 brp_inc; ++ __le32 feature; ++ __le32 fclk_can; ++ __le32 tseg1_min; ++ __le32 tseg1_max; ++ __le32 tseg2_min; ++ __le32 tseg2_max; ++ __le32 sjw_max; ++ __le32 brp_min; ++ __le32 brp_max; ++ __le32 brp_inc; + } __packed; + + #define GS_CAN_FLAG_OVERFLOW 1 + + struct gs_host_frame { + u32 echo_id; +- u32 can_id; ++ __le32 can_id; + + u8 can_dlc; + u8 channel; +@@ -337,13 +343,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + if (!skb) + return; + +- cf->can_id = hf->can_id; ++ cf->can_id = le32_to_cpu(hf->can_id); + + cf->can_dlc = get_can_dlc(hf->can_dlc); + memcpy(cf->data, hf->data, 8); + + /* ERROR frames tell us information about the controller */ +- if (hf->can_id & CAN_ERR_FLAG) ++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG) + gs_update_state(dev, cf); + + netdev->stats.rx_packets++; +@@ -426,11 +432,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev) + if (!dbt) + return -ENOMEM; + +- dbt->prop_seg = bt->prop_seg; +- dbt->phase_seg1 = bt->phase_seg1; +- dbt->phase_seg2 = bt->phase_seg2; +- dbt->sjw = bt->sjw; +- dbt->brp = bt->brp; ++ dbt->prop_seg = cpu_to_le32(bt->prop_seg); ++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1); ++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2); ++ dbt->sjw = cpu_to_le32(bt->sjw); ++ dbt->brp = cpu_to_le32(bt->brp); + + /* request bit timings */ + rc = usb_control_msg(interface_to_usbdev(intf), +@@ -511,7 +517,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, + + cf = (struct can_frame *)skb->data; + +- hf->can_id = cf->can_id; ++ hf->can_id = cpu_to_le32(cf->can_id); + hf->can_dlc = cf->can_dlc; + memcpy(hf->data, cf->data, cf->can_dlc); + +@@ -582,6 +588,7 @@ static int gs_can_open(struct net_device *netdev) + int rc, i; + struct gs_device_mode *dm; + u32 ctrlmode; ++ u32 flags = 0; + + rc = open_candev(netdev); + if (rc) +@@ -649,24 +656,24 @@ static int gs_can_open(struct net_device *netdev) + + /* flags */ + ctrlmode = dev->can.ctrlmode; +- dm->flags = 0; + + if (ctrlmode & CAN_CTRLMODE_LOOPBACK) +- dm->flags |= GS_CAN_MODE_LOOP_BACK; ++ flags |= GS_CAN_MODE_LOOP_BACK; + else if (ctrlmode & CAN_CTRLMODE_LISTENONLY) +- dm->flags |= GS_CAN_MODE_LISTEN_ONLY; ++ flags |= GS_CAN_MODE_LISTEN_ONLY; + + /* Controller is not allowed to retry TX + * this mode is unavailable on atmels uc3c hardware + */ + if (ctrlmode & CAN_CTRLMODE_ONE_SHOT) +- dm->flags |= GS_CAN_MODE_ONE_SHOT; ++ flags |= GS_CAN_MODE_ONE_SHOT; + + if (ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE; ++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ +- dm->mode = GS_CAN_MODE_START; ++ dm->mode = cpu_to_le32(GS_CAN_MODE_START); ++ dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0), + GS_USB_BREQ_MODE, +@@ -746,9 +753,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) + return -ENOMEM; + + if (do_identify) +- imode->mode = GS_CAN_IDENTIFY_ON; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON); + else +- imode->mode = GS_CAN_IDENTIFY_OFF; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF); + + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), +@@ -799,6 +806,7 @@ static struct gs_can *gs_make_candev(unsigned int channel, + struct net_device *netdev; + int rc; + struct gs_device_bt_const *bt_const; ++ u32 feature; + + bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL); + if (!bt_const) +@@ -839,14 +847,14 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* dev settup */ + strcpy(dev->bt_const.name, "gs_usb"); +- dev->bt_const.tseg1_min = bt_const->tseg1_min; +- dev->bt_const.tseg1_max = bt_const->tseg1_max; +- dev->bt_const.tseg2_min = bt_const->tseg2_min; +- dev->bt_const.tseg2_max = bt_const->tseg2_max; +- dev->bt_const.sjw_max = bt_const->sjw_max; +- dev->bt_const.brp_min = bt_const->brp_min; +- dev->bt_const.brp_max = bt_const->brp_max; +- dev->bt_const.brp_inc = bt_const->brp_inc; ++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min); ++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max); ++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min); ++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max); ++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max); ++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min); ++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max); ++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc); + + dev->udev = interface_to_usbdev(intf); + dev->iface = intf; +@@ -863,28 +871,29 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* can settup */ + dev->can.state = CAN_STATE_STOPPED; +- dev->can.clock.freq = bt_const->fclk_can; ++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can); + dev->can.bittiming_const = &dev->bt_const; + dev->can.do_set_bittiming = gs_usb_set_bittiming; + + dev->can.ctrlmode_supported = 0; + +- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY) ++ feature = le32_to_cpu(bt_const->feature); ++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY; + +- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK) ++ if (feature & GS_CAN_FEATURE_LOOP_BACK) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK; + +- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) ++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + +- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT) ++ if (feature & GS_CAN_FEATURE_ONE_SHOT) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT; + + SET_NETDEV_DEV(netdev, &intf->dev); + +- if (dconf->sw_version > 1) +- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY) ++ if (le32_to_cpu(dconf->sw_version) > 1) ++ if (feature & GS_CAN_FEATURE_IDENTIFY) + netdev->ethtool_ops = &gs_usb_ethtool_ops; + + kfree(bt_const); +@@ -919,7 +928,7 @@ static int gs_usb_probe(struct usb_interface *intf, + if (!hconf) + return -ENOMEM; + +- hconf->byte_order = 0x0000beef; ++ hconf->byte_order = cpu_to_le32(0x0000beef); + + /* send host config */ + rc = usb_control_msg(interface_to_usbdev(intf), +-- +2.27.0 + diff --git a/queue-4.9/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch b/queue-4.9/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch new file mode 100644 index 00000000000..d585975395b --- /dev/null +++ b/queue-4.9/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch @@ -0,0 +1,69 @@ +From 3ba5958adb0df9b8535c66ba743e4270e6400043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 11:55:06 +0800 +Subject: dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size + +From: Sugar Zhang + +[ Upstream commit e773ca7da8beeca7f17fe4c9d1284a2b66839cc1 ] + +Actually, burst size is equal to '1 << desc->rqcfg.brst_size'. +we should use burst size, not desc->rqcfg.brst_size. + +dma memcpy performance on Rockchip RV1126 +@ 1512MHz A7, 1056MHz LPDDR3, 200MHz DMA: + +dmatest: + +/# echo dma0chan0 > /sys/module/dmatest/parameters/channel +/# echo 4194304 > /sys/module/dmatest/parameters/test_buf_size +/# echo 8 > /sys/module/dmatest/parameters/iterations +/# echo y > /sys/module/dmatest/parameters/norandom +/# echo y > /sys/module/dmatest/parameters/verbose +/# echo 1 > /sys/module/dmatest/parameters/run + +dmatest: dma0chan0-copy0: result #1: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #2: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #3: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #4: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #5: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #6: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #7: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #8: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 + +Before: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 48 iops 200338 KB/s (0) + +After this patch: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 179 iops 734873 KB/s (0) + +After this patch and increase dma clk to 400MHz: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 259 iops 1062929 KB/s (0) + +Signed-off-by: Sugar Zhang +Link: https://lore.kernel.org/r/1605326106-55681-1-git-send-email-sugar.zhang@rock-chips.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/pl330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 16c08846ea0e1..f5a9bb1231882 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2682,7 +2682,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. + */ +- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) ++ if (burst * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + + desc->bytes_requested = len; +-- +2.27.0 + diff --git a/queue-4.9/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch b/queue-4.9/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch new file mode 100644 index 00000000000..c4428883a11 --- /dev/null +++ b/queue-4.9/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch @@ -0,0 +1,42 @@ +From 5711bdfe543080ba76d0de3047cd8fe55fa69292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 12:30:04 +0530 +Subject: dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant + +From: Marc Ferland + +[ Upstream commit 0ba2df09f1500d3f27398a3382b86d39c3e6abe2 ] + +The xilinx_dma_poll_timeout macro is sometimes called while holding a +spinlock (see xilinx_dma_issue_pending() for an example) this means we +shouldn't sleep when polling the dma channel registers. To address it +in xilinx poll timeout macro use readl_poll_timeout_atomic instead of +readl_poll_timeout variant. + +Signed-off-by: Marc Ferland +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1604473206-32573-2-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index cd271f7826051..ef99ef0bb1ca2 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -420,8 +420,8 @@ struct xilinx_dma_device { + #define to_dma_tx_descriptor(tx) \ + container_of(tx, struct xilinx_dma_tx_descriptor, async_tx) + #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \ +- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \ +- cond, delay_us, timeout_us) ++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \ ++ val, cond, delay_us, timeout_us) + + /* IO accessors */ + static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg) +-- +2.27.0 + diff --git a/queue-4.9/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch b/queue-4.9/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch new file mode 100644 index 00000000000..a458f45b596 --- /dev/null +++ b/queue-4.9/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch @@ -0,0 +1,63 @@ +From 3e4b32ff31da448939b4ce5ea9b962d5e919d9d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 08:45:55 +0100 +Subject: efivarfs: revert "fix memory leak in efivarfs_create()" + +From: Ard Biesheuvel + +[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ] + +The memory leak addressed by commit fe5186cf12e3 is a false positive: +all allocations are recorded in a linked list, and freed when the +filesystem is unmounted. This leads to double frees, and as reported +by David, leads to crashes if SLUB is configured to self destruct when +double frees occur. + +So drop the redundant kfree() again, and instead, mark the offending +pointer variable so the allocation is ignored by kmemleak. + +Cc: Vamshi K Sthambamkadi +Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()") +Reported-by: David Laight +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + fs/efivarfs/inode.c | 2 ++ + fs/efivarfs/super.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c +index 71fccccf317e8..5decb3e06563f 100644 +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -104,6 +105,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, + var->var.VariableName[i] = '\0'; + + inode->i_private = var; ++ kmemleak_ignore(var); + + err = efivar_entry_add(var, &efivarfs_list); + if (err) +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index bbf056191aaa4..b1e6acec53041 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list); + static void efivarfs_evict_inode(struct inode *inode) + { + clear_inode(inode); +- kfree(inode->i_private); + } + + static const struct super_operations efivarfs_ops = { +-- +2.27.0 + diff --git a/queue-4.9/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch b/queue-4.9/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch new file mode 100644 index 00000000000..ea2a13a1362 --- /dev/null +++ b/queue-4.9/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch @@ -0,0 +1,135 @@ +From 3d91beb31c0e5eada11016d50f1ae6e314261096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 03:16:50 +0900 +Subject: HID: cypress: Support Varmilo Keyboards' media hotkeys + +From: Frank Yang + +[ Upstream commit 652f3d00de523a17b0cebe7b90debccf13aa8c31 ] + +The Varmilo VA104M Keyboard (04b4:07b1, reported as Varmilo Z104M) +exposes media control hotkeys as a USB HID consumer control device, but +these keys do not work in the current (5.8-rc1) kernel due to the +incorrect HID report descriptor. Fix the problem by modifying the +internal HID report descriptor. + +More specifically, the keyboard report descriptor specifies the +logical boundary as 572~10754 (0x023c ~ 0x2a02) while the usage +boundary is specified as 0~10754 (0x00 ~ 0x2a02). This results in an +incorrect interpretation of input reports, causing inputs to be ignored. +By setting the Logical Minimum to zero, we align the logical boundary +with the Usage ID boundary. + +Some notes: + +* There seem to be multiple variants of the VA104M keyboard. This + patch specifically targets 04b4:07b1 variant. + +* The device works out-of-the-box on Windows platform with the generic + consumer control device driver (hidserv.inf). This suggests that + Windows either ignores the Logical Minimum/Logical Maximum or + interprets the Usage ID assignment differently from the linux + implementation; Maybe there are other devices out there that only + works on Windows due to this problem? + +Signed-off-by: Frank Yang +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-cypress.c | 44 ++++++++++++++++++++++++++++++++++----- + drivers/hid/hid-ids.h | 2 ++ + 2 files changed, 41 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c +index 1689568b597d4..12c5d7c96527a 100644 +--- a/drivers/hid/hid-cypress.c ++++ b/drivers/hid/hid-cypress.c +@@ -26,19 +26,17 @@ + #define CP_2WHEEL_MOUSE_HACK 0x02 + #define CP_2WHEEL_MOUSE_HACK_ON 0x04 + ++#define VA_INVAL_LOGICAL_BOUNDARY 0x08 ++ + /* + * Some USB barcode readers from cypress have usage min and usage max in + * the wrong order + */ +-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); + unsigned int i; + +- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) +- return rdesc; +- + if (*rsize < 4) + return rdesc; + +@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + ++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ /* ++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly ++ * reports Logical Minimum of its Consumer Control device as 572 ++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero. ++ */ ++ if (*rsize == 25 && ++ rdesc[0] == 0x05 && rdesc[1] == 0x0c && ++ rdesc[2] == 0x09 && rdesc[3] == 0x01 && ++ rdesc[6] == 0x19 && rdesc[7] == 0x00 && ++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) { ++ hid_info(hdev, ++ "fixing up varmilo VA104M consumer control report descriptor\n"); ++ rdesc[12] = 0x00; ++ rdesc[13] = 0x00; ++ } ++ return rdesc; ++} ++ ++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX) ++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize); ++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY) ++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize); ++ ++ return rdesc; ++} ++ + static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) +@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = { + .driver_data = CP_RDESC_SWAPPED_MIN_MAX }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE), + .driver_data = CP_2WHEEL_MOUSE_HACK }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1), ++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY }, + { } + }; + MODULE_DEVICE_TABLE(hid, cp_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 4630b58634d87..c4a53fc648e95 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -307,6 +307,8 @@ + #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81 + #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001 + ++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1 ++ + #define USB_VENDOR_ID_DATA_MODUL 0x7374 + #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201 + +-- +2.27.0 + diff --git a/queue-4.9/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch b/queue-4.9/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch new file mode 100644 index 00000000000..f322ed5bf56 --- /dev/null +++ b/queue-4.9/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch @@ -0,0 +1,39 @@ +From 758c46cf86a3f536bf036fe13793a3a60238a8a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 19:29:39 -0500 +Subject: HID: hid-sensor-hub: Fix issue with devices with no report ID + +From: Pablo Ceballos + +[ Upstream commit 34a9fa2025d9d3177c99351c7aaf256c5f50691f ] + +Some HID devices don't use a report ID because they only have a single +report. In those cases, the report ID in struct hid_report will be zero +and the data for the report will start at the first byte, so don't skip +over the first byte. + +Signed-off-by: Pablo Ceballos +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-sensor-hub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c +index 4ef73374a8f98..7001f07ca3996 100644 +--- a/drivers/hid/hid-sensor-hub.c ++++ b/drivers/hid/hid-sensor-hub.c +@@ -489,7 +489,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev, + return 1; + + ptr = raw_data; +- ptr++; /* Skip report id */ ++ if (report->id) ++ ptr++; /* Skip report id */ + + spin_lock_irqsave(&pdata->lock, flags); + +-- +2.27.0 + diff --git a/queue-4.9/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch b/queue-4.9/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch new file mode 100644 index 00000000000..ed547436e11 --- /dev/null +++ b/queue-4.9/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch @@ -0,0 +1,56 @@ +From cb13b2d979e50e89b74770cca64c9e3fbab465ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 09:57:02 +0800 +Subject: IB/mthca: fix return value of error branch in mthca_init_cq() + +From: Xiongfeng Wang + +[ Upstream commit 6830ff853a5764c75e56750d59d0bbb6b26f1835 ] + +We return 'err' in the error branch, but this variable may be set as zero +by the above code. Fix it by setting 'err' as a negative value before we +goto the error label. + +Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Xiongfeng Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index a6531ffe29a6f..a5694dec3f2ee 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -808,8 +808,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); +- if (IS_ERR(mailbox)) ++ if (IS_ERR(mailbox)) { ++ err = PTR_ERR(mailbox); + goto err_out_arm; ++ } + + cq_context = mailbox->buf; + +@@ -851,9 +853,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + spin_lock_irq(&dev->cq_table.lock); +- if (mthca_array_set(&dev->cq_table.cq, +- cq->cqn & (dev->limits.num_cqs - 1), +- cq)) { ++ err = mthca_array_set(&dev->cq_table.cq, ++ cq->cqn & (dev->limits.num_cqs - 1), cq); ++ if (err) { + spin_unlock_irq(&dev->cq_table.lock); + goto err_out_free_mr; + } +-- +2.27.0 + diff --git a/queue-4.9/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch b/queue-4.9/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch new file mode 100644 index 00000000000..81d57bc26af --- /dev/null +++ b/queue-4.9/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch @@ -0,0 +1,71 @@ +From 844216f8c335c63736a3cc57a0cb4cfd1368d35f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 13:35:46 -0600 +Subject: ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq + +From: Lijun Pan + +[ Upstream commit 0e435befaea45f7ea58682eecab5e37e05b2ce65 ] + +crq->msgs could be NULL if the previous reset did not complete after +freeing crq->msgs. Check for NULL before dereferencing them. + +Snippet of call trace: +... +ibmvnic 30000003 env3 (unregistering): Releasing sub-CRQ +ibmvnic 30000003 env3 (unregistering): Releasing CRQ +BUG: Kernel NULL pointer dereference on read at 0x00000000 +Faulting instruction address: 0xc0000000000c1a30 +Oops: Kernel access of bad area, sig: 11 [#1] +LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries +Modules linked in: ibmvnic(E-) rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag tun raw_diag inet_diag unix_diag bridge af_packet_diag netlink_diag stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ibmvnic] +CPU: 20 PID: 8426 Comm: kworker/20:0 Tainted: G E 5.10.0-rc1+ #12 +Workqueue: events __ibmvnic_reset [ibmvnic] +NIP: c0000000000c1a30 LR: c008000001b00c18 CTR: 0000000000000400 +REGS: c00000000d05b7a0 TRAP: 0380 Tainted: G E (5.10.0-rc1+) +MSR: 800000000280b033 CR: 44002480 XER: 20040000 +CFAR: c0000000000c19ec IRQMASK: 0 +GPR00: 0000000000000400 c00000000d05ba30 c008000001b17c00 0000000000000000 +GPR04: 0000000000000000 0000000000000000 0000000000000000 00000000000001e2 +GPR08: 000000000001f400 ffffffffffffd950 0000000000000000 c008000001b0b280 +GPR12: c0000000000c19c8 c00000001ec72e00 c00000000019a778 c00000002647b440 +GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +GPR20: 0000000000000006 0000000000000001 0000000000000003 0000000000000002 +GPR24: 0000000000001000 c008000001b0d570 0000000000000005 c00000007ab5d550 +GPR28: c00000007ab5c000 c000000032fcf848 c00000007ab5cc00 c000000032fcf800 +NIP [c0000000000c1a30] memset+0x68/0x104 +LR [c008000001b00c18] ibmvnic_reset_crq+0x70/0x110 [ibmvnic] +Call Trace: +[c00000000d05ba30] [0000000000000800] 0x800 (unreliable) +[c00000000d05bab0] [c008000001b0a930] do_reset.isra.40+0x224/0x634 [ibmvnic] +[c00000000d05bb80] [c008000001b08574] __ibmvnic_reset+0x17c/0x3c0 [ibmvnic] +[c00000000d05bc50] [c00000000018d9ac] process_one_work+0x2cc/0x800 +[c00000000d05bd20] [c00000000018df58] worker_thread+0x78/0x520 +[c00000000d05bdb0] [c00000000019a934] kthread+0x1c4/0x1d0 +[c00000000d05be20] [c00000000000d5d0] ret_from_kernel_thread+0x5c/0x6c + +Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index d25b76440c114..88c837504c7d6 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -3525,6 +3525,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter) + } while (rc == H_BUSY || H_IS_LONG_BUSY(rc)); + + /* Clean out the queue */ ++ if (!crq->msgs) ++ return -EINVAL; ++ + memset(crq->msgs, 0, PAGE_SIZE); + crq->cur = 0; + +-- +2.27.0 + diff --git a/queue-4.9/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch b/queue-4.9/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch new file mode 100644 index 00000000000..fbb1d4e82ae --- /dev/null +++ b/queue-4.9/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch @@ -0,0 +1,98 @@ +From 680a884d2620d20cdc251a52e941106d983186a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 20:53:57 -0700 +Subject: Input: i8042 - allow insmod to succeed on devices without an i8042 + controller + +From: Hans de Goede + +[ Upstream commit b1884583fcd17d6a1b1bba94bbb5826e6b5c6e17 ] + +The i8042 module exports several symbols which may be used by other +modules. + +Before this commit it would refuse to load (when built as a module itself) +on systems without an i8042 controller. + +This is a problem specifically for the asus-nb-wmi module. Many Asus +laptops support the Asus WMI interface. Some of them have an i8042 +controller and need to use i8042_install_filter() to filter some kbd +events. Other models do not have an i8042 controller (e.g. they use an +USB attached kbd). + +Before this commit the asus-nb-wmi driver could not be loaded on Asus +models without an i8042 controller, when the i8042 code was built as +a module (as Arch Linux does) because the module_init function of the +i8042 module would fail with -ENODEV and thus the i8042_install_filter +symbol could not be loaded. + +This commit fixes this by exiting from module_init with a return code +of 0 if no controller is found. It also adds a i8042_present bool to +make the module_exit function a no-op in this case and also adds a +check for i8042_present to the exported i8042_command function. + +The latter i8042_present check should not really be necessary because +when builtin that function can already be used on systems without +an i8042 controller, but better safe then sorry. + +Reported-and-tested-by: Marius Iacob +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20201008112628.3979-2-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index c84c685056b99..6b648339733fa 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600); + MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]"); + #endif + ++static bool i8042_present; + static bool i8042_bypass_aux_irq_test; + static char i8042_kbd_firmware_id[128]; + static char i8042_aux_firmware_id[128]; +@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command) + unsigned long flags; + int retval; + ++ if (!i8042_present) ++ return -1; ++ + spin_lock_irqsave(&i8042_lock, flags); + retval = __i8042_command(param, command); + spin_unlock_irqrestore(&i8042_lock, flags); +@@ -1597,12 +1601,15 @@ static int __init i8042_init(void) + + err = i8042_platform_init(); + if (err) +- return err; ++ return (err == -ENODEV) ? 0 : err; + + err = i8042_controller_check(); + if (err) + goto err_platform_exit; + ++ /* Set this before creating the dev to allow i8042_command to work right away */ ++ i8042_present = true; ++ + pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); +@@ -1621,6 +1628,9 @@ static int __init i8042_init(void) + + static void __exit i8042_exit(void) + { ++ if (!i8042_present) ++ return; ++ + platform_device_unregister(i8042_platform_device); + platform_driver_unregister(&i8042_driver); + i8042_platform_exit(); +-- +2.27.0 + diff --git a/queue-4.9/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch b/queue-4.9/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch new file mode 100644 index 00000000000..d2985e81926 --- /dev/null +++ b/queue-4.9/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch @@ -0,0 +1,78 @@ +From d51c52044db019bbeea9160df27ce1d486b6154e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 21:08:58 +0200 +Subject: net: ena: set initial DMA width to avoid intel iommu issue + +From: Shay Agroskin + +[ Upstream commit 09323b3bca95181c0da79daebc8b0603e500f573 ] + +The ENA driver uses the readless mechanism, which uses DMA, to find +out what the DMA mask is supposed to be. + +If DMA is used without setting the dma_mask first, it causes the +Intel IOMMU driver to think that ENA is a 32-bit device and therefore +disables IOMMU passthrough permanently. + +This patch sets the dma_mask to be ENA_MAX_PHYS_ADDR_SIZE_BITS=48 +before readless initialization in +ena_device_init()->ena_com_mmio_reg_read_request_init(), +which is large enough to workaround the intel_iommu issue. + +DMA mask is set again to the correct value after it's received from the +device after readless is initialized. + +The patch also changes the driver to use dma_set_mask_and_coherent() +function instead of the two pci_set_dma_mask() and +pci_set_consistent_dma_mask() ones. Both methods achieve the same +effect. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Mike Cui +Signed-off-by: Arthur Kiyanovski +Signed-off-by: Shay Agroskin +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index da21886609e30..de3d6f8b54316 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2345,16 +2345,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev, + goto err_mmio_read_less; + } + +- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width)); ++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width)); + if (rc) { +- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc); +- goto err_mmio_read_less; +- } +- +- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width)); +- if (rc) { +- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n", +- rc); ++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc); + goto err_mmio_read_less; + } + +@@ -2894,6 +2887,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + ++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS)); ++ if (rc) { ++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc); ++ goto err_disable_device; ++ } ++ + pci_set_master(pdev); + + ena_dev = vzalloc(sizeof(*ena_dev)); +-- +2.27.0 + diff --git a/queue-4.9/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch b/queue-4.9/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch new file mode 100644 index 00000000000..714f3296e99 --- /dev/null +++ b/queue-4.9/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch @@ -0,0 +1,41 @@ +From a6d69b0510f42a7e5de76ca295329d5073fc55c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 17:23:51 +0100 +Subject: nfc: s3fwrn5: use signed integer for parsing GPIO numbers + +From: Krzysztof Kozlowski + +[ Upstream commit d8f0a86795c69f5b697f7d9e5274c124da93c92d ] + +GPIOs - as returned by of_get_named_gpio() and used by the gpiolib - are +signed integers, where negative number indicates error. The return +value of of_get_named_gpio() should not be assigned to an unsigned int +because in case of !CONFIG_GPIOLIB such number would be a valid GPIO. + +Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201123162351.209100-1-krzk@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/s3fwrn5/i2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c +index 3ed0adf6479b0..5b0c065bd279f 100644 +--- a/drivers/nfc/s3fwrn5/i2c.c ++++ b/drivers/nfc/s3fwrn5/i2c.c +@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy { + struct i2c_client *i2c_dev; + struct nci_dev *ndev; + +- unsigned int gpio_en; +- unsigned int gpio_fw_wake; ++ int gpio_en; ++ int gpio_fw_wake; + + struct mutex mutex; + +-- +2.27.0 + diff --git a/queue-4.9/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch b/queue-4.9/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch new file mode 100644 index 00000000000..d43bb874bf7 --- /dev/null +++ b/queue-4.9/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch @@ -0,0 +1,53 @@ +From af85aa5431603888986c15d9ac5d03915357c60b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 14:48:46 +0900 +Subject: perf probe: Fix to die_entrypc() returns error correctly + +From: Masami Hiramatsu + +[ Upstream commit ab4200c17ba6fe71d2da64317aae8a8aa684624c ] + +Fix die_entrypc() to return error correctly if the DIE has no +DW_AT_ranges attribute. Since dwarf_ranges() will treat the case as an +empty ranges and return 0, we have to check it by ourselves. + +Fixes: 91e2f539eeda ("perf probe: Fix to show function entry line as probe-able") +Signed-off-by: Masami Hiramatsu +Cc: Sumanth Korikkar +Cc: Thomas Richter +Link: http://lore.kernel.org/lkml/160645612634.2824037.5284932731175079426.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index fb4e1d2839c5f..cbbacc3467494 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -329,6 +329,7 @@ bool die_is_func_def(Dwarf_Die *dw_die) + int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + { + Dwarf_Addr base, end; ++ Dwarf_Attribute attr; + + if (!addr) + return -EINVAL; +@@ -336,6 +337,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + if (dwarf_entrypc(dw_die, addr) == 0) + return 0; + ++ /* ++ * Since the dwarf_ranges() will return 0 if there is no ++ * DW_AT_ranges attribute, we should check it first. ++ */ ++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr)) ++ return -ENOENT; ++ + return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; + } + +-- +2.27.0 + diff --git a/queue-4.9/perf-x86-fix-sysfs-type-mismatches.patch b/queue-4.9/perf-x86-fix-sysfs-type-mismatches.patch new file mode 100644 index 00000000000..b554552dfbb --- /dev/null +++ b/queue-4.9/perf-x86-fix-sysfs-type-mismatches.patch @@ -0,0 +1,141 @@ +From fa106ff147801a7f5134739f07554ceb9b611f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 10:31:26 -0800 +Subject: perf/x86: fix sysfs type mismatches + +From: Sami Tolvanen + +[ Upstream commit ebd19fc372e3e78bf165f230e7c084e304441c08 ] + +This change switches rapl to use PMU_FORMAT_ATTR, and fixes two other +macros to use device_attribute instead of kobj_attribute to avoid +callback type mismatches that trip indirect call checking with Clang's +Control-Flow Integrity (CFI). + +Reported-by: Sedat Dilek +Signed-off-by: Sami Tolvanen +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Link: https://lkml.kernel.org/r/20201113183126.1239404-1-samitolvanen@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 6 +++--- + arch/x86/events/intel/rapl.c | 14 +------------- + arch/x86/events/intel/uncore.c | 4 ++-- + arch/x86/events/intel/uncore.h | 12 ++++++------ + 4 files changed, 12 insertions(+), 24 deletions(-) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 72d09340c24d2..88ba013d08d49 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -98,14 +98,14 @@ + MODULE_LICENSE("GPL"); + + #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __cstate_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __cstate_##_var##_show, NULL) + + static ssize_t cstate_get_attr_cpumask(struct device *dev, +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c +index 4c1b7ea185415..38dae3d1391b5 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/intel/rapl.c +@@ -115,18 +115,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = { + * any other bit is reserved + */ + #define RAPL_EVENT_MASK 0xFFULL +- +-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ +- char *page) \ +-{ \ +- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ +- return sprintf(page, _format "\n"); \ +-} \ +-static struct kobj_attribute format_attr_##_var = \ +- __ATTR(_name, 0444, __rapl_##_var##_show, NULL) +- + #define RAPL_CNTR_WIDTH 32 + + #define RAPL_EVENT_ATTR_STR(_name, v, str) \ +@@ -548,7 +536,7 @@ static struct attribute_group rapl_pmu_events_group = { + .attrs = NULL, /* patched at runtime */ + }; + +-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7"); ++PMU_FORMAT_ATTR(event, "config:0-7"); + static struct attribute *rapl_formats_attr[] = { + &format_attr_event.attr, + NULL, +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 4f365267b12fe..9f572bf6c6216 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -90,8 +90,8 @@ end: + return map; + } + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct uncore_event_desc *event = + container_of(attr, struct uncore_event_desc, attr); +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index ad986c1e29bcc..f699783114ee3 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -124,7 +124,7 @@ struct intel_uncore_box { + #define UNCORE_BOX_FLAG_CTL_OFFS8 1 /* event config registers are 8-byte apart */ + + struct uncore_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *config; + }; + +@@ -136,8 +136,8 @@ struct pci2phy_map { + + struct pci2phy_map *__find_pci2phy_map(int segment); + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf); ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf); + + #define INTEL_UNCORE_EVENT_DESC(_name, _config) \ + { \ +@@ -146,14 +146,14 @@ ssize_t uncore_event_show(struct kobject *kobj, + } + + #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __uncore_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __uncore_##_var##_show, NULL) + + static inline unsigned uncore_pci_box_ctl(struct intel_uncore_box *box) +-- +2.27.0 + diff --git a/queue-4.9/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch b/queue-4.9/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch new file mode 100644 index 00000000000..984e13946f4 --- /dev/null +++ b/queue-4.9/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch @@ -0,0 +1,95 @@ +From 62d3d40939a98e07d8eedeca73781ef4734e207d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 10:58:20 +0100 +Subject: phy: tegra: xusb: Fix dangling pointer on probe failure + +From: Marc Zyngier + +[ Upstream commit eb9c4dd9bdfdebaa13846c16a8c79b5b336066b6 ] + +If, for some reason, the xusb PHY fails to probe, it leaves +a dangling pointer attached to the platform device structure. + +This would normally be harmless, but the Tegra XHCI driver then +goes and extract that pointer from the PHY device. Things go +downhill from there: + + 8.752082] [004d554e5145533c] address between user and kernel address ranges +[ 8.752085] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 8.752088] Modules linked in: max77620_regulator(E+) xhci_tegra(E+) sdhci_tegra(E+) xhci_hcd(E) sdhci_pltfm(E) cqhci(E) fixed(E) usbcore(E) scsi_mod(E) sdhci(E) host1x(E+) +[ 8.752103] CPU: 4 PID: 158 Comm: systemd-udevd Tainted: G S W E 5.9.0-rc7-00298-gf6337624c4fe #1980 +[ 8.752105] Hardware name: NVIDIA Jetson TX2 Developer Kit (DT) +[ 8.752108] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--) +[ 8.752115] pc : kobject_put+0x1c/0x21c +[ 8.752120] lr : put_device+0x20/0x30 +[ 8.752121] sp : ffffffc012eb3840 +[ 8.752122] x29: ffffffc012eb3840 x28: ffffffc010e82638 +[ 8.752125] x27: ffffffc008d56440 x26: 0000000000000000 +[ 8.752128] x25: ffffff81eb508200 x24: 0000000000000000 +[ 8.752130] x23: ffffff81eb538800 x22: 0000000000000000 +[ 8.752132] x21: 00000000fffffdfb x20: ffffff81eb538810 +[ 8.752134] x19: 3d4d554e51455300 x18: 0000000000000020 +[ 8.752136] x17: ffffffc008d00270 x16: ffffffc008d00c94 +[ 8.752138] x15: 0000000000000004 x14: ffffff81ebd4ae90 +[ 8.752140] x13: 0000000000000000 x12: ffffff81eb86a4e8 +[ 8.752142] x11: ffffff81eb86a480 x10: ffffff81eb862fea +[ 8.752144] x9 : ffffffc01055fb28 x8 : ffffff81eb86a4a8 +[ 8.752146] x7 : 0000000000000001 x6 : 0000000000000001 +[ 8.752148] x5 : ffffff81dff8bc38 x4 : 0000000000000000 +[ 8.752150] x3 : 0000000000000001 x2 : 0000000000000001 +[ 8.752152] x1 : 0000000000000002 x0 : 3d4d554e51455300 +[ 8.752155] Call trace: +[ 8.752157] kobject_put+0x1c/0x21c +[ 8.752160] put_device+0x20/0x30 +[ 8.752164] tegra_xusb_padctl_put+0x24/0x3c +[ 8.752170] tegra_xusb_probe+0x8b0/0xd10 [xhci_tegra] +[ 8.752174] platform_drv_probe+0x60/0xb4 +[ 8.752176] really_probe+0xf0/0x504 +[ 8.752179] driver_probe_device+0x100/0x170 +[ 8.752181] device_driver_attach+0xcc/0xd4 +[ 8.752183] __driver_attach+0xb0/0x17c +[ 8.752185] bus_for_each_dev+0x7c/0xd4 +[ 8.752187] driver_attach+0x30/0x3c +[ 8.752189] bus_add_driver+0x154/0x250 +[ 8.752191] driver_register+0x84/0x140 +[ 8.752193] __platform_driver_register+0x54/0x60 +[ 8.752197] tegra_xusb_init+0x40/0x1000 [xhci_tegra] +[ 8.752201] do_one_initcall+0x54/0x2d0 +[ 8.752205] do_init_module+0x68/0x29c +[ 8.752207] load_module+0x2178/0x26c0 +[ 8.752209] __do_sys_finit_module+0xb0/0x120 +[ 8.752211] __arm64_sys_finit_module+0x2c/0x40 +[ 8.752215] el0_svc_common.constprop.0+0x80/0x240 +[ 8.752218] do_el0_svc+0x30/0xa0 +[ 8.752220] el0_svc+0x18/0x50 +[ 8.752223] el0_sync_handler+0x90/0x318 +[ 8.752225] el0_sync+0x158/0x180 +[ 8.752230] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (3940f000) +[ 8.752232] ---[ end trace 90f6c89d62d85ff5 ]--- + +Reset the pointer on probe failure fixes the issue. + +Fixes: 53d2a715c2403 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20201013095820.311376-1-maz@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index bd0e659002161..0156134dd022d 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -916,6 +916,7 @@ remove_pads: + reset: + reset_control_assert(padctl->rst); + remove: ++ platform_set_drvdata(pdev, NULL); + soc->ops->remove(padctl); + return err; + } +-- +2.27.0 + diff --git a/queue-4.9/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch b/queue-4.9/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch new file mode 100644 index 00000000000..39156b7c5aa --- /dev/null +++ b/queue-4.9/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch @@ -0,0 +1,49 @@ +From fbcfd594e81c79e1089a456795420a0320888462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Nov 2020 13:49:37 +0800 +Subject: platform/x86: toshiba_acpi: Fix the wrong variable assignment + +From: Kaixu Xia + +[ Upstream commit 2a72c46ac4d665614faa25e267c3fb27fb729ed7 ] + +The commit 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up +variable declaration") cleans up variable declaration in +video_proc_write(). Seems it does the variable assignment in the +wrong place, this results in dead code and changes the source code +logic. Fix it by doing the assignment at the beginning of the funciton. + +Fixes: 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up variable declaration") +Reported-by: Tosk Robot +Signed-off-by: Kaixu Xia +Link: https://lore.kernel.org/r/1606024177-16481-1-git-send-email-kaixuxia@tencent.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/toshiba_acpi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index 79a2289370729..f25278bb3e1a8 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -1497,7 +1497,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file)); + char *buffer; + char *cmd; +- int lcd_out, crt_out, tv_out; ++ int lcd_out = -1, crt_out = -1, tv_out = -1; + int remain = count; + int value; + int ret; +@@ -1534,7 +1534,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + + kfree(cmd); + +- lcd_out = crt_out = tv_out = -1; + ret = get_video_status(dev, &video_out); + if (!ret) { + unsigned int new_video_out = video_out; +-- +2.27.0 + diff --git a/queue-4.9/proc-don-t-allow-async-path-resolution-of-proc-self-.patch b/queue-4.9/proc-don-t-allow-async-path-resolution-of-proc-self-.patch new file mode 100644 index 00000000000..fae225cf8a2 --- /dev/null +++ b/queue-4.9/proc-don-t-allow-async-path-resolution-of-proc-self-.patch @@ -0,0 +1,40 @@ +From a518d885566b5fb55bd87501c7493448edd90a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 16:47:52 -0700 +Subject: proc: don't allow async path resolution of /proc/self components + +From: Jens Axboe + +[ Upstream commit 8d4c3e76e3be11a64df95ddee52e99092d42fc19 ] + +If this is attempted by a kthread, then return -EOPNOTSUPP as we don't +currently support that. Once we can get task_pid_ptr() doing the right +thing, then this can go away again. + +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/proc/self.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/proc/self.c b/fs/proc/self.c +index c8bbc1c84a39a..f6e2e3fb8a226 100644 +--- a/fs/proc/self.c ++++ b/fs/proc/self.c +@@ -26,6 +26,13 @@ static const char *proc_self_get_link(struct dentry *dentry, + pid_t tgid = task_tgid_nr_ns(current, ns); + char *name; + ++ /* ++ * Not currently supported. Once we can inherit all of struct pid, ++ * we can allow this. ++ */ ++ if (current->flags & PF_KTHREAD) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (!tgid) + return ERR_PTR(-ENOENT); + /* 11 for max length of signed int in decimal + NULL term */ +-- +2.27.0 + diff --git a/queue-4.9/scsi-libiscsi-fix-nop-race-condition.patch b/queue-4.9/scsi-libiscsi-fix-nop-race-condition.patch new file mode 100644 index 00000000000..aa493d11504 --- /dev/null +++ b/queue-4.9/scsi-libiscsi-fix-nop-race-condition.patch @@ -0,0 +1,132 @@ +From dace56e88bc1c8dbe9eb78f3cdc926c7fbdcfe74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 11:33:17 -0800 +Subject: scsi: libiscsi: Fix NOP race condition + +From: Lee Duncan + +[ Upstream commit fe0a8a95e7134d0b44cd407bc0085b9ba8d8fe31 ] + +iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid +daemon instead of handled in the kernel, as they should be, resulting in a +message from the daemon like: + + iscsid: Got nop in, but kernel supports nop handling. + +This can occur because of the new forward- and back-locks, and the fact +that an iSCSI NOP response can occur before processing of the NOP send is +complete. This can result in "conn->ping_task" being NULL in +iscsi_nop_out_rsp(), when the pointer is actually in the process of being +set. + +To work around this, we add a new state to the "ping_task" pointer. In +addition to NULL (not assigned) and a pointer (assigned), we add the state +"being set", which is signaled with an INVALID pointer (using "-1"). + +Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com +Reviewed-by: Mike Christie +Signed-off-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 23 +++++++++++++++-------- + include/scsi/libiscsi.h | 3 +++ + 2 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index c4336b01db23c..a84b473d4a08b 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -570,8 +570,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) + if (conn->task == task) + conn->task = NULL; + +- if (conn->ping_task == task) +- conn->ping_task = NULL; ++ if (READ_ONCE(conn->ping_task) == task) ++ WRITE_ONCE(conn->ping_task, NULL); + + /* release get from queueing */ + __iscsi_put_task(task); +@@ -780,6 +780,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + task->conn->session->age); + } + ++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK)) ++ WRITE_ONCE(conn->ping_task, task); ++ + if (!ihost->workq) { + if (iscsi_prep_mgmt_task(conn, task)) + goto free_task; +@@ -987,8 +990,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + struct iscsi_nopout hdr; + struct iscsi_task *task; + +- if (!rhdr && conn->ping_task) +- return -EINVAL; ++ if (!rhdr) { ++ if (READ_ONCE(conn->ping_task)) ++ return -EINVAL; ++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK); ++ } + + memset(&hdr, 0, sizeof(struct iscsi_nopout)); + hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE; +@@ -1003,11 +1009,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + + task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0); + if (!task) { ++ if (!rhdr) ++ WRITE_ONCE(conn->ping_task, NULL); + iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n"); + return -EIO; + } else if (!rhdr) { + /* only track our nops */ +- conn->ping_task = task; + conn->last_ping = jiffies; + } + +@@ -1020,7 +1027,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task, + struct iscsi_conn *conn = task->conn; + int rc = 0; + +- if (conn->ping_task != task) { ++ if (READ_ONCE(conn->ping_task) != task) { + /* + * If this is not in response to one of our + * nops then it must be from userspace. +@@ -1960,7 +1967,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn) + */ + static int iscsi_has_ping_timed_out(struct iscsi_conn *conn) + { +- if (conn->ping_task && ++ if (READ_ONCE(conn->ping_task) && + time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) + + (conn->ping_timeout * HZ), jiffies)) + return 1; +@@ -2095,7 +2102,7 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + * Checking the transport already or nop from a cmd timeout still + * running + */ +- if (conn->ping_task) { ++ if (READ_ONCE(conn->ping_task)) { + task->have_checked_conn = true; + rc = BLK_EH_RESET_TIMER; + goto done; +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index c7b1dc713cdd7..9c7f4aad6db66 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -144,6 +144,9 @@ struct iscsi_task { + void *dd_data; /* driver/transport data */ + }; + ++/* invalid scsi_task pointer */ ++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l ++ + static inline int iscsi_task_has_unsol_data(struct iscsi_task *task) + { + return task->unsol_r2t.data_length > task->unsol_r2t.sent; +-- +2.27.0 + diff --git a/queue-4.9/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch b/queue-4.9/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch new file mode 100644 index 00000000000..733e3a9d13d --- /dev/null +++ b/queue-4.9/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch @@ -0,0 +1,88 @@ +From e15ce981baf6cfe99e9db66f1abf77f99e54e72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 19:46:18 -0600 +Subject: scsi: target: iscsi: Fix cmd abort fabric stop race + +From: Mike Christie + +[ Upstream commit f36199355c64a39fe82cfddc7623d827c7e050da ] + +Maurizio found a race where the abort and cmd stop paths can race as +follows: + + 1. thread1 runs iscsit_release_commands_from_conn and sets + CMD_T_FABRIC_STOP. + + 2. thread2 runs iscsit_aborted_task and then does __iscsit_free_cmd. It + then returns from the aborted_task callout and we finish + target_handle_abort and do: + + target_handle_abort -> transport_cmd_check_stop_to_fabric -> + lio_check_stop_free -> target_put_sess_cmd + + The cmd is now freed. + + 3. thread1 now finishes iscsit_release_commands_from_conn and runs + iscsit_free_cmd while accessing a command we just released. + +In __target_check_io_state we check for CMD_T_FABRIC_STOP and set the +CMD_T_ABORTED if the driver is not cleaning up the cmd because of a session +shutdown. However, iscsit_release_commands_from_conn only sets the +CMD_T_FABRIC_STOP and does not check to see if the abort path has claimed +completion ownership of the command. + +This adds a check in iscsit_release_commands_from_conn so only the abort or +fabric stop path cleanup the command. + +Link: https://lore.kernel.org/r/1605318378-9269-1-git-send-email-michael.christie@oracle.com +Reported-by: Maurizio Lombardi +Reviewed-by: Maurizio Lombardi +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 7c0f4b96816a8..eba21f06a9b95 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -493,8 +493,7 @@ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD); + + spin_lock_bh(&conn->cmd_lock); +- if (!list_empty(&cmd->i_conn_node) && +- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) ++ if (!list_empty(&cmd->i_conn_node)) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +@@ -4093,12 +4092,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + spin_lock_bh(&conn->cmd_lock); + list_splice_init(&conn->conn_cmd_list, &tmp_list); + +- list_for_each_entry(cmd, &tmp_list, i_conn_node) { ++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + + if (se_cmd->se_tfo != NULL) { + spin_lock_irq(&se_cmd->t_state_lock); +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ /* ++ * LIO's abort path owns the cleanup for this, ++ * so put it back on the list and let ++ * aborted_task handle it. ++ */ ++ list_move_tail(&cmd->i_conn_node, ++ &conn->conn_cmd_list); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ } + spin_unlock_irq(&se_cmd->t_state_lock); + } + } +-- +2.27.0 + diff --git a/queue-4.9/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch b/queue-4.9/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch new file mode 100644 index 00000000000..e9820a08abd --- /dev/null +++ b/queue-4.9/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch @@ -0,0 +1,50 @@ +From 66cdc01bde62382488d39a556bd674c589525764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 14:29:16 +0800 +Subject: scsi: ufs: Fix race between shutdown and runtime resume flow + +From: Stanley Chu + +[ Upstream commit e92643db514803c2c87d72caf5950b4c0a8faf4a ] + +If UFS host device is in runtime-suspended state while UFS shutdown +callback is invoked, UFS device shall be resumed for register +accesses. Currently only UFS local runtime resume function will be invoked +to wake up the host. This is not enough because if someone triggers +runtime resume from block layer, then race may happen between shutdown and +runtime resume flow, and finally lead to unlocked register access. + +To fix this, in ufshcd_shutdown(), use pm_runtime_get_sync() instead of +resuming UFS device by ufshcd_runtime_resume() "internally" to let runtime +PM framework manage the whole resume flow. + +Link: https://lore.kernel.org/r/20201119062916.12931-1-stanley.chu@mediatek.com +Fixes: 57d104c153d3 ("ufs: add UFS power management support") +Reviewed-by: Can Guo +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index ad5f2e2b4cbaf..ad80e4223c2d3 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6521,11 +6521,7 @@ int ufshcd_shutdown(struct ufs_hba *hba) + if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) + goto out; + +- if (pm_runtime_suspended(hba->dev)) { +- ret = ufshcd_runtime_resume(hba); +- if (ret) +- goto out; +- } ++ pm_runtime_get_sync(hba->dev); + + ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM); + out: +-- +2.27.0 + diff --git a/queue-4.9/series b/queue-4.9/series index ee02a548c28..9965e16288f 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -9,3 +9,27 @@ arm64-pgtable-fix-pte_accessible.patch i2c-imx-fix-reset-of-i2sr_ial-flag.patch alsa-hda-hdmi-use-single-mutex-unlock-in-error-paths.patch alsa-hda-hdmi-fix-incorrect-locking-in-hdmi_pcm_close.patch +hid-cypress-support-varmilo-keyboards-media-hotkeys.patch +input-i8042-allow-insmod-to-succeed-on-devices-witho.patch +hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch +dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch +x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch +proc-don-t-allow-async-path-resolution-of-proc-self-.patch +dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch +scsi-libiscsi-fix-nop-race-condition.patch +scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch +perf-x86-fix-sysfs-type-mismatches.patch +phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch +batman-adv-set-.owner-to-this_module.patch +scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch +bnxt_en-fix-error-return-code-in-bnxt_init_board.patch +video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch +bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch +ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch +nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch +net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch +ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch +efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch +can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch +platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch +perf-probe-fix-to-die_entrypc-returns-error-correctl.patch diff --git a/queue-4.9/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch b/queue-4.9/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch new file mode 100644 index 00000000000..6ab8915aef8 --- /dev/null +++ b/queue-4.9/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch @@ -0,0 +1,63 @@ +From 73947e4bfe46b3902bf09896d2313ee546c11819 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 16:03:05 -0800 +Subject: video: hyperv_fb: Fix the cache type when mapping the VRAM + +From: Dexuan Cui + +[ Upstream commit 5f1251a48c17b54939d7477305e39679a565382c ] + +x86 Hyper-V used to essentially always overwrite the effective cache type +of guest memory accesses to WB. This was problematic in cases where there +is a physical device assigned to the VM, since that often requires that +the VM should have control over cache types. Thus, on newer Hyper-V since +2018, Hyper-V always honors the VM's cache type, but unexpectedly Linux VM +users start to complain that Linux VM's VRAM becomes very slow, and it +turns out that Linux VM should not map the VRAM uncacheable by ioremap(). +Fix this slowness issue by using ioremap_cache(). + +On ARM64, ioremap_cache() is also required as the host also maps the VRAM +cacheable, otherwise VM Connect can't display properly with ioremap() or +ioremap_wc(). + +With this change, the VRAM on new Hyper-V is as fast as regular RAM, so +it's no longer necessary to use the hacks we added to mitigate the +slowness, i.e. we no longer need to allocate physical memory and use +it to back up the VRAM in Generation-1 VM, and we also no longer need to +allocate physical memory to back up the framebuffer in a Generation-2 VM +and copy the framebuffer to the real VRAM. A further big change will +address these for v5.11. + +Fixes: 68a2d20b79b1 ("drivers/video: add Hyper-V Synthetic Video Frame Buffer Driver") +Tested-by: Boqun Feng +Signed-off-by: Dexuan Cui +Reviewed-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Link: https://lore.kernel.org/r/20201118000305.24797-1-decui@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/hyperv_fb.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 2fd49b2358f8b..f3938c5278832 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + goto err1; + } + +- fb_virt = ioremap(par->mem->start, screen_fb_size); ++ /* ++ * Map the VRAM cacheable for performance. This is also required for ++ * VM Connect to display properly for ARM64 Linux VM, as the host also ++ * maps the VRAM cacheable. ++ */ ++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size); + if (!fb_virt) + goto err2; + +-- +2.27.0 + diff --git a/queue-4.9/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch b/queue-4.9/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch new file mode 100644 index 00000000000..8383d409fd8 --- /dev/null +++ b/queue-4.9/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch @@ -0,0 +1,76 @@ +From 86ea8c2d0b68cca9c1848feae67b0dd80dfcdfc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 20:11:19 -0500 +Subject: x86/xen: don't unbind uninitialized lock_kicker_irq + +From: Brian Masney + +[ Upstream commit 65cae18882f943215d0505ddc7e70495877308e6 ] + +When booting a hyperthreaded system with the kernel parameter +'mitigations=auto,nosmt', the following warning occurs: + + WARNING: CPU: 0 PID: 1 at drivers/xen/events/events_base.c:1112 unbind_from_irqhandler+0x4e/0x60 + ... + Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006 + ... + Call Trace: + xen_uninit_lock_cpu+0x28/0x62 + xen_hvm_cpu_die+0x21/0x30 + takedown_cpu+0x9c/0xe0 + ? trace_suspend_resume+0x60/0x60 + cpuhp_invoke_callback+0x9a/0x530 + _cpu_up+0x11a/0x130 + cpu_up+0x7e/0xc0 + bringup_nonboot_cpus+0x48/0x50 + smp_init+0x26/0x79 + kernel_init_freeable+0xea/0x229 + ? rest_init+0xaa/0xaa + kernel_init+0xa/0x106 + ret_from_fork+0x35/0x40 + +The secondary CPUs are not activated with the nosmt mitigations and only +the primary thread on each CPU core is used. In this situation, +xen_hvm_smp_prepare_cpus(), and more importantly xen_init_lock_cpu(), is +not called, so the lock_kicker_irq is not initialized for the secondary +CPUs. Let's fix this by exiting early in xen_uninit_lock_cpu() if the +irq is not set to avoid the warning from above for each secondary CPU. + +Signed-off-by: Brian Masney +Link: https://lore.kernel.org/r/20201107011119.631442-1-bmasney@redhat.com +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/spinlock.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index 8d2c6f071dccf..44bf8a22c97b8 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -98,10 +98,20 @@ void xen_init_lock_cpu(int cpu) + + void xen_uninit_lock_cpu(int cpu) + { ++ int irq; ++ + if (!xen_pvspin) + return; + +- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL); ++ /* ++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary ++ * CPUs are not activated, and lock_kicker_irq is not initialized. ++ */ ++ irq = per_cpu(lock_kicker_irq, cpu); ++ if (irq == -1) ++ return; ++ ++ unbind_from_irqhandler(irq, NULL); + per_cpu(lock_kicker_irq, cpu) = -1; + kfree(per_cpu(irq_name, cpu)); + per_cpu(irq_name, cpu) = NULL; +-- +2.27.0 +