From: Sasha Levin Date: Sat, 13 Mar 2021 04:07:13 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v4.4.262~69 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c6903bf41f6782e9a50a37c3f2353f0c7401c8fd;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch b/queue-5.10/arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch new file mode 100644 index 00000000000..3f4e85f4754 --- /dev/null +++ b/queue-5.10/arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch @@ -0,0 +1,214 @@ +From 5c3f848fc4fb4c0d0675dca460bbb4307087f9ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 23:11:36 +0100 +Subject: ARM: 9029/1: Make iwmmxt.S support Clang's integrated assembler + +From: Jian Cai + +commit 3c9f5708b7aed6a963e2aefccbd1854802de163e upstream. + +This patch replaces 6 IWMMXT instructions Clang's integrated assembler +does not support in iwmmxt.S using macros, while making sure GNU +assembler still emit the same instructions. This should be easier than +providing full IWMMXT support in Clang. This is one of the last bits of +kernel code that could be compiled but not assembled with clang. Once +all of it works with IAS, we no longer need to special-case 32-bit Arm +in Kbuild, or turn off CONFIG_IWMMXT when build-testing. + +"Intel Wireless MMX Technology - Developer Guide - August, 2002" should +be referenced for the encoding schemes of these extensions. + +Link: https://github.com/ClangBuiltLinux/linux/issues/975 + +Suggested-by: Nick Desaulniers +Suggested-by: Ard Biesheuvel +Acked-by: Ard Biesheuvel +Reviewed-by: Nick Desaulniers +Tested-by: Nick Desaulniers +Signed-off-by: Jian Cai +Signed-off-by: Russell King +Signed-off-by: Nick Desaulniers +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/iwmmxt.S | 89 ++++++++++++++++++++-------------------- + arch/arm/kernel/iwmmxt.h | 47 +++++++++++++++++++++ + 2 files changed, 92 insertions(+), 44 deletions(-) + create mode 100644 arch/arm/kernel/iwmmxt.h + +diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S +index 0dcae787b004..d2b4ac06e4ed 100644 +--- a/arch/arm/kernel/iwmmxt.S ++++ b/arch/arm/kernel/iwmmxt.S +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include "iwmmxt.h" + + #if defined(CONFIG_CPU_PJ4) || defined(CONFIG_CPU_PJ4B) + #define PJ4(code...) code +@@ -113,33 +114,33 @@ concan_save: + + concan_dump: + +- wstrw wCSSF, [r1, #MMX_WCSSF] +- wstrw wCASF, [r1, #MMX_WCASF] +- wstrw wCGR0, [r1, #MMX_WCGR0] +- wstrw wCGR1, [r1, #MMX_WCGR1] +- wstrw wCGR2, [r1, #MMX_WCGR2] +- wstrw wCGR3, [r1, #MMX_WCGR3] ++ wstrw wCSSF, r1, MMX_WCSSF ++ wstrw wCASF, r1, MMX_WCASF ++ wstrw wCGR0, r1, MMX_WCGR0 ++ wstrw wCGR1, r1, MMX_WCGR1 ++ wstrw wCGR2, r1, MMX_WCGR2 ++ wstrw wCGR3, r1, MMX_WCGR3 + + 1: @ MUP? wRn + tst r2, #0x2 + beq 2f + +- wstrd wR0, [r1, #MMX_WR0] +- wstrd wR1, [r1, #MMX_WR1] +- wstrd wR2, [r1, #MMX_WR2] +- wstrd wR3, [r1, #MMX_WR3] +- wstrd wR4, [r1, #MMX_WR4] +- wstrd wR5, [r1, #MMX_WR5] +- wstrd wR6, [r1, #MMX_WR6] +- wstrd wR7, [r1, #MMX_WR7] +- wstrd wR8, [r1, #MMX_WR8] +- wstrd wR9, [r1, #MMX_WR9] +- wstrd wR10, [r1, #MMX_WR10] +- wstrd wR11, [r1, #MMX_WR11] +- wstrd wR12, [r1, #MMX_WR12] +- wstrd wR13, [r1, #MMX_WR13] +- wstrd wR14, [r1, #MMX_WR14] +- wstrd wR15, [r1, #MMX_WR15] ++ wstrd wR0, r1, MMX_WR0 ++ wstrd wR1, r1, MMX_WR1 ++ wstrd wR2, r1, MMX_WR2 ++ wstrd wR3, r1, MMX_WR3 ++ wstrd wR4, r1, MMX_WR4 ++ wstrd wR5, r1, MMX_WR5 ++ wstrd wR6, r1, MMX_WR6 ++ wstrd wR7, r1, MMX_WR7 ++ wstrd wR8, r1, MMX_WR8 ++ wstrd wR9, r1, MMX_WR9 ++ wstrd wR10, r1, MMX_WR10 ++ wstrd wR11, r1, MMX_WR11 ++ wstrd wR12, r1, MMX_WR12 ++ wstrd wR13, r1, MMX_WR13 ++ wstrd wR14, r1, MMX_WR14 ++ wstrd wR15, r1, MMX_WR15 + + 2: teq r0, #0 @ anything to load? + reteq lr @ if not, return +@@ -147,30 +148,30 @@ concan_dump: + concan_load: + + @ Load wRn +- wldrd wR0, [r0, #MMX_WR0] +- wldrd wR1, [r0, #MMX_WR1] +- wldrd wR2, [r0, #MMX_WR2] +- wldrd wR3, [r0, #MMX_WR3] +- wldrd wR4, [r0, #MMX_WR4] +- wldrd wR5, [r0, #MMX_WR5] +- wldrd wR6, [r0, #MMX_WR6] +- wldrd wR7, [r0, #MMX_WR7] +- wldrd wR8, [r0, #MMX_WR8] +- wldrd wR9, [r0, #MMX_WR9] +- wldrd wR10, [r0, #MMX_WR10] +- wldrd wR11, [r0, #MMX_WR11] +- wldrd wR12, [r0, #MMX_WR12] +- wldrd wR13, [r0, #MMX_WR13] +- wldrd wR14, [r0, #MMX_WR14] +- wldrd wR15, [r0, #MMX_WR15] ++ wldrd wR0, r0, MMX_WR0 ++ wldrd wR1, r0, MMX_WR1 ++ wldrd wR2, r0, MMX_WR2 ++ wldrd wR3, r0, MMX_WR3 ++ wldrd wR4, r0, MMX_WR4 ++ wldrd wR5, r0, MMX_WR5 ++ wldrd wR6, r0, MMX_WR6 ++ wldrd wR7, r0, MMX_WR7 ++ wldrd wR8, r0, MMX_WR8 ++ wldrd wR9, r0, MMX_WR9 ++ wldrd wR10, r0, MMX_WR10 ++ wldrd wR11, r0, MMX_WR11 ++ wldrd wR12, r0, MMX_WR12 ++ wldrd wR13, r0, MMX_WR13 ++ wldrd wR14, r0, MMX_WR14 ++ wldrd wR15, r0, MMX_WR15 + + @ Load wCx +- wldrw wCSSF, [r0, #MMX_WCSSF] +- wldrw wCASF, [r0, #MMX_WCASF] +- wldrw wCGR0, [r0, #MMX_WCGR0] +- wldrw wCGR1, [r0, #MMX_WCGR1] +- wldrw wCGR2, [r0, #MMX_WCGR2] +- wldrw wCGR3, [r0, #MMX_WCGR3] ++ wldrw wCSSF, r0, MMX_WCSSF ++ wldrw wCASF, r0, MMX_WCASF ++ wldrw wCGR0, r0, MMX_WCGR0 ++ wldrw wCGR1, r0, MMX_WCGR1 ++ wldrw wCGR2, r0, MMX_WCGR2 ++ wldrw wCGR3, r0, MMX_WCGR3 + + @ clear CUP/MUP (only if r1 != 0) + teq r1, #0 +diff --git a/arch/arm/kernel/iwmmxt.h b/arch/arm/kernel/iwmmxt.h +new file mode 100644 +index 000000000000..fb627286f5bb +--- /dev/null ++++ b/arch/arm/kernel/iwmmxt.h +@@ -0,0 +1,47 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#ifndef __IWMMXT_H__ ++#define __IWMMXT_H__ ++ ++.irp b, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 ++.set .LwR\b, \b ++.set .Lr\b, \b ++.endr ++ ++.set .LwCSSF, 0x2 ++.set .LwCASF, 0x3 ++.set .LwCGR0, 0x8 ++.set .LwCGR1, 0x9 ++.set .LwCGR2, 0xa ++.set .LwCGR3, 0xb ++ ++.macro wldrd, reg:req, base:req, offset:req ++.inst 0xedd00100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2) ++.endm ++ ++.macro wldrw, reg:req, base:req, offset:req ++.inst 0xfd900100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2) ++.endm ++ ++.macro wstrd, reg:req, base:req, offset:req ++.inst 0xedc00100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2) ++.endm ++ ++.macro wstrw, reg:req, base:req, offset:req ++.inst 0xfd800100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2) ++.endm ++ ++#ifdef __clang__ ++ ++#define wCon c1 ++ ++.macro tmrc, dest:req, control:req ++mrc p1, 0, \dest, \control, c0, 0 ++.endm ++ ++.macro tmcr, control:req, src:req ++mcr p1, 0, \src, \control, c0, 0 ++.endm ++#endif ++ ++#endif +-- +2.30.1 + diff --git a/queue-5.10/arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch b/queue-5.10/arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch new file mode 100644 index 00000000000..4077703ae52 --- /dev/null +++ b/queue-5.10/arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch @@ -0,0 +1,154 @@ +From 788a39e50131e640e6c6dfbbd7020c0bf10e629b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 11:23:39 +0300 +Subject: ARM: assembler: introduce adr_l, ldr_l and str_l macros + +From: Ard Biesheuvel + +commit 0b1674638a5c69cbace63278625c199100955490 upstream. + +Like arm64, ARM supports position independent code sequences that +produce symbol references with a greater reach than the ordinary +adr/ldr instructions. Since on ARM, the adrl pseudo-instruction is +only supported in ARM mode (and not at all when using Clang), having +a adr_l macro like we do on arm64 is useful, and increases symmetry +as well. + +Currently, we use open coded instruction sequences involving literals +and arithmetic operations. Instead, we can use movw/movt pairs on v7 +CPUs, circumventing the D-cache entirely. + +E.g., on v7+ CPUs, we can emit a PC-relative reference as follows: + + movw , #:lower16: - (1f + 8) + movt , #:upper16: - (1f + 8) + 1: add , , pc + +For older CPUs, we can emit the literal into a subsection, allowing it +to be emitted out of line while retaining the ability to perform +arithmetic on label offsets. + +E.g., on pre-v7 CPUs, we can emit a PC-relative reference as follows: + + ldr , 2f + 1: add , , pc + .subsection 1 + 2: .long - (1b + 8) + .previous + +This is allowed by the assembler because, unlike ordinary sections, +subsections are combined into a single section in the object file, and +so the label references are not true cross-section references that are +visible as relocations. (Subsections have been available in binutils +since 2004 at least, so they should not cause any issues with older +toolchains.) + +So use the above to implement the macros mov_l, adr_l, ldr_l and str_l, +all of which will use movw/movt pairs on v7 and later CPUs, and use +PC-relative literals otherwise. + +Reviewed-by: Nicolas Pitre +Reviewed-by: Linus Walleij +Signed-off-by: Ard Biesheuvel +Signed-off-by: Nick Desaulniers +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/assembler.h | 84 ++++++++++++++++++++++++++++++++ + 1 file changed, 84 insertions(+) + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index feac2c8b86f2..72627c5fb3b2 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -494,4 +494,88 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) + #define _ASM_NOKPROBE(entry) + #endif + ++ .macro __adldst_l, op, reg, sym, tmp, c ++ .if __LINUX_ARM_ARCH__ < 7 ++ ldr\c \tmp, .La\@ ++ .subsection 1 ++ .align 2 ++.La\@: .long \sym - .Lpc\@ ++ .previous ++ .else ++ .ifnb \c ++ THUMB( ittt \c ) ++ .endif ++ movw\c \tmp, #:lower16:\sym - .Lpc\@ ++ movt\c \tmp, #:upper16:\sym - .Lpc\@ ++ .endif ++ ++#ifndef CONFIG_THUMB2_KERNEL ++ .set .Lpc\@, . + 8 // PC bias ++ .ifc \op, add ++ add\c \reg, \tmp, pc ++ .else ++ \op\c \reg, [pc, \tmp] ++ .endif ++#else ++.Lb\@: add\c \tmp, \tmp, pc ++ /* ++ * In Thumb-2 builds, the PC bias depends on whether we are currently ++ * emitting into a .arm or a .thumb section. The size of the add opcode ++ * above will be 2 bytes when emitting in Thumb mode and 4 bytes when ++ * emitting in ARM mode, so let's use this to account for the bias. ++ */ ++ .set .Lpc\@, . + (. - .Lb\@) ++ ++ .ifnc \op, add ++ \op\c \reg, [\tmp] ++ .endif ++#endif ++ .endm ++ ++ /* ++ * mov_l - move a constant value or [relocated] address into a register ++ */ ++ .macro mov_l, dst:req, imm:req ++ .if __LINUX_ARM_ARCH__ < 7 ++ ldr \dst, =\imm ++ .else ++ movw \dst, #:lower16:\imm ++ movt \dst, #:upper16:\imm ++ .endif ++ .endm ++ ++ /* ++ * adr_l - adr pseudo-op with unlimited range ++ * ++ * @dst: destination register ++ * @sym: name of the symbol ++ * @cond: conditional opcode suffix ++ */ ++ .macro adr_l, dst:req, sym:req, cond ++ __adldst_l add, \dst, \sym, \dst, \cond ++ .endm ++ ++ /* ++ * ldr_l - ldr pseudo-op with unlimited range ++ * ++ * @dst: destination register ++ * @sym: name of the symbol ++ * @cond: conditional opcode suffix ++ */ ++ .macro ldr_l, dst:req, sym:req, cond ++ __adldst_l ldr, \dst, \sym, \dst, \cond ++ .endm ++ ++ /* ++ * str_l - str pseudo-op with unlimited range ++ * ++ * @src: source register ++ * @sym: name of the symbol ++ * @tmp: mandatory scratch register ++ * @cond: conditional opcode suffix ++ */ ++ .macro str_l, src:req, sym:req, tmp:req, cond ++ __adldst_l str, \src, \sym, \tmp, \cond ++ .endm ++ + #endif /* __ASM_ASSEMBLER_H__ */ +-- +2.30.1 + diff --git a/queue-5.10/arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch b/queue-5.10/arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch new file mode 100644 index 00000000000..f89dabf28b7 --- /dev/null +++ b/queue-5.10/arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch @@ -0,0 +1,44 @@ +From cc0d8721f030921a8f0b5ebe0a2b88d0001d376b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 12:28:01 +0300 +Subject: ARM: efistub: replace adrl pseudo-op with adr_l macro invocation + +From: Ard Biesheuvel + +commit 67e3f828bd4bf5e4eb4214dc4eb227d8f1c8a877 upstream. + +The ARM 'adrl' pseudo instruction is a bit problematic, as it does not +exist in Thumb mode, and it is not implemented by Clang either. Since +the Thumb variant has a slightly bigger range, it is sometimes necessary +to emit the 'adrl' variant in ARM mode where Thumb mode can use adr just +fine. However, that still leaves the Clang issue, which does not appear +to be supporting this any time soon. + +So let's switch to the adr_l macro, which works for both ARM and Thumb, +and has unlimited range. + +Reviewed-by: Nicolas Pitre +Signed-off-by: Ard Biesheuvel +Signed-off-by: Nick Desaulniers +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/head.S | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index a0de09f994d8..247ce9055990 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -1440,8 +1440,7 @@ ENTRY(efi_enter_kernel) + mov r4, r0 @ preserve image base + mov r8, r1 @ preserve DT pointer + +- ARM( adrl r0, call_cache_fn ) +- THUMB( adr r0, call_cache_fn ) ++ adr_l r0, call_cache_fn + adr r1, 0f @ clean the region of code we + bl cache_clean_flush @ may run with the MMU off + +-- +2.30.1 + diff --git a/queue-5.10/clk-qcom-gdsc-implement-no_ret_periph-flag.patch b/queue-5.10/clk-qcom-gdsc-implement-no_ret_periph-flag.patch new file mode 100644 index 00000000000..e8089792c35 --- /dev/null +++ b/queue-5.10/clk-qcom-gdsc-implement-no_ret_periph-flag.patch @@ -0,0 +1,79 @@ +From 89ceb6955e89eb82b8bb84a629e644fc468f212e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 19:38:15 +0100 +Subject: clk: qcom: gdsc: Implement NO_RET_PERIPH flag + +From: AngeloGioacchino Del Regno + +[ Upstream commit 785c02eb35009a4be6dbc68f4f7d916e90b7177d ] + +In some rare occasions, we want to only set the RETAIN_MEM bit, but +not the RETAIN_PERIPH one: this is seen on at least SDM630/636/660's +GPU-GX GDSC, where unsetting and setting back the RETAIN_PERIPH bit +will generate chaos and panics during GPU suspend time (mainly, the +chaos is unaligned access). + +For this reason, introduce a new NO_RET_PERIPH flag to the GDSC +driver to address this corner case. + +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210113183817.447866-8-angelogioacchino.delregno@somainline.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gdsc.c | 10 ++++++++-- + drivers/clk/qcom/gdsc.h | 3 ++- + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c +index af26e0695b86..51ed640e527b 100644 +--- a/drivers/clk/qcom/gdsc.c ++++ b/drivers/clk/qcom/gdsc.c +@@ -183,7 +183,10 @@ static inline int gdsc_assert_reset(struct gdsc *sc) + static inline void gdsc_force_mem_on(struct gdsc *sc) + { + int i; +- u32 mask = RETAIN_MEM | RETAIN_PERIPH; ++ u32 mask = RETAIN_MEM; ++ ++ if (!(sc->flags & NO_RET_PERIPH)) ++ mask |= RETAIN_PERIPH; + + for (i = 0; i < sc->cxc_count; i++) + regmap_update_bits(sc->regmap, sc->cxcs[i], mask, mask); +@@ -192,7 +195,10 @@ static inline void gdsc_force_mem_on(struct gdsc *sc) + static inline void gdsc_clear_mem_on(struct gdsc *sc) + { + int i; +- u32 mask = RETAIN_MEM | RETAIN_PERIPH; ++ u32 mask = RETAIN_MEM; ++ ++ if (!(sc->flags & NO_RET_PERIPH)) ++ mask |= RETAIN_PERIPH; + + for (i = 0; i < sc->cxc_count; i++) + regmap_update_bits(sc->regmap, sc->cxcs[i], mask, 0); +diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h +index bd537438c793..5bb396b344d1 100644 +--- a/drivers/clk/qcom/gdsc.h ++++ b/drivers/clk/qcom/gdsc.h +@@ -42,7 +42,7 @@ struct gdsc { + #define PWRSTS_ON BIT(2) + #define PWRSTS_OFF_ON (PWRSTS_OFF | PWRSTS_ON) + #define PWRSTS_RET_ON (PWRSTS_RET | PWRSTS_ON) +- const u8 flags; ++ const u16 flags; + #define VOTABLE BIT(0) + #define CLAMP_IO BIT(1) + #define HW_CTRL BIT(2) +@@ -51,6 +51,7 @@ struct gdsc { + #define POLL_CFG_GDSCR BIT(5) + #define ALWAYS_ON BIT(6) + #define RETAIN_FF_ENABLE BIT(7) ++#define NO_RET_PERIPH BIT(8) + struct reset_controller_dev *rcdev; + unsigned int *resets; + unsigned int reset_count; +-- +2.30.1 + diff --git a/queue-5.10/clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch b/queue-5.10/clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch new file mode 100644 index 00000000000..2a29f4326ec --- /dev/null +++ b/queue-5.10/clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch @@ -0,0 +1,54 @@ +From c2d7bdb39dbcdbd8e7043a49e120bb53dd2ebb83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 23:10:58 +0100 +Subject: clk: qcom: gpucc-msm8998: Add resets, cxc, fix flags on gpu_gx_gdsc + +From: AngeloGioacchino Del Regno + +[ Upstream commit a59c16c80bd791878cf81d1d5aae508eeb2e73f1 ] + +The GPU GX GDSC has GPU_GX_BCR reset and gfx3d_clk CXC, as stated +on downstream kernels (and as verified upstream, because otherwise +random lockups happen). +Also, add PWRSTS_RET and NO_RET_PERIPH: also as found downstream, +and also as verified here, to avoid GPU related lockups it is +necessary to force retain mem, but *not* peripheral when enabling +this GDSC (and, of course, the inverse on disablement). + +With this change, the GPU finally works flawlessly on my four +different MSM8998 devices from two different manufacturers. + +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210114221059.483390-11-angelogioacchino.delregno@somainline.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-msm8998.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-msm8998.c b/drivers/clk/qcom/gpucc-msm8998.c +index 9b3923af02a1..1a518c4915b4 100644 +--- a/drivers/clk/qcom/gpucc-msm8998.c ++++ b/drivers/clk/qcom/gpucc-msm8998.c +@@ -253,12 +253,16 @@ static struct gdsc gpu_cx_gdsc = { + static struct gdsc gpu_gx_gdsc = { + .gdscr = 0x1094, + .clamp_io_ctrl = 0x130, ++ .resets = (unsigned int []){ GPU_GX_BCR }, ++ .reset_count = 1, ++ .cxcs = (unsigned int []){ 0x1098 }, ++ .cxc_count = 1, + .pd = { + .name = "gpu_gx", + }, + .parent = &gpu_cx_gdsc.pd, +- .pwrsts = PWRSTS_OFF_ON, +- .flags = CLAMP_IO | AON_RESET, ++ .pwrsts = PWRSTS_OFF_ON | PWRSTS_RET, ++ .flags = CLAMP_IO | SW_RESET | AON_RESET | NO_RET_PERIPH, + }; + + static struct clk_regmap *gpucc_msm8998_clocks[] = { +-- +2.30.1 + diff --git a/queue-5.10/drivers-base-build-kunit-tests-without-structleak-pl.patch b/queue-5.10/drivers-base-build-kunit-tests-without-structleak-pl.patch new file mode 100644 index 00000000000..247c7c397df --- /dev/null +++ b/queue-5.10/drivers-base-build-kunit-tests-without-structleak-pl.patch @@ -0,0 +1,40 @@ +From afa558c12a9e708e99d4fbfb6044943246480a92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 13:45:27 +0100 +Subject: drivers/base: build kunit tests without structleak plugin + +From: Arnd Bergmann + +[ Upstream commit 38009c766725a9877ea8866fc813a5460011817f ] + +The structleak plugin causes the stack frame size to grow immensely: + +drivers/base/test/property-entry-test.c: In function 'pe_test_reference': +drivers/base/test/property-entry-test.c:481:1: error: the frame size of 2640 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] + 481 | } + | ^ +drivers/base/test/property-entry-test.c: In function 'pe_test_uints': +drivers/base/test/property-entry-test.c:99:1: error: the frame size of 2592 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] + +Turn it off in this file. + +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210125124533.101339-3-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/test/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/test/Makefile b/drivers/base/test/Makefile +index 3ca56367c84b..2f15fae8625f 100644 +--- a/drivers/base/test/Makefile ++++ b/drivers/base/test/Makefile +@@ -2,3 +2,4 @@ + obj-$(CONFIG_TEST_ASYNC_DRIVER_PROBE) += test_async_driver_probe.o + + obj-$(CONFIG_KUNIT_DRIVER_PE_TEST) += property-entry-test.o ++CFLAGS_REMOVE_property-entry-test.o += -fplugin-arg-structleak_plugin-byref -fplugin-arg-structleak_plugin-byref-all +-- +2.30.1 + diff --git a/queue-5.10/drivers-base-memory-don-t-store-phys_device-in-memor.patch b/queue-5.10/drivers-base-memory-don-t-store-phys_device-in-memor.patch new file mode 100644 index 00000000000..5dc64e36f55 --- /dev/null +++ b/queue-5.10/drivers-base-memory-don-t-store-phys_device-in-memor.patch @@ -0,0 +1,183 @@ +From 218843846dfddea257fee5caa0898fd7b81a509b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:17:24 -0800 +Subject: drivers/base/memory: don't store phys_device in memory blocks + +From: David Hildenbrand + +[ Upstream commit e9a2e48e8704c9d20a625c6f2357147d03ea7b97 ] + +No need to store the value for each and every memory block, as we can +easily query the value at runtime. Reshuffle the members to optimize the +memory layout. Also, let's clarify what the interface once was used for +and why it's legacy nowadays. + +"phys_device" was used on s390x in older versions of lsmem[2]/chmem[3], +back when they were still part of s390x-tools. They were later replaced +by the variants in linux-utils. For example, RHEL6 and RHEL7 contain +lsmem/chmem from s390-utils. RHEL8 switched to versions from util-linux +on s390x [4]. + +"phys_device" was added with sysfs support for memory hotplug in commit +3947be1969a9 ("[PATCH] memory hotplug: sysfs and add/remove functions") in +2005. It always returned 0. + +s390x started returning something != 0 on some setups (if sclp.rzm is set +by HW) in 2010 via commit 57b552ba0b2f ("memory hotplug/s390: set +phys_device"). + +For s390x, it allowed for identifying which memory block devices belong to +the same storage increment (RZM). Only if all memory block devices +comprising a single storage increment were offline, the memory could +actually be removed in the hypervisor. + +Since commit e5d709bb5fb7 ("s390/memory hotplug: provide +memory_block_size_bytes() function") in 2013 a memory block device spans +at least one storage increment - which is why the interface isn't really +helpful/used anymore (except by old lsmem/chmem tools). + +There were once RFC patches to make use of "phys_device" in ACPI context; +however, the underlying problem could be solved using different interfaces +[1]. + +[1] https://patchwork.kernel.org/patch/2163871/ +[2] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/lsmem +[3] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/chmem +[4] https://bugzilla.redhat.com/show_bug.cgi?id=1504134 + +Link: https://lkml.kernel.org/r/20210201181347.13262-2-david@redhat.com +Signed-off-by: David Hildenbrand +Acked-by: Michal Hocko +Reviewed-by: Oscar Salvador +Cc: Dave Hansen +Cc: Greg Kroah-Hartman +Cc: Gerald Schaefer +Cc: Jonathan Corbet +Cc: "Rafael J. Wysocki" +Cc: Mauro Carvalho Chehab +Cc: Ilya Dryomov +Cc: Vaibhav Jain +Cc: Tom Rix +Cc: Geert Uytterhoeven +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + .../ABI/testing/sysfs-devices-memory | 5 ++-- + .../admin-guide/mm/memory-hotplug.rst | 4 +-- + drivers/base/memory.c | 25 +++++++------------ + include/linux/memory.h | 3 +-- + 4 files changed, 15 insertions(+), 22 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-devices-memory b/Documentation/ABI/testing/sysfs-devices-memory +index 2da2b1fba2c1..16a727a611b1 100644 +--- a/Documentation/ABI/testing/sysfs-devices-memory ++++ b/Documentation/ABI/testing/sysfs-devices-memory +@@ -26,8 +26,9 @@ Date: September 2008 + Contact: Badari Pulavarty + Description: + The file /sys/devices/system/memory/memoryX/phys_device +- is read-only and is designed to show the name of physical +- memory device. Implementation is currently incomplete. ++ is read-only; it is a legacy interface only ever used on s390x ++ to expose the covered storage increment. ++Users: Legacy s390-tools lsmem/chmem + + What: /sys/devices/system/memory/memoryX/phys_index + Date: September 2008 +diff --git a/Documentation/admin-guide/mm/memory-hotplug.rst b/Documentation/admin-guide/mm/memory-hotplug.rst +index 5c4432c96c4b..245739f55ac7 100644 +--- a/Documentation/admin-guide/mm/memory-hotplug.rst ++++ b/Documentation/admin-guide/mm/memory-hotplug.rst +@@ -160,8 +160,8 @@ Under each memory block, you can see 5 files: + + "online_movable", "online", "offline" command + which will be performed on all sections in the block. +-``phys_device`` read-only: designed to show the name of physical memory +- device. This is not well implemented now. ++``phys_device`` read-only: legacy interface only ever used on s390x to ++ expose the covered storage increment. + ``removable`` read-only: contains an integer value indicating + whether the memory block is removable or not + removable. A value of 1 indicates that the memory +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index eef4ffb6122c..de058d15b33e 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -290,20 +290,20 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr, + } + + /* +- * phys_device is a bad name for this. What I really want +- * is a way to differentiate between memory ranges that +- * are part of physical devices that constitute +- * a complete removable unit or fru. +- * i.e. do these ranges belong to the same physical device, +- * s.t. if I offline all of these sections I can then +- * remove the physical device? ++ * Legacy interface that we cannot remove: s390x exposes the storage increment ++ * covered by a memory block, allowing for identifying which memory blocks ++ * comprise a storage increment. Since a memory block spans complete ++ * storage increments nowadays, this interface is basically unused. Other ++ * archs never exposed != 0. + */ + static ssize_t phys_device_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct memory_block *mem = to_memory_block(dev); ++ unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr); + +- return sysfs_emit(buf, "%d\n", mem->phys_device); ++ return sysfs_emit(buf, "%d\n", ++ arch_get_memory_phys_device(start_pfn)); + } + + #ifdef CONFIG_MEMORY_HOTREMOVE +@@ -488,11 +488,7 @@ static DEVICE_ATTR_WO(soft_offline_page); + static DEVICE_ATTR_WO(hard_offline_page); + #endif + +-/* +- * Note that phys_device is optional. It is here to allow for +- * differentiation between which *physical* devices each +- * section belongs to... +- */ ++/* See phys_device_show(). */ + int __weak arch_get_memory_phys_device(unsigned long start_pfn) + { + return 0; +@@ -574,7 +570,6 @@ int register_memory(struct memory_block *memory) + static int init_memory_block(unsigned long block_id, unsigned long state) + { + struct memory_block *mem; +- unsigned long start_pfn; + int ret = 0; + + mem = find_memory_block_by_id(block_id); +@@ -588,8 +583,6 @@ static int init_memory_block(unsigned long block_id, unsigned long state) + + mem->start_section_nr = block_id * sections_per_block; + mem->state = state; +- start_pfn = section_nr_to_pfn(mem->start_section_nr); +- mem->phys_device = arch_get_memory_phys_device(start_pfn); + mem->nid = NUMA_NO_NODE; + + ret = register_memory(mem); +diff --git a/include/linux/memory.h b/include/linux/memory.h +index 439a89e758d8..4da95e684e20 100644 +--- a/include/linux/memory.h ++++ b/include/linux/memory.h +@@ -27,9 +27,8 @@ struct memory_block { + unsigned long start_section_nr; + unsigned long state; /* serialized by the dev->lock */ + int online_type; /* for passing data to online routine */ +- int phys_device; /* to which fru does this belong? */ +- struct device dev; + int nid; /* NID for this memory block */ ++ struct device dev; + }; + + int arch_get_memory_phys_device(unsigned long start_pfn); +-- +2.30.1 + diff --git a/queue-5.10/ext4-don-t-try-to-processed-freed-blocks-until-mball.patch b/queue-5.10/ext4-don-t-try-to-processed-freed-blocks-until-mball.patch new file mode 100644 index 00000000000..5e1f2f121e1 --- /dev/null +++ b/queue-5.10/ext4-don-t-try-to-processed-freed-blocks-until-mball.patch @@ -0,0 +1,60 @@ +From c9ac3e9bd8317ab2fecb87ff4e587b6e89d152c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 12:33:20 -0500 +Subject: ext4: don't try to processed freed blocks until mballoc is + initialized + +From: Theodore Ts'o + +[ Upstream commit 027f14f5357279655c3ebc6d14daff8368d4f53f ] + +If we try to make any changes via the journal between when the journal +is initialized, but before the multi-block allocated is initialized, +we will end up deferencing a NULL pointer when the journal commit +callback function calls ext4_process_freed_data(). + +The proximate cause of this failure was commit 2d01ddc86606 ("ext4: +save error info to sb through journal if available") since file system +corruption problems detected before the call to ext4_mb_init() would +result in a journal commit before we aborted the mount of the file +system.... and we would then trigger the NULL pointer deref. + +Link: https://lore.kernel.org/r/YAm8qH/0oo2ofSMR@mit.edu +Reported-by: Murphy Zhou +Reviewed-by: Jan Kara +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ea5aefa23a20..e30bf8f342c2 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4876,7 +4876,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); + +- sbi->s_journal->j_commit_callback = ext4_journal_commit_callback; + sbi->s_journal->j_submit_inode_data_buffers = + ext4_journal_submit_inode_data_buffers; + sbi->s_journal->j_finish_inode_data_buffers = +@@ -4993,6 +4992,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount5; + } + ++ /* ++ * We can only set up the journal commit callback once ++ * mballoc is initialized ++ */ ++ if (sbi->s_journal) ++ sbi->s_journal->j_commit_callback = ++ ext4_journal_commit_callback; ++ + block = ext4_count_free_clusters(sb); + ext4_free_blocks_count_set(sbi->s_es, + EXT4_C2B(sbi, block)); +-- +2.30.1 + diff --git a/queue-5.10/hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch b/queue-5.10/hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch new file mode 100644 index 00000000000..b9967482d75 --- /dev/null +++ b/queue-5.10/hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch @@ -0,0 +1,61 @@ +From 1efe1dfbaab030e9e618704e134e44b0dfae64af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Jan 2021 18:02:20 +0000 +Subject: HID: logitech-dj: add support for the new lightspeed connection + iteration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Filipe Laíns + +[ Upstream commit fab3a95654eea01d6b0204995be8b7492a00d001 ] + +This new connection type is the new iteration of the Lightspeed +connection and will probably be used in some of the newer gaming +devices. It is currently use in the G Pro X Superlight. + +This patch should be backported to older versions, as currently the +driver will panic when seing the unsupported connection. This isn't +an issue when using the receiver that came with the device, as Logitech +has been using different PIDs when they change the connection type, but +is an issue when using a generic receiver (well, generic Lightspeed +receiver), which is the case of the one in the Powerplay mat. Currently, +the only generic Ligthspeed receiver we support, and the only one that +exists AFAIK, is ther Powerplay. + +As it stands, the driver will panic when seeing a G Pro X Superlight +connected to the Powerplay receiver and won't send any input events to +userspace! The kernel will warn about this so the issue should be easy +to identify, but it is still very worrying how hard it will fail :( + +[915977.398471] logitech-djreceiver 0003:046D:C53A.0107: unusable device of type UNKNOWN (0x0f) connected on slot 1 + +Signed-off-by: Filipe Laíns +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-dj.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index fcdc922bc973..271bd8d24339 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -995,7 +995,12 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev, + workitem.reports_supported |= STD_KEYBOARD; + break; + case 0x0d: +- device_type = "eQUAD Lightspeed 1_1"; ++ device_type = "eQUAD Lightspeed 1.1"; ++ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); ++ workitem.reports_supported |= STD_KEYBOARD; ++ break; ++ case 0x0f: ++ device_type = "eQUAD Lightspeed 1.2"; + logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); + workitem.reports_supported |= STD_KEYBOARD; + break; +-- +2.30.1 + diff --git a/queue-5.10/i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch b/queue-5.10/i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch new file mode 100644 index 00000000000..a25aa056f75 --- /dev/null +++ b/queue-5.10/i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch @@ -0,0 +1,65 @@ +From 294e988b143ebe5ad210f1d3cb61d4b195478b6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 18:21:51 +0100 +Subject: i2c: rcar: faster irq code to minimize HW race condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit c7b514ec979e23a08c411f3d8ed39c7922751422 ] + +To avoid the HW race condition on R-Car Gen2 and earlier, we need to +write to ICMCR as soon as possible in the interrupt handler. We can +improve this by writing a static value instead of masking out bits. + +Signed-off-by: Wolfram Sang +Reviewed-by: Niklas Söderlund +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 217def2d7cb4..824586d7ee56 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -91,7 +91,6 @@ + + #define RCAR_BUS_PHASE_START (MDBS | MIE | ESG) + #define RCAR_BUS_PHASE_DATA (MDBS | MIE) +-#define RCAR_BUS_MASK_DATA (~(ESG | FSB) & 0xFF) + #define RCAR_BUS_PHASE_STOP (MDBS | MIE | FSB) + + #define RCAR_IRQ_SEND (MNR | MAL | MST | MAT | MDE) +@@ -621,7 +620,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + /* + * This driver has a lock-free design because there are IP cores (at least + * R-Car Gen2) which have an inherent race condition in their hardware design. +- * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after ++ * There, we need to switch to RCAR_BUS_PHASE_DATA as soon as possible after + * the interrupt was generated, otherwise an unwanted repeated message gets + * generated. It turned out that taking a spinlock at the beginning of the ISR + * was already causing repeated messages. Thus, this driver was converted to +@@ -630,13 +629,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + static irqreturn_t rcar_i2c_irq(int irq, void *ptr) + { + struct rcar_i2c_priv *priv = ptr; +- u32 msr, val; ++ u32 msr; + + /* Clear START or STOP immediately, except for REPSTART after read */ +- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) { +- val = rcar_i2c_read(priv, ICMCR); +- rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA); +- } ++ if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) ++ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA); + + msr = rcar_i2c_read(priv, ICMSR); + +-- +2.30.1 + diff --git a/queue-5.10/i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch b/queue-5.10/i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch new file mode 100644 index 00000000000..55353fc4c50 --- /dev/null +++ b/queue-5.10/i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch @@ -0,0 +1,46 @@ +From 12052e3206f4d61a8d61ffcf5155a00b4518e106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 18:21:52 +0100 +Subject: i2c: rcar: optimize cacheline to minimize HW race condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit 25c2e0fb5fefb8d7847214cf114d94c7aad8e9ce ] + +'flags' and 'io' are needed first, so they should be at the beginning of +the private struct. + +Signed-off-by: Wolfram Sang +Reviewed-by: Niklas Söderlund +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 824586d7ee56..ad6630e3cc77 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -119,6 +119,7 @@ enum rcar_i2c_type { + }; + + struct rcar_i2c_priv { ++ u32 flags; + void __iomem *io; + struct i2c_adapter adap; + struct i2c_msg *msg; +@@ -129,7 +130,6 @@ struct rcar_i2c_priv { + + int pos; + u32 icccr; +- u32 flags; + u8 recovery_icmcr; /* protected by adapter lock */ + enum rcar_i2c_type devtype; + struct i2c_client *slave; +-- +2.30.1 + diff --git a/queue-5.10/i40e-fix-memory-leak-in-i40e_probe.patch b/queue-5.10/i40e-fix-memory-leak-in-i40e_probe.patch new file mode 100644 index 00000000000..1e74066c163 --- /dev/null +++ b/queue-5.10/i40e-fix-memory-leak-in-i40e_probe.patch @@ -0,0 +1,39 @@ +From 694b2ccbab58c5250f25717a736df63cdff02240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 07:14:30 +0000 +Subject: i40e: Fix memory leak in i40e_probe + +From: Keita Suzuki + +[ Upstream commit 58cab46c622d6324e47bd1c533693c94498e4172 ] + +Struct i40e_veb is allocated in function i40e_setup_pf_switch, and +stored to an array field veb inside struct i40e_pf. However when +i40e_setup_misc_vector fails, this memory leaks. + +Fix this by calling exit and teardown functions. + +Signed-off-by: Keita Suzuki +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 59971f62e626..3e4a4d6f0419 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -15100,6 +15100,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (err) { + dev_info(&pdev->dev, + "setup of misc vector failed: %d\n", err); ++ i40e_cloud_filter_exit(pf); ++ i40e_fdir_teardown(pf); + goto err_vsis; + } + } +-- +2.30.1 + diff --git a/queue-5.10/input-applespi-don-t-wait-for-responses-to-commands-.patch b/queue-5.10/input-applespi-don-t-wait-for-responses-to-commands-.patch new file mode 100644 index 00000000000..84619a3f583 --- /dev/null +++ b/queue-5.10/input-applespi-don-t-wait-for-responses-to-commands-.patch @@ -0,0 +1,97 @@ +From e8318a8ae5b97325e544a7ff3e561f05875ba48a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 11:10:51 -0800 +Subject: Input: applespi - don't wait for responses to commands indefinitely. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ronald Tschalär + +[ Upstream commit 0ce1ac23149c6da939a5926c098c270c58c317a0 ] + +The response to a command may never arrive or it may be corrupted (and +hence dropped) for some reason. While exceedingly rare, when it did +happen it blocked all further commands. One way to fix this was to +do a suspend/resume. However, recovering automatically seems like a +nicer option. Hence this puts a time limit (1 sec) on how long we're +willing to wait for a response, after which we assume it got lost. + +Signed-off-by: Ronald Tschalär +Link: https://lore.kernel.org/r/20210217190718.11035-1-ronald@innovation.ch +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/applespi.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c +index 14362ebab9a9..0b46bc014cde 100644 +--- a/drivers/input/keyboard/applespi.c ++++ b/drivers/input/keyboard/applespi.c +@@ -48,6 +48,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -400,7 +401,7 @@ struct applespi_data { + unsigned int cmd_msg_cntr; + /* lock to protect the above parameters and flags below */ + spinlock_t cmd_msg_lock; +- bool cmd_msg_queued; ++ ktime_t cmd_msg_queued; + enum applespi_evt_type cmd_evt_type; + + struct led_classdev backlight_info; +@@ -716,7 +717,7 @@ static void applespi_msg_complete(struct applespi_data *applespi, + wake_up_all(&applespi->drain_complete); + + if (is_write_msg) { +- applespi->cmd_msg_queued = false; ++ applespi->cmd_msg_queued = 0; + applespi_send_cmd_msg(applespi); + } + +@@ -758,8 +759,16 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi) + return 0; + + /* check whether send is in progress */ +- if (applespi->cmd_msg_queued) +- return 0; ++ if (applespi->cmd_msg_queued) { ++ if (ktime_ms_delta(ktime_get(), applespi->cmd_msg_queued) < 1000) ++ return 0; ++ ++ dev_warn(&applespi->spi->dev, "Command %d timed out\n", ++ applespi->cmd_evt_type); ++ ++ applespi->cmd_msg_queued = 0; ++ applespi->write_active = false; ++ } + + /* set up packet */ + memset(packet, 0, APPLESPI_PACKET_SIZE); +@@ -856,7 +865,7 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi) + return sts; + } + +- applespi->cmd_msg_queued = true; ++ applespi->cmd_msg_queued = ktime_get_coarse(); + applespi->write_active = true; + + return 0; +@@ -1908,7 +1917,7 @@ static int __maybe_unused applespi_resume(struct device *dev) + applespi->drain = false; + applespi->have_cl_led_on = false; + applespi->have_bl_level = 0; +- applespi->cmd_msg_queued = false; ++ applespi->cmd_msg_queued = 0; + applespi->read_active = false; + applespi->write_active = false; + +-- +2.30.1 + diff --git a/queue-5.10/iommu-amd-fix-performance-counter-initialization.patch b/queue-5.10/iommu-amd-fix-performance-counter-initialization.patch new file mode 100644 index 00000000000..a7b1d6808b3 --- /dev/null +++ b/queue-5.10/iommu-amd-fix-performance-counter-initialization.patch @@ -0,0 +1,117 @@ +From b379ad579a67d960da6383e12632c2f0213ea2a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 06:27:12 -0600 +Subject: iommu/amd: Fix performance counter initialization + +From: Suravee Suthikulpanit + +[ Upstream commit 6778ff5b21bd8e78c8bd547fd66437cf2657fd9b ] + +Certain AMD platforms enable power gating feature for IOMMU PMC, +which prevents the IOMMU driver from updating the counter while +trying to validate the PMC functionality in the init_iommu_perf_ctr(). +This results in disabling PMC support and the following error message: + + "AMD-Vi: Unable to read/write to IOMMU perf counter" + +To workaround this issue, disable power gating temporarily by programming +the counter source to non-zero value while validating the counter, +and restore the prior state afterward. + +Signed-off-by: Suravee Suthikulpanit +Tested-by: Tj (Elloe Linux) +Link: https://lore.kernel.org/r/20210208122712.5048-1-suravee.suthikulpanit@amd.com +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201753 +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/init.c | 45 ++++++++++++++++++++++++++++++---------- + 1 file changed, 34 insertions(+), 11 deletions(-) + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index c842545368fd..3c215f0a6052 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -254,6 +255,8 @@ static enum iommu_init_state init_state = IOMMU_START_STATE; + static int amd_iommu_enable_interrupts(void); + static int __init iommu_go_to_state(enum iommu_init_state state); + static void init_device_table_dma(void); ++static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr, ++ u8 fxn, u64 *value, bool is_write); + + static bool amd_iommu_pre_enabled = true; + +@@ -1717,13 +1720,11 @@ static int __init init_iommu_all(struct acpi_table_header *table) + return 0; + } + +-static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr, +- u8 fxn, u64 *value, bool is_write); +- +-static void init_iommu_perf_ctr(struct amd_iommu *iommu) ++static void __init init_iommu_perf_ctr(struct amd_iommu *iommu) + { ++ int retry; + struct pci_dev *pdev = iommu->dev; +- u64 val = 0xabcd, val2 = 0, save_reg = 0; ++ u64 val = 0xabcd, val2 = 0, save_reg, save_src; + + if (!iommu_feature(iommu, FEATURE_PC)) + return; +@@ -1731,17 +1732,39 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu) + amd_iommu_pc_present = true; + + /* save the value to restore, if writable */ +- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false)) ++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false) || ++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, false)) + goto pc_false; + +- /* Check if the performance counters can be written to */ +- if ((iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true)) || +- (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false)) || +- (val != val2)) ++ /* ++ * Disable power gating by programing the performance counter ++ * source to 20 (i.e. counts the reads and writes from/to IOMMU ++ * Reserved Register [MMIO Offset 1FF8h] that are ignored.), ++ * which never get incremented during this init phase. ++ * (Note: The event is also deprecated.) ++ */ ++ val = 20; ++ if (iommu_pc_get_set_reg(iommu, 0, 0, 8, &val, true)) + goto pc_false; + ++ /* Check if the performance counters can be written to */ ++ val = 0xabcd; ++ for (retry = 5; retry; retry--) { ++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true) || ++ iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false) || ++ val2) ++ break; ++ ++ /* Wait about 20 msec for power gating to disable and retry. */ ++ msleep(20); ++ } ++ + /* restore */ +- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true)) ++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true) || ++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, true)) ++ goto pc_false; ++ ++ if (val != val2) + goto pc_false; + + pci_info(pdev, "IOMMU performance counters supported\n"); +-- +2.30.1 + diff --git a/queue-5.10/iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch b/queue-5.10/iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch new file mode 100644 index 00000000000..ba479745986 --- /dev/null +++ b/queue-5.10/iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch @@ -0,0 +1,55 @@ +From ac7a3d1373dcfe6cba1a9a61a468f446937bfd56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 16:07:29 +0800 +Subject: iommu/vt-d: Clear PRQ overflow only when PRQ is empty + +From: Lu Baolu + +[ Upstream commit 28a77185f1cd0650b664f54614143aaaa3a7a615 ] + +It is incorrect to always clear PRO when it's set w/o first checking +whether the overflow condition has been cleared. Current code assumes +that if an overflow condition occurs it must have been cleared by earlier +loop. However since the code runs in a threaded context, the overflow +condition could occur even after setting the head to the tail under some +extreme condition. To be sane, we should read both head/tail again when +seeing a pending PRO and only clear PRO after all pending PRs have been +handled. + +Suggested-by: Kevin Tian +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/linux-iommu/MWHPR11MB18862D2EA5BD432BF22D99A48CA09@MWHPR11MB1886.namprd11.prod.outlook.com/ +Link: https://lore.kernel.org/r/20210126080730.2232859-2-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/svm.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c +index 43f392d27d31..b200a3acc6ed 100644 +--- a/drivers/iommu/intel/svm.c ++++ b/drivers/iommu/intel/svm.c +@@ -1079,8 +1079,17 @@ static irqreturn_t prq_event_thread(int irq, void *d) + * Clear the page request overflow bit and wake up all threads that + * are waiting for the completion of this handling. + */ +- if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) +- writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG); ++ if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) { ++ pr_info_ratelimited("IOMMU: %s: PRQ overflow detected\n", ++ iommu->name); ++ head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK; ++ tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK; ++ if (head == tail) { ++ writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG); ++ pr_info_ratelimited("IOMMU: %s: PRQ overflow cleared", ++ iommu->name); ++ } ++ } + + if (!completion_done(&iommu->prq_complete)) + complete(&iommu->prq_complete); +-- +2.30.1 + diff --git a/queue-5.10/kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch b/queue-5.10/kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch new file mode 100644 index 00000000000..84c91f42e43 --- /dev/null +++ b/queue-5.10/kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch @@ -0,0 +1,63 @@ +From 49d11a413c892f839e501e6ad60d838992b06909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:05:42 -0800 +Subject: kasan: fix memory corruption in kasan_bitops_tags test + +From: Andrey Konovalov + +[ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ] + +Since the hardware tag-based KASAN mode might not have a redzone that +comes after an allocated object (when kasan.mode=prod is enabled), the +kasan_bitops_tags() test ends up corrupting the next object in memory. + +Change the test so it always accesses the redzone that lies within the +allocated object's boundaries. + +Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a +Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com +Signed-off-by: Andrey Konovalov +Reviewed-by: Marco Elver +Reviewed-by: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Branislav Rankov +Cc: Catalin Marinas +Cc: Dmitry Vyukov +Cc: Evgenii Stepanov +Cc: Kevin Brodsky +Cc: Peter Collingbourne +Cc: Vincenzo Frascino +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/test_kasan.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/lib/test_kasan.c b/lib/test_kasan.c +index 662f862702fc..400507f1e5db 100644 +--- a/lib/test_kasan.c ++++ b/lib/test_kasan.c +@@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test) + return; + } + +- /* Allocation size will be rounded to up granule size, which is 16. */ +- bits = kzalloc(sizeof(*bits), GFP_KERNEL); ++ /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ ++ bits = kzalloc(48, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); + +- /* Do the accesses past the 16 allocated bytes. */ +- kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]); +- kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]); ++ /* Do the accesses past the 48 allocated bytes, but within the redone. */ ++ kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); ++ kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); + + kfree(bits); + } +-- +2.30.1 + diff --git a/queue-5.10/kbuild-clamp-sublevel-to-255.patch b/queue-5.10/kbuild-clamp-sublevel-to-255.patch new file mode 100644 index 00000000000..8a6f8294e20 --- /dev/null +++ b/queue-5.10/kbuild-clamp-sublevel-to-255.patch @@ -0,0 +1,52 @@ +From 1edaf6097c7bcc8869d3d281ea262d37c8417b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 22:50:32 -0500 +Subject: kbuild: clamp SUBLEVEL to 255 + +[ Upstream commit 9b82f13e7ef316cdc0a8858f1349f4defce3f9e0 ] + +Right now if SUBLEVEL becomes larger than 255 it will overflow into the +territory of PATCHLEVEL, causing havoc in userspace that tests for +specific kernel version. + +While userspace code tests for MAJOR and PATCHLEVEL, it doesn't test +SUBLEVEL at any point as ABI changes don't happen in the context of +stable tree. + +Thus, to avoid overflows, simply clamp SUBLEVEL to it's maximum value in +the context of LINUX_VERSION_CODE. This does not affect "make +kernelversion" and such. + +Signed-off-by: Sasha Levin +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + Makefile | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/Makefile b/Makefile +index 7fdb78b48f55..56d375763b0d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1247,9 +1247,15 @@ define filechk_utsrelease.h + endef + + define filechk_version.h +- echo \#define LINUX_VERSION_CODE $(shell \ +- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \ +- echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))' ++ if [ $(SUBLEVEL) -gt 255 ]; then \ ++ echo \#define LINUX_VERSION_CODE $(shell \ ++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \ ++ else \ ++ echo \#define LINUX_VERSION_CODE $(shell \ ++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \ ++ fi; \ ++ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + \ ++ ((c) > 255 ? 255 : (c)))' + endef + + $(version_h): FORCE +-- +2.30.1 + diff --git a/queue-5.10/mmc-mediatek-fix-race-condition-between-msdc_request.patch b/queue-5.10/mmc-mediatek-fix-race-condition-between-msdc_request.patch new file mode 100644 index 00000000000..193c9ffe5ec --- /dev/null +++ b/queue-5.10/mmc-mediatek-fix-race-condition-between-msdc_request.patch @@ -0,0 +1,85 @@ +From 101721af96b84d214769174d811c68d0d31a6d9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Dec 2020 15:16:11 +0800 +Subject: mmc: mediatek: fix race condition between msdc_request_timeout and + irq + +From: Chaotian Jing + +[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ] + +when get request SW timeout, if CMD/DAT xfer done irq coming right now, +then there is race between the msdc_request_timeout work and irq handler, +and the host->cmd and host->data may set to NULL in irq handler. also, +current flow ensure that only one path can go to msdc_request_done(), so +no need check the return value of cancel_delayed_work(). + +Signed-off-by: Chaotian Jing +Link: https://lore.kernel.org/r/20201218071611.12276-1-chaotian.jing@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mtk-sd.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 004fbfc23672..dc84e2dff408 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -1101,13 +1101,13 @@ static void msdc_track_cmd_data(struct msdc_host *host, + static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq) + { + unsigned long flags; +- bool ret; + +- ret = cancel_delayed_work(&host->req_timeout); +- if (!ret) { +- /* delay work already running */ +- return; +- } ++ /* ++ * No need check the return value of cancel_delayed_work, as only ONE ++ * path will go here! ++ */ ++ cancel_delayed_work(&host->req_timeout); ++ + spin_lock_irqsave(&host->lock, flags); + host->mrq = NULL; + spin_unlock_irqrestore(&host->lock, flags); +@@ -1129,7 +1129,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, + bool done = false; + bool sbc_error; + unsigned long flags; +- u32 *rsp = cmd->resp; ++ u32 *rsp; + + if (mrq->sbc && cmd == mrq->cmd && + (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR +@@ -1150,6 +1150,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, + + if (done) + return true; ++ rsp = cmd->resp; + + sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask); + +@@ -1337,7 +1338,7 @@ static void msdc_data_xfer_next(struct msdc_host *host, + static bool msdc_data_xfer_done(struct msdc_host *host, u32 events, + struct mmc_request *mrq, struct mmc_data *data) + { +- struct mmc_command *stop = data->stop; ++ struct mmc_command *stop; + unsigned long flags; + bool done; + unsigned int check_data = events & +@@ -1353,6 +1354,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events, + + if (done) + return true; ++ stop = data->stop; + + if (check_data || (stop && stop->error)) { + dev_dbg(host->dev, "DMA status: 0x%8X\n", +-- +2.30.1 + diff --git a/queue-5.10/mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch b/queue-5.10/mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch new file mode 100644 index 00000000000..3fee9c6c695 --- /dev/null +++ b/queue-5.10/mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch @@ -0,0 +1,37 @@ +From be306f22ebd2696e9717f9365614ed826345d80f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 21:35:27 +0100 +Subject: mmc: mxs-mmc: Fix a resource leak in an error handling path in + 'mxs_mmc_probe()' + +From: Christophe JAILLET + +[ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ] + +If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()' +call. + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201208203527.49262-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mxs-mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c +index 75007f61df97..4fbbff03137c 100644 +--- a/drivers/mmc/host/mxs-mmc.c ++++ b/drivers/mmc/host/mxs-mmc.c +@@ -643,7 +643,7 @@ static int mxs_mmc_probe(struct platform_device *pdev) + + ret = mmc_of_parse(mmc); + if (ret) +- goto out_clk_disable; ++ goto out_free_dma; + + mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; + +-- +2.30.1 + diff --git a/queue-5.10/mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch b/queue-5.10/mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch new file mode 100644 index 00000000000..c4f789ce4a3 --- /dev/null +++ b/queue-5.10/mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch @@ -0,0 +1,65 @@ +From d3e1b2c32ee8fc39c2ee6cdb46841cc20a8c7f58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 18:04:06 -0600 +Subject: mmc: sdhci-iproc: Add ACPI bindings for the RPi + +From: Jeremy Linton + +[ Upstream commit 4f9833d3ec8da34861cd0680b00c73e653877eb9 ] + +The RPi4 has an Arasan controller it carries over from the RPi3 and a newer +eMMC2 controller. Because of a couple of quirks, it seems wiser to bind +these controllers to the same driver that DT is using on this platform +rather than the generic sdhci_acpi driver with PNP0D40. + +So, BCM2847 describes the older Arasan and BRCME88C describes the newer +eMMC2. The older Arasan is reusing an existing ACPI _HID used by other OSes +booting these tables on the RPi. + +With this change, Linux is capable of utilizing the SD card slot, and the +Wi-Fi when booted with UEFI+ACPI on the RPi4. + +Signed-off-by: Jeremy Linton +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20210120000406.1843400-2-jeremy.linton@arm.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-iproc.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c +index c9434b461aab..ddeaf8e1f72f 100644 +--- a/drivers/mmc/host/sdhci-iproc.c ++++ b/drivers/mmc/host/sdhci-iproc.c +@@ -296,9 +296,27 @@ static const struct of_device_id sdhci_iproc_of_match[] = { + MODULE_DEVICE_TABLE(of, sdhci_iproc_of_match); + + #ifdef CONFIG_ACPI ++/* ++ * This is a duplicate of bcm2835_(pltfrm_)data without caps quirks ++ * which are provided by the ACPI table. ++ */ ++static const struct sdhci_pltfm_data sdhci_bcm_arasan_data = { ++ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION | ++ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | ++ SDHCI_QUIRK_NO_HISPD_BIT, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .ops = &sdhci_iproc_32only_ops, ++}; ++ ++static const struct sdhci_iproc_data bcm_arasan_data = { ++ .pdata = &sdhci_bcm_arasan_data, ++}; ++ + static const struct acpi_device_id sdhci_iproc_acpi_ids[] = { + { .id = "BRCM5871", .driver_data = (kernel_ulong_t)&iproc_cygnus_data }, + { .id = "BRCM5872", .driver_data = (kernel_ulong_t)&iproc_data }, ++ { .id = "BCM2847", .driver_data = (kernel_ulong_t)&bcm_arasan_data }, ++ { .id = "BRCME88C", .driver_data = (kernel_ulong_t)&bcm2711_data }, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(acpi, sdhci_iproc_acpi_ids); +-- +2.30.1 + diff --git a/queue-5.10/mmc-sdhci-update-firmware-interface-api.patch b/queue-5.10/mmc-sdhci-update-firmware-interface-api.patch new file mode 100644 index 00000000000..52c7964996e --- /dev/null +++ b/queue-5.10/mmc-sdhci-update-firmware-interface-api.patch @@ -0,0 +1,46 @@ +From c64cb6643a200be061534594e887a18fd4f97413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 17:38:31 -0600 +Subject: mmc: sdhci: Update firmware interface API + +From: Jeremy Linton + +[ Upstream commit c5b1c6dc13daec60405ecd31eaa5379a9f798fa8 ] + +The device_* calls were added a few years ago to abstract +DT/ACPI/fwnode firmware interfaces. Lets convert the two +sdhci caps fields to use the generic calls rather than the OF +specific ones. This has the side effect of allowing +ACPI based devices to quirk themselves when the caps field +is broken. + +Signed-off-by: Jeremy Linton +Link: https://lore.kernel.org/r/20201120233831.447365-1-jeremy.linton@arm.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 3561ae8a481a..6edf9fffd934 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3994,10 +3994,10 @@ void __sdhci_read_caps(struct sdhci_host *host, const u16 *ver, + if (host->v4_mode) + sdhci_do_enable_v4_mode(host); + +- of_property_read_u64(mmc_dev(host->mmc)->of_node, +- "sdhci-caps-mask", &dt_caps_mask); +- of_property_read_u64(mmc_dev(host->mmc)->of_node, +- "sdhci-caps", &dt_caps); ++ device_property_read_u64_array(mmc_dev(host->mmc), ++ "sdhci-caps-mask", &dt_caps_mask, 1); ++ device_property_read_u64_array(mmc_dev(host->mmc), ++ "sdhci-caps", &dt_caps, 1); + + v = ver ? *ver : sdhci_readw(host, SDHCI_HOST_VERSION); + host->version = (v & SDHCI_SPEC_VER_MASK) >> SDHCI_SPEC_VER_SHIFT; +-- +2.30.1 + diff --git a/queue-5.10/pci-fix-pci_register_io_range-memory-leak.patch b/queue-5.10/pci-fix-pci_register_io_range-memory-leak.patch new file mode 100644 index 00000000000..df42dbb713d --- /dev/null +++ b/queue-5.10/pci-fix-pci_register_io_range-memory-leak.patch @@ -0,0 +1,81 @@ +From 3ad32979b8e2835e11278f42a962a94f2e5934d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 11:03:32 +0100 +Subject: PCI: Fix pci_register_io_range() memory leak + +From: Geert Uytterhoeven + +[ Upstream commit f6bda644fa3a7070621c3bf12cd657f69a42f170 ] + +Kmemleak reports: + + unreferenced object 0xc328de40 (size 64): + comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................ + 00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................ + + backtrace: + [] pci_register_io_range+0x3c/0x80 + [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0 + [] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac + [] devm_of_pci_bridge_init+0x60/0x1b8 + [] devm_pci_alloc_host_bridge+0x54/0x64 + [] rcar_pcie_probe+0x2c/0x644 + +In case a PCI host driver's probe is deferred, the same I/O range may be +allocated again, and be ignored, causing a memory leak. + +Fix this by (a) letting logic_pio_register_range() return -EEXIST if the +passed range already exists, so pci_register_io_range() will free it, and +by (b) making pci_register_io_range() not consider -EEXIST an error +condition. + +Link: https://lore.kernel.org/r/20210202100332.829047-1-geert+renesas@glider.be +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 4 ++++ + lib/logic_pio.c | 3 +++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 5c9345072510..9e971fffeb6a 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4010,6 +4010,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr, + ret = logic_pio_register_range(range); + if (ret) + kfree(range); ++ ++ /* Ignore duplicates due to deferred probing */ ++ if (ret == -EEXIST) ++ ret = 0; + #endif + + return ret; +diff --git a/lib/logic_pio.c b/lib/logic_pio.c +index f32fe481b492..07b4b9a1f54b 100644 +--- a/lib/logic_pio.c ++++ b/lib/logic_pio.c +@@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex); + * @new_range: pointer to the IO range to be registered. + * + * Returns 0 on success, the error code in case of failure. ++ * If the range already exists, -EEXIST will be returned, which should be ++ * considered a success. + * + * Register a new IO range node in the IO range list. + */ +@@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range) + list_for_each_entry(range, &io_range_list, list) { + if (range->fwnode == new_range->fwnode) { + /* range already there */ ++ ret = -EEXIST; + goto end_register; + } + if (range->flags == LOGIC_PIO_CPU_MMIO && +-- +2.30.1 + diff --git a/queue-5.10/pci-link-remove-bandwidth-notification.patch b/queue-5.10/pci-link-remove-bandwidth-notification.patch new file mode 100644 index 00000000000..6d167c91f49 --- /dev/null +++ b/queue-5.10/pci-link-remove-bandwidth-notification.patch @@ -0,0 +1,240 @@ +From 181a968affdfa5fc4e59e5de1807355759d203f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 14:17:54 -0600 +Subject: PCI/LINK: Remove bandwidth notification + +From: Bjorn Helgaas + +[ Upstream commit b4c7d2076b4e767dd2e075a2b3a9e57753fc67f5 ] + +The PCIe Bandwidth Change Notification feature logs messages when the link +bandwidth changes. Some users have reported that these messages occur +often enough to significantly reduce NVMe performance. GPUs also seem to +generate these messages. + +We don't know why the link bandwidth changes, but in the reported cases +there's no indication that it's caused by hardware failures. + +Remove the bandwidth change notifications for now. Hopefully we can add +this back when we have a better understanding of why this happens and how +we can make the messages useful instead of overwhelming. + +Link: https://lore.kernel.org/r/20200115221008.GA191037@google.com/ +Link: https://lore.kernel.org/r/155605909349.3575.13433421148215616375.stgit@gimli.home/ +Link: https://bugzilla.kernel.org/show_bug.cgi?id=206197 +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/Kconfig | 8 -- + drivers/pci/pcie/Makefile | 1 - + drivers/pci/pcie/bw_notification.c | 138 ----------------------------- + drivers/pci/pcie/portdrv.h | 6 -- + drivers/pci/pcie/portdrv_pci.c | 1 - + 5 files changed, 154 deletions(-) + delete mode 100644 drivers/pci/pcie/bw_notification.c + +diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig +index 3946555a6042..45a2ef702b45 100644 +--- a/drivers/pci/pcie/Kconfig ++++ b/drivers/pci/pcie/Kconfig +@@ -133,14 +133,6 @@ config PCIE_PTM + This is only useful if you have devices that support PTM, but it + is safe to enable even if you don't. + +-config PCIE_BW +- bool "PCI Express Bandwidth Change Notification" +- depends on PCIEPORTBUS +- help +- This enables PCI Express Bandwidth Change Notification. If +- you know link width or rate changes occur only to correct +- unreliable links, you may answer Y. +- + config PCIE_EDR + bool "PCI Express Error Disconnect Recover support" + depends on PCIE_DPC && ACPI +diff --git a/drivers/pci/pcie/Makefile b/drivers/pci/pcie/Makefile +index 68da9280ff11..9a7085668466 100644 +--- a/drivers/pci/pcie/Makefile ++++ b/drivers/pci/pcie/Makefile +@@ -12,5 +12,4 @@ obj-$(CONFIG_PCIEAER_INJECT) += aer_inject.o + obj-$(CONFIG_PCIE_PME) += pme.o + obj-$(CONFIG_PCIE_DPC) += dpc.o + obj-$(CONFIG_PCIE_PTM) += ptm.o +-obj-$(CONFIG_PCIE_BW) += bw_notification.o + obj-$(CONFIG_PCIE_EDR) += edr.o +diff --git a/drivers/pci/pcie/bw_notification.c b/drivers/pci/pcie/bw_notification.c +deleted file mode 100644 +index 565d23cccb8b..000000000000 +--- a/drivers/pci/pcie/bw_notification.c ++++ /dev/null +@@ -1,138 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0+ +-/* +- * PCI Express Link Bandwidth Notification services driver +- * Author: Alexandru Gagniuc +- * +- * Copyright (C) 2019, Dell Inc +- * +- * The PCIe Link Bandwidth Notification provides a way to notify the +- * operating system when the link width or data rate changes. This +- * capability is required for all root ports and downstream ports +- * supporting links wider than x1 and/or multiple link speeds. +- * +- * This service port driver hooks into the bandwidth notification interrupt +- * and warns when links become degraded in operation. +- */ +- +-#define dev_fmt(fmt) "bw_notification: " fmt +- +-#include "../pci.h" +-#include "portdrv.h" +- +-static bool pcie_link_bandwidth_notification_supported(struct pci_dev *dev) +-{ +- int ret; +- u32 lnk_cap; +- +- ret = pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnk_cap); +- return (ret == PCIBIOS_SUCCESSFUL) && (lnk_cap & PCI_EXP_LNKCAP_LBNC); +-} +- +-static void pcie_enable_link_bandwidth_notification(struct pci_dev *dev) +-{ +- u16 lnk_ctl; +- +- pcie_capability_write_word(dev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS); +- +- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl); +- lnk_ctl |= PCI_EXP_LNKCTL_LBMIE; +- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl); +-} +- +-static void pcie_disable_link_bandwidth_notification(struct pci_dev *dev) +-{ +- u16 lnk_ctl; +- +- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl); +- lnk_ctl &= ~PCI_EXP_LNKCTL_LBMIE; +- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl); +-} +- +-static irqreturn_t pcie_bw_notification_irq(int irq, void *context) +-{ +- struct pcie_device *srv = context; +- struct pci_dev *port = srv->port; +- u16 link_status, events; +- int ret; +- +- ret = pcie_capability_read_word(port, PCI_EXP_LNKSTA, &link_status); +- events = link_status & PCI_EXP_LNKSTA_LBMS; +- +- if (ret != PCIBIOS_SUCCESSFUL || !events) +- return IRQ_NONE; +- +- pcie_capability_write_word(port, PCI_EXP_LNKSTA, events); +- pcie_update_link_speed(port->subordinate, link_status); +- return IRQ_WAKE_THREAD; +-} +- +-static irqreturn_t pcie_bw_notification_handler(int irq, void *context) +-{ +- struct pcie_device *srv = context; +- struct pci_dev *port = srv->port; +- struct pci_dev *dev; +- +- /* +- * Print status from downstream devices, not this root port or +- * downstream switch port. +- */ +- down_read(&pci_bus_sem); +- list_for_each_entry(dev, &port->subordinate->devices, bus_list) +- pcie_report_downtraining(dev); +- up_read(&pci_bus_sem); +- +- return IRQ_HANDLED; +-} +- +-static int pcie_bandwidth_notification_probe(struct pcie_device *srv) +-{ +- int ret; +- +- /* Single-width or single-speed ports do not have to support this. */ +- if (!pcie_link_bandwidth_notification_supported(srv->port)) +- return -ENODEV; +- +- ret = request_threaded_irq(srv->irq, pcie_bw_notification_irq, +- pcie_bw_notification_handler, +- IRQF_SHARED, "PCIe BW notif", srv); +- if (ret) +- return ret; +- +- pcie_enable_link_bandwidth_notification(srv->port); +- pci_info(srv->port, "enabled with IRQ %d\n", srv->irq); +- +- return 0; +-} +- +-static void pcie_bandwidth_notification_remove(struct pcie_device *srv) +-{ +- pcie_disable_link_bandwidth_notification(srv->port); +- free_irq(srv->irq, srv); +-} +- +-static int pcie_bandwidth_notification_suspend(struct pcie_device *srv) +-{ +- pcie_disable_link_bandwidth_notification(srv->port); +- return 0; +-} +- +-static int pcie_bandwidth_notification_resume(struct pcie_device *srv) +-{ +- pcie_enable_link_bandwidth_notification(srv->port); +- return 0; +-} +- +-static struct pcie_port_service_driver pcie_bandwidth_notification_driver = { +- .name = "pcie_bw_notification", +- .port_type = PCIE_ANY_PORT, +- .service = PCIE_PORT_SERVICE_BWNOTIF, +- .probe = pcie_bandwidth_notification_probe, +- .suspend = pcie_bandwidth_notification_suspend, +- .resume = pcie_bandwidth_notification_resume, +- .remove = pcie_bandwidth_notification_remove, +-}; +- +-int __init pcie_bandwidth_notification_init(void) +-{ +- return pcie_port_service_register(&pcie_bandwidth_notification_driver); +-} +diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h +index af7cf237432a..2ff5724b8f13 100644 +--- a/drivers/pci/pcie/portdrv.h ++++ b/drivers/pci/pcie/portdrv.h +@@ -53,12 +53,6 @@ int pcie_dpc_init(void); + static inline int pcie_dpc_init(void) { return 0; } + #endif + +-#ifdef CONFIG_PCIE_BW +-int pcie_bandwidth_notification_init(void); +-#else +-static inline int pcie_bandwidth_notification_init(void) { return 0; } +-#endif +- + /* Port Type */ + #define PCIE_ANY_PORT (~0) + +diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c +index 3a3ce40ae1ab..d4559cf88f79 100644 +--- a/drivers/pci/pcie/portdrv_pci.c ++++ b/drivers/pci/pcie/portdrv_pci.c +@@ -248,7 +248,6 @@ static void __init pcie_init_services(void) + pcie_pme_init(); + pcie_dpc_init(); + pcie_hp_init(); +- pcie_bandwidth_notification_init(); + } + + static int __init pcie_portdrv_init(void) +-- +2.30.1 + diff --git a/queue-5.10/pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch b/queue-5.10/pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch new file mode 100644 index 00000000000..f37dc0243cf --- /dev/null +++ b/queue-5.10/pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch @@ -0,0 +1,66 @@ +From e1649c758ddf4e6adc0a349a912efd71a9568191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 18:48:10 +0000 +Subject: PCI: mediatek: Add missing of_node_put() to fix reference leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczyński + +[ Upstream commit 42814c438aac79746d310f413a27d5b0b959c5de ] + +The for_each_available_child_of_node helper internally makes use of the +of_get_next_available_child() which performs an of_node_get() on each +iteration when searching for next available child node. + +Should an available child node be found, then it would return a device +node pointer with reference count incremented, thus early return from +the middle of the loop requires an explicit of_node_put() to prevent +reference count leak. + +To stop the reference leak, explicitly call of_node_put() before +returning after an error occurred. + +Link: https://lore.kernel.org/r/20210120184810.3068794-1-kw@linux.com +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-mediatek.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c +index cf4c18f0c25a..23548b517e4b 100644 +--- a/drivers/pci/controller/pcie-mediatek.c ++++ b/drivers/pci/controller/pcie-mediatek.c +@@ -1035,14 +1035,14 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie) + err = of_pci_get_devfn(child); + if (err < 0) { + dev_err(dev, "failed to parse devfn: %d\n", err); +- return err; ++ goto error_put_node; + } + + slot = PCI_SLOT(err); + + err = mtk_pcie_parse_port(pcie, child, slot); + if (err) +- return err; ++ goto error_put_node; + } + + err = mtk_pcie_subsys_powerup(pcie); +@@ -1058,6 +1058,9 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie) + mtk_pcie_subsys_powerdown(pcie); + + return 0; ++error_put_node: ++ of_node_put(child); ++ return err; + } + + static int mtk_pcie_probe(struct platform_device *pdev) +-- +2.30.1 + diff --git a/queue-5.10/pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch b/queue-5.10/pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch new file mode 100644 index 00000000000..3a4f771af7a --- /dev/null +++ b/queue-5.10/pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch @@ -0,0 +1,50 @@ +From 58c3e854aa9835fb4411398d06815443f87f3f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 22:24:35 +0100 +Subject: PCI: xgene-msi: Fix race in installing chained irq handler + +From: Martin Kaiser + +[ Upstream commit a93c00e5f975f23592895b7e83f35de2d36b7633 ] + +Fix a race where a pending interrupt could be received and the handler +called before the handler's data has been setup, by converting to +irq_set_chained_handler_and_data(). + +See also 2cf5a03cb29d ("PCI/keystone: Fix race in installing chained IRQ +handler"). + +Based on the mail discussion, it seems ok to drop the error handling. + +Link: https://lore.kernel.org/r/20210115212435.19940-3-martin@kaiser.cx +Signed-off-by: Martin Kaiser +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-xgene-msi.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c +index 2470782cb01a..1c34c897a7e2 100644 +--- a/drivers/pci/controller/pci-xgene-msi.c ++++ b/drivers/pci/controller/pci-xgene-msi.c +@@ -384,13 +384,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu) + if (!msi_group->gic_irq) + continue; + +- irq_set_chained_handler(msi_group->gic_irq, +- xgene_msi_isr); +- err = irq_set_handler_data(msi_group->gic_irq, msi_group); +- if (err) { +- pr_err("failed to register GIC IRQ handler\n"); +- return -EINVAL; +- } ++ irq_set_chained_handler_and_data(msi_group->gic_irq, ++ xgene_msi_isr, msi_group); ++ + /* + * Statically allocate MSI GIC IRQs to each CPU core. + * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated +-- +2.30.1 + diff --git a/queue-5.10/platform-olpc-fix-probe-error-handling.patch b/queue-5.10/platform-olpc-fix-probe-error-handling.patch new file mode 100644 index 00000000000..9e052a4046a --- /dev/null +++ b/queue-5.10/platform-olpc-fix-probe-error-handling.patch @@ -0,0 +1,60 @@ +From e9e9769c963ced096c9be69291e342d132203a15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 08:37:38 +0100 +Subject: Platform: OLPC: Fix probe error handling + +From: Lubomir Rintel + +[ Upstream commit cec551ea0d41c679ed11d758e1a386e20285b29d ] + +Reset ec_priv if probe ends unsuccessfully. + +Signed-off-by: Lubomir Rintel +Link: https://lore.kernel.org/r/20210126073740.10232-2-lkundrak@v3.sk +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/olpc/olpc-ec.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c +index f64b82824db2..2db7113383fd 100644 +--- a/drivers/platform/olpc/olpc-ec.c ++++ b/drivers/platform/olpc/olpc-ec.c +@@ -426,11 +426,8 @@ static int olpc_ec_probe(struct platform_device *pdev) + + /* get the EC revision */ + err = olpc_ec_cmd(EC_FIRMWARE_REV, NULL, 0, &ec->version, 1); +- if (err) { +- ec_priv = NULL; +- kfree(ec); +- return err; +- } ++ if (err) ++ goto error; + + config.dev = pdev->dev.parent; + config.driver_data = ec; +@@ -440,12 +437,16 @@ static int olpc_ec_probe(struct platform_device *pdev) + if (IS_ERR(ec->dcon_rdev)) { + dev_err(&pdev->dev, "failed to register DCON regulator\n"); + err = PTR_ERR(ec->dcon_rdev); +- kfree(ec); +- return err; ++ goto error; + } + + ec->dbgfs_dir = olpc_ec_setup_debugfs(); + ++ return 0; ++ ++error: ++ ec_priv = NULL; ++ kfree(ec); + return err; + } + +-- +2.30.1 + diff --git a/queue-5.10/powerpc-64-fix-stack-trace-not-displaying-final-fram.patch b/queue-5.10/powerpc-64-fix-stack-trace-not-displaying-final-fram.patch new file mode 100644 index 00000000000..4aaf27f1c06 --- /dev/null +++ b/queue-5.10/powerpc-64-fix-stack-trace-not-displaying-final-fram.patch @@ -0,0 +1,113 @@ +From 7cddb59b8ff3d7d10dc0bd55c851a1d47f6db52b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 00:59:20 +1100 +Subject: powerpc/64: Fix stack trace not displaying final frame + +From: Michael Ellerman + +[ Upstream commit e3de1e291fa58a1ab0f471a4b458eff2514e4b5f ] + +In commit bf13718bc57a ("powerpc: show registers when unwinding +interrupt frames") we changed our stack dumping logic to show the full +registers whenever we find an interrupt frame on the stack. + +However we didn't notice that on 64-bit this doesn't show the final +frame, ie. the interrupt that brought us in from userspace, whereas on +32-bit it does. + +That is due to confusion about the size of that last frame. The code +in show_stack() calls validate_sp(), passing it STACK_INT_FRAME_SIZE +to check the sp is at least that far below the top of the stack. + +However on 64-bit that size is too large for the final frame, because +it includes the red zone, but we don't allocate a red zone for the +first frame. + +So add a new define that encodes the correct size for 32-bit and +64-bit, and use it in show_stack(). + +This results in the full trace being shown on 64-bit, eg: + + sysrq: Trigger a crash + Kernel panic - not syncing: sysrq triggered crash + CPU: 0 PID: 83 Comm: sh Not tainted 5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty #649 + Call Trace: + [c00000000a1c3ac0] [c000000000897b70] dump_stack+0xc4/0x114 (unreliable) + [c00000000a1c3b00] [c00000000014334c] panic+0x178/0x41c + [c00000000a1c3ba0] [c00000000094e600] sysrq_handle_crash+0x40/0x50 + [c00000000a1c3c00] [c00000000094ef98] __handle_sysrq+0xd8/0x210 + [c00000000a1c3ca0] [c00000000094f820] write_sysrq_trigger+0x100/0x188 + [c00000000a1c3ce0] [c0000000005559dc] proc_reg_write+0x10c/0x1b0 + [c00000000a1c3d10] [c000000000479950] vfs_write+0xf0/0x360 + [c00000000a1c3d60] [c000000000479d9c] ksys_write+0x7c/0x140 + [c00000000a1c3db0] [c00000000002bf5c] system_call_exception+0x19c/0x2c0 + [c00000000a1c3e10] [c00000000000d35c] system_call_common+0xec/0x278 + --- interrupt: c00 at 0x7fff9fbab428 + NIP: 00007fff9fbab428 LR: 000000001000b724 CTR: 0000000000000000 + REGS: c00000000a1c3e80 TRAP: 0c00 Not tainted (5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty) + MSR: 900000000280f033 CR: 22002884 XER: 00000000 + IRQMASK: 0 + GPR00: 0000000000000004 00007fffc3cb8960 00007fff9fc59900 0000000000000001 + GPR04: 000000002a4b32d0 0000000000000002 0000000000000063 0000000000000063 + GPR08: 000000002a4b32d0 0000000000000000 0000000000000000 0000000000000000 + GPR12: 0000000000000000 00007fff9fcca9a0 0000000000000000 0000000000000000 + GPR16: 0000000000000000 0000000000000000 0000000000000000 00000000100b8fd0 + GPR20: 000000002a4b3485 00000000100b8f90 0000000000000000 0000000000000000 + GPR24: 000000002a4b0440 00000000100e77b8 0000000000000020 000000002a4b32d0 + GPR28: 0000000000000001 0000000000000002 000000002a4b32d0 0000000000000001 + NIP [00007fff9fbab428] 0x7fff9fbab428 + LR [000000001000b724] 0x1000b724 + --- interrupt: c00 + +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210209141627.2898485-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ptrace.h | 3 +++ + arch/powerpc/kernel/asm-offsets.c | 2 +- + arch/powerpc/kernel/process.c | 2 +- + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h +index e2c778c176a3..7bb064ad04d8 100644 +--- a/arch/powerpc/include/asm/ptrace.h ++++ b/arch/powerpc/include/asm/ptrace.h +@@ -62,6 +62,9 @@ struct pt_regs + }; + #endif + ++ ++#define STACK_FRAME_WITH_PT_REGS (STACK_FRAME_OVERHEAD + sizeof(struct pt_regs)) ++ + #ifdef __powerpc64__ + + /* +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index c2722ff36e98..5c125255571c 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -307,7 +307,7 @@ int main(void) + + /* Interrupt register frame */ + DEFINE(INT_FRAME_SIZE, STACK_INT_FRAME_SIZE); +- DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_OVERHEAD + sizeof(struct pt_regs)); ++ DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_WITH_PT_REGS); + STACK_PT_REGS_OFFSET(GPR0, gpr[0]); + STACK_PT_REGS_OFFSET(GPR1, gpr[1]); + STACK_PT_REGS_OFFSET(GPR2, gpr[2]); +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index d421a2c7f822..1a1d2657fe8d 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -2170,7 +2170,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack, + * See if this is an exception frame. + * We look for the "regshere" marker in the current frame. + */ +- if (validate_sp(sp, tsk, STACK_INT_FRAME_SIZE) ++ if (validate_sp(sp, tsk, STACK_FRAME_WITH_PT_REGS) + && stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) { + struct pt_regs *regs = (struct pt_regs *) + (sp + STACK_FRAME_OVERHEAD); +-- +2.30.1 + diff --git a/queue-5.10/powerpc-improve-handling-of-unrecoverable-system-res.patch b/queue-5.10/powerpc-improve-handling-of-unrecoverable-system-res.patch new file mode 100644 index 00000000000..449403ada04 --- /dev/null +++ b/queue-5.10/powerpc-improve-handling-of-unrecoverable-system-res.patch @@ -0,0 +1,41 @@ +From ee6e132a6b3ee9aff93c1e9542e045c78ea15a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Jan 2021 23:08:35 +1000 +Subject: powerpc: improve handling of unrecoverable system reset + +From: Nicholas Piggin + +[ Upstream commit 11cb0a25f71818ca7ab4856548ecfd83c169aa4d ] + +If an unrecoverable system reset hits in process context, the system +does not have to panic. Similar to machine check, call nmi_exit() +before die(). + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210130130852.2952424-26-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/traps.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 5006dcbe1d9f..77dffea3d537 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -509,8 +509,11 @@ void system_reset_exception(struct pt_regs *regs) + die("Unrecoverable nested System Reset", regs, SIGABRT); + #endif + /* Must die if the interrupt is not recoverable */ +- if (!(regs->msr & MSR_RI)) ++ if (!(regs->msr & MSR_RI)) { ++ /* For the reason explained in die_mce, nmi_exit before die */ ++ nmi_exit(); + die("Unrecoverable System Reset", regs, SIGABRT); ++ } + + if (saved_hsrrs) { + mtspr(SPRN_HSRR0, hsrr0); +-- +2.30.1 + diff --git a/queue-5.10/powerpc-pci-add-ppc_md.discover_phbs.patch b/queue-5.10/powerpc-pci-add-ppc_md.discover_phbs.patch new file mode 100644 index 00000000000..988aa84d2de --- /dev/null +++ b/queue-5.10/powerpc-pci-add-ppc_md.discover_phbs.patch @@ -0,0 +1,90 @@ +From 92ef382beecb48c2b076e4ceada5e3c58c44ba2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 15:35:06 +1100 +Subject: powerpc/pci: Add ppc_md.discover_phbs() + +From: Oliver O'Halloran + +[ Upstream commit 5537fcb319d016ce387f818dd774179bc03217f5 ] + +On many powerpc platforms the discovery and initalisation of +pci_controllers (PHBs) happens inside of setup_arch(). This is very early +in boot (pre-initcalls) and means that we're initialising the PHB long +before many basic kernel services (slab allocator, debugfs, a real ioremap) +are available. + +On PowerNV this causes an additional problem since we map the PHB registers +with ioremap(). As of commit d538aadc2718 ("powerpc/ioremap: warn on early +use of ioremap()") a warning is printed because we're using the "incorrect" +API to setup and MMIO mapping in searly boot. The kernel does provide +early_ioremap(), but that is not intended to create long-lived MMIO +mappings and a seperate warning is printed by generic code if +early_ioremap() mappings are "leaked." + +This is all fixable with dumb hacks like using early_ioremap() to setup +the initial mapping then replacing it with a real ioremap later on in +boot, but it does raise the question: Why the hell are we setting up the +PHB's this early in boot? + +The old and wise claim it's due to "hysterical rasins." Aside from amused +grapes there doesn't appear to be any real reason to maintain the current +behaviour. Already most of the newer embedded platforms perform PHB +discovery in an arch_initcall and between the end of setup_arch() and the +start of initcalls none of the generic kernel code does anything PCI +related. On powerpc scanning PHBs occurs in a subsys_initcall so it should +be possible to move the PHB discovery to a core, postcore or arch initcall. + +This patch adds the ppc_md.discover_phbs hook and a core_initcall stub that +calls it. The core_initcalls are the earliest to be called so this will +any possibly issues with dependency between initcalls. This isn't just an +academic issue either since on pseries and PowerNV EEH init occurs in an +arch_initcall and depends on the pci_controllers being available, similarly +the creation of pci_dns occurs at core_initcall_sync (i.e. between core and +postcore initcalls). These problems need to be addressed seperately. + +Reported-by: kernel test robot +Signed-off-by: Oliver O'Halloran +[mpe: Make discover_phbs() static] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201103043523.916109-1-oohall@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/machdep.h | 3 +++ + arch/powerpc/kernel/pci-common.c | 10 ++++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h +index 475687f24f4a..d319160d790c 100644 +--- a/arch/powerpc/include/asm/machdep.h ++++ b/arch/powerpc/include/asm/machdep.h +@@ -59,6 +59,9 @@ struct machdep_calls { + int (*pcibios_root_bridge_prepare)(struct pci_host_bridge + *bridge); + ++ /* finds all the pci_controllers present at boot */ ++ void (*discover_phbs)(void); ++ + /* To setup PHBs when using automatic OF platform driver for PCI */ + int (*pci_setup_phb)(struct pci_controller *host); + +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index be108616a721..7920559a1ca8 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -1625,3 +1625,13 @@ static void fixup_hide_host_resource_fsl(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MOTOROLA, PCI_ANY_ID, fixup_hide_host_resource_fsl); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, fixup_hide_host_resource_fsl); ++ ++ ++static int __init discover_phbs(void) ++{ ++ if (ppc_md.discover_phbs) ++ ppc_md.discover_phbs(); ++ ++ return 0; ++} ++core_initcall(discover_phbs); +-- +2.30.1 + diff --git a/queue-5.10/powerpc-perf-record-counter-overflow-always-if-sampl.patch b/queue-5.10/powerpc-perf-record-counter-overflow-always-if-sampl.patch new file mode 100644 index 00000000000..33116c7f91f --- /dev/null +++ b/queue-5.10/powerpc-perf-record-counter-overflow-always-if-sampl.patch @@ -0,0 +1,80 @@ +From fe2cf9cc0ad4bd4c84b0aaf73df753f0a225681d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 04:14:52 -0500 +Subject: powerpc/perf: Record counter overflow always if SAMPLE_IP is unset + +From: Athira Rajeev + +[ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ] + +While sampling for marked events, currently we record the sample only +if the SIAR valid bit of Sampled Instruction Event Register (SIER) is +set. SIAR_VALID bit is used for fetching the instruction address from +Sampled Instruction Address Register(SIAR). But there are some +usecases, where the user is interested only in the PMU stats at each +counter overflow and the exact IP of the overflow event is not +required. Dropping SIAR invalid samples will fail to record some of +the counter overflows in such cases. + +Example of such usecase is dumping the PMU stats (event counts) after +some regular amount of instructions/events from the userspace (ex: via +ptrace). Here counter overflow is indicated to userspace via signal +handler, and captured by monitoring and enabling I/O signaling on the +event file descriptor. In these cases, we expect to get +sample/overflow indication after each specified sample_period. + +Perf event attribute will not have PERF_SAMPLE_IP set in the +sample_type if exact IP of the overflow event is not requested. So +while profiling if SAMPLE_IP is not set, just record the counter +overflow irrespective of SIAR_VALID check. + +Suggested-by: Michael Ellerman +Signed-off-by: Athira Rajeev +[mpe: Reflow comment and if formatting] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1612516492-1428-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 426baa4de602..ded4a3efd3f0 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2112,7 +2112,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + left += period; + if (left <= 0) + left = period; +- record = siar_valid(regs); ++ ++ /* ++ * If address is not requested in the sample via ++ * PERF_SAMPLE_IP, just record that sample irrespective ++ * of SIAR valid check. ++ */ ++ if (event->attr.sample_type & PERF_SAMPLE_IP) ++ record = siar_valid(regs); ++ else ++ record = 1; ++ + event->hw.last_period = event->hw.sample_period; + } + if (left < 0x80000000LL) +@@ -2130,9 +2140,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + * MMCR2. Check attr.exclude_kernel and address to drop the sample in + * these cases. + */ +- if (event->attr.exclude_kernel && record) +- if (is_kernel_addr(mfspr(SPRN_SIAR))) +- record = 0; ++ if (event->attr.exclude_kernel && ++ (event->attr.sample_type & PERF_SAMPLE_IP) && ++ is_kernel_addr(mfspr(SPRN_SIAR))) ++ record = 0; + + /* + * Finally record data if requested. +-- +2.30.1 + diff --git a/queue-5.10/s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch b/queue-5.10/s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch new file mode 100644 index 00000000000..cbf9b07f65a --- /dev/null +++ b/queue-5.10/s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch @@ -0,0 +1,36 @@ +From b77c12805b02919e409eb7a4878223ad47cd1e28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 07:13:02 +0100 +Subject: s390/smp: __smp_rescan_cpus() - move cpumask away from stack + +From: Heiko Carstens + +[ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ] + +Avoid a potentially large stack frame and overflow by making +"cpumask_t avail" a static variable. There is no concurrent +access due to the existing locking. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 3a0d545f0ce8..791bc373418b 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -775,7 +775,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, + static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) + { + struct sclp_core_entry *core; +- cpumask_t avail; ++ static cpumask_t avail; + bool configured; + u16 core_id; + int nr, i; +-- +2.30.1 + diff --git a/queue-5.10/scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch b/queue-5.10/scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch new file mode 100644 index 00000000000..d3a268a5081 --- /dev/null +++ b/queue-5.10/scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch @@ -0,0 +1,50 @@ +From 195d940689a8ecc225e5076a0a65b59b8f96741b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Feb 2021 22:46:00 -0600 +Subject: scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling + +From: Mike Christie + +[ Upstream commit d28d48c699779973ab9a3bd0e5acfa112bd4fdef ] + +If iscsi_prep_scsi_cmd_pdu() fails we try to add it back to the cmdqueue, +but we leave it partially setup. We don't have functions that can undo the +pdu and init task setup. We only have cleanup_task which can clean up both +parts. So this has us just fail the cmd and go through the standard cleanup +routine and then have the SCSI midlayer retry it like is done when it fails +in the queuecommand path. + +Link: https://lore.kernel.org/r/20210207044608.27585-2-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 5125a6c7f70e..41b8192d207d 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1532,14 +1532,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn) + } + rc = iscsi_prep_scsi_cmd_pdu(conn->task); + if (rc) { +- if (rc == -ENOMEM || rc == -EACCES) { +- spin_lock_bh(&conn->taskqueuelock); +- list_add_tail(&conn->task->running, +- &conn->cmdqueue); +- conn->task = NULL; +- spin_unlock_bh(&conn->taskqueuelock); +- goto done; +- } else ++ if (rc == -ENOMEM || rc == -EACCES) ++ fail_scsi_task(conn->task, DID_IMM_RETRY); ++ else + fail_scsi_task(conn->task, DID_ABORT); + spin_lock_bh(&conn->taskqueuelock); + continue; +-- +2.30.1 + diff --git a/queue-5.10/scsi-target-core-add-cmd-length-set-before-cmd-compl.patch b/queue-5.10/scsi-target-core-add-cmd-length-set-before-cmd-compl.patch new file mode 100644 index 00000000000..a145d0a19a4 --- /dev/null +++ b/queue-5.10/scsi-target-core-add-cmd-length-set-before-cmd-compl.patch @@ -0,0 +1,77 @@ +From 7e60977c48b4f3efe441023d484bd35c64e95732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 10:22:01 +0300 +Subject: scsi: target: core: Add cmd length set before cmd complete + +From: Aleksandr Miloserdov + +[ Upstream commit 1c73e0c5e54d5f7d77f422a10b03ebe61eaed5ad ] + +TCM doesn't properly handle underflow case for service actions. One way to +prevent it is to always complete command with +target_complete_cmd_with_length(), however it requires access to data_sg, +which is not always available. + +This change introduces target_set_cmd_data_length() function which allows +to set command data length before completing it. + +Link: https://lore.kernel.org/r/20210209072202.41154-2-a.miloserdov@yadro.com +Reviewed-by: Roman Bolshakov +Reviewed-by: Bodo Stroesser +Signed-off-by: Aleksandr Miloserdov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_transport.c | 15 +++++++++++---- + include/target/target_core_backend.h | 1 + + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index ff26ab0a5f60..484f0ba0a65b 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -873,11 +873,9 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) + } + EXPORT_SYMBOL(target_complete_cmd); + +-void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length) ++void target_set_cmd_data_length(struct se_cmd *cmd, int length) + { +- if ((scsi_status == SAM_STAT_GOOD || +- cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) && +- length < cmd->data_length) { ++ if (length < cmd->data_length) { + if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) { + cmd->residual_count += cmd->data_length - length; + } else { +@@ -887,6 +885,15 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len + + cmd->data_length = length; + } ++} ++EXPORT_SYMBOL(target_set_cmd_data_length); ++ ++void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length) ++{ ++ if (scsi_status == SAM_STAT_GOOD || ++ cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) { ++ target_set_cmd_data_length(cmd, length); ++ } + + target_complete_cmd(cmd, scsi_status); + } +diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h +index 6336780d83a7..ce2fba49c95d 100644 +--- a/include/target/target_core_backend.h ++++ b/include/target/target_core_backend.h +@@ -72,6 +72,7 @@ int transport_backend_register(const struct target_backend_ops *); + void target_backend_unregister(const struct target_backend_ops *); + + void target_complete_cmd(struct se_cmd *, u8); ++void target_set_cmd_data_length(struct se_cmd *, int); + void target_complete_cmd_with_length(struct se_cmd *, u8, int); + + void transport_copy_sense_to_cmd(struct se_cmd *, unsigned char *); +-- +2.30.1 + diff --git a/queue-5.10/scsi-target-core-prevent-underflow-for-service-actio.patch b/queue-5.10/scsi-target-core-prevent-underflow-for-service-actio.patch new file mode 100644 index 00000000000..69f03a15c94 --- /dev/null +++ b/queue-5.10/scsi-target-core-prevent-underflow-for-service-actio.patch @@ -0,0 +1,102 @@ +From f0e5c73199b6af81e14a51f3a9f6e204a7c7f4a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 10:22:02 +0300 +Subject: scsi: target: core: Prevent underflow for service actions + +From: Aleksandr Miloserdov + +[ Upstream commit 14d24e2cc77411301e906a8cf41884739de192de ] + +TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which +might be considered an underflow in case of Data-In size being greater than +8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow. + +Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com +Reviewed-by: Roman Bolshakov +Reviewed-by: Bodo Stroesser +Signed-off-by: Aleksandr Miloserdov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_pr.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index 5f79ea05f9b8..b42193c554fb 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -3738,6 +3738,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd) + spin_unlock(&dev->t10_pr.registration_lock); + + put_unaligned_be32(add_len, &buf[4]); ++ target_set_cmd_data_length(cmd, 8 + add_len); + + transport_kunmap_data_sg(cmd); + +@@ -3756,7 +3757,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) + struct t10_pr_registration *pr_reg; + unsigned char *buf; + u64 pr_res_key; +- u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */ ++ u32 add_len = 0; + + if (cmd->data_length < 8) { + pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u" +@@ -3774,8 +3775,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) + pr_reg = dev->dev_pr_res_holder; + if (pr_reg) { + /* +- * Set the hardcoded Additional Length ++ * Set the Additional Length to 16 when a reservation is held + */ ++ add_len = 16; + put_unaligned_be32(add_len, &buf[4]); + + if (cmd->data_length < 22) +@@ -3811,6 +3813,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) + (pr_reg->pr_res_type & 0x0f); + } + ++ target_set_cmd_data_length(cmd, 8 + add_len); ++ + err: + spin_unlock(&dev->dev_reservation_lock); + transport_kunmap_data_sg(cmd); +@@ -3829,7 +3833,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) + struct se_device *dev = cmd->se_dev; + struct t10_reservation *pr_tmpl = &dev->t10_pr; + unsigned char *buf; +- u16 add_len = 8; /* Hardcoded to 8. */ ++ u16 len = 8; /* Hardcoded to 8. */ + + if (cmd->data_length < 6) { + pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:" +@@ -3841,7 +3845,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) + if (!buf) + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + +- put_unaligned_be16(add_len, &buf[0]); ++ put_unaligned_be16(len, &buf[0]); + buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */ + buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */ + buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */ +@@ -3870,6 +3874,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) + buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */ + buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */ + ++ target_set_cmd_data_length(cmd, len); ++ + transport_kunmap_data_sg(cmd); + + return 0; +@@ -4030,6 +4036,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) + * Set ADDITIONAL_LENGTH + */ + put_unaligned_be32(add_len, &buf[4]); ++ target_set_cmd_data_length(cmd, 8 + add_len); + + transport_kunmap_data_sg(cmd); + +-- +2.30.1 + diff --git a/queue-5.10/scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch b/queue-5.10/scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch new file mode 100644 index 00000000000..3e327860f31 --- /dev/null +++ b/queue-5.10/scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch @@ -0,0 +1,98 @@ +From 48856783169f2e9037af1fec6a4ec4c95fdf33c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jan 2021 01:59:27 -0800 +Subject: scsi: ufs: WB is only available on LUN #0 to #7 + +From: Jaegeuk Kim + +[ Upstream commit a2fca52ee640a04112ed9d9a137c940ea6ad288e ] + +Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from +rpmb LUN. The reason is that the unit descriptor length is different per +LU. + +The length of Normal LU is 45 while the one of rpmb LU is 35. + +int ufshcd_read_desc_param(struct ufs_hba *hba, ...) +{ + param_offset=41; + param_size=4; + buff_len=45; + ... + buff_len=35 by rpmb LU; + + if (is_kmalloc) { + /* Make sure we don't copy more data than available */ + if (param_offset + param_size > buff_len) + param_size = buff_len - param_offset; + --> param_size = 250; + memcpy(param_read_buf, &desc_buf[param_offset], param_size); + --> memcpy(param_read_buf, desc_buf+41, 250); + +[ 141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c + } +} + +Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org +Reviewed-by: Avri Altman +Signed-off-by: Jaegeuk Kim +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-sysfs.c | 3 ++- + drivers/scsi/ufs/ufs.h | 6 ++++-- + drivers/scsi/ufs/ufshcd.c | 2 +- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c +index bdcd27faa054..34b424ad96a2 100644 +--- a/drivers/scsi/ufs/ufs-sysfs.c ++++ b/drivers/scsi/ufs/ufs-sysfs.c +@@ -785,7 +785,8 @@ static ssize_t _pname##_show(struct device *dev, \ + struct scsi_device *sdev = to_scsi_device(dev); \ + struct ufs_hba *hba = shost_priv(sdev->host); \ + u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun); \ +- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) \ ++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, \ ++ _duname##_DESC_PARAM##_puname)) \ + return -EINVAL; \ + return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \ + lun, _duname##_DESC_PARAM##_puname, buf, _size); \ +diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h +index f8ab16f30fdc..07ca39008b84 100644 +--- a/drivers/scsi/ufs/ufs.h ++++ b/drivers/scsi/ufs/ufs.h +@@ -551,13 +551,15 @@ struct ufs_dev_info { + * @return: true if the lun has a matching unit descriptor, false otherwise + */ + static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info, +- u8 lun) ++ u8 lun, u8 param_offset) + { + if (!dev_info || !dev_info->max_lu_supported) { + pr_err("Max General LU supported by UFS isn't initialized\n"); + return false; + } +- ++ /* WB is available only for the logical unit from 0 to 7 */ ++ if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS) ++ return lun < UFS_UPIU_MAX_WB_LUN_ID; + return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported); + } + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 5a7cc2e42ffd..97d9d5d99adc 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -3378,7 +3378,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba, + * Unit descriptors are only available for general purpose LUs (LUN id + * from 0 to 7) and RPMB Well known LU. + */ +- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) ++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset)) + return -EOPNOTSUPP; + + return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun, +-- +2.30.1 + diff --git a/queue-5.10/series b/queue-5.10/series index afacaa00373..96d1be6562b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -130,3 +130,43 @@ net-enetc-initialize-rfs-rss-memories-for-unused-por.patch ath11k-peer-delete-synchronization-with-firmware.patch ath11k-start-vdev-if-a-bss-peer-is-already-created.patch ath11k-fix-ap-mode-for-qca6390.patch +i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch +i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch +scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch +udf-fix-silent-aed-taglocation-corruption.patch +iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch +mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch +mmc-mediatek-fix-race-condition-between-msdc_request.patch +mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch +platform-olpc-fix-probe-error-handling.patch +powerpc-pci-add-ppc_md.discover_phbs.patch +spi-stm32-make-spurious-and-overrun-interrupts-visib.patch +powerpc-improve-handling-of-unrecoverable-system-res.patch +powerpc-perf-record-counter-overflow-always-if-sampl.patch +hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch +powerpc-64-fix-stack-trace-not-displaying-final-fram.patch +iommu-amd-fix-performance-counter-initialization.patch +clk-qcom-gdsc-implement-no_ret_periph-flag.patch +sparc32-limit-memblock-allocation-to-low-memory.patch +sparc64-use-arch_validate_flags-to-validate-adi-flag.patch +input-applespi-don-t-wait-for-responses-to-commands-.patch +pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch +pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch +drivers-base-build-kunit-tests-without-structleak-pl.patch +pci-link-remove-bandwidth-notification.patch +ext4-don-t-try-to-processed-freed-blocks-until-mball.patch +kbuild-clamp-sublevel-to-255.patch +pci-fix-pci_register_io_range-memory-leak.patch +i40e-fix-memory-leak-in-i40e_probe.patch +kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch +s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch +drivers-base-memory-don-t-store-phys_device-in-memor.patch +sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch +scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch +scsi-target-core-add-cmd-length-set-before-cmd-compl.patch +scsi-target-core-prevent-underflow-for-service-actio.patch +clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch +mmc-sdhci-update-firmware-interface-api.patch +arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch +arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch +arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch diff --git a/queue-5.10/sparc32-limit-memblock-allocation-to-low-memory.patch b/queue-5.10/sparc32-limit-memblock-allocation-to-low-memory.patch new file mode 100644 index 00000000000..d511009166a --- /dev/null +++ b/queue-5.10/sparc32-limit-memblock-allocation-to-low-memory.patch @@ -0,0 +1,42 @@ +From 38c6127c7ad10b46db9092d8e5ada94c6795d8ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 14:20:31 +0100 +Subject: sparc32: Limit memblock allocation to low memory + +From: Andreas Larsson + +[ Upstream commit bda166930c37604ffa93f2425426af6921ec575a ] + +Commit cca079ef8ac29a7c02192d2bad2ffe4c0c5ffdd0 changed sparc32 to use +memblocks instead of bootmem, but also made high memory available via +memblock allocation which does not work together with e.g. phys_to_virt +and can lead to kernel panic. + +This changes back to only low memory being allocatable in the early +stages, now using memblock allocation. + +Signed-off-by: Andreas Larsson +Acked-by: Mike Rapoport +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/mm/init_32.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c +index eb2946b1df8a..6139c5700ccc 100644 +--- a/arch/sparc/mm/init_32.c ++++ b/arch/sparc/mm/init_32.c +@@ -197,6 +197,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail) + size = memblock_phys_mem_size() - memblock_reserved_size(); + *pages_avail = (size >> PAGE_SHIFT) - high_pages; + ++ /* Only allow low memory to be allocated via memblock allocation */ ++ memblock_set_current_limit(max_low_pfn << PAGE_SHIFT); ++ + return max_pfn; + } + +-- +2.30.1 + diff --git a/queue-5.10/sparc64-use-arch_validate_flags-to-validate-adi-flag.patch b/queue-5.10/sparc64-use-arch_validate_flags-to-validate-adi-flag.patch new file mode 100644 index 00000000000..6eee168d12c --- /dev/null +++ b/queue-5.10/sparc64-use-arch_validate_flags-to-validate-adi-flag.patch @@ -0,0 +1,108 @@ +From a95b471947a3304cec465bc67c548c12b1cf8a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 11:56:11 -0600 +Subject: sparc64: Use arch_validate_flags() to validate ADI flag + +From: Khalid Aziz + +[ Upstream commit 147d8622f2a26ef34beacc60e1ed8b66c2fa457f ] + +When userspace calls mprotect() to enable ADI on an address range, +do_mprotect_pkey() calls arch_validate_prot() to validate new +protection flags. arch_validate_prot() for sparc looks at the first +VMA associated with address range to verify if ADI can indeed be +enabled on this address range. This has two issues - (1) Address +range might cover multiple VMAs while arch_validate_prot() looks at +only the first VMA, (2) arch_validate_prot() peeks at VMA without +holding mmap lock which can result in race condition. + +arch_validate_flags() from commit c462ac288f2c ("mm: Introduce +arch_validate_flags()") allows for VMA flags to be validated for all +VMAs that cover the address range given by user while holding mmap +lock. This patch updates sparc code to move the VMA check from +arch_validate_prot() to arch_validate_flags() to fix above two +issues. + +Suggested-by: Jann Horn +Suggested-by: Christoph Hellwig +Suggested-by: Catalin Marinas +Signed-off-by: Khalid Aziz +Reviewed-by: Catalin Marinas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/mman.h | 54 +++++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 25 deletions(-) + +diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h +index f94532f25db1..274217e7ed70 100644 +--- a/arch/sparc/include/asm/mman.h ++++ b/arch/sparc/include/asm/mman.h +@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr) + { + if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI)) + return 0; +- if (prot & PROT_ADI) { +- if (!adi_capable()) +- return 0; ++ return 1; ++} + +- if (addr) { +- struct vm_area_struct *vma; ++#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags) ++/* arch_validate_flags() - Ensure combination of flags is valid for a ++ * VMA. ++ */ ++static inline bool arch_validate_flags(unsigned long vm_flags) ++{ ++ /* If ADI is being enabled on this VMA, check for ADI ++ * capability on the platform and ensure VMA is suitable ++ * for ADI ++ */ ++ if (vm_flags & VM_SPARC_ADI) { ++ if (!adi_capable()) ++ return false; + +- vma = find_vma(current->mm, addr); +- if (vma) { +- /* ADI can not be enabled on PFN +- * mapped pages +- */ +- if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP)) +- return 0; ++ /* ADI can not be enabled on PFN mapped pages */ ++ if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP)) ++ return false; + +- /* Mergeable pages can become unmergeable +- * if ADI is enabled on them even if they +- * have identical data on them. This can be +- * because ADI enabled pages with identical +- * data may still not have identical ADI +- * tags on them. Disallow ADI on mergeable +- * pages. +- */ +- if (vma->vm_flags & VM_MERGEABLE) +- return 0; +- } +- } ++ /* Mergeable pages can become unmergeable ++ * if ADI is enabled on them even if they ++ * have identical data on them. This can be ++ * because ADI enabled pages with identical ++ * data may still not have identical ADI ++ * tags on them. Disallow ADI on mergeable ++ * pages. ++ */ ++ if (vm_flags & VM_MERGEABLE) ++ return false; + } +- return 1; ++ return true; + } + #endif /* CONFIG_SPARC64 */ + +-- +2.30.1 + diff --git a/queue-5.10/spi-stm32-make-spurious-and-overrun-interrupts-visib.patch b/queue-5.10/spi-stm32-make-spurious-and-overrun-interrupts-visib.patch new file mode 100644 index 00000000000..a1c9362606d --- /dev/null +++ b/queue-5.10/spi-stm32-make-spurious-and-overrun-interrupts-visib.patch @@ -0,0 +1,60 @@ +From 01ce6b87adc47d2c3056ce618cc968bb78236ece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 19:59:32 +0100 +Subject: spi: stm32: make spurious and overrun interrupts visible + +From: Alain Volmat + +[ Upstream commit c64e7efe46b7de21937ef4b3594d9b1fc74f07df ] + +We do not expect to receive spurious interrupts so rise a warning +if it happens. + +RX overrun is an error condition that signals a corrupted RX +stream both in dma and in irq modes. Report the error and +abort the transfer in either cases. + +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1612551572-495-9-git-send-email-alain.volmat@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 6eeb39669a86..53c4311cc6ab 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -928,8 +928,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + mask |= STM32H7_SPI_SR_RXP; + + if (!(sr & mask)) { +- dev_dbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", +- sr, ier); ++ dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", ++ sr, ier); + spin_unlock_irqrestore(&spi->lock, flags); + return IRQ_NONE; + } +@@ -956,15 +956,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + } + + if (sr & STM32H7_SPI_SR_OVR) { +- dev_warn(spi->dev, "Overrun: received value discarded\n"); +- if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) +- stm32h7_spi_read_rxfifo(spi, false); +- /* +- * If overrun is detected while using DMA, it means that +- * something went wrong, so stop the current transfer +- */ +- if (spi->cur_usedma) +- end = true; ++ dev_err(spi->dev, "Overrun: RX data lost\n"); ++ end = true; + } + + if (sr & STM32H7_SPI_SR_EOT) { +-- +2.30.1 + diff --git a/queue-5.10/sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch b/queue-5.10/sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch new file mode 100644 index 00000000000..b0f3aad30bb --- /dev/null +++ b/queue-5.10/sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch @@ -0,0 +1,73 @@ +From d4cf80e0bf2b6819446f8a4f131ea2776ad56571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:20:53 -0800 +Subject: sysctl.c: fix underflow value setting risk in vm_table + +From: Lin Feng + +[ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ] + +Apart from subsystem specific .proc_handler handler, all ctl_tables with +extra1 and extra2 members set should use proc_dointvec_minmax instead of +proc_dointvec, or the limit set in extra* never work and potentially echo +underflow values(negative numbers) is likely make system unstable. + +Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not +a valid value, but we can set to them. And then kernel may crash. + +# echo -1 > /proc/sys/vm/vfs_cache_pressure + +Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com +Signed-off-by: Lin Feng +Cc: Alexey Dobriyan +Cc: "Eric W. Biederman" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index afad085960b8..b9306d2bb426 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2951,7 +2951,7 @@ static struct ctl_table vm_table[] = { + .data = &block_dump, + .maxlen = sizeof(block_dump), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, + { +@@ -2959,7 +2959,7 @@ static struct ctl_table vm_table[] = { + .data = &sysctl_vfs_cache_pressure, + .maxlen = sizeof(sysctl_vfs_cache_pressure), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, + #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \ +@@ -2969,7 +2969,7 @@ static struct ctl_table vm_table[] = { + .data = &sysctl_legacy_va_layout, + .maxlen = sizeof(sysctl_legacy_va_layout), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, + #endif +@@ -2979,7 +2979,7 @@ static struct ctl_table vm_table[] = { + .data = &node_reclaim_mode, + .maxlen = sizeof(node_reclaim_mode), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, + { +-- +2.30.1 + diff --git a/queue-5.10/udf-fix-silent-aed-taglocation-corruption.patch b/queue-5.10/udf-fix-silent-aed-taglocation-corruption.patch new file mode 100644 index 00000000000..316b59f19d3 --- /dev/null +++ b/queue-5.10/udf-fix-silent-aed-taglocation-corruption.patch @@ -0,0 +1,53 @@ +From e578b4d9819f9bcc65e7103fe298a3dc0e61b547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 17:41:16 -0600 +Subject: udf: fix silent AED tagLocation corruption + +From: Steven J. Magnani + +[ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ] + +When extending a file, udf_do_extend_file() may enter following empty +indirect extent. At the end of udf_do_extend_file() we revert prev_epos +to point to the last written extent. However if we end up not adding any +further extent in udf_do_extend_file(), the reverting points prev_epos +into the header area of the AED and following updates of the extents +(in udf_update_extents()) will corrupt the header. + +Make sure that we do not follow indirect extent if we are not going to +add any more extents so that returning back to the last written extent +works correctly. + +Link: https://lore.kernel.org/r/20210107234116.6190-2-magnani@ieee.org +Signed-off-by: Steven J. Magnani +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/inode.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index bb89c3e43212..0dd2f93ac048 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -544,11 +544,14 @@ static int udf_do_extend_file(struct inode *inode, + + udf_write_aext(inode, last_pos, &last_ext->extLocation, + last_ext->extLength, 1); ++ + /* +- * We've rewritten the last extent but there may be empty +- * indirect extent after it - enter it. ++ * We've rewritten the last extent. If we are going to add ++ * more extents, we may need to enter possible following ++ * empty indirect extent. + */ +- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0); ++ if (new_block_bytes || prealloc_len) ++ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0); + } + + /* Managed to do everything necessary? */ +-- +2.30.1 +