From: Sasha Levin Date: Mon, 30 Nov 2020 03:21:44 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.4.247~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cfed25e341fb816db1683913539c473ae6682bb8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arch-pgtable-define-max_possible_physmem_bits-where-.patch b/queue-5.4/arch-pgtable-define-max_possible_physmem_bits-where-.patch new file mode 100644 index 00000000000..258061b4e64 --- /dev/null +++ b/queue-5.4/arch-pgtable-define-max_possible_physmem_bits-where-.patch @@ -0,0 +1,219 @@ +From 7b8322734b0fffcf70c826ccf7b0ecb5ae02b160 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 17:52:58 +0100 +Subject: arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed + +From: Arnd Bergmann + +[ Upstream commit cef397038167ac15d085914493d6c86385773709 ] + +Stefan Agner reported a bug when using zsram on 32-bit Arm machines +with RAM above the 4GB address boundary: + + Unable to handle kernel NULL pointer dereference at virtual address 00000000 + pgd = a27bd01c + [00000000] *pgd=236a0003, *pmd=1ffa64003 + Internal error: Oops: 207 [#1] SMP ARM + Modules linked in: mdio_bcm_unimac(+) brcmfmac cfg80211 brcmutil raspberrypi_hwmon hci_uart crc32_arm_ce bcm2711_thermal phy_generic genet + CPU: 0 PID: 123 Comm: mkfs.ext4 Not tainted 5.9.6 #1 + Hardware name: BCM2711 + PC is at zs_map_object+0x94/0x338 + LR is at zram_bvec_rw.constprop.0+0x330/0xa64 + pc : [] lr : [] psr: 60000013 + sp : e376bbe0 ip : 00000000 fp : c1e2921c + r10: 00000002 r9 : c1dda730 r8 : 00000000 + r7 : e8ff7a00 r6 : 00000000 r5 : 02f9ffa0 r4 : e3710000 + r3 : 000fdffe r2 : c1e0ce80 r1 : ebf979a0 r0 : 00000000 + Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user + Control: 30c5383d Table: 235c2a80 DAC: fffffffd + Process mkfs.ext4 (pid: 123, stack limit = 0x495a22e6) + Stack: (0xe376bbe0 to 0xe376c000) + +As it turns out, zsram needs to know the maximum memory size, which +is defined in MAX_PHYSMEM_BITS when CONFIG_SPARSEMEM is set, or in +MAX_POSSIBLE_PHYSMEM_BITS on the x86 architecture. + +The same problem will be hit on all 32-bit architectures that have a +physical address space larger than 4GB and happen to not enable sparsemem +and include asm/sparsemem.h from asm/pgtable.h. + +After the initial discussion, I suggested just always defining +MAX_POSSIBLE_PHYSMEM_BITS whenever CONFIG_PHYS_ADDR_T_64BIT is +set, or provoking a build error otherwise. This addresses all +configurations that can currently have this runtime bug, but +leaves all other configurations unchanged. + +I looked up the possible number of bits in source code and +datasheets, here is what I found: + + - on ARC, CONFIG_ARC_HAS_PAE40 controls whether 32 or 40 bits are used + - on ARM, CONFIG_LPAE enables 40 bit addressing, without it we never + support more than 32 bits, even though supersections in theory allow + up to 40 bits as well. + - on MIPS, some MIPS32r1 or later chips support 36 bits, and MIPS32r5 + XPA supports up to 60 bits in theory, but 40 bits are more than + anyone will ever ship + - On PowerPC, there are three different implementations of 36 bit + addressing, but 32-bit is used without CONFIG_PTE_64BIT + - On RISC-V, the normal page table format can support 34 bit + addressing. There is no highmem support on RISC-V, so anything + above 2GB is unused, but it might be useful to eventually support + CONFIG_ZRAM for high pages. + +Fixes: 61989a80fb3a ("staging: zsmalloc: zsmalloc memory allocation library") +Fixes: 02390b87a945 ("mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS") +Acked-by: Thomas Bogendoerfer +Reviewed-by: Stefan Agner +Tested-by: Stefan Agner +Acked-by: Mike Rapoport +Link: https://lore.kernel.org/linux-mm/bdfa44bf1c570b05d6c70898e2bbb0acf234ecdf.1604762181.git.stefan@agner.ch/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/pgtable.h | 2 ++ + arch/arm/include/asm/pgtable-2level.h | 2 ++ + arch/arm/include/asm/pgtable-3level.h | 2 ++ + arch/mips/include/asm/pgtable-32.h | 3 +++ + arch/powerpc/include/asm/book3s/32/pgtable.h | 2 ++ + arch/powerpc/include/asm/nohash/32/pgtable.h | 2 ++ + arch/riscv/include/asm/pgtable-32.h | 2 ++ + include/asm-generic/pgtable.h | 13 +++++++++++++ + 8 files changed, 28 insertions(+) + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index 7addd0301c51a..6bdcf9b495b83 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -135,8 +135,10 @@ + + #ifdef CONFIG_ARC_HAS_PAE40 + #define PTE_BITS_NON_RWX_IN_PD1 (0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #else + #define PTE_BITS_NON_RWX_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /************************************************************************** +diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h +index 51beec41d48c8..50b51ac91fcbe 100644 +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -75,6 +75,8 @@ + #define PTE_HWTABLE_OFF (PTE_HWTABLE_PTRS * sizeof(pte_t)) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u32)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++ + /* + * PMD_SHIFT determines the size of the area a second-level page table can map + * PGDIR_SHIFT determines what a third-level page table entry can map +diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h +index 5b18295021a03..8006a56cc2ce2 100644 +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -25,6 +25,8 @@ + #define PTE_HWTABLE_OFF (0) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u64)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 ++ + /* + * PGDIR_SHIFT determines the size a top-level page table entry can map. + */ +diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h +index ba967148b016b..2604fab8a92dc 100644 +--- a/arch/mips/include/asm/pgtable-32.h ++++ b/arch/mips/include/asm/pgtable-32.h +@@ -155,6 +155,7 @@ static inline void pmd_clear(pmd_t *pmdp) + + #if defined(CONFIG_XPA) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #define pte_pfn(x) (((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT)) + static inline pte_t + pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -170,6 +171,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot) + + #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #define pte_pfn(x) ((unsigned long)((x).pte_high >> 6)) + + static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -184,6 +186,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) + + #else + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #ifdef CONFIG_CPU_VR41XX + #define pte_pfn(x) ((unsigned long)((x).pte >> (PAGE_SHIFT + 2))) + #define pfn_pte(pfn, prot) __pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot)) +diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h +index 0796533d37dd5..7b6349be621a3 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h +@@ -37,8 +37,10 @@ static inline bool pte_user(pte_t pte) + */ + #ifdef CONFIG_PTE_64BIT + #define PTE_RPN_MASK (~((1ULL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #else + #define PTE_RPN_MASK (~((1UL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /* +diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h +index 552b96eef0c8e..3d32d7103ec8e 100644 +--- a/arch/powerpc/include/asm/nohash/32/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/32/pgtable.h +@@ -148,8 +148,10 @@ int map_kernel_page(unsigned long va, phys_addr_t pa, pgprot_t prot); + */ + #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT) + #define PTE_RPN_MASK (~((1ULL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #else + #define PTE_RPN_MASK (~((1UL << PTE_RPN_SHIFT) - 1)) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /* +diff --git a/arch/riscv/include/asm/pgtable-32.h b/arch/riscv/include/asm/pgtable-32.h +index b0ab66e5fdb1d..5b2e79e5bfa5b 100644 +--- a/arch/riscv/include/asm/pgtable-32.h ++++ b/arch/riscv/include/asm/pgtable-32.h +@@ -14,4 +14,6 @@ + #define PGDIR_SIZE (_AC(1, UL) << PGDIR_SHIFT) + #define PGDIR_MASK (~(PGDIR_SIZE - 1)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 34 ++ + #endif /* _ASM_RISCV_PGTABLE_32_H */ +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index ea39a0b54c637..15f77361eb130 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -1159,6 +1159,19 @@ static inline bool arch_has_pfn_modify_check(void) + + #endif /* !__ASSEMBLY__ */ + ++#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT) ++#ifdef CONFIG_PHYS_ADDR_T_64BIT ++/* ++ * ZSMALLOC needs to know the highest PFN on 32-bit architectures ++ * with physical address space extension, but falls back to ++ * BITS_PER_LONG otherwise. ++ */ ++#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition ++#else ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++#endif ++#endif ++ + #ifndef has_transparent_hugepage + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + #define has_transparent_hugepage() 1 +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-dra76x-m_can-fix-order-of-clocks.patch b/queue-5.4/arm-dts-dra76x-m_can-fix-order-of-clocks.patch new file mode 100644 index 00000000000..d3a0c493dc2 --- /dev/null +++ b/queue-5.4/arm-dts-dra76x-m_can-fix-order-of-clocks.patch @@ -0,0 +1,43 @@ +From 9ef51df167fd283ea3e5c1160d9c352ec7af5d04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 15:12:11 +0100 +Subject: ARM: dts: dra76x: m_can: fix order of clocks + +From: Marc Kleine-Budde + +[ Upstream commit 05d5de6ba7dbe490dd413b5ca11d0875bd2bc006 ] + +According to the bosch,m_can.yaml bindings the first clock shall be the "hclk", +while the second clock "cclk". + +This patch fixes the order accordingly. + +Fixes: 0adbe832f21a ("ARM: dts: dra76x: Add MCAN node") +Cc: Faiz Abbas +Cc: Tony Lindgren +Cc: linux-omap@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra76x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi +index 9f6fbe4c1fee1..859e4382ac4bb 100644 +--- a/arch/arm/boot/dts/dra76x.dtsi ++++ b/arch/arm/boot/dts/dra76x.dtsi +@@ -32,8 +32,8 @@ + interrupts = , + ; + interrupt-names = "int0", "int1"; +- clocks = <&mcan_clk>, <&l3_iclk_div>; +- clock-names = "cclk", "hclk"; ++ clocks = <&l3_iclk_div>, <&mcan_clk>; ++ clock-names = "hclk", "cclk"; + bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>; + }; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm-omap2-manage-mpu-state-properly-for-omap_enter_i.patch b/queue-5.4/arm-omap2-manage-mpu-state-properly-for-omap_enter_i.patch new file mode 100644 index 00000000000..ca979a9f01b --- /dev/null +++ b/queue-5.4/arm-omap2-manage-mpu-state-properly-for-omap_enter_i.patch @@ -0,0 +1,62 @@ +From 3666af0528afde8e916f9e00b3dd6ff59081772f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 08:03:17 +0200 +Subject: ARM: OMAP2+: Manage MPU state properly for omap_enter_idle_coupled() + +From: Tony Lindgren + +[ Upstream commit 294a3317bef52b189139c813b50dd14d344fa9ec ] + +Based on more testing, commit 8ca5ee624b4c ("ARM: OMAP2+: Restore MPU +power domain if cpu_cluster_pm_enter() fails") is a poor fix for handling +cpu_cluster_pm_enter() returned errors. + +We should not override the cpuidle states with a hardcoded PWRDM_POWER_ON +value. Instead, we should use a configured idle state that does not cause +the context to be lost. Otherwise we end up configuring a potentially +improper state for the MPUSS. We also want to update the returned state +index for the selected state. + +Let's just select the highest power idle state C1 to ensure no context +loss is allowed on cpu_cluster_pm_enter() errors. With these changes we +can now unconditionally call omap4_enter_lowpower() for WFI like we did +earlier before commit 55be2f50336f ("ARM: OMAP2+: Handle errors for +cpu_pm"). And we can return the selected state index. + +Fixes: 8f04aea048d5 ("ARM: OMAP2+: Restore MPU power domain if cpu_cluster_pm_enter() fails") +Fixes: 55be2f50336f ("ARM: OMAP2+: Handle errors for cpu_pm") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/cpuidle44xx.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c +index a92d277f81a08..c8d317fafe2ea 100644 +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -175,8 +175,11 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + if (mpuss_can_lose_context) { + error = cpu_cluster_pm_enter(); + if (error) { +- omap_set_pwrdm_state(mpu_pd, PWRDM_POWER_ON); +- goto cpu_cluster_pm_out; ++ index = 0; ++ cx = state_ptr + index; ++ pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state); ++ omap_set_pwrdm_state(mpu_pd, cx->mpu_state); ++ mpuss_can_lose_context = 0; + } + } + } +@@ -184,7 +187,6 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + omap4_enter_lowpower(dev->cpu, cx->cpu_state); + cpu_done[dev->cpu] = true; + +-cpu_cluster_pm_out: + /* Wakeup CPU1 only if it is not offlined */ + if (dev->cpu == 0 && cpumask_test_cpu(1, cpu_online_mask)) { + +-- +2.27.0 + diff --git a/queue-5.4/arm64-tegra-wrong-aon-hsp-reg-property-size.patch b/queue-5.4/arm64-tegra-wrong-aon-hsp-reg-property-size.patch new file mode 100644 index 00000000000..551c9217274 --- /dev/null +++ b/queue-5.4/arm64-tegra-wrong-aon-hsp-reg-property-size.patch @@ -0,0 +1,37 @@ +From e14044dd0d6d5fa145eb3898f91f0fe78ff36750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:26:45 -0700 +Subject: arm64: tegra: Wrong AON HSP reg property size + +From: Dipen Patel + +[ Upstream commit 1741e18737948c140ccc4cc643e8126d95ee6e79 ] + +The AON HSP node's "reg" property size 0xa0000 will overlap with other +resources. This patch fixes that wrong value with correct size 0x90000. + +Reviewed-by: Mikko Perttunen +Signed-off-by: Dipen Patel +Fixes: a38570c22e9d ("arm64: tegra: Add nodes for TCU on Tegra194") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index 5728255bd0c1a..78f7e6e50beb0 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -692,7 +692,7 @@ + + hsp_aon: hsp@c150000 { + compatible = "nvidia,tegra194-hsp", "nvidia,tegra186-hsp"; +- reg = <0x0c150000 0xa0000>; ++ reg = <0x0c150000 0x90000>; + interrupts = , + , + , +-- +2.27.0 + diff --git a/queue-5.4/batman-adv-set-.owner-to-this_module.patch b/queue-5.4/batman-adv-set-.owner-to-this_module.patch new file mode 100644 index 00000000000..c670ea2a343 --- /dev/null +++ b/queue-5.4/batman-adv-set-.owner-to-this_module.patch @@ -0,0 +1,37 @@ +From dc0b9d59d07e93486507507d34e4f2fee55a286c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 10:30:04 +0000 +Subject: batman-adv: set .owner to THIS_MODULE + +From: Taehee Yoo + +[ Upstream commit 14a2e551faea53d45bc11629a9dac88f88950ca7 ] + +If THIS_MODULE is not set, the module would be removed while debugfs is +being used. +It eventually makes kernel panic. + +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Signed-off-by: Taehee Yoo +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/log.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c +index 11941cf1adcc9..87f3de3d4e4ca 100644 +--- a/net/batman-adv/log.c ++++ b/net/batman-adv/log.c +@@ -180,6 +180,7 @@ static const struct file_operations batadv_log_fops = { + .read = batadv_log_read, + .poll = batadv_log_poll, + .llseek = no_llseek, ++ .owner = THIS_MODULE, + }; + + /** +-- +2.27.0 + diff --git a/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch b/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch new file mode 100644 index 00000000000..a60b8761b19 --- /dev/null +++ b/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_board.patch @@ -0,0 +1,38 @@ +From 45b3d360319156abe5ac2e0b8b1228b5b2825db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 21:30:21 +0800 +Subject: bnxt_en: fix error return code in bnxt_init_board() + +From: Zhang Changzhong + +[ Upstream commit 3383176efc0fb0c0900a191026468a58668b4214 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Edwin Peer +Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 4869cda460dad..d8e1d7a9196cd 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10826,6 +10826,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); ++ rc = -EIO; + goto init_err_disable; + } + +-- +2.27.0 + diff --git a/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch b/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch new file mode 100644 index 00000000000..5a205735bbd --- /dev/null +++ b/queue-5.4/bnxt_en-fix-error-return-code-in-bnxt_init_one.patch @@ -0,0 +1,38 @@ +From 1609353bdc8ecc45fcffeb4e243a604a79fd4d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 20:17:31 +0800 +Subject: bnxt_en: fix error return code in bnxt_init_one() + +From: Zhang Changzhong + +[ Upstream commit b5f796b62c98cd8c219c4b788ecb6e1218e648cb ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c213eae8d3cd ("bnxt_en: Improve VF/PF link change logic.") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Reviewed-by: Edwin Peer +Link: https://lore.kernel.org/r/1605701851-20270-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 6f777e9b4b936..4869cda460dad 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -11892,6 +11892,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + create_singlethread_workqueue("bnxt_pf_wq"); + if (!bnxt_pf_wq) { + dev_err(&pdev->dev, "Unable to create workqueue.\n"); ++ rc = -ENOMEM; + goto init_err_pci_clean; + } + } +-- +2.27.0 + diff --git a/queue-5.4/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch b/queue-5.4/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch new file mode 100644 index 00000000000..c2c4e750b51 --- /dev/null +++ b/queue-5.4/bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch @@ -0,0 +1,38 @@ +From f4450d45dad043663f0831b1385ee62310274564 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 02:44:31 -0500 +Subject: bnxt_en: Release PCI regions when DMA mask setup fails during probe. + +From: Michael Chan + +[ Upstream commit c54bc3ced5106663c2f2b44071800621f505b00e ] + +Jump to init_err_release to cleanup. bnxt_unmap_bars() will also be +called but it will do nothing if the BARs are not mapped yet. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Jakub Kicinski +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index d8e1d7a9196cd..7c8187d386756 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10827,7 +10827,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); + rc = -EIO; +- goto init_err_disable; ++ goto init_err_release; + } + + pci_set_master(pdev); +-- +2.27.0 + diff --git a/queue-5.4/bus-ti-sysc-fix-bogus-resetdone-warning-on-enable-fo.patch b/queue-5.4/bus-ti-sysc-fix-bogus-resetdone-warning-on-enable-fo.patch new file mode 100644 index 00000000000..8593dd760d5 --- /dev/null +++ b/queue-5.4/bus-ti-sysc-fix-bogus-resetdone-warning-on-enable-fo.patch @@ -0,0 +1,45 @@ +From 989ef9af0f106aadf32910beec82a80fdafe0bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 10:08:47 +0200 +Subject: bus: ti-sysc: Fix bogus resetdone warning on enable for cpsw + +From: Tony Lindgren + +[ Upstream commit e7ae08d398e094e1305dee823435b1f996d39106 ] + +Bail out early from sysc_wait_softreset() just like we do in sysc_reset() +if there's no sysstatus srst_shift to fix a bogus resetdone warning on +enable as suggested by Grygorii Strashko . + +We do not currently handle resets for modules that need writing to the +sysstatus register. If we at some point add that, we also need to add +SYSS_QUIRK_RESETDONE_INVERTED flag for cpsw as the sysstatus bit is low +when reset is done as described in the am335x TRM "Table 14-202 +SOFT_RESET Register Field Descriptions" + +Fixes: d46f9fbec719 ("bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit") +Suggested-by: Grygorii Strashko +Acked-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 770a780dfa544..3934ce3385ac3 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -192,6 +192,9 @@ static int sysc_wait_softreset(struct sysc *ddata) + u32 sysc_mask, syss_done, rstval; + int syss_offset, error = 0; + ++ if (ddata->cap->regbits->srst_shift < 0) ++ return 0; ++ + syss_offset = ddata->offsets[SYSC_SYSSTATUS]; + sysc_mask = BIT(ddata->cap->regbits->srst_shift); + +-- +2.27.0 + diff --git a/queue-5.4/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch b/queue-5.4/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch new file mode 100644 index 00000000000..7f38fc51950 --- /dev/null +++ b/queue-5.4/can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch @@ -0,0 +1,320 @@ +From 58a41a0b410ceddb39b9436d5fec6d481a329743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 14:03:17 +0100 +Subject: can: gs_usb: fix endianess problem with candleLight firmware + +From: Marc Kleine-Budde + +[ Upstream commit 4ba1cb39fce4464151517a37ce0ac0a1a3f580d6 ] + +The firmware on the original USB2CAN by Geschwister Schneider Technologie +Entwicklungs- und Vertriebs UG exchanges all data between the host and the +device in host byte order. This is done with the struct +gs_host_config::byte_order member, which is sent first to indicate the desired +byte order. + +The widely used open source firmware candleLight doesn't support this feature +and exchanges the data in little endian byte order. This breaks if a device +with candleLight firmware is used on big endianess systems. + +To fix this problem, all u32 (but not the struct gs_host_frame::echo_id, which +is a transparent cookie) are converted to __le32. + +Cc: Maximilian Schneider +Cc: Hubert Denkmair +Reported-by: Michael Rausch +Link: https://lore.kernel.org/r/b58aace7-61f3-6df7-c6df-69fee2c66906@netadair.de +Tested-by: Oleksij Rempel +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/r/20201120103818.3386964-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/gs_usb.c | 131 +++++++++++++++++++---------------- + 1 file changed, 70 insertions(+), 61 deletions(-) + +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index a4b4b742c80c3..0ad13d78815c5 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -63,21 +63,27 @@ enum gs_can_identify_mode { + }; + + /* data types passed between host and device */ ++ ++/* The firmware on the original USB2CAN by Geschwister Schneider ++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data ++ * between the host and the device in host byte order. This is done ++ * with the struct gs_host_config::byte_order member, which is sent ++ * first to indicate the desired byte order. ++ * ++ * The widely used open source firmware candleLight doesn't support ++ * this feature and exchanges the data in little endian byte order. ++ */ + struct gs_host_config { +- u32 byte_order; ++ __le32 byte_order; + } __packed; +-/* All data exchanged between host and device is exchanged in host byte order, +- * thanks to the struct gs_host_config byte_order member, which is sent first +- * to indicate the desired byte order. +- */ + + struct gs_device_config { + u8 reserved1; + u8 reserved2; + u8 reserved3; + u8 icount; +- u32 sw_version; +- u32 hw_version; ++ __le32 sw_version; ++ __le32 hw_version; + } __packed; + + #define GS_CAN_MODE_NORMAL 0 +@@ -87,26 +93,26 @@ struct gs_device_config { + #define GS_CAN_MODE_ONE_SHOT BIT(3) + + struct gs_device_mode { +- u32 mode; +- u32 flags; ++ __le32 mode; ++ __le32 flags; + } __packed; + + struct gs_device_state { +- u32 state; +- u32 rxerr; +- u32 txerr; ++ __le32 state; ++ __le32 rxerr; ++ __le32 txerr; + } __packed; + + struct gs_device_bittiming { +- u32 prop_seg; +- u32 phase_seg1; +- u32 phase_seg2; +- u32 sjw; +- u32 brp; ++ __le32 prop_seg; ++ __le32 phase_seg1; ++ __le32 phase_seg2; ++ __le32 sjw; ++ __le32 brp; + } __packed; + + struct gs_identify_mode { +- u32 mode; ++ __le32 mode; + } __packed; + + #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0) +@@ -117,23 +123,23 @@ struct gs_identify_mode { + #define GS_CAN_FEATURE_IDENTIFY BIT(5) + + struct gs_device_bt_const { +- u32 feature; +- u32 fclk_can; +- u32 tseg1_min; +- u32 tseg1_max; +- u32 tseg2_min; +- u32 tseg2_max; +- u32 sjw_max; +- u32 brp_min; +- u32 brp_max; +- u32 brp_inc; ++ __le32 feature; ++ __le32 fclk_can; ++ __le32 tseg1_min; ++ __le32 tseg1_max; ++ __le32 tseg2_min; ++ __le32 tseg2_max; ++ __le32 sjw_max; ++ __le32 brp_min; ++ __le32 brp_max; ++ __le32 brp_inc; + } __packed; + + #define GS_CAN_FLAG_OVERFLOW 1 + + struct gs_host_frame { + u32 echo_id; +- u32 can_id; ++ __le32 can_id; + + u8 can_dlc; + u8 channel; +@@ -329,13 +335,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + if (!skb) + return; + +- cf->can_id = hf->can_id; ++ cf->can_id = le32_to_cpu(hf->can_id); + + cf->can_dlc = get_can_dlc(hf->can_dlc); + memcpy(cf->data, hf->data, 8); + + /* ERROR frames tell us information about the controller */ +- if (hf->can_id & CAN_ERR_FLAG) ++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG) + gs_update_state(dev, cf); + + netdev->stats.rx_packets++; +@@ -418,11 +424,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev) + if (!dbt) + return -ENOMEM; + +- dbt->prop_seg = bt->prop_seg; +- dbt->phase_seg1 = bt->phase_seg1; +- dbt->phase_seg2 = bt->phase_seg2; +- dbt->sjw = bt->sjw; +- dbt->brp = bt->brp; ++ dbt->prop_seg = cpu_to_le32(bt->prop_seg); ++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1); ++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2); ++ dbt->sjw = cpu_to_le32(bt->sjw); ++ dbt->brp = cpu_to_le32(bt->brp); + + /* request bit timings */ + rc = usb_control_msg(interface_to_usbdev(intf), +@@ -503,7 +509,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, + + cf = (struct can_frame *)skb->data; + +- hf->can_id = cf->can_id; ++ hf->can_id = cpu_to_le32(cf->can_id); + hf->can_dlc = cf->can_dlc; + memcpy(hf->data, cf->data, cf->can_dlc); + +@@ -573,6 +579,7 @@ static int gs_can_open(struct net_device *netdev) + int rc, i; + struct gs_device_mode *dm; + u32 ctrlmode; ++ u32 flags = 0; + + rc = open_candev(netdev); + if (rc) +@@ -640,24 +647,24 @@ static int gs_can_open(struct net_device *netdev) + + /* flags */ + ctrlmode = dev->can.ctrlmode; +- dm->flags = 0; + + if (ctrlmode & CAN_CTRLMODE_LOOPBACK) +- dm->flags |= GS_CAN_MODE_LOOP_BACK; ++ flags |= GS_CAN_MODE_LOOP_BACK; + else if (ctrlmode & CAN_CTRLMODE_LISTENONLY) +- dm->flags |= GS_CAN_MODE_LISTEN_ONLY; ++ flags |= GS_CAN_MODE_LISTEN_ONLY; + + /* Controller is not allowed to retry TX + * this mode is unavailable on atmels uc3c hardware + */ + if (ctrlmode & CAN_CTRLMODE_ONE_SHOT) +- dm->flags |= GS_CAN_MODE_ONE_SHOT; ++ flags |= GS_CAN_MODE_ONE_SHOT; + + if (ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE; ++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ +- dm->mode = GS_CAN_MODE_START; ++ dm->mode = cpu_to_le32(GS_CAN_MODE_START); ++ dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0), + GS_USB_BREQ_MODE, +@@ -737,9 +744,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) + return -ENOMEM; + + if (do_identify) +- imode->mode = GS_CAN_IDENTIFY_ON; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON); + else +- imode->mode = GS_CAN_IDENTIFY_OFF; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF); + + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), +@@ -790,6 +797,7 @@ static struct gs_can *gs_make_candev(unsigned int channel, + struct net_device *netdev; + int rc; + struct gs_device_bt_const *bt_const; ++ u32 feature; + + bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL); + if (!bt_const) +@@ -830,14 +838,14 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* dev settup */ + strcpy(dev->bt_const.name, "gs_usb"); +- dev->bt_const.tseg1_min = bt_const->tseg1_min; +- dev->bt_const.tseg1_max = bt_const->tseg1_max; +- dev->bt_const.tseg2_min = bt_const->tseg2_min; +- dev->bt_const.tseg2_max = bt_const->tseg2_max; +- dev->bt_const.sjw_max = bt_const->sjw_max; +- dev->bt_const.brp_min = bt_const->brp_min; +- dev->bt_const.brp_max = bt_const->brp_max; +- dev->bt_const.brp_inc = bt_const->brp_inc; ++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min); ++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max); ++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min); ++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max); ++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max); ++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min); ++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max); ++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc); + + dev->udev = interface_to_usbdev(intf); + dev->iface = intf; +@@ -854,28 +862,29 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* can settup */ + dev->can.state = CAN_STATE_STOPPED; +- dev->can.clock.freq = bt_const->fclk_can; ++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can); + dev->can.bittiming_const = &dev->bt_const; + dev->can.do_set_bittiming = gs_usb_set_bittiming; + + dev->can.ctrlmode_supported = 0; + +- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY) ++ feature = le32_to_cpu(bt_const->feature); ++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY; + +- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK) ++ if (feature & GS_CAN_FEATURE_LOOP_BACK) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK; + +- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) ++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + +- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT) ++ if (feature & GS_CAN_FEATURE_ONE_SHOT) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT; + + SET_NETDEV_DEV(netdev, &intf->dev); + +- if (dconf->sw_version > 1) +- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY) ++ if (le32_to_cpu(dconf->sw_version) > 1) ++ if (feature & GS_CAN_FEATURE_IDENTIFY) + netdev->ethtool_ops = &gs_usb_ethtool_ops; + + kfree(bt_const); +@@ -910,7 +919,7 @@ static int gs_usb_probe(struct usb_interface *intf, + if (!hconf) + return -ENOMEM; + +- hconf->byte_order = 0x0000beef; ++ hconf->byte_order = cpu_to_le32(0x0000beef); + + /* send host config */ + rc = usb_control_msg(interface_to_usbdev(intf), +-- +2.27.0 + diff --git a/queue-5.4/can-m_can-fix-nominal-bitiming-tseg2-min-for-version.patch b/queue-5.4/can-m_can-fix-nominal-bitiming-tseg2-min-for-version.patch new file mode 100644 index 00000000000..65e2e358cbf --- /dev/null +++ b/queue-5.4/can-m_can-fix-nominal-bitiming-tseg2-min-for-version.patch @@ -0,0 +1,43 @@ +From c662409a664399e2104f1fddfae2cdcbb5751617 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 19:47:38 +0100 +Subject: can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 + +From: Marc Kleine-Budde + +[ Upstream commit e3409e4192535fbcc86a84b7a65d9351f46039ec ] + +At lest the revision 3.3.0 of the bosch m_can IP core specifies that valid +register values for "Nominal Time segment after sample point (NTSEG2)" are from +1 to 127. As the hardware uses a value of one more than the programmed value, +mean tseg2_min is 2. + +This patch fixes the tseg2_min value accordingly. + +Cc: Dan Murphy +Cc: Mario Huettel +Acked-by: Sriram Dash +Link: https://lore.kernel.org/r/20201124190751.3972238-1-mkl@pengutronix.de +Fixes: b03cfc5bb0e1 ("can: m_can: Enable M_CAN version dependent initialization") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index eafdb4441d441..f9a2a9ecbac9e 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -990,7 +990,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = { + .name = KBUILD_MODNAME, + .tseg1_min = 2, /* Time segment 1 = prop_seg + phase_seg1 */ + .tseg1_max = 256, +- .tseg2_min = 1, /* Time segment 2 = phase_seg2 */ ++ .tseg2_min = 2, /* Time segment 2 = phase_seg2 */ + .tseg2_max = 128, + .sjw_max = 128, + .brp_min = 1, +-- +2.27.0 + diff --git a/queue-5.4/can-m_can-m_can_open-remove-irqf_trigger_falling-fro.patch b/queue-5.4/can-m_can-m_can_open-remove-irqf_trigger_falling-fro.patch new file mode 100644 index 00000000000..039c801b5d8 --- /dev/null +++ b/queue-5.4/can-m_can-m_can_open-remove-irqf_trigger_falling-fro.patch @@ -0,0 +1,53 @@ +From f1a3a14fa91fa15702590a69fd8455548e43cf9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 08:35:12 +0100 +Subject: can: m_can: m_can_open(): remove IRQF_TRIGGER_FALLING from + request_threaded_irq()'s flags + +From: Marc Kleine-Budde + +[ Upstream commit 865f5b671b48d0088ce981cff1e822d9f7da441f ] + +The threaded IRQ handler is used for the tcan4x5x driver only. The IRQ pin of +the tcan4x5x controller is active low, so better not use IRQF_TRIGGER_FALLING +when requesting the IRQ. As this can result in missing interrupts. + +Further, if the device tree specified the interrupt as "IRQ_TYPE_LEVEL_LOW", +unloading and reloading of the driver results in the following error during +ifup: + +| irq: type mismatch, failed to map hwirq-31 for gpio@20a8000! +| tcan4x5x spi1.1: m_can device registered (irq=0, version=32) +| tcan4x5x spi1.1 can2: TCAN4X5X successfully initialized. +| tcan4x5x spi1.1 can2: failed to request interrupt + +This patch fixes the problem by removing the IRQF_TRIGGER_FALLING from the +request_threaded_irq(). + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Cc: Dan Murphy +Cc: Sriram Dash +Cc: Pankaj Sharma +Link: https://lore.kernel.org/r/20201127093548.509253-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 246fa2657d744..eafdb4441d441 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1605,7 +1605,7 @@ static int m_can_open(struct net_device *dev) + INIT_WORK(&cdev->tx_work, m_can_tx_work_queue); + + err = request_threaded_irq(dev->irq, NULL, m_can_isr, +- IRQF_ONESHOT | IRQF_TRIGGER_FALLING, ++ IRQF_ONESHOT, + dev->name, dev); + } else { + err = request_irq(dev->irq, m_can_isr, IRQF_SHARED, dev->name, +-- +2.27.0 + diff --git a/queue-5.4/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch b/queue-5.4/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch new file mode 100644 index 00000000000..dbf04452167 --- /dev/null +++ b/queue-5.4/cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch @@ -0,0 +1,41 @@ +From c1c84557b10362e8b293233be3024f093c6f644b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 20:02:13 +0530 +Subject: cxgb4: fix the panic caused by non smac rewrite + +From: Raju Rangoju + +[ Upstream commit bff453921ae105a8dbbad0ed7dd5f5ce424536e7 ] + +SMT entry is allocated only when loopback Source MAC +rewriting is requested. Accessing SMT entry for non +smac rewrite cases results in kernel panic. + +Fix the panic caused by non smac rewrite + +Fixes: 937d84205884 ("cxgb4: set up filter action after rewrites") +Signed-off-by: Raju Rangoju +Link: https://lore.kernel.org/r/20201118143213.13319-1-rajur@chelsio.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +index 202af8dc79662..cb50b41cd3df2 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -630,7 +630,8 @@ int set_filter_wr(struct adapter *adapter, int fidx) + FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) | + FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) | + FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld)); +- fwr->smac_sel = f->smt->idx; ++ if (f->fs.newsmac) ++ fwr->smac_sel = f->smt->idx; + fwr->rx_chan_rx_rpl_iq = + htons(FW_FILTER_WR_RX_CHAN_V(0) | + FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id)); +-- +2.27.0 + diff --git a/queue-5.4/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch b/queue-5.4/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch new file mode 100644 index 00000000000..a170925c9cb --- /dev/null +++ b/queue-5.4/dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch @@ -0,0 +1,69 @@ +From 950fda253507ddf8aaf3b84e713c7595851611bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 11:55:06 +0800 +Subject: dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size + +From: Sugar Zhang + +[ Upstream commit e773ca7da8beeca7f17fe4c9d1284a2b66839cc1 ] + +Actually, burst size is equal to '1 << desc->rqcfg.brst_size'. +we should use burst size, not desc->rqcfg.brst_size. + +dma memcpy performance on Rockchip RV1126 +@ 1512MHz A7, 1056MHz LPDDR3, 200MHz DMA: + +dmatest: + +/# echo dma0chan0 > /sys/module/dmatest/parameters/channel +/# echo 4194304 > /sys/module/dmatest/parameters/test_buf_size +/# echo 8 > /sys/module/dmatest/parameters/iterations +/# echo y > /sys/module/dmatest/parameters/norandom +/# echo y > /sys/module/dmatest/parameters/verbose +/# echo 1 > /sys/module/dmatest/parameters/run + +dmatest: dma0chan0-copy0: result #1: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #2: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #3: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #4: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #5: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #6: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #7: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 +dmatest: dma0chan0-copy0: result #8: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000 + +Before: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 48 iops 200338 KB/s (0) + +After this patch: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 179 iops 734873 KB/s (0) + +After this patch and increase dma clk to 400MHz: + + dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 259 iops 1062929 KB/s (0) + +Signed-off-by: Sugar Zhang +Link: https://lore.kernel.org/r/1605326106-55681-1-git-send-email-sugar.zhang@rock-chips.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/pl330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index cd81d10974a29..57b6555d6d042 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2793,7 +2793,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. + */ +- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) ++ if (burst * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + + desc->bytes_requested = len; +-- +2.27.0 + diff --git a/queue-5.4/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch b/queue-5.4/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch new file mode 100644 index 00000000000..ad2a62145c5 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch @@ -0,0 +1,42 @@ +From d054e62bf38995ce44047411f1a60eae2e80391e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 12:30:04 +0530 +Subject: dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant + +From: Marc Ferland + +[ Upstream commit 0ba2df09f1500d3f27398a3382b86d39c3e6abe2 ] + +The xilinx_dma_poll_timeout macro is sometimes called while holding a +spinlock (see xilinx_dma_issue_pending() for an example) this means we +shouldn't sleep when polling the dma channel registers. To address it +in xilinx poll timeout macro use readl_poll_timeout_atomic instead of +readl_poll_timeout variant. + +Signed-off-by: Marc Ferland +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1604473206-32573-2-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 43acba2a1c0ee..a6abfe702c5a3 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -454,8 +454,8 @@ struct xilinx_dma_device { + #define to_dma_tx_descriptor(tx) \ + container_of(tx, struct xilinx_dma_tx_descriptor, async_tx) + #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \ +- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \ +- cond, delay_us, timeout_us) ++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \ ++ val, cond, delay_us, timeout_us) + + /* IO accessors */ + static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg) +-- +2.27.0 + diff --git a/queue-5.4/efi-efi_earlycon-should-depend-on-efi.patch b/queue-5.4/efi-efi_earlycon-should-depend-on-efi.patch new file mode 100644 index 00000000000..ce336e7658f --- /dev/null +++ b/queue-5.4/efi-efi_earlycon-should-depend-on-efi.patch @@ -0,0 +1,49 @@ +From 1c45e0e26b238ae55df52132b36746399b2751af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 20:16:46 +0100 +Subject: efi: EFI_EARLYCON should depend on EFI + +From: Geert Uytterhoeven + +[ Upstream commit 36a237526cd81ff4b6829e6ebd60921c6f976e3b ] + +CONFIG_EFI_EARLYCON defaults to yes, and thus is enabled on systems that +do not support EFI, or do not have EFI support enabled, but do satisfy +the symbol's other dependencies. + +While drivers/firmware/efi/ won't be entered during the build phase if +CONFIG_EFI=n, and drivers/firmware/efi/earlycon.c itself thus won't be +built, enabling EFI_EARLYCON does force-enable CONFIG_FONT_SUPPORT and +CONFIG_ARCH_USE_MEMREMAP_PROT, and CONFIG_FONT_8x16, which is +undesirable. + +Fix this by making CONFIG_EFI_EARLYCON depend on CONFIG_EFI. + +This reduces kernel size on headless systems by more than 4 KiB. + +Fixes: 69c1f396f25b805a ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20201124191646.3559757-1-geert@linux-m68k.org +Reviewed-by: Damien Le Moal +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig +index 6a6b412206ec0..3222645c95b33 100644 +--- a/drivers/firmware/efi/Kconfig ++++ b/drivers/firmware/efi/Kconfig +@@ -216,7 +216,7 @@ config EFI_DEV_PATH_PARSER + + config EFI_EARLYCON + def_bool y +- depends on SERIAL_EARLYCON && !ARM && !IA64 ++ depends on EFI && SERIAL_EARLYCON && !ARM && !IA64 + select FONT_SUPPORT + select ARCH_USE_MEMREMAP_PROT + +-- +2.27.0 + diff --git a/queue-5.4/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch b/queue-5.4/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch new file mode 100644 index 00000000000..0a45449f424 --- /dev/null +++ b/queue-5.4/efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch @@ -0,0 +1,63 @@ +From 04b2cc3955992a11e6591e653517d242a98459e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 08:45:55 +0100 +Subject: efivarfs: revert "fix memory leak in efivarfs_create()" + +From: Ard Biesheuvel + +[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ] + +The memory leak addressed by commit fe5186cf12e3 is a false positive: +all allocations are recorded in a linked list, and freed when the +filesystem is unmounted. This leads to double frees, and as reported +by David, leads to crashes if SLUB is configured to self destruct when +double frees occur. + +So drop the redundant kfree() again, and instead, mark the offending +pointer variable so the allocation is ignored by kmemleak. + +Cc: Vamshi K Sthambamkadi +Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()") +Reported-by: David Laight +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + fs/efivarfs/inode.c | 2 ++ + fs/efivarfs/super.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c +index 96c0c86f3fffe..0297ad95eb5cc 100644 +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -103,6 +104,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, + var->var.VariableName[i] = '\0'; + + inode->i_private = var; ++ kmemleak_ignore(var); + + err = efivar_entry_add(var, &efivarfs_list); + if (err) +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index edcd6769a94b4..9760a52800b42 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -21,7 +21,6 @@ LIST_HEAD(efivarfs_list); + static void efivarfs_evict_inode(struct inode *inode) + { + clear_inode(inode); +- kfree(inode->i_private); + } + + static const struct super_operations efivarfs_ops = { +-- +2.27.0 + diff --git a/queue-5.4/hid-add-hid_quirk_increment_usage_on_duplicate-for-g.patch b/queue-5.4/hid-add-hid_quirk_increment_usage_on_duplicate-for-g.patch new file mode 100644 index 00000000000..45a50f07d6c --- /dev/null +++ b/queue-5.4/hid-add-hid_quirk_increment_usage_on_duplicate-for-g.patch @@ -0,0 +1,53 @@ +From 30dd52358dec8d10c06124ac64cee793a383ad55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Nov 2020 11:34:52 -0800 +Subject: HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices + +From: Chris Ye + +[ Upstream commit f59ee399de4a8ca4d7d19cdcabb4b63e94867f09 ] + +Kernel 5.4 introduces HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE, devices need to +be set explicitly with this flag. + +Signed-off-by: Chris Ye +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 4 ++++ + drivers/hid/hid-quirks.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index d173badafcf1f..6b1c26e6fa4a3 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -451,6 +451,10 @@ + #define USB_VENDOR_ID_FRUCTEL 0x25B6 + #define USB_DEVICE_ID_GAMETEL_MT_MODE 0x0002 + ++#define USB_VENDOR_ID_GAMEVICE 0x27F8 ++#define USB_DEVICE_ID_GAMEVICE_GV186 0x0BBE ++#define USB_DEVICE_ID_GAMEVICE_KISHI 0x0BBF ++ + #define USB_VENDOR_ID_GAMERON 0x0810 + #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR 0x0001 + #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index abee4e950a4ee..60d188a704e5e 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -85,6 +85,10 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, +-- +2.27.0 + diff --git a/queue-5.4/hid-add-logitech-dinovo-edge-battery-quirk.patch b/queue-5.4/hid-add-logitech-dinovo-edge-battery-quirk.patch new file mode 100644 index 00000000000..a970c87f5cb --- /dev/null +++ b/queue-5.4/hid-add-logitech-dinovo-edge-battery-quirk.patch @@ -0,0 +1,55 @@ +From 68030c6ef1663ad9e98d95792c412db1eadac305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 14:36:58 +0100 +Subject: HID: Add Logitech Dinovo Edge battery quirk + +From: Hans de Goede + +[ Upstream commit 7940fb035abd88040d56be209962feffa33b03d0 ] + +The battery status is also being reported by the logitech-hidpp driver, +so ignore the standard HID battery status to avoid reporting the same +info twice. + +Note the logitech-hidpp battery driver provides more info, such as properly +differentiating between charging and discharging. Also the standard HID +battery info seems to be wrong, reporting a capacity of just 26% after +fully charging the device. + +Signed-off-by: Hans de Goede +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 6b1c26e6fa4a3..2aa810665a78c 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -750,6 +750,7 @@ + #define USB_VENDOR_ID_LOGITECH 0x046d + #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e + #define USB_DEVICE_ID_LOGITECH_T651 0xb00c ++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 + #define USB_DEVICE_ID_LOGITECH_C007 0xc007 + #define USB_DEVICE_ID_LOGITECH_C077 0xc077 + #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index b2bff932c524f..b2da8476d0d30 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -319,6 +319,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.27.0 + diff --git a/queue-5.4/hid-add-support-for-sega-saturn.patch b/queue-5.4/hid-add-support-for-sega-saturn.patch new file mode 100644 index 00000000000..3323002c8dd --- /dev/null +++ b/queue-5.4/hid-add-support-for-sega-saturn.patch @@ -0,0 +1,50 @@ +From 0e15df6253fddbe0a995885581edc960f81956c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 22:52:31 +0200 +Subject: HID: add support for Sega Saturn +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit 1811977cb11354aef8cbd13e35ff50db716728a4 ] + +This device needs HID_QUIRK_MULTI_INPUT in order to be presented to userspace +in a consistent way. + +Reported-and-tested-by: David Gámiz Jiménez +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b2c86403e43b1..d173badafcf1f 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -489,6 +489,7 @@ + #define USB_DEVICE_ID_PENPOWER 0x00f4 + + #define USB_VENDOR_ID_GREENASIA 0x0e8f ++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010 + #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013 + + #define USB_VENDOR_ID_GRETAGMACBETH 0x0971 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 0440e2f6e8a3c..abee4e950a4ee 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -83,6 +83,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, +-- +2.27.0 + diff --git a/queue-5.4/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch b/queue-5.4/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch new file mode 100644 index 00000000000..297adef3bec --- /dev/null +++ b/queue-5.4/hid-cypress-support-varmilo-keyboards-media-hotkeys.patch @@ -0,0 +1,135 @@ +From fa6faa05dc96130c40c91f0ef670bb1f70c63323 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 03:16:50 +0900 +Subject: HID: cypress: Support Varmilo Keyboards' media hotkeys + +From: Frank Yang + +[ Upstream commit 652f3d00de523a17b0cebe7b90debccf13aa8c31 ] + +The Varmilo VA104M Keyboard (04b4:07b1, reported as Varmilo Z104M) +exposes media control hotkeys as a USB HID consumer control device, but +these keys do not work in the current (5.8-rc1) kernel due to the +incorrect HID report descriptor. Fix the problem by modifying the +internal HID report descriptor. + +More specifically, the keyboard report descriptor specifies the +logical boundary as 572~10754 (0x023c ~ 0x2a02) while the usage +boundary is specified as 0~10754 (0x00 ~ 0x2a02). This results in an +incorrect interpretation of input reports, causing inputs to be ignored. +By setting the Logical Minimum to zero, we align the logical boundary +with the Usage ID boundary. + +Some notes: + +* There seem to be multiple variants of the VA104M keyboard. This + patch specifically targets 04b4:07b1 variant. + +* The device works out-of-the-box on Windows platform with the generic + consumer control device driver (hidserv.inf). This suggests that + Windows either ignores the Logical Minimum/Logical Maximum or + interprets the Usage ID assignment differently from the linux + implementation; Maybe there are other devices out there that only + works on Windows due to this problem? + +Signed-off-by: Frank Yang +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-cypress.c | 44 ++++++++++++++++++++++++++++++++++----- + drivers/hid/hid-ids.h | 2 ++ + 2 files changed, 41 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c +index a50ba4a4a1d71..b88f889b3932e 100644 +--- a/drivers/hid/hid-cypress.c ++++ b/drivers/hid/hid-cypress.c +@@ -23,19 +23,17 @@ + #define CP_2WHEEL_MOUSE_HACK 0x02 + #define CP_2WHEEL_MOUSE_HACK_ON 0x04 + ++#define VA_INVAL_LOGICAL_BOUNDARY 0x08 ++ + /* + * Some USB barcode readers from cypress have usage min and usage max in + * the wrong order + */ +-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); + unsigned int i; + +- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) +- return rdesc; +- + if (*rsize < 4) + return rdesc; + +@@ -48,6 +46,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + ++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ /* ++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly ++ * reports Logical Minimum of its Consumer Control device as 572 ++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero. ++ */ ++ if (*rsize == 25 && ++ rdesc[0] == 0x05 && rdesc[1] == 0x0c && ++ rdesc[2] == 0x09 && rdesc[3] == 0x01 && ++ rdesc[6] == 0x19 && rdesc[7] == 0x00 && ++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) { ++ hid_info(hdev, ++ "fixing up varmilo VA104M consumer control report descriptor\n"); ++ rdesc[12] = 0x00; ++ rdesc[13] = 0x00; ++ } ++ return rdesc; ++} ++ ++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX) ++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize); ++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY) ++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize); ++ ++ return rdesc; ++} ++ + static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) +@@ -128,6 +160,8 @@ static const struct hid_device_id cp_devices[] = { + .driver_data = CP_RDESC_SWAPPED_MIN_MAX }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE), + .driver_data = CP_2WHEEL_MOUSE_HACK }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1), ++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY }, + { } + }; + MODULE_DEVICE_TABLE(hid, cp_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 62b8802a534e8..b2c86403e43b1 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -337,6 +337,8 @@ + #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81 + #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001 + ++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1 ++ + #define USB_VENDOR_ID_DATA_MODUL 0x7374 + #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201 + +-- +2.27.0 + diff --git a/queue-5.4/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch b/queue-5.4/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch new file mode 100644 index 00000000000..715fbf42bf9 --- /dev/null +++ b/queue-5.4/hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch @@ -0,0 +1,39 @@ +From 2ab215b7f674fec83e7449bfbd89e3587616118e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 19:29:39 -0500 +Subject: HID: hid-sensor-hub: Fix issue with devices with no report ID + +From: Pablo Ceballos + +[ Upstream commit 34a9fa2025d9d3177c99351c7aaf256c5f50691f ] + +Some HID devices don't use a report ID because they only have a single +report. In those cases, the report ID in struct hid_report will be zero +and the data for the report will start at the first byte, so don't skip +over the first byte. + +Signed-off-by: Pablo Ceballos +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-sensor-hub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c +index 94c7398b5c279..3dd7d32467378 100644 +--- a/drivers/hid/hid-sensor-hub.c ++++ b/drivers/hid/hid-sensor-hub.c +@@ -483,7 +483,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev, + return 1; + + ptr = raw_data; +- ptr++; /* Skip report id */ ++ if (report->id) ++ ptr++; /* Skip report id */ + + spin_lock_irqsave(&pdata->lock, flags); + +-- +2.27.0 + diff --git a/queue-5.4/hid-ite-replace-abs_misc-120-121-events-with-touchpa.patch b/queue-5.4/hid-ite-replace-abs_misc-120-121-events-with-touchpa.patch new file mode 100644 index 00000000000..11675bd4628 --- /dev/null +++ b/queue-5.4/hid-ite-replace-abs_misc-120-121-events-with-touchpa.patch @@ -0,0 +1,131 @@ +From f185d8b30d181c0142129802ee2d4d081c20c79f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 09:48:14 +0200 +Subject: HID: ite: Replace ABS_MISC 120/121 events with touchpad on/off + keypresses + +From: Hans de Goede + +[ Upstream commit 3c785a06dee99501a17f8e8cf29b2b7e3f1e94ea ] + +The usb-hid keyboard-dock for the Acer Switch 10 SW5-012 model declares +an application and hid-usage page of 0x0088 for the INPUT(4) report which +it sends. This reports contains 2 8-bit fields which are declared as +HID_MAIN_ITEM_VARIABLE. + +The keyboard-touchpad combo never actually generates this report, except +when the touchpad is toggled on/off with the Fn + F7 hotkey combo. The +toggle on/off is handled inside the keyboard-dock, when the touchpad is +toggled off it simply stops sending events. + +When the touchpad is toggled on/off an INPUT(4) report is generated with +the first content byte set to 120/121, before this commit the kernel +would report this as ABS_MISC 120/121 events. + +Patch the descriptor to replace the HID_MAIN_ITEM_VARIABLE with +HID_MAIN_ITEM_RELATIVE (because no key-presss release events are send) +and add mappings for the 0x00880078 and 0x00880079 usages to generate +touchpad on/off key events when the touchpad is toggled on/off. + +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ite.c | 61 ++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c +index 044a93f3c1178..742c052b0110a 100644 +--- a/drivers/hid/hid-ite.c ++++ b/drivers/hid/hid-ite.c +@@ -11,6 +11,48 @@ + + #include "hid-ids.h" + ++#define QUIRK_TOUCHPAD_ON_OFF_REPORT BIT(0) ++ ++static __u8 *ite_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) { ++ if (*rsize == 188 && rdesc[162] == 0x81 && rdesc[163] == 0x02) { ++ hid_info(hdev, "Fixing up ITE keyboard report descriptor\n"); ++ rdesc[163] = HID_MAIN_ITEM_RELATIVE; ++ } ++ } ++ ++ return rdesc; ++} ++ ++static int ite_input_mapping(struct hid_device *hdev, ++ struct hid_input *hi, struct hid_field *field, ++ struct hid_usage *usage, unsigned long **bit, ++ int *max) ++{ ++ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if ((quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) && ++ (usage->hid & HID_USAGE_PAGE) == 0x00880000) { ++ if (usage->hid == 0x00880078) { ++ /* Touchpad on, userspace expects F22 for this */ ++ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F22); ++ return 1; ++ } ++ if (usage->hid == 0x00880079) { ++ /* Touchpad off, userspace expects F23 for this */ ++ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F23); ++ return 1; ++ } ++ return -1; ++ } ++ ++ return 0; ++} ++ + static int ite_event(struct hid_device *hdev, struct hid_field *field, + struct hid_usage *usage, __s32 value) + { +@@ -37,13 +79,27 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field, + return 0; + } + ++static int ite_probe(struct hid_device *hdev, const struct hid_device_id *id) ++{ ++ int ret; ++ ++ hid_set_drvdata(hdev, (void *)id->driver_data); ++ ++ ret = hid_open_report(hdev); ++ if (ret) ++ return ret; ++ ++ return hid_hw_start(hdev, HID_CONNECT_DEFAULT); ++} ++ + static const struct hid_device_id ite_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) }, + { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) }, + /* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, +- USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) }, ++ USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012), ++ .driver_data = QUIRK_TOUCHPAD_ON_OFF_REPORT }, + /* ITE8910 USB kbd ctlr, with Synaptics touchpad connected to it. */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, +@@ -55,6 +111,9 @@ MODULE_DEVICE_TABLE(hid, ite_devices); + static struct hid_driver ite_driver = { + .name = "itetech", + .id_table = ite_devices, ++ .probe = ite_probe, ++ .report_fixup = ite_report_fixup, ++ .input_mapping = ite_input_mapping, + .event = ite_event, + }; + module_hid_driver(ite_driver); +-- +2.27.0 + diff --git a/queue-5.4/hid-logitech-hidpp-add-hidpp_consumer_vendor_keys-qu.patch b/queue-5.4/hid-logitech-hidpp-add-hidpp_consumer_vendor_keys-qu.patch new file mode 100644 index 00000000000..368eaaa1594 --- /dev/null +++ b/queue-5.4/hid-logitech-hidpp-add-hidpp_consumer_vendor_keys-qu.patch @@ -0,0 +1,54 @@ +From 3ddd5778e15fa8fe8cb6364485d90923293fbf3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 14:36:57 +0100 +Subject: HID: logitech-hidpp: Add HIDPP_CONSUMER_VENDOR_KEYS quirk for the + Dinovo Edge + +From: Hans de Goede + +[ Upstream commit c27168a04a438a457c100253b1aaf0c779218aae ] + +Like the MX5000 and MX5500 quad/bluetooth keyboards the Dinovo Edge also +needs the HIDPP_CONSUMER_VENDOR_KEYS quirk for some special keys to work. +Specifically without this the "Phone" and the 'A' - 'D' Smart Keys do not +send any events. + +In addition to fixing these keys not sending any events, adding the +Bluetooth match, so that hid-logitech-hidpp is used instead of the +generic HID driver, also adds battery monitoring support when the +keyboard is connected over Bluetooth. + +Signed-off-by: Hans de Goede +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index e49d36de07968..919551ed5809c 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3789,6 +3789,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* Keyboard MX5000 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb305), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Dinovo Edge (Bluetooth-receiver in HID proxy mode) */ ++ LDJ_DEVICE(0xb309), ++ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ + LDJ_DEVICE(0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, +@@ -3831,6 +3834,9 @@ static const struct hid_device_id hidpp_devices[] = { + { /* MX5000 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Dinovo Edge keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb309), ++ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* MX5500 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, +-- +2.27.0 + diff --git a/queue-5.4/hid-uclogic-add-id-for-trust-flex-design-tablet.patch b/queue-5.4/hid-uclogic-add-id-for-trust-flex-design-tablet.patch new file mode 100644 index 00000000000..0e959572dde --- /dev/null +++ b/queue-5.4/hid-uclogic-add-id-for-trust-flex-design-tablet.patch @@ -0,0 +1,63 @@ +From 2b2112a3ef1b128d5836053772e7c6251248b2cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 08:38:05 +0200 +Subject: HID: uclogic: Add ID for Trust Flex Design Tablet + +From: Martijn van de Streek + +[ Upstream commit 022fc5315b7aff69d3df2c953b892a6232642d50 ] + +The Trust Flex Design Tablet has an UGTizer USB ID and requires the same +initialization as the UGTizer GP0610 to be detected as a graphics tablet +instead of a mouse. + +Signed-off-by: Martijn van de Streek +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-uclogic-core.c | 2 ++ + drivers/hid/hid-uclogic-params.c | 2 ++ + 3 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 7363d0b488bd8..62b8802a534e8 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1292,6 +1292,7 @@ + + #define USB_VENDOR_ID_UGTIZER 0x2179 + #define USB_DEVICE_ID_UGTIZER_TABLET_GP0610 0x0053 ++#define USB_DEVICE_ID_UGTIZER_TABLET_GT5040 0x0077 + + #define USB_VENDOR_ID_VIEWSONIC 0x0543 + #define USB_DEVICE_ID_VIEWSONIC_PD1011 0xe621 +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index 86b568037cb8a..8e9c9e646cb7d 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -385,6 +385,8 @@ static const struct hid_device_id uclogic_devices[] = { + USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, + USB_DEVICE_ID_UGTIZER_TABLET_GP0610) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, ++ USB_DEVICE_ID_UGTIZER_TABLET_GT5040) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_TABLET_G5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 78a364ae2f685..e80c812f44a77 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -997,6 +997,8 @@ int uclogic_params_init(struct uclogic_params *params, + break; + case VID_PID(USB_VENDOR_ID_UGTIZER, + USB_DEVICE_ID_UGTIZER_TABLET_GP0610): ++ case VID_PID(USB_VENDOR_ID_UGTIZER, ++ USB_DEVICE_ID_UGTIZER_TABLET_GT5040): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_G540): + case VID_PID(USB_VENDOR_ID_UGEE, +-- +2.27.0 + diff --git a/queue-5.4/i40e-fix-removing-driver-while-bare-metal-vfs-pass-t.patch b/queue-5.4/i40e-fix-removing-driver-while-bare-metal-vfs-pass-t.patch new file mode 100644 index 00000000000..963d79b764f --- /dev/null +++ b/queue-5.4/i40e-fix-removing-driver-while-bare-metal-vfs-pass-t.patch @@ -0,0 +1,162 @@ +From 474f4024d4b30361ee3cf0c72e7db2dd82ba7dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 10:06:40 -0800 +Subject: i40e: Fix removing driver while bare-metal VFs pass traffic + +From: Sylwester Dziedziuch + +[ Upstream commit 2980cbd4dce7b1e9bf57df3ced43a7b184986f50 ] + +Prevent VFs from resetting when PF driver is being unloaded: +- introduce new pf state: __I40E_VF_RESETS_DISABLED; +- check if pf state has __I40E_VF_RESETS_DISABLED state set, + if so, disable any further VFLR event notifications; +- when i40e_remove (rmmod i40e) is called, disable any resets on + the VFs; + +Previously if there were bare-metal VFs passing traffic and PF +driver was removed, there was a possibility of VFs triggering a Tx +timeout right before iavf_remove. This was causing iavf_close to +not be called because there is a check in the beginning of iavf_remove +that bails out early if adapter->state < IAVF_DOWN_PENDING. This +makes it so some resources do not get cleaned up. + +Fixes: 6a9ddb36eeb8 ("i40e: disable IOV before freeing resources") +Signed-off-by: Slawomir Laba +Signed-off-by: Brett Creeley +Signed-off-by: Sylwester Dziedziuch +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20201120180640.3654474-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 22 +++++++++++----- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 +++++++++++-------- + 3 files changed, 31 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 401304d4d5536..cfe99bae8e362 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -150,6 +150,7 @@ enum i40e_state_t { + __I40E_CLIENT_RESET, + __I40E_VIRTCHNL_OP_PENDING, + __I40E_RECOVERY_MODE, ++ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ + /* This must be last as it determines the size of the BITMAP */ + __I40E_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index b3c3911adfc2e..2b4327416457d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3988,8 +3988,16 @@ static irqreturn_t i40e_intr(int irq, void *data) + } + + if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) { +- ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; +- set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ /* disable any further VFLR event notifications */ ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) { ++ u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA); ++ ++ reg &= ~I40E_PFINT_ICR0_VFLR_MASK; ++ wr32(hw, I40E_PFINT_ICR0_ENA, reg); ++ } else { ++ ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK; ++ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state); ++ } + } + + if (icr0 & I40E_PFINT_ICR0_GRST_MASK) { +@@ -15345,6 +15353,11 @@ static void i40e_remove(struct pci_dev *pdev) + while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) + usleep_range(1000, 2000); + ++ if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { ++ set_bit(__I40E_VF_RESETS_DISABLED, pf->state); ++ i40e_free_vfs(pf); ++ pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; ++ } + /* no more scheduling of any task */ + set_bit(__I40E_SUSPENDED, pf->state); + set_bit(__I40E_DOWN, pf->state); +@@ -15371,11 +15384,6 @@ static void i40e_remove(struct pci_dev *pdev) + */ + i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false); + +- if (pf->flags & I40E_FLAG_SRIOV_ENABLED) { +- i40e_free_vfs(pf); +- pf->flags &= ~I40E_FLAG_SRIOV_ENABLED; +- } +- + i40e_fdir_teardown(pf); + + /* If there is a switch structure or any orphans, remove them. +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 38042d610f82c..09ff3f335ffa6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1335,7 +1335,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf) + * @vf: pointer to the VF structure + * @flr: VFLR was issued or not + * +- * Returns true if the VF is reset, false otherwise. ++ * Returns true if the VF is in reset, resets successfully, or resets ++ * are disabled and false otherwise. + **/ + bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + { +@@ -1345,11 +1346,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr) + u32 reg; + int i; + ++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) ++ return true; ++ + /* If the VFs have been disabled, this means something else is + * resetting the VF, so we shouldn't continue. + */ + if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) +- return false; ++ return true; + + i40e_trigger_vf_reset(vf, flr); + +@@ -1513,6 +1517,15 @@ void i40e_free_vfs(struct i40e_pf *pf) + + i40e_notify_client_of_vf_enable(pf, 0); + ++ /* Disable IOV before freeing resources. This lets any VF drivers ++ * running in the host get themselves cleaned up before we yank ++ * the carpet out from underneath their feet. ++ */ ++ if (!pci_vfs_assigned(pf->pdev)) ++ pci_disable_sriov(pf->pdev); ++ else ++ dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); ++ + /* Amortize wait time by stopping all VFs at the same time */ + for (i = 0; i < pf->num_alloc_vfs; i++) { + if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states)) +@@ -1528,15 +1541,6 @@ void i40e_free_vfs(struct i40e_pf *pf) + i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]); + } + +- /* Disable IOV before freeing resources. This lets any VF drivers +- * running in the host get themselves cleaned up before we yank +- * the carpet out from underneath their feet. +- */ +- if (!pci_vfs_assigned(pf->pdev)) +- pci_disable_sriov(pf->pdev); +- else +- dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n"); +- + /* free up VF resources */ + tmp = pf->num_alloc_vfs; + pf->num_alloc_vfs = 0; +-- +2.27.0 + diff --git a/queue-5.4/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch b/queue-5.4/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch new file mode 100644 index 00000000000..ece3e29a75d --- /dev/null +++ b/queue-5.4/ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch @@ -0,0 +1,56 @@ +From 7a6b013e4cd0e2c83136ae71a466a41435c1d878 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 09:57:02 +0800 +Subject: IB/mthca: fix return value of error branch in mthca_init_cq() + +From: Xiongfeng Wang + +[ Upstream commit 6830ff853a5764c75e56750d59d0bbb6b26f1835 ] + +We return 'err' in the error branch, but this variable may be set as zero +by the above code. Fix it by setting 'err' as a negative value before we +goto the error label. + +Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Xiongfeng Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index c3cfea243af8c..119b2573c9a08 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -803,8 +803,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); +- if (IS_ERR(mailbox)) ++ if (IS_ERR(mailbox)) { ++ err = PTR_ERR(mailbox); + goto err_out_arm; ++ } + + cq_context = mailbox->buf; + +@@ -846,9 +848,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + spin_lock_irq(&dev->cq_table.lock); +- if (mthca_array_set(&dev->cq_table.cq, +- cq->cqn & (dev->limits.num_cqs - 1), +- cq)) { ++ err = mthca_array_set(&dev->cq_table.cq, ++ cq->cqn & (dev->limits.num_cqs - 1), cq); ++ if (err) { + spin_unlock_irq(&dev->cq_table.lock); + goto err_out_free_mr; + } +-- +2.27.0 + diff --git a/queue-5.4/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch b/queue-5.4/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch new file mode 100644 index 00000000000..76846452e40 --- /dev/null +++ b/queue-5.4/ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch @@ -0,0 +1,42 @@ +From 61387e13bef8702c3f92fe21e7efc076cc8c254c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 16:40:11 -0600 +Subject: ibmvnic: fix call_netdevice_notifiers in do_reset + +From: Lijun Pan + +[ Upstream commit 8393597579f5250636f1cff157ea73f402b6501e ] + +When netdev_notify_peers was substituted in +commit 986103e7920c ("net/ibmvnic: Fix RTNL deadlock during device reset"), +call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev) was missed. +Fix it now. + +Fixes: 986103e7920c ("net/ibmvnic: Fix RTNL deadlock during device reset") +Signed-off-by: Lijun Pan +Reviewed-by: Dany Madden +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index f357b9cbfee72..8d9e95c2725fb 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1994,8 +1994,10 @@ static int do_reset(struct ibmvnic_adapter *adapter, + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); + +- if (adapter->reset_reason != VNIC_RESET_FAILOVER) ++ if (adapter->reset_reason != VNIC_RESET_FAILOVER) { + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ } + + rc = 0; + +-- +2.27.0 + diff --git a/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch b/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch new file mode 100644 index 00000000000..0e2ba3019ec --- /dev/null +++ b/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch @@ -0,0 +1,71 @@ +From ae82445cd0f96b1a61c01cef05ef00e3e0e50f3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 13:35:46 -0600 +Subject: ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq + +From: Lijun Pan + +[ Upstream commit 0e435befaea45f7ea58682eecab5e37e05b2ce65 ] + +crq->msgs could be NULL if the previous reset did not complete after +freeing crq->msgs. Check for NULL before dereferencing them. + +Snippet of call trace: +... +ibmvnic 30000003 env3 (unregistering): Releasing sub-CRQ +ibmvnic 30000003 env3 (unregistering): Releasing CRQ +BUG: Kernel NULL pointer dereference on read at 0x00000000 +Faulting instruction address: 0xc0000000000c1a30 +Oops: Kernel access of bad area, sig: 11 [#1] +LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries +Modules linked in: ibmvnic(E-) rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag tun raw_diag inet_diag unix_diag bridge af_packet_diag netlink_diag stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ibmvnic] +CPU: 20 PID: 8426 Comm: kworker/20:0 Tainted: G E 5.10.0-rc1+ #12 +Workqueue: events __ibmvnic_reset [ibmvnic] +NIP: c0000000000c1a30 LR: c008000001b00c18 CTR: 0000000000000400 +REGS: c00000000d05b7a0 TRAP: 0380 Tainted: G E (5.10.0-rc1+) +MSR: 800000000280b033 CR: 44002480 XER: 20040000 +CFAR: c0000000000c19ec IRQMASK: 0 +GPR00: 0000000000000400 c00000000d05ba30 c008000001b17c00 0000000000000000 +GPR04: 0000000000000000 0000000000000000 0000000000000000 00000000000001e2 +GPR08: 000000000001f400 ffffffffffffd950 0000000000000000 c008000001b0b280 +GPR12: c0000000000c19c8 c00000001ec72e00 c00000000019a778 c00000002647b440 +GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +GPR20: 0000000000000006 0000000000000001 0000000000000003 0000000000000002 +GPR24: 0000000000001000 c008000001b0d570 0000000000000005 c00000007ab5d550 +GPR28: c00000007ab5c000 c000000032fcf848 c00000007ab5cc00 c000000032fcf800 +NIP [c0000000000c1a30] memset+0x68/0x104 +LR [c008000001b00c18] ibmvnic_reset_crq+0x70/0x110 [ibmvnic] +Call Trace: +[c00000000d05ba30] [0000000000000800] 0x800 (unreliable) +[c00000000d05bab0] [c008000001b0a930] do_reset.isra.40+0x224/0x634 [ibmvnic] +[c00000000d05bb80] [c008000001b08574] __ibmvnic_reset+0x17c/0x3c0 [ibmvnic] +[c00000000d05bc50] [c00000000018d9ac] process_one_work+0x2cc/0x800 +[c00000000d05bd20] [c00000000018df58] worker_thread+0x78/0x520 +[c00000000d05bdb0] [c00000000019a934] kthread+0x1c4/0x1d0 +[c00000000d05be20] [c00000000000d5d0] ret_from_kernel_thread+0x5c/0x6c + +Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 238915410d79a..e53994ca3142c 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4777,6 +4777,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter) + } while (rc == H_BUSY || H_IS_LONG_BUSY(rc)); + + /* Clean out the queue */ ++ if (!crq->msgs) ++ return -EINVAL; ++ + memset(crq->msgs, 0, PAGE_SIZE); + crq->cur = 0; + crq->active = false; +-- +2.27.0 + diff --git a/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-reset_sub_cr.patch b/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-reset_sub_cr.patch new file mode 100644 index 00000000000..b48c6613b93 --- /dev/null +++ b/queue-5.4/ibmvnic-fix-null-pointer-dereference-in-reset_sub_cr.patch @@ -0,0 +1,73 @@ +From 5e44f501dfadf4c854ec68b8934cb939a18cff18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 13:35:45 -0600 +Subject: ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues + +From: Lijun Pan + +[ Upstream commit a0faaa27c71608799e0dd765c5af38a089091802 ] + +adapter->tx_scrq and adapter->rx_scrq could be NULL if the previous reset +did not complete after freeing sub crqs. Check for NULL before +dereferencing them. + +Snippet of call trace: +ibmvnic 30000006 env6: Releasing sub-CRQ +ibmvnic 30000006 env6: Releasing CRQ +... +ibmvnic 30000006 env6: Got Control IP offload Response +ibmvnic 30000006 env6: Re-setting tx_scrq[0] +BUG: Kernel NULL pointer dereference on read at 0x00000000 +Faulting instruction address: 0xc008000003dea7cc +Oops: Kernel access of bad area, sig: 11 [#1] +LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries +Modules linked in: rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag tun bridge stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmvnic ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod +CPU: 80 PID: 1856 Comm: kworker/80:2 Tainted: G W 5.8.0+ #4 +Workqueue: events __ibmvnic_reset [ibmvnic] +NIP: c008000003dea7cc LR: c008000003dea7bc CTR: 0000000000000000 +REGS: c0000007ef7db860 TRAP: 0380 Tainted: G W (5.8.0+) +MSR: 800000000280b033 CR: 28002422 XER: 0000000d +CFAR: c000000000bd9520 IRQMASK: 0 +GPR00: c008000003dea7bc c0000007ef7dbaf0 c008000003df7400 c0000007fa26ec00 +GPR04: c0000007fcd0d008 c0000007fcd96350 0000000000000027 c0000007fcd0d010 +GPR08: 0000000000000023 0000000000000000 0000000000000000 0000000000000000 +GPR12: 0000000000002000 c00000001ec18e00 c0000000001982f8 c0000007bad6e840 +GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +GPR20: 0000000000000000 0000000000000000 0000000000000000 fffffffffffffef7 +GPR24: 0000000000000402 c0000007fa26f3a8 0000000000000003 c00000016f8ec048 +GPR28: 0000000000000000 0000000000000000 0000000000000000 c0000007fa26ec00 +NIP [c008000003dea7cc] ibmvnic_reset_init+0x15c/0x258 [ibmvnic] +LR [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic] +Call Trace: +[c0000007ef7dbaf0] [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic] (unreliable) +[c0000007ef7dbb80] [c008000003de8860] __ibmvnic_reset+0x408/0x970 [ibmvnic] +[c0000007ef7dbc50] [c00000000018b7cc] process_one_work+0x2cc/0x800 +[c0000007ef7dbd20] [c00000000018bd78] worker_thread+0x78/0x520 +[c0000007ef7dbdb0] [c0000000001984c4] kthread+0x1d4/0x1e0 +[c0000007ef7dbe20] [c00000000000cea8] ret_from_kernel_thread+0x5c/0x74 + +Fixes: 57a49436f4e8 ("ibmvnic: Reset sub-crqs during driver reset") +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 717f793455056..238915410d79a 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2767,6 +2767,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter) + { + int i, rc; + ++ if (!adapter->tx_scrq || !adapter->rx_scrq) ++ return -EINVAL; ++ + for (i = 0; i < adapter->req_tx_queues; i++) { + netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i); + rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]); +-- +2.27.0 + diff --git a/queue-5.4/ibmvnic-notify-peers-when-failover-and-migration-hap.patch b/queue-5.4/ibmvnic-notify-peers-when-failover-and-migration-hap.patch new file mode 100644 index 00000000000..142adc2dd9d --- /dev/null +++ b/queue-5.4/ibmvnic-notify-peers-when-failover-and-migration-hap.patch @@ -0,0 +1,61 @@ +From 0f3dc2fed737d90a8adedfe166dd70d612121e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 16:40:12 -0600 +Subject: ibmvnic: notify peers when failover and migration happen + +From: Lijun Pan + +[ Upstream commit 98025bce3a6200a0c4637272a33b5913928ba5b8 ] + +Commit 61d3e1d9bc2a ("ibmvnic: Remove netdev notify for failover resets") +excluded the failover case for notify call because it said +netdev_notify_peers() can cause network traffic to stall or halt. +Current testing does not show network traffic stall +or halt because of the notify call for failover event. +netdev_notify_peers may be used when a device wants to inform the +rest of the network about some sort of a reconfiguration +such as failover or migration. + +It is unnecessary to call that in other events like +FATAL, NON_FATAL, CHANGE_PARAM, and TIMEOUT resets +since in those scenarios the hardware does not change. +If the driver must do a hard reset, it is necessary to notify peers. + +Fixes: 61d3e1d9bc2a ("ibmvnic: Remove netdev notify for failover resets") +Suggested-by: Brian King +Suggested-by: Pradeep Satyanarayana +Signed-off-by: Dany Madden +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 8d9e95c2725fb..717f793455056 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1994,7 +1994,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); + +- if (adapter->reset_reason != VNIC_RESET_FAILOVER) { ++ if (adapter->reset_reason == VNIC_RESET_FAILOVER || ++ adapter->reset_reason == VNIC_RESET_MOBILITY) { + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); + call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); + } +@@ -2067,6 +2068,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter, + if (rc) + return IBMVNIC_OPEN_FAILED; + ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.4/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch b/queue-5.4/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch new file mode 100644 index 00000000000..0623545be54 --- /dev/null +++ b/queue-5.4/input-i8042-allow-insmod-to-succeed-on-devices-witho.patch @@ -0,0 +1,98 @@ +From 5949b7e92284607ccf443ba77ffc80c0f251002f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 20:53:57 -0700 +Subject: Input: i8042 - allow insmod to succeed on devices without an i8042 + controller + +From: Hans de Goede + +[ Upstream commit b1884583fcd17d6a1b1bba94bbb5826e6b5c6e17 ] + +The i8042 module exports several symbols which may be used by other +modules. + +Before this commit it would refuse to load (when built as a module itself) +on systems without an i8042 controller. + +This is a problem specifically for the asus-nb-wmi module. Many Asus +laptops support the Asus WMI interface. Some of them have an i8042 +controller and need to use i8042_install_filter() to filter some kbd +events. Other models do not have an i8042 controller (e.g. they use an +USB attached kbd). + +Before this commit the asus-nb-wmi driver could not be loaded on Asus +models without an i8042 controller, when the i8042 code was built as +a module (as Arch Linux does) because the module_init function of the +i8042 module would fail with -ENODEV and thus the i8042_install_filter +symbol could not be loaded. + +This commit fixes this by exiting from module_init with a return code +of 0 if no controller is found. It also adds a i8042_present bool to +make the module_exit function a no-op in this case and also adds a +check for i8042_present to the exported i8042_command function. + +The latter i8042_present check should not really be necessary because +when builtin that function can already be used on systems without +an i8042 controller, but better safe then sorry. + +Reported-and-tested-by: Marius Iacob +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20201008112628.3979-2-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 20ff2bed3917a..5a89c1cfdaa97 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -121,6 +121,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600); + MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]"); + #endif + ++static bool i8042_present; + static bool i8042_bypass_aux_irq_test; + static char i8042_kbd_firmware_id[128]; + static char i8042_aux_firmware_id[128]; +@@ -341,6 +342,9 @@ int i8042_command(unsigned char *param, int command) + unsigned long flags; + int retval; + ++ if (!i8042_present) ++ return -1; ++ + spin_lock_irqsave(&i8042_lock, flags); + retval = __i8042_command(param, command); + spin_unlock_irqrestore(&i8042_lock, flags); +@@ -1609,12 +1613,15 @@ static int __init i8042_init(void) + + err = i8042_platform_init(); + if (err) +- return err; ++ return (err == -ENODEV) ? 0 : err; + + err = i8042_controller_check(); + if (err) + goto err_platform_exit; + ++ /* Set this before creating the dev to allow i8042_command to work right away */ ++ i8042_present = true; ++ + pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); +@@ -1633,6 +1640,9 @@ static int __init i8042_init(void) + + static void __exit i8042_exit(void) + { ++ if (!i8042_present) ++ return; ++ + platform_device_unregister(i8042_platform_device); + platform_driver_unregister(&i8042_driver); + i8042_platform_exit(); +-- +2.27.0 + diff --git a/queue-5.4/iwlwifi-mvm-write-queue_sync_state-only-for-sync.patch b/queue-5.4/iwlwifi-mvm-write-queue_sync_state-only-for-sync.patch new file mode 100644 index 00000000000..40a9b717ecc --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-write-queue_sync_state-only-for-sync.patch @@ -0,0 +1,42 @@ +From e7a3c4bf66bc149737f32b1a75d7bdf52436d0fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 10:50:09 +0200 +Subject: iwlwifi: mvm: write queue_sync_state only for sync + +From: Avraham Stern + +[ Upstream commit 97cc16943f23078535fdbce4f6391b948b4ccc08 ] + +We use mvm->queue_sync_state to wait for synchronous queue sync +messages, but if an async one happens inbetween we shouldn't +clear mvm->queue_sync_state after sending the async one, that +can run concurrently (at least from the CPU POV) with another +synchronous queue sync. + +Signed-off-by: Johannes Berg +Fixes: 3c514bf831ac ("iwlwifi: mvm: add a loose synchronization of the NSSN across Rx queues") +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201107104557.51a3148f2c14.I0772171dbaec87433a11513e9586d98b5d920b5f@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 01b26b3327b01..73b8bf0fbf16f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -3069,6 +3069,9 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw, + goto out_unlock; + } + ++ if (vif->type == NL80211_IFTYPE_STATION) ++ vif->bss_conf.he_support = sta->he_cap.has_he; ++ + if (sta->tdls && + (vif->p2p || + iwl_mvm_tdls_sta_count(mvm, NULL) == +-- +2.27.0 + diff --git a/queue-5.4/net-dsa-mv88e6xxx-wait-for-eeprom-done-after-hw-rese.patch b/queue-5.4/net-dsa-mv88e6xxx-wait-for-eeprom-done-after-hw-rese.patch new file mode 100644 index 00000000000..01222810ad8 --- /dev/null +++ b/queue-5.4/net-dsa-mv88e6xxx-wait-for-eeprom-done-after-hw-rese.patch @@ -0,0 +1,97 @@ +From bc5f95f7bbd0075edc4c83831be892d4b9ebe658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 08:43:01 -0800 +Subject: net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset + +From: Andrew Lunn + +[ Upstream commit a3dcb3e7e70c72a68a79b30fc3a3adad5612731c ] + +When the switch is hardware reset, it reads the contents of the +EEPROM. This can contain instructions for programming values into +registers and to perform waits between such programming. Reading the +EEPROM can take longer than the 100ms mv88e6xxx_hardware_reset() waits +after deasserting the reset GPIO. So poll the EEPROM done bit to +ensure it is complete. + +Signed-off-by: Andrew Lunn +Signed-off-by: Ruslan Sushko +Link: https://lore.kernel.org/r/20201116164301.977661-1-rus@sushko.dev +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 2 ++ + drivers/net/dsa/mv88e6xxx/global1.c | 31 +++++++++++++++++++++++++++++ + drivers/net/dsa/mv88e6xxx/global1.h | 1 + + 3 files changed, 34 insertions(+) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 92e4d140df6fa..469b155df4885 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2143,6 +2143,8 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip) + usleep_range(10000, 20000); + gpiod_set_value_cansleep(gpiod, 0); + usleep_range(10000, 20000); ++ ++ mv88e6xxx_g1_wait_eeprom_done(chip); + } + } + +diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c +index 8a903624fdd7c..938dd146629f1 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.c ++++ b/drivers/net/dsa/mv88e6xxx/global1.c +@@ -75,6 +75,37 @@ static int mv88e6xxx_g1_wait_init_ready(struct mv88e6xxx_chip *chip) + return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1); + } + ++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip) ++{ ++ const unsigned long timeout = jiffies + 1 * HZ; ++ u16 val; ++ int err; ++ ++ /* Wait up to 1 second for the switch to finish reading the ++ * EEPROM. ++ */ ++ while (time_before(jiffies, timeout)) { ++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val); ++ if (err) { ++ dev_err(chip->dev, "Error reading status"); ++ return; ++ } ++ ++ /* If the switch is still resetting, it may not ++ * respond on the bus, and so MDIO read returns ++ * 0xffff. Differentiate between that, and waiting for ++ * the EEPROM to be done by bit 0 being set. ++ */ ++ if (val != 0xffff && ++ val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE)) ++ return; ++ ++ usleep_range(1000, 2000); ++ } ++ ++ dev_err(chip->dev, "Timeout waiting for EEPROM done"); ++} ++ + /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1 + * Offset 0x02: Switch MAC Address Register Bytes 2 & 3 + * Offset 0x03: Switch MAC Address Register Bytes 4 & 5 +diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h +index 0ae96a1e919b6..08d66ef6aace6 100644 +--- a/drivers/net/dsa/mv88e6xxx/global1.h ++++ b/drivers/net/dsa/mv88e6xxx/global1.h +@@ -277,6 +277,7 @@ int mv88e6xxx_g1_set_switch_mac(struct mv88e6xxx_chip *chip, u8 *addr); + int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip); + int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip); ++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip); + + int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip); + int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip); +-- +2.27.0 + diff --git a/queue-5.4/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch b/queue-5.4/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch new file mode 100644 index 00000000000..f161e4e8763 --- /dev/null +++ b/queue-5.4/net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch @@ -0,0 +1,78 @@ +From a7003530e5bc6b2fe37b7d1723bed2e5eeb37dfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 21:08:58 +0200 +Subject: net: ena: set initial DMA width to avoid intel iommu issue + +From: Shay Agroskin + +[ Upstream commit 09323b3bca95181c0da79daebc8b0603e500f573 ] + +The ENA driver uses the readless mechanism, which uses DMA, to find +out what the DMA mask is supposed to be. + +If DMA is used without setting the dma_mask first, it causes the +Intel IOMMU driver to think that ENA is a 32-bit device and therefore +disables IOMMU passthrough permanently. + +This patch sets the dma_mask to be ENA_MAX_PHYS_ADDR_SIZE_BITS=48 +before readless initialization in +ena_device_init()->ena_com_mmio_reg_read_request_init(), +which is large enough to workaround the intel_iommu issue. + +DMA mask is set again to the correct value after it's received from the +device after readless is initialized. + +The patch also changes the driver to use dma_set_mask_and_coherent() +function instead of the two pci_set_dma_mask() and +pci_set_consistent_dma_mask() ones. Both methods achieve the same +effect. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Mike Cui +Signed-off-by: Arthur Kiyanovski +Signed-off-by: Shay Agroskin +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 635345bced313..2e5348ec2a2e9 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2622,16 +2622,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev, + goto err_mmio_read_less; + } + +- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width)); ++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width)); + if (rc) { +- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc); +- goto err_mmio_read_less; +- } +- +- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width)); +- if (rc) { +- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n", +- rc); ++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc); + goto err_mmio_read_less; + } + +@@ -3450,6 +3443,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + ++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS)); ++ if (rc) { ++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc); ++ goto err_disable_device; ++ } ++ + pci_set_master(pdev); + + ena_dev = vzalloc(sizeof(*ena_dev)); +-- +2.27.0 + diff --git a/queue-5.4/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch b/queue-5.4/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch new file mode 100644 index 00000000000..51f26502ccd --- /dev/null +++ b/queue-5.4/nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch @@ -0,0 +1,41 @@ +From 98523bfa62f249a0525bb98a9de7b3f0a0cdfb6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 17:23:51 +0100 +Subject: nfc: s3fwrn5: use signed integer for parsing GPIO numbers + +From: Krzysztof Kozlowski + +[ Upstream commit d8f0a86795c69f5b697f7d9e5274c124da93c92d ] + +GPIOs - as returned by of_get_named_gpio() and used by the gpiolib - are +signed integers, where negative number indicates error. The return +value of of_get_named_gpio() should not be assigned to an unsigned int +because in case of !CONFIG_GPIOLIB such number would be a valid GPIO. + +Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201123162351.209100-1-krzk@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/s3fwrn5/i2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c +index e4f7fa00862de..2505abc8ef281 100644 +--- a/drivers/nfc/s3fwrn5/i2c.c ++++ b/drivers/nfc/s3fwrn5/i2c.c +@@ -26,8 +26,8 @@ struct s3fwrn5_i2c_phy { + struct i2c_client *i2c_dev; + struct nci_dev *ndev; + +- unsigned int gpio_en; +- unsigned int gpio_fw_wake; ++ int gpio_en; ++ int gpio_fw_wake; + + struct mutex mutex; + +-- +2.27.0 + diff --git a/queue-5.4/nvme-free-sq-cq-dbbuf-pointers-when-dbbuf-set-fails.patch b/queue-5.4/nvme-free-sq-cq-dbbuf-pointers-when-dbbuf-set-fails.patch new file mode 100644 index 00000000000..19ce3e284d4 --- /dev/null +++ b/queue-5.4/nvme-free-sq-cq-dbbuf-pointers-when-dbbuf-set-fails.patch @@ -0,0 +1,63 @@ +From a57093a9e051324d82c12e8be0fb1100c5e32dac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 23:28:47 +0900 +Subject: nvme: free sq/cq dbbuf pointers when dbbuf set fails + +From: Minwoo Im + +[ Upstream commit 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf ] + +If Doorbell Buffer Config command fails even 'dev->dbbuf_dbs != NULL' +which means OACS indicates that NVME_CTRL_OACS_DBBUF_SUPP is set, +nvme_dbbuf_update_and_check_event() will check event even it's not been +successfully set. + +This patch fixes mismatch among dbbuf for sq/cqs in case that dbbuf +command fails. + +Signed-off-by: Minwoo Im +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index f5d12bf109c78..9b1fc8633cfe1 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -271,9 +271,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev, + nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)]; + } + ++static void nvme_dbbuf_free(struct nvme_queue *nvmeq) ++{ ++ if (!nvmeq->qid) ++ return; ++ ++ nvmeq->dbbuf_sq_db = NULL; ++ nvmeq->dbbuf_cq_db = NULL; ++ nvmeq->dbbuf_sq_ei = NULL; ++ nvmeq->dbbuf_cq_ei = NULL; ++} ++ + static void nvme_dbbuf_set(struct nvme_dev *dev) + { + struct nvme_command c; ++ unsigned int i; + + if (!dev->dbbuf_dbs) + return; +@@ -287,6 +299,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev) + dev_warn(dev->ctrl.device, "unable to set dbbuf\n"); + /* Free memory and continue on */ + nvme_dbbuf_dma_free(dev); ++ ++ for (i = 1; i <= dev->online_queues; i++) ++ nvme_dbbuf_free(&dev->queues[i]); + } + } + +-- +2.27.0 + diff --git a/queue-5.4/optee-add-writeback-to-valid-memory-type.patch b/queue-5.4/optee-add-writeback-to-valid-memory-type.patch new file mode 100644 index 00000000000..3ec981e7fba --- /dev/null +++ b/queue-5.4/optee-add-writeback-to-valid-memory-type.patch @@ -0,0 +1,41 @@ +From b2b3685c9638015e14230842b3cba6e46fa3b048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 15:06:04 +0000 +Subject: optee: add writeback to valid memory type + +From: Rui Miguel Silva + +[ Upstream commit 853735e404244f5496cdb6188c5ed9a0f9627ee6 ] + +Only in smp systems the cache policy is setup as write alloc, in +single cpu systems the cache policy is set as writeback and it is +normal memory, so, it should pass the is_normal_memory check in the +share memory registration. + +Add the right condition to make it work in no smp systems. + +Fixes: cdbcf83d29c1 ("tee: optee: check type of registered shared memory") +Signed-off-by: Rui Miguel Silva +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/call.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c +index cf2367ba08d63..aadedec3bfe7b 100644 +--- a/drivers/tee/optee/call.c ++++ b/drivers/tee/optee/call.c +@@ -530,7 +530,8 @@ void optee_free_pages_list(void *list, size_t num_entries) + static bool is_normal_memory(pgprot_t p) + { + #if defined(CONFIG_ARM) +- return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC; ++ return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) || ++ ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK)); + #elif defined(CONFIG_ARM64) + return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL); + #else +-- +2.27.0 + diff --git a/queue-5.4/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch b/queue-5.4/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch new file mode 100644 index 00000000000..8a5cd9cbe8f --- /dev/null +++ b/queue-5.4/perf-probe-fix-to-die_entrypc-returns-error-correctl.patch @@ -0,0 +1,53 @@ +From 3b41aaa83c66e6cfbfa24b67f3d4f3093fa00b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 14:48:46 +0900 +Subject: perf probe: Fix to die_entrypc() returns error correctly + +From: Masami Hiramatsu + +[ Upstream commit ab4200c17ba6fe71d2da64317aae8a8aa684624c ] + +Fix die_entrypc() to return error correctly if the DIE has no +DW_AT_ranges attribute. Since dwarf_ranges() will treat the case as an +empty ranges and return 0, we have to check it by ourselves. + +Fixes: 91e2f539eeda ("perf probe: Fix to show function entry line as probe-able") +Signed-off-by: Masami Hiramatsu +Cc: Sumanth Korikkar +Cc: Thomas Richter +Link: http://lore.kernel.org/lkml/160645612634.2824037.5284932731175079426.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 5544bfbd0f6c0..ab34ef2c661f8 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -319,6 +319,7 @@ bool die_is_func_def(Dwarf_Die *dw_die) + int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + { + Dwarf_Addr base, end; ++ Dwarf_Attribute attr; + + if (!addr) + return -EINVAL; +@@ -326,6 +327,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + if (dwarf_entrypc(dw_die, addr) == 0) + return 0; + ++ /* ++ * Since the dwarf_ranges() will return 0 if there is no ++ * DW_AT_ranges attribute, we should check it first. ++ */ ++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr)) ++ return -ENOENT; ++ + return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; + } + +-- +2.27.0 + diff --git a/queue-5.4/perf-stat-use-proper-cpu-for-shadow-stats.patch b/queue-5.4/perf-stat-use-proper-cpu-for-shadow-stats.patch new file mode 100644 index 00000000000..738f62c182f --- /dev/null +++ b/queue-5.4/perf-stat-use-proper-cpu-for-shadow-stats.patch @@ -0,0 +1,89 @@ +From cc03fa6b32dfc6f736aee9ba8cd4054cf083d9fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 13:14:03 +0900 +Subject: perf stat: Use proper cpu for shadow stats + +From: Namhyung Kim + +[ Upstream commit c0ee1d5ae8c8650031badcfca6483a28c0f94f38 ] + +Currently perf stat shows some metrics (like IPC) for defined events. +But when no aggregation mode is used (-A option), it shows incorrect +values since it used a value from a different cpu. + +Before: + + $ perf stat -aA -e cycles,instructions sleep 1 + + Performance counter stats for 'system wide': + + CPU0 116,057,380 cycles + CPU1 86,084,722 cycles + CPU2 99,423,125 cycles + CPU3 98,272,994 cycles + CPU0 53,369,217 instructions # 0.46 insn per cycle + CPU1 33,378,058 instructions # 0.29 insn per cycle + CPU2 58,150,086 instructions # 0.50 insn per cycle + CPU3 40,029,703 instructions # 0.34 insn per cycle + + 1.001816971 seconds time elapsed + +So the IPC for CPU1 should be 0.38 (= 33,378,058 / 86,084,722) +but it was 0.29 (= 33,378,058 / 116,057,380) and so on. + +After: + + $ perf stat -aA -e cycles,instructions sleep 1 + + Performance counter stats for 'system wide': + + CPU0 109,621,384 cycles + CPU1 159,026,454 cycles + CPU2 99,460,366 cycles + CPU3 124,144,142 cycles + CPU0 44,396,706 instructions # 0.41 insn per cycle + CPU1 120,195,425 instructions # 0.76 insn per cycle + CPU2 44,763,978 instructions # 0.45 insn per cycle + CPU3 69,049,079 instructions # 0.56 insn per cycle + + 1.001910444 seconds time elapsed + +Fixes: 44d49a600259 ("perf stat: Support metrics in --per-core/socket mode") +Reported-by: Sam Xi +Signed-off-by: Namhyung Kim +Reviewed-by: Andi Kleen +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20201127041404.390276-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-display.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 373e399e57d28..93147cc40162f 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -316,13 +316,10 @@ static int first_shadow_cpu(struct perf_stat_config *config, + struct evlist *evlist = evsel->evlist; + int i; + +- if (!config->aggr_get_id) +- return 0; +- + if (config->aggr_mode == AGGR_NONE) + return id; + +- if (config->aggr_mode == AGGR_GLOBAL) ++ if (!config->aggr_get_id) + return 0; + + for (i = 0; i < perf_evsel__nr_cpus(evsel); i++) { +-- +2.27.0 + diff --git a/queue-5.4/perf-x86-fix-sysfs-type-mismatches.patch b/queue-5.4/perf-x86-fix-sysfs-type-mismatches.patch new file mode 100644 index 00000000000..67e42387049 --- /dev/null +++ b/queue-5.4/perf-x86-fix-sysfs-type-mismatches.patch @@ -0,0 +1,141 @@ +From 69b099b6cdac80cbb5ae105c27c8e86c2cd3624d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 10:31:26 -0800 +Subject: perf/x86: fix sysfs type mismatches + +From: Sami Tolvanen + +[ Upstream commit ebd19fc372e3e78bf165f230e7c084e304441c08 ] + +This change switches rapl to use PMU_FORMAT_ATTR, and fixes two other +macros to use device_attribute instead of kobj_attribute to avoid +callback type mismatches that trip indirect call checking with Clang's +Control-Flow Integrity (CFI). + +Reported-by: Sedat Dilek +Signed-off-by: Sami Tolvanen +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kees Cook +Link: https://lkml.kernel.org/r/20201113183126.1239404-1-samitolvanen@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 6 +++--- + arch/x86/events/intel/uncore.c | 4 ++-- + arch/x86/events/intel/uncore.h | 12 ++++++------ + arch/x86/events/rapl.c | 14 +------------- + 4 files changed, 12 insertions(+), 24 deletions(-) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 4814c964692cb..0b50119ea12cc 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -107,14 +107,14 @@ + MODULE_LICENSE("GPL"); + + #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __cstate_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __cstate_##_var##_show, NULL) + + static ssize_t cstate_get_attr_cpumask(struct device *dev, +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 86467f85c3831..a335be03aeef1 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -92,8 +92,8 @@ end: + return map; + } + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct uncore_event_desc *event = + container_of(attr, struct uncore_event_desc, attr); +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index bbfdaa720b456..7b964c63e993c 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -144,7 +144,7 @@ struct intel_uncore_box { + #define UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS 2 + + struct uncore_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *config; + }; + +@@ -165,8 +165,8 @@ struct pci2phy_map { + struct pci2phy_map *__find_pci2phy_map(int segment); + int uncore_pcibus_to_physid(struct pci_bus *bus); + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf); ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf); + + #define INTEL_UNCORE_EVENT_DESC(_name, _config) \ + { \ +@@ -175,14 +175,14 @@ ssize_t uncore_event_show(struct kobject *kobj, + } + + #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __uncore_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __uncore_##_var##_show, NULL) + + static inline bool uncore_pmc_fixed(int idx) +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index 187c72a58e69c..9050d7b8abc5a 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -93,18 +93,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = { + * any other bit is reserved + */ + #define RAPL_EVENT_MASK 0xFFULL +- +-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ +- char *page) \ +-{ \ +- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ +- return sprintf(page, _format "\n"); \ +-} \ +-static struct kobj_attribute format_attr_##_var = \ +- __ATTR(_name, 0444, __rapl_##_var##_show, NULL) +- + #define RAPL_CNTR_WIDTH 32 + + #define RAPL_EVENT_ATTR_STR(_name, v, str) \ +@@ -433,7 +421,7 @@ static struct attribute_group rapl_pmu_events_group = { + .attrs = attrs_empty, + }; + +-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7"); ++PMU_FORMAT_ATTR(event, "config:0-7"); + static struct attribute *rapl_formats_attr[] = { + &format_attr_event.attr, + NULL, +-- +2.27.0 + diff --git a/queue-5.4/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch b/queue-5.4/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch new file mode 100644 index 00000000000..8d2d3e1ae6d --- /dev/null +++ b/queue-5.4/phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch @@ -0,0 +1,95 @@ +From 5be58e9de0109f03351be06c35afd98481548bb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 10:58:20 +0100 +Subject: phy: tegra: xusb: Fix dangling pointer on probe failure + +From: Marc Zyngier + +[ Upstream commit eb9c4dd9bdfdebaa13846c16a8c79b5b336066b6 ] + +If, for some reason, the xusb PHY fails to probe, it leaves +a dangling pointer attached to the platform device structure. + +This would normally be harmless, but the Tegra XHCI driver then +goes and extract that pointer from the PHY device. Things go +downhill from there: + + 8.752082] [004d554e5145533c] address between user and kernel address ranges +[ 8.752085] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 8.752088] Modules linked in: max77620_regulator(E+) xhci_tegra(E+) sdhci_tegra(E+) xhci_hcd(E) sdhci_pltfm(E) cqhci(E) fixed(E) usbcore(E) scsi_mod(E) sdhci(E) host1x(E+) +[ 8.752103] CPU: 4 PID: 158 Comm: systemd-udevd Tainted: G S W E 5.9.0-rc7-00298-gf6337624c4fe #1980 +[ 8.752105] Hardware name: NVIDIA Jetson TX2 Developer Kit (DT) +[ 8.752108] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--) +[ 8.752115] pc : kobject_put+0x1c/0x21c +[ 8.752120] lr : put_device+0x20/0x30 +[ 8.752121] sp : ffffffc012eb3840 +[ 8.752122] x29: ffffffc012eb3840 x28: ffffffc010e82638 +[ 8.752125] x27: ffffffc008d56440 x26: 0000000000000000 +[ 8.752128] x25: ffffff81eb508200 x24: 0000000000000000 +[ 8.752130] x23: ffffff81eb538800 x22: 0000000000000000 +[ 8.752132] x21: 00000000fffffdfb x20: ffffff81eb538810 +[ 8.752134] x19: 3d4d554e51455300 x18: 0000000000000020 +[ 8.752136] x17: ffffffc008d00270 x16: ffffffc008d00c94 +[ 8.752138] x15: 0000000000000004 x14: ffffff81ebd4ae90 +[ 8.752140] x13: 0000000000000000 x12: ffffff81eb86a4e8 +[ 8.752142] x11: ffffff81eb86a480 x10: ffffff81eb862fea +[ 8.752144] x9 : ffffffc01055fb28 x8 : ffffff81eb86a4a8 +[ 8.752146] x7 : 0000000000000001 x6 : 0000000000000001 +[ 8.752148] x5 : ffffff81dff8bc38 x4 : 0000000000000000 +[ 8.752150] x3 : 0000000000000001 x2 : 0000000000000001 +[ 8.752152] x1 : 0000000000000002 x0 : 3d4d554e51455300 +[ 8.752155] Call trace: +[ 8.752157] kobject_put+0x1c/0x21c +[ 8.752160] put_device+0x20/0x30 +[ 8.752164] tegra_xusb_padctl_put+0x24/0x3c +[ 8.752170] tegra_xusb_probe+0x8b0/0xd10 [xhci_tegra] +[ 8.752174] platform_drv_probe+0x60/0xb4 +[ 8.752176] really_probe+0xf0/0x504 +[ 8.752179] driver_probe_device+0x100/0x170 +[ 8.752181] device_driver_attach+0xcc/0xd4 +[ 8.752183] __driver_attach+0xb0/0x17c +[ 8.752185] bus_for_each_dev+0x7c/0xd4 +[ 8.752187] driver_attach+0x30/0x3c +[ 8.752189] bus_add_driver+0x154/0x250 +[ 8.752191] driver_register+0x84/0x140 +[ 8.752193] __platform_driver_register+0x54/0x60 +[ 8.752197] tegra_xusb_init+0x40/0x1000 [xhci_tegra] +[ 8.752201] do_one_initcall+0x54/0x2d0 +[ 8.752205] do_init_module+0x68/0x29c +[ 8.752207] load_module+0x2178/0x26c0 +[ 8.752209] __do_sys_finit_module+0xb0/0x120 +[ 8.752211] __arm64_sys_finit_module+0x2c/0x40 +[ 8.752215] el0_svc_common.constprop.0+0x80/0x240 +[ 8.752218] do_el0_svc+0x30/0xa0 +[ 8.752220] el0_svc+0x18/0x50 +[ 8.752223] el0_sync_handler+0x90/0x318 +[ 8.752225] el0_sync+0x158/0x180 +[ 8.752230] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (3940f000) +[ 8.752232] ---[ end trace 90f6c89d62d85ff5 ]--- + +Reset the pointer on probe failure fixes the issue. + +Fixes: 53d2a715c2403 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20201013095820.311376-1-maz@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 2ea8497af82a6..bf5d80b97597b 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -949,6 +949,7 @@ power_down: + reset: + reset_control_assert(padctl->rst); + remove: ++ platform_set_drvdata(pdev, NULL); + soc->ops->remove(padctl); + return err; + } +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-thinkpad_acpi-send-tablet-mode-switch-a.patch b/queue-5.4/platform-x86-thinkpad_acpi-send-tablet-mode-switch-a.patch new file mode 100644 index 00000000000..58f28a29e98 --- /dev/null +++ b/queue-5.4/platform-x86-thinkpad_acpi-send-tablet-mode-switch-a.patch @@ -0,0 +1,41 @@ +From ad76b4be1c841f367a27bca4e54211f6d633b13f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 14:21:57 +0100 +Subject: platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time + +From: Benjamin Berg + +[ Upstream commit e40cc1b476d60f22628741e53cf3446a29e6e6b9 ] + +The lid state may change while the machine is suspended. As such, we may +need to re-check the state at wake-up time (at least when waking up from +hibernation). +Add the appropriate call to the resume handler in order to sync the +SW_TABLET_MODE switch state with the hardware state. + +Fixes: dda3ec0aa631 ("platform/x86: thinkpad_acpi: Implement tablet mode using GMMS method") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210269 +Signed-off-by: Benjamin Berg +Acked-by: Henrique de Moraes Holschuh +Link: https://lore.kernel.org/r/20201123132157.866303-1-benjamin@sipsolutions.net +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index abcb336a515a1..5081048f2356e 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -4238,6 +4238,7 @@ static void hotkey_resume(void) + pr_err("error while attempting to reset the event firmware interface\n"); + + tpacpi_send_radiosw_update(); ++ tpacpi_input_send_tabletsw(); + hotkey_tablet_mode_notify_change(); + hotkey_wakeup_reason_notify_change(); + hotkey_wakeup_hotunplug_complete_notify_change(); +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch b/queue-5.4/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch new file mode 100644 index 00000000000..35d84f9df4c --- /dev/null +++ b/queue-5.4/platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch @@ -0,0 +1,49 @@ +From 5eddda75f84cf18da7ef88e7e7aa347053c9cbe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Nov 2020 13:49:37 +0800 +Subject: platform/x86: toshiba_acpi: Fix the wrong variable assignment + +From: Kaixu Xia + +[ Upstream commit 2a72c46ac4d665614faa25e267c3fb27fb729ed7 ] + +The commit 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up +variable declaration") cleans up variable declaration in +video_proc_write(). Seems it does the variable assignment in the +wrong place, this results in dead code and changes the source code +logic. Fix it by doing the assignment at the beginning of the funciton. + +Fixes: 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up variable declaration") +Reported-by: Tosk Robot +Signed-off-by: Kaixu Xia +Link: https://lore.kernel.org/r/1606024177-16481-1-git-send-email-kaixuxia@tencent.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/toshiba_acpi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index a1e6569427c34..71a969fc3b206 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -1485,7 +1485,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file)); + char *buffer; + char *cmd; +- int lcd_out, crt_out, tv_out; ++ int lcd_out = -1, crt_out = -1, tv_out = -1; + int remain = count; + int value; + int ret; +@@ -1517,7 +1517,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + + kfree(cmd); + +- lcd_out = crt_out = tv_out = -1; + ret = get_video_status(dev, &video_out); + if (!ret) { + unsigned int new_video_out = video_out; +-- +2.27.0 + diff --git a/queue-5.4/powerpc-64s-fix-allnoconfig-build-since-uaccess-flus.patch b/queue-5.4/powerpc-64s-fix-allnoconfig-build-since-uaccess-flus.patch new file mode 100644 index 00000000000..df8fcc157ff --- /dev/null +++ b/queue-5.4/powerpc-64s-fix-allnoconfig-build-since-uaccess-flus.patch @@ -0,0 +1,42 @@ +From f9a658f6eb172a80f6125e9cd2cf8c7d42ba08d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 18:40:16 +1100 +Subject: powerpc/64s: Fix allnoconfig build since uaccess flush + +From: Stephen Rothwell + +[ Upstream commit b6b79dd53082db11070b4368d85dd6699ff0b063 ] + +Using DECLARE_STATIC_KEY_FALSE needs linux/jump_table.h. + +Otherwise the build fails with eg: + + arch/powerpc/include/asm/book3s/64/kup-radix.h:66:1: warning: data definition has no type or storage class + 66 | DECLARE_STATIC_KEY_FALSE(uaccess_flush_key); + +Fixes: 9a32a7e78bd0 ("powerpc/64s: flush L1D after user accesses") +Signed-off-by: Stephen Rothwell +[mpe: Massage change log] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201123184016.693fe464@canb.auug.org.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/kup-radix.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h +index c1e45f510591e..a29b64129a7d4 100644 +--- a/arch/powerpc/include/asm/book3s/64/kup-radix.h ++++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h +@@ -54,6 +54,8 @@ + + #else /* !__ASSEMBLY__ */ + ++#include ++ + DECLARE_STATIC_KEY_FALSE(uaccess_flush_key); + + #ifdef CONFIG_PPC_KUAP +-- +2.27.0 + diff --git a/queue-5.4/proc-don-t-allow-async-path-resolution-of-proc-self-.patch b/queue-5.4/proc-don-t-allow-async-path-resolution-of-proc-self-.patch new file mode 100644 index 00000000000..5edf9eae246 --- /dev/null +++ b/queue-5.4/proc-don-t-allow-async-path-resolution-of-proc-self-.patch @@ -0,0 +1,40 @@ +From 5e0ec97aae51dfa127c5766ba86908a366e1f82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 16:47:52 -0700 +Subject: proc: don't allow async path resolution of /proc/self components + +From: Jens Axboe + +[ Upstream commit 8d4c3e76e3be11a64df95ddee52e99092d42fc19 ] + +If this is attempted by a kthread, then return -EOPNOTSUPP as we don't +currently support that. Once we can get task_pid_ptr() doing the right +thing, then this can go away again. + +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/proc/self.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/proc/self.c b/fs/proc/self.c +index 32af065397f80..582336862d258 100644 +--- a/fs/proc/self.c ++++ b/fs/proc/self.c +@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry, + pid_t tgid = task_tgid_nr_ns(current, ns); + char *name; + ++ /* ++ * Not currently supported. Once we can inherit all of struct pid, ++ * we can allow this. ++ */ ++ if (current->flags & PF_KTHREAD) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (!tgid) + return ERR_PTR(-ENOENT); + /* max length of unsigned int in decimal + NULL term */ +-- +2.27.0 + diff --git a/queue-5.4/rdma-hns-bugfix-for-memory-window-mtpt-configuration.patch b/queue-5.4/rdma-hns-bugfix-for-memory-window-mtpt-configuration.patch new file mode 100644 index 00000000000..1eca2be1e88 --- /dev/null +++ b/queue-5.4/rdma-hns-bugfix-for-memory-window-mtpt-configuration.patch @@ -0,0 +1,37 @@ +From e803fca9c842eb08f589344c31077491b1baa2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:26:12 +0800 +Subject: RDMA/hns: Bugfix for memory window mtpt configuration + +From: Yixian Liu + +[ Upstream commit 17475e104dcb74217c282781817f8f52b46130d3 ] + +When a memory window is bound to a memory region, the local write access +should be set for its mtpt table. + +Fixes: c7c28191408b ("RDMA/hns: Add MW support for hip08") +Link: https://lore.kernel.org/r/1606386372-21094-1-git-send-email-liweihang@huawei.com +Signed-off-by: Yixian Liu +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index b285920bcd8ab..e8933daab4995 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2423,6 +2423,7 @@ static int hns_roce_v2_mw_write_mtpt(void *mb_buf, struct hns_roce_mw *mw) + + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1); + roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_L_INV_EN_S, 1); ++ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S, 1); + + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S, 0); + roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_MR_MW_S, 1); +-- +2.27.0 + diff --git a/queue-5.4/rdma-hns-fix-retry_cnt-and-rnr_cnt-when-querying-qp.patch b/queue-5.4/rdma-hns-fix-retry_cnt-and-rnr_cnt-when-querying-qp.patch new file mode 100644 index 00000000000..d6ac04a9ae9 --- /dev/null +++ b/queue-5.4/rdma-hns-fix-retry_cnt-and-rnr_cnt-when-querying-qp.patch @@ -0,0 +1,46 @@ +From 769f8c39a56d5d134ea5638b04e48ec40adbac17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 17:29:37 +0800 +Subject: RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP + +From: Wenpeng Liang + +[ Upstream commit ab6f7248cc446b85fe9e31091670ad7c4293d7fd ] + +The maximum number of retransmission should be returned when querying QP, +not the value of retransmission counter. + +Fixes: 99fcf82521d9 ("RDMA/hns: Fix the wrong value of rnr_retry when querying qp") +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Link: https://lore.kernel.org/r/1606382977-21431-1-git-send-email-liweihang@huawei.com +Signed-off-by: Wenpeng Liang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index bb75328193957..b285920bcd8ab 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4614,11 +4614,11 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, + V2_QPC_BYTE_28_AT_M, + V2_QPC_BYTE_28_AT_S); + qp_attr->retry_cnt = roce_get_field(context.byte_212_lsn, +- V2_QPC_BYTE_212_RETRY_CNT_M, +- V2_QPC_BYTE_212_RETRY_CNT_S); ++ V2_QPC_BYTE_212_RETRY_NUM_INIT_M, ++ V2_QPC_BYTE_212_RETRY_NUM_INIT_S); + qp_attr->rnr_retry = roce_get_field(context.byte_244_rnr_rxack, +- V2_QPC_BYTE_244_RNR_CNT_M, +- V2_QPC_BYTE_244_RNR_CNT_S); ++ V2_QPC_BYTE_244_RNR_NUM_INIT_M, ++ V2_QPC_BYTE_244_RNR_NUM_INIT_S); + + done: + qp_attr->cur_qp_state = qp_attr->qp_state; +-- +2.27.0 + diff --git a/queue-5.4/s390-qeth-fix-af_iucv-notification-race.patch b/queue-5.4/s390-qeth-fix-af_iucv-notification-race.patch new file mode 100644 index 00000000000..78cabb71cc0 --- /dev/null +++ b/queue-5.4/s390-qeth-fix-af_iucv-notification-race.patch @@ -0,0 +1,172 @@ +From 4dd81089de1d3588fbc192d918e395bf19d14694 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 10:09:38 +0100 +Subject: s390/qeth: fix af_iucv notification race + +From: Julian Wiedmann + +[ Upstream commit 8908f36d20d8ba610d3a7d110b3049b5853b9bb1 ] + +The two expected notification sequences are +1. TX_NOTIFY_PENDING with a subsequent TX_NOTIFY_DELAYED_*, when + our TX completion code first observed the pending TX and the QAOB + then completes at a later time; or +2. TX_NOTIFY_OK, when qeth_qdio_handle_aob() picked up the QAOB + completion before our TX completion code even noticed that the TX + was pending. + +But as qeth_iqd_tx_complete() and qeth_qdio_handle_aob() can run +concurrently, we may end up with a race that results in a sequence of +TX_NOTIFY_DELAYED_* followed by TX_NOTIFY_PENDING. Which would confuse +the af_iucv code in its tracking of pending transmits. + +Rework the notification code, so that qeth_qdio_handle_aob() defers its +notification if the TX completion code is still active. + +Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") +Signed-off-by: Julian Wiedmann +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core.h | 9 ++-- + drivers/s390/net/qeth_core_main.c | 73 ++++++++++++++++++++++--------- + 2 files changed, 58 insertions(+), 24 deletions(-) + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 820f2c29376c0..93b4cb156b0bc 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -436,10 +436,13 @@ enum qeth_qdio_out_buffer_state { + QETH_QDIO_BUF_EMPTY, + /* Filled by driver; owned by hardware in order to be sent. */ + QETH_QDIO_BUF_PRIMED, +- /* Identified to be pending in TPQ. */ ++ /* Discovered by the TX completion code: */ + QETH_QDIO_BUF_PENDING, +- /* Found in completion queue. */ +- QETH_QDIO_BUF_IN_CQ, ++ /* Finished by the TX completion code: */ ++ QETH_QDIO_BUF_NEED_QAOB, ++ /* Received QAOB notification on CQ: */ ++ QETH_QDIO_BUF_QAOB_OK, ++ QETH_QDIO_BUF_QAOB_ERROR, + /* Handled via transfer pending / completion queue. */ + QETH_QDIO_BUF_HANDLED_DELAYED, + }; +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 6a2ac575e0a39..f07e73eb37ebb 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -438,6 +438,7 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx, + static void qeth_qdio_handle_aob(struct qeth_card *card, + unsigned long phys_aob_addr) + { ++ enum qeth_qdio_out_buffer_state new_state = QETH_QDIO_BUF_QAOB_OK; + struct qaob *aob; + struct qeth_qdio_out_buffer *buffer; + enum iucv_tx_notify notification; +@@ -449,22 +450,6 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, + buffer = (struct qeth_qdio_out_buffer *) aob->user1; + QETH_CARD_TEXT_(card, 5, "%lx", aob->user1); + +- if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED, +- QETH_QDIO_BUF_IN_CQ) == QETH_QDIO_BUF_PRIMED) { +- notification = TX_NOTIFY_OK; +- } else { +- WARN_ON_ONCE(atomic_read(&buffer->state) != +- QETH_QDIO_BUF_PENDING); +- atomic_set(&buffer->state, QETH_QDIO_BUF_IN_CQ); +- notification = TX_NOTIFY_DELAYED_OK; +- } +- +- if (aob->aorc != 0) { +- QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc); +- notification = qeth_compute_cq_notification(aob->aorc, 1); +- } +- qeth_notify_skbs(buffer->q, buffer, notification); +- + /* Free dangling allocations. The attached skbs are handled by + * qeth_cleanup_handled_pending(). + */ +@@ -475,7 +460,33 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, + kmem_cache_free(qeth_core_header_cache, + (void *) aob->sba[i]); + } +- atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ ++ if (aob->aorc) { ++ QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc); ++ new_state = QETH_QDIO_BUF_QAOB_ERROR; ++ } ++ ++ switch (atomic_xchg(&buffer->state, new_state)) { ++ case QETH_QDIO_BUF_PRIMED: ++ /* Faster than TX completion code. */ ++ notification = qeth_compute_cq_notification(aob->aorc, 0); ++ qeth_notify_skbs(buffer->q, buffer, notification); ++ atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ case QETH_QDIO_BUF_PENDING: ++ /* TX completion code is active and will handle the async ++ * completion for us. ++ */ ++ break; ++ case QETH_QDIO_BUF_NEED_QAOB: ++ /* TX completion code is already finished. */ ++ notification = qeth_compute_cq_notification(aob->aorc, 1); ++ qeth_notify_skbs(buffer->q, buffer, notification); ++ atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } + + qdio_release_aob(aob); + } +@@ -1095,9 +1106,6 @@ static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error, + struct qeth_qdio_out_q *queue = buf->q; + struct sk_buff *skb; + +- /* release may never happen from within CQ tasklet scope */ +- WARN_ON_ONCE(atomic_read(&buf->state) == QETH_QDIO_BUF_IN_CQ); +- + if (atomic_read(&buf->state) == QETH_QDIO_BUF_PENDING) + qeth_notify_skbs(queue, buf, TX_NOTIFY_GENERALERROR); + +@@ -5224,9 +5232,32 @@ static void qeth_iqd_tx_complete(struct qeth_qdio_out_q *queue, + + if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED, + QETH_QDIO_BUF_PENDING) == +- QETH_QDIO_BUF_PRIMED) ++ QETH_QDIO_BUF_PRIMED) { + qeth_notify_skbs(queue, buffer, TX_NOTIFY_PENDING); + ++ /* Handle race with qeth_qdio_handle_aob(): */ ++ switch (atomic_xchg(&buffer->state, ++ QETH_QDIO_BUF_NEED_QAOB)) { ++ case QETH_QDIO_BUF_PENDING: ++ /* No concurrent QAOB notification. */ ++ break; ++ case QETH_QDIO_BUF_QAOB_OK: ++ qeth_notify_skbs(queue, buffer, ++ TX_NOTIFY_DELAYED_OK); ++ atomic_set(&buffer->state, ++ QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ case QETH_QDIO_BUF_QAOB_ERROR: ++ qeth_notify_skbs(queue, buffer, ++ TX_NOTIFY_DELAYED_GENERALERROR); ++ atomic_set(&buffer->state, ++ QETH_QDIO_BUF_HANDLED_DELAYED); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } ++ } ++ + QETH_CARD_TEXT_(card, 5, "pel%u", bidx); + + /* prepare the queue slot for re-use: */ +-- +2.27.0 + diff --git a/queue-5.4/s390-qeth-fix-tear-down-of-async-tx-buffers.patch b/queue-5.4/s390-qeth-fix-tear-down-of-async-tx-buffers.patch new file mode 100644 index 00000000000..838fa4da581 --- /dev/null +++ b/queue-5.4/s390-qeth-fix-tear-down-of-async-tx-buffers.patch @@ -0,0 +1,57 @@ +From ec00ee75656cd8817b0c54e2184a313b42955c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 10:09:39 +0100 +Subject: s390/qeth: fix tear down of async TX buffers + +From: Julian Wiedmann + +[ Upstream commit 7ed10e16e50daf74460f54bc922e27c6863c8d61 ] + +When qeth_iqd_tx_complete() detects that a TX buffer requires additional +async completion via QAOB, it might fail to replace the queue entry's +metadata (and ends up triggering recovery). + +Assume now that the device gets torn down, overruling the recovery. +If the QAOB notification then arrives before the tear down has +sufficiently progressed, the buffer state is changed to +QETH_QDIO_BUF_HANDLED_DELAYED by qeth_qdio_handle_aob(). + +The tear down code calls qeth_drain_output_queue(), where +qeth_cleanup_handled_pending() will then attempt to replace such a +buffer _again_. If it succeeds this time, the buffer ends up dangling in +its replacement's ->next_pending list ... where it will never be freed, +since there's no further call to qeth_cleanup_handled_pending(). + +But the second attempt isn't actually needed, we can simply leave the +buffer on the queue and re-use it after a potential recovery has +completed. The qeth_clear_output_buffer() in qeth_drain_output_queue() +will ensure that it's in a clean state again. + +Fixes: 72861ae792c2 ("qeth: recovery through asynchronous delivery") +Signed-off-by: Julian Wiedmann +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core_main.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index f07e73eb37ebb..fad1c46d4b0e1 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -426,12 +426,6 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx, + + } + } +- if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) == +- QETH_QDIO_BUF_HANDLED_DELAYED)) { +- /* for recovery situations */ +- qeth_init_qdio_out_buf(q, bidx); +- QETH_CARD_TEXT(q->card, 2, "clprecov"); +- } + } + + +-- +2.27.0 + diff --git a/queue-5.4/s390-qeth-make-af_iucv-tx-notification-call-more-rob.patch b/queue-5.4/s390-qeth-make-af_iucv-tx-notification-call-more-rob.patch new file mode 100644 index 00000000000..aafc2fa4285 --- /dev/null +++ b/queue-5.4/s390-qeth-make-af_iucv-tx-notification-call-more-rob.patch @@ -0,0 +1,45 @@ +From 8417b54d652ad8cfaf0d19542cb8d9a4d36fc315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 10:09:37 +0100 +Subject: s390/qeth: make af_iucv TX notification call more robust + +From: Julian Wiedmann + +[ Upstream commit 34c7f50f7d0d36fa663c74aee39e25e912505320 ] + +Calling into socket code is ugly already, at least check whether we are +dealing with the expected sk_family. Only looking at skb->protocol is +bound to cause troubles (consider eg. af_packet). + +Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") +Signed-off-by: Julian Wiedmann +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 5043f0fcf399a..6a2ac575e0a39 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -31,6 +31,7 @@ + + #include + #include ++#include + + #include + #include +@@ -1083,7 +1084,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *q, + skb_queue_walk(&buf->skb_list, skb) { + QETH_CARD_TEXT_(q->card, 5, "skbn%d", notification); + QETH_CARD_TEXT_(q->card, 5, "%lx", (long) skb); +- if (skb->protocol == htons(ETH_P_AF_IUCV) && skb->sk) ++ if (skb->sk && skb->sk->sk_family == PF_IUCV) + iucv_sk(skb->sk)->sk_txnotify(skb, notification); + } + } +-- +2.27.0 + diff --git a/queue-5.4/scsi-libiscsi-fix-nop-race-condition.patch b/queue-5.4/scsi-libiscsi-fix-nop-race-condition.patch new file mode 100644 index 00000000000..bb177d1b76e --- /dev/null +++ b/queue-5.4/scsi-libiscsi-fix-nop-race-condition.patch @@ -0,0 +1,132 @@ +From e53f13cdb0aa058a4e7b417074bfb87c5ca634f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 11:33:17 -0800 +Subject: scsi: libiscsi: Fix NOP race condition + +From: Lee Duncan + +[ Upstream commit fe0a8a95e7134d0b44cd407bc0085b9ba8d8fe31 ] + +iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid +daemon instead of handled in the kernel, as they should be, resulting in a +message from the daemon like: + + iscsid: Got nop in, but kernel supports nop handling. + +This can occur because of the new forward- and back-locks, and the fact +that an iSCSI NOP response can occur before processing of the NOP send is +complete. This can result in "conn->ping_task" being NULL in +iscsi_nop_out_rsp(), when the pointer is actually in the process of being +set. + +To work around this, we add a new state to the "ping_task" pointer. In +addition to NULL (not assigned) and a pointer (assigned), we add the state +"being set", which is signaled with an INVALID pointer (using "-1"). + +Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com +Reviewed-by: Mike Christie +Signed-off-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 23 +++++++++++++++-------- + include/scsi/libiscsi.h | 3 +++ + 2 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 70b99c0e2e678..f954be3d5ee22 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -533,8 +533,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) + if (conn->task == task) + conn->task = NULL; + +- if (conn->ping_task == task) +- conn->ping_task = NULL; ++ if (READ_ONCE(conn->ping_task) == task) ++ WRITE_ONCE(conn->ping_task, NULL); + + /* release get from queueing */ + __iscsi_put_task(task); +@@ -738,6 +738,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + task->conn->session->age); + } + ++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK)) ++ WRITE_ONCE(conn->ping_task, task); ++ + if (!ihost->workq) { + if (iscsi_prep_mgmt_task(conn, task)) + goto free_task; +@@ -941,8 +944,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + struct iscsi_nopout hdr; + struct iscsi_task *task; + +- if (!rhdr && conn->ping_task) +- return -EINVAL; ++ if (!rhdr) { ++ if (READ_ONCE(conn->ping_task)) ++ return -EINVAL; ++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK); ++ } + + memset(&hdr, 0, sizeof(struct iscsi_nopout)); + hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE; +@@ -957,11 +963,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + + task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0); + if (!task) { ++ if (!rhdr) ++ WRITE_ONCE(conn->ping_task, NULL); + iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n"); + return -EIO; + } else if (!rhdr) { + /* only track our nops */ +- conn->ping_task = task; + conn->last_ping = jiffies; + } + +@@ -984,7 +991,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task, + struct iscsi_conn *conn = task->conn; + int rc = 0; + +- if (conn->ping_task != task) { ++ if (READ_ONCE(conn->ping_task) != task) { + /* + * If this is not in response to one of our + * nops then it must be from userspace. +@@ -1923,7 +1930,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn) + */ + static int iscsi_has_ping_timed_out(struct iscsi_conn *conn) + { +- if (conn->ping_task && ++ if (READ_ONCE(conn->ping_task) && + time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) + + (conn->ping_timeout * HZ), jiffies)) + return 1; +@@ -2058,7 +2065,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + * Checking the transport already or nop from a cmd timeout still + * running + */ +- if (conn->ping_task) { ++ if (READ_ONCE(conn->ping_task)) { + task->have_checked_conn = true; + rc = BLK_EH_RESET_TIMER; + goto done; +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index c25fb86ffae95..b3bbd10eb3f07 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -132,6 +132,9 @@ struct iscsi_task { + void *dd_data; /* driver/transport data */ + }; + ++/* invalid scsi_task pointer */ ++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l ++ + static inline int iscsi_task_has_unsol_data(struct iscsi_task *task) + { + return task->unsol_r2t.data_length > task->unsol_r2t.sent; +-- +2.27.0 + diff --git a/queue-5.4/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch b/queue-5.4/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch new file mode 100644 index 00000000000..a3786877b32 --- /dev/null +++ b/queue-5.4/scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch @@ -0,0 +1,88 @@ +From 3e64c53d918ac2e3a1f98178ea443a4ccd688e45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 19:46:18 -0600 +Subject: scsi: target: iscsi: Fix cmd abort fabric stop race + +From: Mike Christie + +[ Upstream commit f36199355c64a39fe82cfddc7623d827c7e050da ] + +Maurizio found a race where the abort and cmd stop paths can race as +follows: + + 1. thread1 runs iscsit_release_commands_from_conn and sets + CMD_T_FABRIC_STOP. + + 2. thread2 runs iscsit_aborted_task and then does __iscsit_free_cmd. It + then returns from the aborted_task callout and we finish + target_handle_abort and do: + + target_handle_abort -> transport_cmd_check_stop_to_fabric -> + lio_check_stop_free -> target_put_sess_cmd + + The cmd is now freed. + + 3. thread1 now finishes iscsit_release_commands_from_conn and runs + iscsit_free_cmd while accessing a command we just released. + +In __target_check_io_state we check for CMD_T_FABRIC_STOP and set the +CMD_T_ABORTED if the driver is not cleaning up the cmd because of a session +shutdown. However, iscsit_release_commands_from_conn only sets the +CMD_T_FABRIC_STOP and does not check to see if the abort path has claimed +completion ownership of the command. + +This adds a check in iscsit_release_commands_from_conn so only the abort or +fabric stop path cleanup the command. + +Link: https://lore.kernel.org/r/1605318378-9269-1-git-send-email-michael.christie@oracle.com +Reported-by: Maurizio Lombardi +Reviewed-by: Maurizio Lombardi +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index bca183369ad8b..3403667a9592f 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -483,8 +483,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp); + void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + { + spin_lock_bh(&conn->cmd_lock); +- if (!list_empty(&cmd->i_conn_node) && +- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) ++ if (!list_empty(&cmd->i_conn_node)) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +@@ -4082,12 +4081,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + spin_lock_bh(&conn->cmd_lock); + list_splice_init(&conn->conn_cmd_list, &tmp_list); + +- list_for_each_entry(cmd, &tmp_list, i_conn_node) { ++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + + if (se_cmd->se_tfo != NULL) { + spin_lock_irq(&se_cmd->t_state_lock); +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ /* ++ * LIO's abort path owns the cleanup for this, ++ * so put it back on the list and let ++ * aborted_task handle it. ++ */ ++ list_move_tail(&cmd->i_conn_node, ++ &conn->conn_cmd_list); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ } + spin_unlock_irq(&se_cmd->t_state_lock); + } + } +-- +2.27.0 + diff --git a/queue-5.4/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch b/queue-5.4/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch new file mode 100644 index 00000000000..5710dc65d08 --- /dev/null +++ b/queue-5.4/scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch @@ -0,0 +1,50 @@ +From 7084f03aa46339229c0e411d60d13dd755bea381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 14:29:16 +0800 +Subject: scsi: ufs: Fix race between shutdown and runtime resume flow + +From: Stanley Chu + +[ Upstream commit e92643db514803c2c87d72caf5950b4c0a8faf4a ] + +If UFS host device is in runtime-suspended state while UFS shutdown +callback is invoked, UFS device shall be resumed for register +accesses. Currently only UFS local runtime resume function will be invoked +to wake up the host. This is not enough because if someone triggers +runtime resume from block layer, then race may happen between shutdown and +runtime resume flow, and finally lead to unlocked register access. + +To fix this, in ufshcd_shutdown(), use pm_runtime_get_sync() instead of +resuming UFS device by ufshcd_runtime_resume() "internally" to let runtime +PM framework manage the whole resume flow. + +Link: https://lore.kernel.org/r/20201119062916.12931-1-stanley.chu@mediatek.com +Fixes: 57d104c153d3 ("ufs: add UFS power management support") +Reviewed-by: Can Guo +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 0772327f87d93..b6ce880ddd153 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -8160,11 +8160,7 @@ int ufshcd_shutdown(struct ufs_hba *hba) + if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) + goto out; + +- if (pm_runtime_suspended(hba->dev)) { +- ret = ufshcd_runtime_resume(hba); +- if (ret) +- goto out; +- } ++ pm_runtime_get_sync(hba->dev); + + ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM); + out: +-- +2.27.0 + diff --git a/queue-5.4/series b/queue-5.4/series index f43f1653721..6e7124bcf36 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -19,3 +19,62 @@ trace-fix-potenial-dangerous-pointer.patch arm64-pgtable-fix-pte_accessible.patch arm64-pgtable-ensure-dirty-bit-is-preserved-across-pte_wrprotect.patch i2c-imx-fix-reset-of-i2sr_ial-flag.patch +hid-uclogic-add-id-for-trust-flex-design-tablet.patch +hid-ite-replace-abs_misc-120-121-events-with-touchpa.patch +hid-cypress-support-varmilo-keyboards-media-hotkeys.patch +hid-add-support-for-sega-saturn.patch +input-i8042-allow-insmod-to-succeed-on-devices-witho.patch +hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch +staging-ralink-gdma-fix-kconfig-dependency-bug-for-d.patch +hid-add-hid_quirk_increment_usage_on_duplicate-for-g.patch +dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch +x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch +hid-logitech-hidpp-add-hidpp_consumer_vendor_keys-qu.patch +hid-add-logitech-dinovo-edge-battery-quirk.patch +proc-don-t-allow-async-path-resolution-of-proc-self-.patch +nvme-free-sq-cq-dbbuf-pointers-when-dbbuf-set-fails.patch +vhost-scsi-fix-cmd-completion-race.patch +dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch +scsi-libiscsi-fix-nop-race-condition.patch +scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch +perf-x86-fix-sysfs-type-mismatches.patch +xtensa-uaccess-add-missing-__user-to-strncpy_from_us.patch +net-dsa-mv88e6xxx-wait-for-eeprom-done-after-hw-rese.patch +bus-ti-sysc-fix-bogus-resetdone-warning-on-enable-fo.patch +arm-omap2-manage-mpu-state-properly-for-omap_enter_i.patch +phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch +iwlwifi-mvm-write-queue_sync_state-only-for-sync.patch +batman-adv-set-.owner-to-this_module.patch +arch-pgtable-define-max_possible_physmem_bits-where-.patch +arm-dts-dra76x-m_can-fix-order-of-clocks.patch +scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch +bnxt_en-fix-error-return-code-in-bnxt_init_one.patch +bnxt_en-fix-error-return-code-in-bnxt_init_board.patch +video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch +bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch +cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch +s390-qeth-make-af_iucv-tx-notification-call-more-rob.patch +s390-qeth-fix-af_iucv-notification-race.patch +s390-qeth-fix-tear-down-of-async-tx-buffers.patch +ibmvnic-fix-call_netdevice_notifiers-in-do_reset.patch +ibmvnic-notify-peers-when-failover-and-migration-hap.patch +powerpc-64s-fix-allnoconfig-build-since-uaccess-flus.patch +ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch +i40e-fix-removing-driver-while-bare-metal-vfs-pass-t.patch +nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch +net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch +ibmvnic-fix-null-pointer-dereference-in-reset_sub_cr.patch +ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch +optee-add-writeback-to-valid-memory-type.patch +arm64-tegra-wrong-aon-hsp-reg-property-size.patch +efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch +efi-efi_earlycon-should-depend-on-efi.patch +can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch +platform-x86-thinkpad_acpi-send-tablet-mode-switch-a.patch +platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch +rdma-hns-fix-retry_cnt-and-rnr_cnt-when-querying-qp.patch +rdma-hns-bugfix-for-memory-window-mtpt-configuration.patch +can-m_can-m_can_open-remove-irqf_trigger_falling-fro.patch +can-m_can-fix-nominal-bitiming-tseg2-min-for-version.patch +perf-stat-use-proper-cpu-for-shadow-stats.patch +perf-probe-fix-to-die_entrypc-returns-error-correctl.patch diff --git a/queue-5.4/staging-ralink-gdma-fix-kconfig-dependency-bug-for-d.patch b/queue-5.4/staging-ralink-gdma-fix-kconfig-dependency-bug-for-d.patch new file mode 100644 index 00000000000..7a1f2baf414 --- /dev/null +++ b/queue-5.4/staging-ralink-gdma-fix-kconfig-dependency-bug-for-d.patch @@ -0,0 +1,54 @@ +From 35bcf06df24d811cae9d803c1d767cf21511997e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 21:15:23 +0300 +Subject: staging: ralink-gdma: fix kconfig dependency bug for DMA_RALINK + +From: Necip Fazil Yildiran + +[ Upstream commit 06ea594051707c6b8834ef5b24e9b0730edd391b ] + +When DMA_RALINK is enabled and DMADEVICES is disabled, it results in the +following Kbuild warnings: + +WARNING: unmet direct dependencies detected for DMA_ENGINE + Depends on [n]: DMADEVICES [=n] + Selected by [y]: + - DMA_RALINK [=y] && STAGING [=y] && RALINK [=y] && !SOC_RT288X [=n] + +WARNING: unmet direct dependencies detected for DMA_VIRTUAL_CHANNELS + Depends on [n]: DMADEVICES [=n] + Selected by [y]: + - DMA_RALINK [=y] && STAGING [=y] && RALINK [=y] && !SOC_RT288X [=n] + +The reason is that DMA_RALINK selects DMA_ENGINE and DMA_VIRTUAL_CHANNELS +without depending on or selecting DMADEVICES while DMA_ENGINE and +DMA_VIRTUAL_CHANNELS are subordinate to DMADEVICES. This can also fail +building the kernel as demonstrated in a bug report. + +Honor the kconfig dependency to remove unmet direct dependency warnings +and avoid any potential build failures. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210055 +Signed-off-by: Necip Fazil Yildiran +Link: https://lore.kernel.org/r/20201104181522.43567-1-fazilyildiran@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/ralink-gdma/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/ralink-gdma/Kconfig b/drivers/staging/ralink-gdma/Kconfig +index 54e8029e6b1af..0017376234e28 100644 +--- a/drivers/staging/ralink-gdma/Kconfig ++++ b/drivers/staging/ralink-gdma/Kconfig +@@ -2,6 +2,7 @@ + config DMA_RALINK + tristate "RALINK DMA support" + depends on RALINK && !SOC_RT288X ++ depends on DMADEVICES + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + +-- +2.27.0 + diff --git a/queue-5.4/vhost-scsi-fix-cmd-completion-race.patch b/queue-5.4/vhost-scsi-fix-cmd-completion-race.patch new file mode 100644 index 00000000000..dd6da1d8efa --- /dev/null +++ b/queue-5.4/vhost-scsi-fix-cmd-completion-race.patch @@ -0,0 +1,126 @@ +From ea9c71b8b06e20da50dd8164aa5b8c8168c0fd14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 23:33:21 -0600 +Subject: vhost scsi: fix cmd completion race + +From: Mike Christie + +[ Upstream commit 47a3565e8bb14ec48a75b48daf57aa830e2691f8 ] + +We might not do the final se_cmd put from vhost_scsi_complete_cmd_work. +When the last put happens a little later then we could race where +vhost_scsi_complete_cmd_work does vhost_signal, the guest runs and sends +more IO, and vhost_scsi_handle_vq runs but does not find any free cmds. + +This patch has us delay completing the cmd until the last lio core ref +is dropped. We then know that once we signal to the guest that the cmd +is completed that if it queues a new command it will find a free cmd. + +Signed-off-by: Mike Christie +Reviewed-by: Maurizio Lombardi +Link: https://lore.kernel.org/r/1604986403-4931-4-git-send-email-michael.christie@oracle.com +Signed-off-by: Michael S. Tsirkin +Acked-by: Stefan Hajnoczi +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 42 +++++++++++++++--------------------------- + 1 file changed, 15 insertions(+), 27 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index f63f84a257256..98c484149ac7f 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -320,7 +320,7 @@ static u32 vhost_scsi_tpg_get_inst_index(struct se_portal_group *se_tpg) + return 1; + } + +-static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) ++static void vhost_scsi_release_cmd_res(struct se_cmd *se_cmd) + { + struct vhost_scsi_cmd *tv_cmd = container_of(se_cmd, + struct vhost_scsi_cmd, tvc_se_cmd); +@@ -340,6 +340,16 @@ static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) + target_free_tag(se_sess, se_cmd); + } + ++static void vhost_scsi_release_cmd(struct se_cmd *se_cmd) ++{ ++ struct vhost_scsi_cmd *cmd = container_of(se_cmd, ++ struct vhost_scsi_cmd, tvc_se_cmd); ++ struct vhost_scsi *vs = cmd->tvc_vhost; ++ ++ llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list); ++ vhost_work_queue(&vs->dev, &vs->vs_completion_work); ++} ++ + static u32 vhost_scsi_sess_get_index(struct se_session *se_sess) + { + return 0; +@@ -362,28 +372,15 @@ static int vhost_scsi_get_cmd_state(struct se_cmd *se_cmd) + return 0; + } + +-static void vhost_scsi_complete_cmd(struct vhost_scsi_cmd *cmd) +-{ +- struct vhost_scsi *vs = cmd->tvc_vhost; +- +- llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list); +- +- vhost_work_queue(&vs->dev, &vs->vs_completion_work); +-} +- + static int vhost_scsi_queue_data_in(struct se_cmd *se_cmd) + { +- struct vhost_scsi_cmd *cmd = container_of(se_cmd, +- struct vhost_scsi_cmd, tvc_se_cmd); +- vhost_scsi_complete_cmd(cmd); ++ transport_generic_free_cmd(se_cmd, 0); + return 0; + } + + static int vhost_scsi_queue_status(struct se_cmd *se_cmd) + { +- struct vhost_scsi_cmd *cmd = container_of(se_cmd, +- struct vhost_scsi_cmd, tvc_se_cmd); +- vhost_scsi_complete_cmd(cmd); ++ transport_generic_free_cmd(se_cmd, 0); + return 0; + } + +@@ -429,15 +426,6 @@ vhost_scsi_allocate_evt(struct vhost_scsi *vs, + return evt; + } + +-static void vhost_scsi_free_cmd(struct vhost_scsi_cmd *cmd) +-{ +- struct se_cmd *se_cmd = &cmd->tvc_se_cmd; +- +- /* TODO locking against target/backend threads? */ +- transport_generic_free_cmd(se_cmd, 0); +- +-} +- + static int vhost_scsi_check_stop_free(struct se_cmd *se_cmd) + { + return target_put_sess_cmd(se_cmd); +@@ -556,7 +544,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + } else + pr_err("Faulted on virtio_scsi_cmd_resp\n"); + +- vhost_scsi_free_cmd(cmd); ++ vhost_scsi_release_cmd_res(se_cmd); + } + + vq = -1; +@@ -1088,7 +1076,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + &prot_iter, exp_data_len, + &data_iter))) { + vq_err(vq, "Failed to map iov to sgl\n"); +- vhost_scsi_release_cmd(&cmd->tvc_se_cmd); ++ vhost_scsi_release_cmd_res(&cmd->tvc_se_cmd); + goto err; + } + } +-- +2.27.0 + diff --git a/queue-5.4/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch b/queue-5.4/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch new file mode 100644 index 00000000000..977f7b5570c --- /dev/null +++ b/queue-5.4/video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch @@ -0,0 +1,63 @@ +From a24643aefcf6fd5eca01fc3a942dcadd066343d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 16:03:05 -0800 +Subject: video: hyperv_fb: Fix the cache type when mapping the VRAM + +From: Dexuan Cui + +[ Upstream commit 5f1251a48c17b54939d7477305e39679a565382c ] + +x86 Hyper-V used to essentially always overwrite the effective cache type +of guest memory accesses to WB. This was problematic in cases where there +is a physical device assigned to the VM, since that often requires that +the VM should have control over cache types. Thus, on newer Hyper-V since +2018, Hyper-V always honors the VM's cache type, but unexpectedly Linux VM +users start to complain that Linux VM's VRAM becomes very slow, and it +turns out that Linux VM should not map the VRAM uncacheable by ioremap(). +Fix this slowness issue by using ioremap_cache(). + +On ARM64, ioremap_cache() is also required as the host also maps the VRAM +cacheable, otherwise VM Connect can't display properly with ioremap() or +ioremap_wc(). + +With this change, the VRAM on new Hyper-V is as fast as regular RAM, so +it's no longer necessary to use the hacks we added to mitigate the +slowness, i.e. we no longer need to allocate physical memory and use +it to back up the VRAM in Generation-1 VM, and we also no longer need to +allocate physical memory to back up the framebuffer in a Generation-2 VM +and copy the framebuffer to the real VRAM. A further big change will +address these for v5.11. + +Fixes: 68a2d20b79b1 ("drivers/video: add Hyper-V Synthetic Video Frame Buffer Driver") +Tested-by: Boqun Feng +Signed-off-by: Dexuan Cui +Reviewed-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Link: https://lore.kernel.org/r/20201118000305.24797-1-decui@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/hyperv_fb.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 2dcb7c58b31e1..81671272aa58f 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -703,7 +703,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + goto err1; + } + +- fb_virt = ioremap(par->mem->start, screen_fb_size); ++ /* ++ * Map the VRAM cacheable for performance. This is also required for ++ * VM Connect to display properly for ARM64 Linux VM, as the host also ++ * maps the VRAM cacheable. ++ */ ++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size); + if (!fb_virt) + goto err2; + +-- +2.27.0 + diff --git a/queue-5.4/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch b/queue-5.4/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch new file mode 100644 index 00000000000..bfd3b76fc18 --- /dev/null +++ b/queue-5.4/x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch @@ -0,0 +1,76 @@ +From 0476c6d1bf4a34fafd4be911912d635205d3263e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 20:11:19 -0500 +Subject: x86/xen: don't unbind uninitialized lock_kicker_irq + +From: Brian Masney + +[ Upstream commit 65cae18882f943215d0505ddc7e70495877308e6 ] + +When booting a hyperthreaded system with the kernel parameter +'mitigations=auto,nosmt', the following warning occurs: + + WARNING: CPU: 0 PID: 1 at drivers/xen/events/events_base.c:1112 unbind_from_irqhandler+0x4e/0x60 + ... + Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006 + ... + Call Trace: + xen_uninit_lock_cpu+0x28/0x62 + xen_hvm_cpu_die+0x21/0x30 + takedown_cpu+0x9c/0xe0 + ? trace_suspend_resume+0x60/0x60 + cpuhp_invoke_callback+0x9a/0x530 + _cpu_up+0x11a/0x130 + cpu_up+0x7e/0xc0 + bringup_nonboot_cpus+0x48/0x50 + smp_init+0x26/0x79 + kernel_init_freeable+0xea/0x229 + ? rest_init+0xaa/0xaa + kernel_init+0xa/0x106 + ret_from_fork+0x35/0x40 + +The secondary CPUs are not activated with the nosmt mitigations and only +the primary thread on each CPU core is used. In this situation, +xen_hvm_smp_prepare_cpus(), and more importantly xen_init_lock_cpu(), is +not called, so the lock_kicker_irq is not initialized for the secondary +CPUs. Let's fix this by exiting early in xen_uninit_lock_cpu() if the +irq is not set to avoid the warning from above for each secondary CPU. + +Signed-off-by: Brian Masney +Link: https://lore.kernel.org/r/20201107011119.631442-1-bmasney@redhat.com +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/spinlock.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index 6deb49094c605..d817b7c862a62 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -93,10 +93,20 @@ void xen_init_lock_cpu(int cpu) + + void xen_uninit_lock_cpu(int cpu) + { ++ int irq; ++ + if (!xen_pvspin) + return; + +- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL); ++ /* ++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary ++ * CPUs are not activated, and lock_kicker_irq is not initialized. ++ */ ++ irq = per_cpu(lock_kicker_irq, cpu); ++ if (irq == -1) ++ return; ++ ++ unbind_from_irqhandler(irq, NULL); + per_cpu(lock_kicker_irq, cpu) = -1; + kfree(per_cpu(irq_name, cpu)); + per_cpu(irq_name, cpu) = NULL; +-- +2.27.0 + diff --git a/queue-5.4/xtensa-uaccess-add-missing-__user-to-strncpy_from_us.patch b/queue-5.4/xtensa-uaccess-add-missing-__user-to-strncpy_from_us.patch new file mode 100644 index 00000000000..2d1e52be789 --- /dev/null +++ b/queue-5.4/xtensa-uaccess-add-missing-__user-to-strncpy_from_us.patch @@ -0,0 +1,38 @@ +From 9cd1ffd7a614299e88eea97a38e1ea1f2f742577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 00:09:37 +0300 +Subject: xtensa: uaccess: Add missing __user to strncpy_from_user() prototype + +From: Laurent Pinchart + +[ Upstream commit dc293f2106903ab9c24e9cea18c276e32c394c33 ] + +When adding __user annotations in commit 2adf5352a34a, the +strncpy_from_user() function declaration for the +CONFIG_GENERIC_STRNCPY_FROM_USER case was missed. Fix it. + +Reported-by: kernel test robot +Signed-off-by: Laurent Pinchart +Message-Id: <20200831210937.17938-1-laurent.pinchart@ideasonboard.com> +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/include/asm/uaccess.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h +index 3f80386f18838..5cb24a789e9e1 100644 +--- a/arch/xtensa/include/asm/uaccess.h ++++ b/arch/xtensa/include/asm/uaccess.h +@@ -300,7 +300,7 @@ strncpy_from_user(char *dst, const char *src, long count) + return -EFAULT; + } + #else +-long strncpy_from_user(char *dst, const char *src, long count); ++long strncpy_from_user(char *dst, const char __user *src, long count); + #endif + + /* +-- +2.27.0 +