From: Sasha Levin Date: Fri, 5 Mar 2021 03:36:46 +0000 (-0500) Subject: Fixes for 5.11 X-Git-Tag: v4.4.260~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dc22f5b72abd54dfdf0f613cf1527cd9191ccba8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.11 Signed-off-by: Sasha Levin --- diff --git a/queue-5.11/alsa-usb-audio-add-djm-450-to-the-quirks-table.patch b/queue-5.11/alsa-usb-audio-add-djm-450-to-the-quirks-table.patch new file mode 100644 index 00000000000..8e02a8819d1 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-add-djm-450-to-the-quirks-table.patch @@ -0,0 +1,99 @@ +From 80df637f37182ab8b5454e73472b22ee5275a7ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 13:42:28 +0000 +Subject: ALSA: usb-audio: Add DJM-450 to the quirks table + +From: Olivia Mackintosh + +[ Upstream commit 9119e5661eab2c56a96b936cde49c6740dc49ff9 ] + +As with most Pioneer devices, the device descriptor is vendor specific +and as such, the number of channels, the PCM format, endpoints and +sample rate need to be specified. This device has 8 inputs and 8 outputs +and a sample rate of 48000 only. The PCM format is S24_3LE like other +devices. + +There seems to be an appetite for reducing duplication amongs these +Pioneer patches but again, I feel this is a step to be taken after +support has been added as it's not completely clear where the +commonalities are. + +Signed-off-by: Olivia Mackintosh +Link: https://lore.kernel.org/r/20210202134225.3217-3-livvy@base.nu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks-table.h | 57 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 57 insertions(+) + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 93d55cd1a5a4..1165a5ac60f2 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3817,6 +3817,63 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++{ ++ /* ++ * Pioneer DJ DJM-450 ++ * PCM is 8 channels out @ 48 fixed (endpoint 0x01) ++ * and 8 channels in @ 48 fixed (endpoint 0x82). ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0013), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, // outputs ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x01, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 48000 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, // inputs ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x82, ++ .ep_idx = 1, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 48000 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + #undef USB_DEVICE_VENDOR_SPEC + #undef USB_AUDIO_DEVICE +-- +2.30.1 + diff --git a/queue-5.11/alsa-usb-audio-add-djm450-to-pioneer-format-quirk.patch b/queue-5.11/alsa-usb-audio-add-djm450-to-pioneer-format-quirk.patch new file mode 100644 index 00000000000..dc61cb79615 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-add-djm450-to-pioneer-format-quirk.patch @@ -0,0 +1,69 @@ +From 6474cb6231ac31b955e4af36e4324981826ee7fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 13:42:26 +0000 +Subject: ALSA: usb-audio: Add DJM450 to Pioneer format quirk + +From: Olivia Mackintosh + +[ Upstream commit 3b85f5fc75d564a9eb4171dcb6b8687b080cd4d5 ] + +Like the DJM-750, ensure that the format control message is passed to +the device when opening a stream. It seems as though fmt->sync_ep is not +always set when this function is called hence the passing of the value +at the call site. If this can be fixed, fmt->sync_up should be used as +the wvalue. + +There doesn't seem to be a "cpu_to_le24" type function defined hence for +the open code but I did see a similar thing done in Bluez lib. Perhaps +we can get these definitions defined in byteorder.h. See hci_cpu_to_le24 +in include/net/bluetooth/hci.h:2543 for similar usage. + +Signed-off-by: Olivia Mackintosh +Link: https://lore.kernel.org/r/20210202134225.3217-2-livvy@base.nu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index e196e364cef1..9ba4682ebc48 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1470,6 +1470,23 @@ static void set_format_emu_quirk(struct snd_usb_substream *subs, + subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0; + } + ++static int pioneer_djm_set_format_quirk(struct snd_usb_substream *subs, ++ u16 windex) ++{ ++ unsigned int cur_rate = subs->data_endpoint->cur_rate; ++ u8 sr[3]; ++ // Convert to little endian ++ sr[0] = cur_rate & 0xff; ++ sr[1] = (cur_rate >> 8) & 0xff; ++ sr[2] = (cur_rate >> 16) & 0xff; ++ usb_set_interface(subs->dev, 0, 1); ++ // we should derive windex from fmt-sync_ep but it's not set ++ snd_usb_ctl_msg(subs->stream->chip->dev, ++ usb_rcvctrlpipe(subs->stream->chip->dev, 0), ++ 0x01, 0x22, 0x0100, windex, &sr, 0x0003); ++ return 0; ++} ++ + void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + const struct audioformat *fmt) + { +@@ -1483,6 +1500,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ + subs->stream_offset_adj = 2; + break; ++ case USB_ID(0x2b73, 0x0013): /* Pioneer DJM-450 */ ++ pioneer_djm_set_format_quirk(subs, 0x0082); ++ break; + } + } + +-- +2.30.1 + diff --git a/queue-5.11/alsa-usb-audio-add-support-for-pioneer-djm-750.patch b/queue-5.11/alsa-usb-audio-add-support-for-pioneer-djm-750.patch new file mode 100644 index 00000000000..d8fb318e39e --- /dev/null +++ b/queue-5.11/alsa-usb-audio-add-support-for-pioneer-djm-750.patch @@ -0,0 +1,114 @@ +From 683d92320b131177fd7a67075e2835781544f8a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 13:06:21 +0000 +Subject: ALSA: usb-audio: Add support for Pioneer DJM-750 + +From: Olivia Mackintosh + +[ Upstream commit b952ac76a20bc0b23cd7e22de19fb407713238a3 ] + +This adds the Pioneer DJ DJM-750 to the quirks table and ensures +skip_pioneer_sync_ep() is (also) called: this device uses the vendor +ID of 0x08e4 (I'm not sure why they use multiple vendor IDs but many +just like to be awkward it seems). + +Playback on all 8 channels works. I'll likely keep this working in the +future and submit futher patches and improvements as necessary. + +Signed-off-by: Olivia Mackintosh +Link: https://lore.kernel.org/r/20210118130621.77miiie47wp7mump@base.nu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/implicit.c | 3 +- + sound/usb/quirks-table.h | 60 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 62 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index bba54430e6d0..11a85e66aa96 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -304,7 +304,8 @@ static int audioformat_implicit_fb_quirk(struct snd_usb_audio *chip, + /* Pioneer devices with vendor spec class */ + if (attr == USB_ENDPOINT_SYNC_ASYNC && + alts->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC && +- USB_ID_VENDOR(chip->usb_id) == 0x2b73 /* Pioneer */) { ++ (USB_ID_VENDOR(chip->usb_id) == 0x2b73 || /* Pioneer */ ++ USB_ID_VENDOR(chip->usb_id) == 0x08e4 /* Pioneer */)) { + if (skip_pioneer_sync_ep(chip, fmt, alts)) + return 1; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index c8a4bdf18207..93d55cd1a5a4 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3757,6 +3757,66 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++{ ++ /* ++ * Pioneer DJ DJM-750 ++ * 8 channels playback & 8 channels capture @ 44.1/48/96kHz S24LE ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x08e4, 0x017f), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x05, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_44100| ++ SNDRV_PCM_RATE_48000| ++ SNDRV_PCM_RATE_96000, ++ .rate_min = 44100, ++ .rate_max = 96000, ++ .nr_rates = 3, ++ .rate_table = (unsigned int[]) { 44100, 48000, 96000 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x86, ++ .ep_idx = 1, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_44100| ++ SNDRV_PCM_RATE_48000| ++ SNDRV_PCM_RATE_96000, ++ .rate_min = 44100, ++ .rate_max = 96000, ++ .nr_rates = 3, ++ .rate_table = (unsigned int[]) { 44100, 48000, 96000 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + #undef USB_DEVICE_VENDOR_SPEC + #undef USB_AUDIO_DEVICE +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-add-dmi-quirk-table-to-soc_intel_is_byt_c.patch b/queue-5.11/asoc-intel-add-dmi-quirk-table-to-soc_intel_is_byt_c.patch new file mode 100644 index 00000000000..6d455ec3cfe --- /dev/null +++ b/queue-5.11/asoc-intel-add-dmi-quirk-table-to-soc_intel_is_byt_c.patch @@ -0,0 +1,82 @@ +From 8e1ebd96dc6f2bee6b9835e92ce695af88a99a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 22:49:56 +0100 +Subject: ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr() + +From: Hans de Goede + +[ Upstream commit 8ade6d8b02b1ead741bd4f6c42921035caab6560 ] + +Some Bay Trail systems: +1. Use a non CR version of the Bay Trail SoC +2. Contain at least 6 interrupt resources so that the + platform_get_resource(pdev, IORESOURCE_IRQ, 5) check to workaround + non CR systems which list their IPC IRQ at index 0 despite being + non CR does not work +3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5 + +Add a DMI quirk table to check for the few known models with this issue, +so that the right IPC IRQ index is used on these systems. + +Reviewed-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210120214957.140232-5-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-intel-quirks.h | 25 +++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/sound/soc/intel/common/soc-intel-quirks.h b/sound/soc/intel/common/soc-intel-quirks.h +index b07df3059926..a93987ab7f4d 100644 +--- a/sound/soc/intel/common/soc-intel-quirks.h ++++ b/sound/soc/intel/common/soc-intel-quirks.h +@@ -11,6 +11,7 @@ + + #if IS_ENABLED(CONFIG_X86) + ++#include + #include + #include + #include +@@ -38,12 +39,36 @@ SOC_INTEL_IS_CPU(cml, KABYLAKE_L); + + static inline bool soc_intel_is_byt_cr(struct platform_device *pdev) + { ++ /* ++ * List of systems which: ++ * 1. Use a non CR version of the Bay Trail SoC ++ * 2. Contain at least 6 interrupt resources so that the ++ * platform_get_resource(pdev, IORESOURCE_IRQ, 5) check below ++ * succeeds ++ * 3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5 ++ * ++ * This needs to be here so that it can be shared between the SST and ++ * SOF drivers. We rely on the compiler to optimize this out in files ++ * where soc_intel_is_byt_cr is not used. ++ */ ++ static const struct dmi_system_id force_bytcr_table[] = { ++ { /* Lenovo Yoga Tablet 2 series */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "YOGATablet2"), ++ }, ++ }, ++ {} ++ }; + struct device *dev = &pdev->dev; + int status = 0; + + if (!soc_intel_is_byt()) + return false; + ++ if (dmi_check_system(force_bytcr_table)) ++ return true; ++ + if (iosf_mbi_available()) { + u32 bios_status; + +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-bytcr_rt5640-add-new-byt_rt5640_no_speake.patch b/queue-5.11/asoc-intel-bytcr_rt5640-add-new-byt_rt5640_no_speake.patch new file mode 100644 index 00000000000..aa66031ed7a --- /dev/null +++ b/queue-5.11/asoc-intel-bytcr_rt5640-add-new-byt_rt5640_no_speake.patch @@ -0,0 +1,106 @@ +From 134cbaf2d9ee78c43486948e5c7f4105d35cc699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Jan 2021 22:01:17 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add new BYT_RT5640_NO_SPEAKERS quirk-flag + +From: Hans de Goede + +[ Upstream commit 1851ccf9e155b2a6f6cca1a7bd49325f5efbd5d2 ] + +Some devices, like mini PCs/media/top-set boxes do not have any speakers +at all, an example of the is the Mele PCG03 Mini PC. + +Add a new BYT_RT5640_NO_SPEAKERS quirk-flag which when sets does not add +speaker routes and modifies the components and the (optional) long_name +strings to reflect that there are no speakers. + +Cc: Rasmus Porsager +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210109210119.159032-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 5520d7c80019..dce2df30d4c5 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -71,6 +71,7 @@ enum { + #define BYT_RT5640_SSP0_AIF2 BIT(21) + #define BYT_RT5640_MCLK_EN BIT(22) + #define BYT_RT5640_MCLK_25MHZ BIT(23) ++#define BYT_RT5640_NO_SPEAKERS BIT(24) + + #define BYTCR_INPUT_DEFAULTS \ + (BYT_RT5640_IN3_MAP | \ +@@ -132,6 +133,8 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk JD_NOT_INV enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) + dev_info(dev, "quirk MONO_SPEAKER enabled\n"); ++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) ++ dev_info(dev, "quirk NO_SPEAKERS enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC) + dev_info(dev, "quirk DIFF_MIC enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) { +@@ -946,7 +949,7 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime) + ret = snd_soc_dapm_add_routes(&card->dapm, + byt_rt5640_mono_spk_map, + ARRAY_SIZE(byt_rt5640_mono_spk_map)); +- } else { ++ } else if (!(byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS)) { + ret = snd_soc_dapm_add_routes(&card->dapm, + byt_rt5640_stereo_spk_map, + ARRAY_SIZE(byt_rt5640_stereo_spk_map)); +@@ -1188,6 +1191,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + static const char * const map_name[] = { "dmic1", "dmic2", "in1", "in3" }; ++ __maybe_unused const char *spk_type; + const struct dmi_system_id *dmi_id; + struct byt_rt5640_private *priv; + struct snd_soc_acpi_mach *mach; +@@ -1196,7 +1200,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + bool sof_parent; + int ret_val = 0; + int dai_index = 0; +- int i; ++ int i, cfg_spk; + + is_bytcr = false; + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); +@@ -1335,16 +1339,24 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + } + } + ++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) { ++ cfg_spk = 0; ++ spk_type = "none"; ++ } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) { ++ cfg_spk = 1; ++ spk_type = "mono"; ++ } else { ++ cfg_spk = 2; ++ spk_type = "stereo"; ++ } ++ + snprintf(byt_rt5640_components, sizeof(byt_rt5640_components), +- "cfg-spk:%s cfg-mic:%s", +- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ? "1" : "2", ++ "cfg-spk:%d cfg-mic:%s", cfg_spk, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]); + byt_rt5640_card.components = byt_rt5640_components; + #if !IS_ENABLED(CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES) + snprintf(byt_rt5640_long_name, sizeof(byt_rt5640_long_name), +- "bytcr-rt5640-%s-spk-%s-mic", +- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ? +- "mono" : "stereo", ++ "bytcr-rt5640-%s-spk-%s-mic", spk_type, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]); + byt_rt5640_card.long_name = byt_rt5640_long_name; + #endif +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-acer-one-s.patch b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-acer-one-s.patch new file mode 100644 index 00000000000..d5ff3c7e311 --- /dev/null +++ b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-acer-one-s.patch @@ -0,0 +1,55 @@ +From 84c3c97ae7b80c34fc5756d67d38c1e0679453bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 22:35:55 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet + +From: Hans de Goede + +[ Upstream commit c58947af08aedbdee0fce5ea6e6bf3e488ae0e2c ] + +The Acer One S1002 tablet is using an analog mic on IN1 and has +its jack-detect connected to JD2_IN4N, instead of using the default +IN3 for its internal mic and JD1_IN4P for jack-detect. + +Note it is also using AIF2 instead of AIF1 which is somewhat unusual, +this is correctly advertised in the ACPI CHAN package, so the speakers +do work without the quirk. + +Add a quirk for the mic and jack-detect settings. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210216213555.36555-5-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index ba8ea651a22e..f00d4e417b6c 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -402,6 +402,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Acer One 10 S1002 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "One S1002"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF2 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-estar-beau.patch b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-estar-beau.patch new file mode 100644 index 00000000000..524d2d3c7c4 --- /dev/null +++ b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-estar-beau.patch @@ -0,0 +1,49 @@ +From 952f020365a885b0319fcc60d4a702d4b9eefd04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 22:35:52 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID + 7316R tablet + +From: Hans de Goede + +[ Upstream commit bdea43fc0436c9e98fdfe151c2ed8a3fc7277404 ] + +The Estar Beauty HD MID 7316R tablet almost fully works with out default +settings. The only problem is that it has only 1 speaker so any sounds +only playing on the right channel get lost. + +Add a quirk for this model using the default settings + MONO_SPEAKER. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210216213555.36555-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index dce2df30d4c5..ee41f41c8184 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -527,6 +527,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_MCLK_EN), + }, ++ { /* Estar Beauty HD MID 7316R */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-voyo-winpa.patch b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-voyo-winpa.patch new file mode 100644 index 00000000000..6ab8f51d2f9 --- /dev/null +++ b/queue-5.11/asoc-intel-bytcr_rt5640-add-quirk-for-the-voyo-winpa.patch @@ -0,0 +1,50 @@ +From bc93e14c60c3300668ff456bcaf54b8412124384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 22:35:53 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 tablet + +From: Hans de Goede + +[ Upstream commit e1317cc9ca4ac20262895fddb065ffda4fc29cfb ] + +The Voyo Winpad A15 tablet uses a Bay Trail (non CR) SoC, so it is using +SSP2 (AIF1) and it mostly works with the defaults. But instead of using +DMIC1 it is using an analog mic on IN1, add a quirk for this. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210216213555.36555-3-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index ee41f41c8184..ba8ea651a22e 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -811,6 +811,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Voyo Winpad A15 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Catch-all for generic Insyde tablets, must be last */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-bytcr_rt5651-add-quirk-for-the-jumper-ezp.patch b/queue-5.11/asoc-intel-bytcr_rt5651-add-quirk-for-the-jumper-ezp.patch new file mode 100644 index 00000000000..d8bf4273cab --- /dev/null +++ b/queue-5.11/asoc-intel-bytcr_rt5651-add-quirk-for-the-jumper-ezp.patch @@ -0,0 +1,53 @@ +From 8e58b14b4ee633cb399a3a2c3f0fef5e67292cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 22:35:54 +0100 +Subject: ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet + +From: Hans de Goede + +[ Upstream commit df8359c512fa770ffa6b0b0309807d9b9825a47f ] + +Add a DMI quirk for the Jumper EZpad 7 tablet, this tablet has +a jack-detect switch which reads 1/high when a jack is inserted, +rather then using the standard active-low setup which most +jack-detect switches use. All other settings are using the defaults. + +Add a DMI-quirk setting the defaults + the BYT_RT5651_JD_NOT_INV +flags for this. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210216213555.36555-4-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index f289ec8563a1..148b7b1bd3e8 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -435,6 +435,19 @@ static const struct dmi_system_id byt_rt5651_quirk_table[] = { + BYT_RT5651_SSP0_AIF1 | + BYT_RT5651_MONO_SPEAKER), + }, ++ { ++ /* Jumper EZpad 7 */ ++ .callback = byt_rt5651_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Jumper"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "EZpad"), ++ /* Jumper12x.WJ2012.bsBKRCP05 with the version dropped */ ++ DMI_MATCH(DMI_BIOS_VERSION, "Jumper12x.WJ2012.bsBKRCP"), ++ }, ++ .driver_data = (void *)(BYT_RT5651_DEFAULT_QUIRKS | ++ BYT_RT5651_IN2_MAP | ++ BYT_RT5651_JD_NOT_INV), ++ }, + { + /* KIANO SlimNote 14.2 */ + .callback = byt_rt5651_quirk_cb, +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-sof-sdw-indent-and-add-quirks-consistentl.patch b/queue-5.11/asoc-intel-sof-sdw-indent-and-add-quirks-consistentl.patch new file mode 100644 index 00000000000..87980743037 --- /dev/null +++ b/queue-5.11/asoc-intel-sof-sdw-indent-and-add-quirks-consistentl.patch @@ -0,0 +1,62 @@ +From c25684e77b5ded8468599234c1f4a7fdae28b101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 17:33:27 -0600 +Subject: ASoC: Intel: sof-sdw: indent and add quirks consistently + +From: Pierre-Louis Bossart + +[ Upstream commit 8caf37e2be761688c396c609880936a807af490f ] + +Use the same style for all quirks to avoid misses and errors + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20210208233336.59449-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 152ea166eeae..c64c0d5c5751 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -126,9 +126,10 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, + "Tiger Lake Client Platform"), + }, +- .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | +- SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | +- SOF_SSP_PORT(SOF_I2S_SSP2)), ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD1 | ++ SOF_SDW_PCH_DMIC | ++ SOF_SSP_PORT(SOF_I2S_SSP2)), + }, + { + .callback = sof_sdw_quirk_cb, +@@ -152,7 +153,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Google"), + DMI_MATCH(DMI_PRODUCT_NAME, "Volteer"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, + { +@@ -161,7 +163,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Google"), + DMI_MATCH(DMI_PRODUCT_NAME, "Ripto"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, + +-- +2.30.1 + diff --git a/queue-5.11/asoc-intel-sof_sdw-detect-dmic-number-based-on-mach-.patch b/queue-5.11/asoc-intel-sof_sdw-detect-dmic-number-based-on-mach-.patch new file mode 100644 index 00000000000..af58c2208ed --- /dev/null +++ b/queue-5.11/asoc-intel-sof_sdw-detect-dmic-number-based-on-mach-.patch @@ -0,0 +1,41 @@ +From 7836adf61a78e911de12486d244c431c40d91fa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 17:33:30 -0600 +Subject: ASoC: Intel: sof_sdw: detect DMIC number based on mach params + +From: Rander Wang + +[ Upstream commit f88dcb9b98d3f86ead04d2453475267910448bb8 ] + +Current driver create DMIC dai based on quirk for each platforms, +so we need to add quirk for new platforms. Now driver reports DMIC +number to machine driver and machine driver can create DMIC dai based +on this information. The old check is reserved for some platforms +may be failed to set the DMIC number in BIOS. + +Reviewed-by: Bard Liao +Signed-off-by: Rander Wang +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210208233336.59449-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index c64c0d5c5751..daca06dde99b 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -936,7 +936,7 @@ static int sof_card_dai_links_create(struct device *dev, + ctx->idisp_codec = true; + + /* enable dmic01 & dmic16k */ +- dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC) ? 2 : 0; ++ dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC || mach_params->dmic_num) ? 2 : 0; + comp_num += dmic_num; + + dev_dbg(dev, "sdw %d, ssp %d, dmic %d, hdmi %d", sdw_be_num, ssp_num, +-- +2.30.1 + diff --git a/queue-5.11/ath10k-fix-wmi-mgmt-tx-queue-full-due-to-race-condit.patch b/queue-5.11/ath10k-fix-wmi-mgmt-tx-queue-full-due-to-race-condit.patch new file mode 100644 index 00000000000..b3f3a5a4dcf --- /dev/null +++ b/queue-5.11/ath10k-fix-wmi-mgmt-tx-queue-full-due-to-race-condit.patch @@ -0,0 +1,93 @@ +From c342834cd315ac5c7c326c022e467a876fadd70d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Dec 2020 14:34:47 +0800 +Subject: ath10k: fix wmi mgmt tx queue full due to race condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miaoqing Pan + +[ Upstream commit b55379e343a3472c35f4a1245906db5158cab453 ] + +Failed to transmit wmi management frames: + +[84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full +[84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28 +[84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28 +[84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28 + +This issue is caused by race condition between skb_dequeue and +__skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a +different lock: ar->data_lock vs list->lock, the result is no protection. +So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt() +running concurrently on different CPUs, there appear to be a rare corner +cases when the queue length is 1, + + CPUx (skb_deuque) CPUy (__skb_queue_tail) + next=list + prev=list + struct sk_buff *skb = skb_peek(list); WRITE_ONCE(newsk->next, next); + WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev); + next = skb->next; WRITE_ONCE(next->prev, newsk); + prev = skb->prev; WRITE_ONCE(prev->next, newsk); + skb->next = skb->prev = NULL; list->qlen++; + WRITE_ONCE(next->prev, prev); + WRITE_ONCE(prev->next, next); + +If the instruction ‘next = skb->next’ is executed before +‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the +old ‘next’ pointer, but the length is still added by one. The final +result is the length of the queue will reach the maximum value but +the queue is empty. + +So remove ar->data_lock, and use 'skb_queue_tail' instead of +'__skb_queue_tail' to prevent the potential race condition. Also switch +to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously. + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1 + +Signed-off-by: Miaoqing Pan +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1608618887-8857-1-git-send-email-miaoqing@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index e815aab412d7..9a56a0a5f85d 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3763,23 +3763,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar) + static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb) + { + struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue; +- int ret = 0; +- +- spin_lock_bh(&ar->data_lock); + +- if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) { ++ if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) { + ath10k_warn(ar, "wmi mgmt tx queue is full\n"); +- ret = -ENOSPC; +- goto unlock; ++ return -ENOSPC; + } + +- __skb_queue_tail(q, skb); ++ skb_queue_tail(q, skb); + ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work); + +-unlock: +- spin_unlock_bh(&ar->data_lock); +- +- return ret; ++ return 0; + } + + static enum ath10k_mac_tx_path +-- +2.30.1 + diff --git a/queue-5.11/ath10k-prevent-deinitializing-napi-twice.patch b/queue-5.11/ath10k-prevent-deinitializing-napi-twice.patch new file mode 100644 index 00000000000..cb0cdf74e91 --- /dev/null +++ b/queue-5.11/ath10k-prevent-deinitializing-napi-twice.patch @@ -0,0 +1,379 @@ +From 7c49fa64bae10302ecd90f6fa859532791a4032a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 08:35:04 +0200 +Subject: ath10k: prevent deinitializing NAPI twice + +From: Wen Gong + +[ Upstream commit e2f8b74e58cb1560c1399ba94a470b770e858259 ] + +It happened "Kernel panic - not syncing: hung_task: blocked tasks" when +test simulate crash and ifconfig down/rmmod meanwhile. + +Test steps: + +1.Test commands, either can reproduce the hang for PCIe, SDIO and SNOC. +echo soft > /sys/kernel/debug/ieee80211/phy0/ath10k/simulate_fw_crash;sleep 0.05;ifconfig wlan0 down +echo soft > /sys/kernel/debug/ieee80211/phy0/ath10k/simulate_fw_crash;rmmod ath10k_sdio +echo hw-restart > /sys/kernel/debug/ieee80211/phy0/ath10k/simulate_fw_crash;rmmod ath10k_pci + +2. dmesg: +[ 5622.548630] ath10k_sdio mmc1:0001:1: simulating soft firmware crash +[ 5622.655995] ieee80211 phy0: Hardware restart was requested +[ 5776.355164] INFO: task shill:1572 blocked for more than 122 seconds. +[ 5776.355687] INFO: task kworker/1:2:24437 blocked for more than 122 seconds. +[ 5776.359812] Kernel panic - not syncing: hung_task: blocked tasks +[ 5776.359836] CPU: 1 PID: 55 Comm: khungtaskd Tainted: G W 4.19.86 #137 +[ 5776.359846] Hardware name: MediaTek krane sku176 board (DT) +[ 5776.359855] Call trace: +[ 5776.359868] dump_backtrace+0x0/0x170 +[ 5776.359881] show_stack+0x20/0x2c +[ 5776.359896] dump_stack+0xd4/0x10c +[ 5776.359916] panic+0x12c/0x29c +[ 5776.359937] hung_task_panic+0x0/0x50 +[ 5776.359953] kthread+0x120/0x130 +[ 5776.359965] ret_from_fork+0x10/0x18 +[ 5776.359986] SMP: stopping secondary CPUs +[ 5776.360012] Kernel Offset: 0x141ea00000 from 0xffffff8008000000 +[ 5776.360026] CPU features: 0x0,2188200c +[ 5776.360035] Memory Limit: none + +command "ifconfig wlan0 down" or "rmmod ath10k_sdio" will be blocked +callstack of ifconfig: +[<0>] __switch_to+0x120/0x13c +[<0>] msleep+0x28/0x38 +[<0>] ath10k_sdio_hif_stop+0x24c/0x294 [ath10k_sdio] +[<0>] ath10k_core_stop+0x50/0x78 [ath10k_core] +[<0>] ath10k_halt+0x120/0x178 [ath10k_core] +[<0>] ath10k_stop+0x4c/0x8c [ath10k_core] +[<0>] drv_stop+0xe0/0x1e4 [mac80211] +[<0>] ieee80211_stop_device+0x48/0x54 [mac80211] +[<0>] ieee80211_do_stop+0x678/0x6f8 [mac80211] +[<0>] ieee80211_stop+0x20/0x30 [mac80211] +[<0>] __dev_close_many+0xb8/0x11c +[<0>] __dev_change_flags+0xe0/0x1d0 +[<0>] dev_change_flags+0x30/0x6c +[<0>] devinet_ioctl+0x370/0x564 +[<0>] inet_ioctl+0xdc/0x304 +[<0>] sock_do_ioctl+0x50/0x288 +[<0>] compat_sock_ioctl+0x1b4/0x1aac +[<0>] __se_compat_sys_ioctl+0x100/0x26fc +[<0>] __arm64_compat_sys_ioctl+0x20/0x2c +[<0>] el0_svc_common+0xa4/0x154 +[<0>] el0_svc_compat_handler+0x2c/0x38 +[<0>] el0_svc_compat+0x8/0x18 +[<0>] 0xffffffffffffffff + +callstack of rmmod: +[<0>] __switch_to+0x120/0x13c +[<0>] msleep+0x28/0x38 +[<0>] ath10k_sdio_hif_stop+0x294/0x31c [ath10k_sdio] +[<0>] ath10k_core_stop+0x50/0x78 [ath10k_core] +[<0>] ath10k_halt+0x120/0x178 [ath10k_core] +[<0>] ath10k_stop+0x4c/0x8c [ath10k_core] +[<0>] drv_stop+0xe0/0x1e4 [mac80211] +[<0>] ieee80211_stop_device+0x48/0x54 [mac80211] +[<0>] ieee80211_do_stop+0x678/0x6f8 [mac80211] +[<0>] ieee80211_stop+0x20/0x30 [mac80211] +[<0>] __dev_close_many+0xb8/0x11c +[<0>] dev_close_many+0x70/0x100 +[<0>] dev_close+0x4c/0x80 +[<0>] cfg80211_shutdown_all_interfaces+0x50/0xcc [cfg80211] +[<0>] ieee80211_remove_interfaces+0x58/0x1a0 [mac80211] +[<0>] ieee80211_unregister_hw+0x40/0x100 [mac80211] +[<0>] ath10k_mac_unregister+0x1c/0x44 [ath10k_core] +[<0>] ath10k_core_unregister+0x38/0x7c [ath10k_core] +[<0>] ath10k_sdio_remove+0x8c/0xd0 [ath10k_sdio] +[<0>] sdio_bus_remove+0x48/0x108 +[<0>] device_release_driver_internal+0x138/0x1ec +[<0>] driver_detach+0x6c/0xa8 +[<0>] bus_remove_driver+0x78/0xa8 +[<0>] driver_unregister+0x30/0x50 +[<0>] sdio_unregister_driver+0x28/0x34 +[<0>] cleanup_module+0x14/0x6bc [ath10k_sdio] +[<0>] __arm64_sys_delete_module+0x1e0/0x22c +[<0>] el0_svc_common+0xa4/0x154 +[<0>] el0_svc_compat_handler+0x2c/0x38 +[<0>] el0_svc_compat+0x8/0x18 +[<0>] 0xffffffffffffffff + +SNOC: +[ 647.156863] Call trace: +[ 647.162166] [] __switch_to+0x120/0x13c +[ 647.164512] [] __schedule+0x5ec/0x798 +[ 647.170062] [] schedule+0x74/0x94 +[ 647.175050] [] schedule_timeout+0x314/0x42c +[ 647.179874] [] schedule_timeout_uninterruptible+0x34/0x40 +[ 647.185780] [] msleep+0x28/0x38 +[ 647.192546] [] ath10k_snoc_hif_stop+0x4c/0x1e0 [ath10k_snoc] +[ 647.197439] [] ath10k_core_stop+0x50/0x7c [ath10k_core] +[ 647.204652] [] ath10k_halt+0x114/0x16c [ath10k_core] +[ 647.211420] [] ath10k_stop+0x4c/0x88 [ath10k_core] +[ 647.217865] [] drv_stop+0x110/0x244 [mac80211] +[ 647.224367] [] ieee80211_stop_device+0x48/0x54 [mac80211] +[ 647.230359] [] ieee80211_do_stop+0x6a4/0x73c [mac80211] +[ 647.237033] [] ieee80211_stop+0x20/0x30 [mac80211] +[ 647.243942] [] __dev_close_many+0xa0/0xfc +[ 647.250435] [] dev_close_many+0x70/0x100 +[ 647.255651] [] dev_close+0x4c/0x80 +[ 647.261244] [] cfg80211_shutdown_all_interfaces+0x44/0xcc [cfg80211] +[ 647.266383] [] ieee80211_remove_interfaces+0x58/0x1b4 [mac80211] +[ 647.274128] [] ieee80211_unregister_hw+0x50/0x120 [mac80211] +[ 647.281659] [] ath10k_mac_unregister+0x1c/0x44 [ath10k_core] +[ 647.288839] [] ath10k_core_unregister+0x48/0x90 [ath10k_core] +[ 647.296027] [] ath10k_snoc_remove+0x5c/0x150 [ath10k_snoc] +[ 647.303229] [] platform_drv_remove+0x28/0x50 +[ 647.310517] [] device_release_driver_internal+0x114/0x1b8 +[ 647.316257] [] driver_detach+0x6c/0xa8 +[ 647.323021] [] bus_remove_driver+0x78/0xa8 +[ 647.328571] [] driver_unregister+0x30/0x50 +[ 647.334213] [] platform_driver_unregister+0x1c/0x28 +[ 647.339876] [] cleanup_module+0x1c/0x120 [ath10k_snoc] +[ 647.346196] [] SyS_delete_module+0x1dc/0x22c + +PCIe: +[ 615.392770] rmmod D 0 3523 3458 0x00000080 +[ 615.392777] Call Trace: +[ 615.392784] __schedule+0x617/0x7d3 +[ 615.392791] ? __mod_timer+0x263/0x35c +[ 615.392797] schedule+0x62/0x72 +[ 615.392803] schedule_timeout+0x8d/0xf3 +[ 615.392809] ? run_local_timers+0x6b/0x6b +[ 615.392814] msleep+0x1b/0x22 +[ 615.392824] ath10k_pci_hif_stop+0x68/0xd6 [ath10k_pci] +[ 615.392844] ath10k_core_stop+0x44/0x67 [ath10k_core] +[ 615.392859] ath10k_halt+0x102/0x153 [ath10k_core] +[ 615.392873] ath10k_stop+0x38/0x75 [ath10k_core] +[ 615.392893] drv_stop+0x9a/0x13c [mac80211] +[ 615.392915] ieee80211_do_stop+0x772/0x7cd [mac80211] +[ 615.392937] ieee80211_stop+0x1a/0x1e [mac80211] +[ 615.392945] __dev_close_many+0x9e/0xf0 +[ 615.392952] dev_close_many+0x62/0xe8 +[ 615.392958] dev_close+0x54/0x7d +[ 615.392975] cfg80211_shutdown_all_interfaces+0x6e/0xa5 [cfg80211] +[ 615.393021] ieee80211_remove_interfaces+0x52/0x1aa [mac80211] +[ 615.393049] ieee80211_unregister_hw+0x54/0x136 [mac80211] +[ 615.393068] ath10k_mac_unregister+0x19/0x4a [ath10k_core] +[ 615.393091] ath10k_core_unregister+0x39/0x7e [ath10k_core] +[ 615.393104] ath10k_pci_remove+0x3d/0x7f [ath10k_pci] +[ 615.393117] pci_device_remove+0x41/0xa6 +[ 615.393129] device_release_driver_internal+0x123/0x1ec +[ 615.393140] driver_detach+0x60/0x90 +[ 615.393152] bus_remove_driver+0x72/0x9f +[ 615.393164] pci_unregister_driver+0x1e/0x87 +[ 615.393177] SyS_delete_module+0x1d7/0x277 +[ 615.393188] do_syscall_64+0x6b/0xf7 +[ 615.393199] entry_SYSCALL_64_after_hwframe+0x41/0xa6 + +The test command run simulate_fw_crash firstly and it call into +ath10k_sdio_hif_stop from ath10k_core_restart, then napi_disable +is called and bit NAPI_STATE_SCHED is set. After that, function +ath10k_sdio_hif_stop is called again from ath10k_stop by command +"ifconfig wlan0 down" or "rmmod ath10k_sdio", then command blocked. + +It is blocked by napi_synchronize, napi_disable will set bit with +NAPI_STATE_SCHED, and then napi_synchronize will enter dead loop +becuase bit NAPI_STATE_SCHED is set by napi_disable. + +function of napi_synchronize +static inline void napi_synchronize(const struct napi_struct *n) +{ + if (IS_ENABLED(CONFIG_SMP)) + while (test_bit(NAPI_STATE_SCHED, &n->state)) + msleep(1); + else + barrier(); +} + +function of napi_disable +void napi_disable(struct napi_struct *n) +{ + might_sleep(); + set_bit(NAPI_STATE_DISABLE, &n->state); + + while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) + msleep(1); + while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) + msleep(1); + + hrtimer_cancel(&n->timer); + + clear_bit(NAPI_STATE_DISABLE, &n->state); +} + +Add flag for it avoid the hang and crash. + +Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 +Tested-on: WCN3990 hw1.0 SNOC hw1.0 WLAN.HL.3.1-01307.1-QCAHLSWMTPL-2 + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1598617348-2325-1-git-send-email-wgong@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/ahb.c | 5 ++--- + drivers/net/wireless/ath/ath10k/core.c | 25 +++++++++++++++++++++++++ + drivers/net/wireless/ath/ath10k/core.h | 5 +++++ + drivers/net/wireless/ath/ath10k/pci.c | 7 ++++--- + drivers/net/wireless/ath/ath10k/sdio.c | 5 ++--- + drivers/net/wireless/ath/ath10k/snoc.c | 6 +++--- + 6 files changed, 41 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c +index 05a61975c83f..869524852fba 100644 +--- a/drivers/net/wireless/ath/ath10k/ahb.c ++++ b/drivers/net/wireless/ath/ath10k/ahb.c +@@ -626,7 +626,7 @@ static int ath10k_ahb_hif_start(struct ath10k *ar) + { + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif start\n"); + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + ath10k_ce_enable_interrupts(ar); + ath10k_pci_enable_legacy_irq(ar); + +@@ -644,8 +644,7 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar) + ath10k_ahb_irq_disable(ar); + synchronize_irq(ar_ahb->irq); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + + ath10k_pci_flush(ar); + } +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index eeb6ff6aa2e1..a419ec7130f9 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -2305,6 +2305,31 @@ void ath10k_core_start_recovery(struct ath10k *ar) + } + EXPORT_SYMBOL(ath10k_core_start_recovery); + ++void ath10k_core_napi_enable(struct ath10k *ar) ++{ ++ lockdep_assert_held(&ar->conf_mutex); ++ ++ if (test_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags)) ++ return; ++ ++ napi_enable(&ar->napi); ++ set_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags); ++} ++EXPORT_SYMBOL(ath10k_core_napi_enable); ++ ++void ath10k_core_napi_sync_disable(struct ath10k *ar) ++{ ++ lockdep_assert_held(&ar->conf_mutex); ++ ++ if (!test_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags)) ++ return; ++ ++ napi_synchronize(&ar->napi); ++ napi_disable(&ar->napi); ++ clear_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags); ++} ++EXPORT_SYMBOL(ath10k_core_napi_sync_disable); ++ + static void ath10k_core_restart(struct work_struct *work) + { + struct ath10k *ar = container_of(work, struct ath10k, restart_work); +diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h +index 51f7e960e297..f4be6bfb2539 100644 +--- a/drivers/net/wireless/ath/ath10k/core.h ++++ b/drivers/net/wireless/ath/ath10k/core.h +@@ -868,6 +868,9 @@ enum ath10k_dev_flags { + + /* Indicates that ath10k device is during recovery process and not complete */ + ATH10K_FLAG_RESTARTING, ++ ++ /* protected by conf_mutex */ ++ ATH10K_FLAG_NAPI_ENABLED, + }; + + enum ath10k_cal_mode { +@@ -1308,6 +1311,8 @@ static inline bool ath10k_peer_stats_enabled(struct ath10k *ar) + + extern unsigned long ath10k_coredump_mask; + ++void ath10k_core_napi_sync_disable(struct ath10k *ar); ++void ath10k_core_napi_enable(struct ath10k *ar); + struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev, + enum ath10k_bus bus, + enum ath10k_hw_rev hw_rev, +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 2328df09875c..e7fde635e0ee 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1958,7 +1958,7 @@ static int ath10k_pci_hif_start(struct ath10k *ar) + + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n"); + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + + ath10k_pci_irq_enable(ar); + ath10k_pci_rx_post(ar); +@@ -2075,8 +2075,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + + ath10k_pci_irq_disable(ar); + ath10k_pci_irq_sync(ar); +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ++ ath10k_core_napi_sync_disable(ar); ++ + cancel_work_sync(&ar_pci->dump_work); + + /* Most likely the device has HTT Rx ring configured. The only way to +diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c +index c415090d1f37..b746052737e0 100644 +--- a/drivers/net/wireless/ath/ath10k/sdio.c ++++ b/drivers/net/wireless/ath/ath10k/sdio.c +@@ -1859,7 +1859,7 @@ static int ath10k_sdio_hif_start(struct ath10k *ar) + struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar); + int ret; + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + + /* Sleep 20 ms before HIF interrupts are disabled. + * This will give target plenty of time to process the BMI done +@@ -1992,8 +1992,7 @@ static void ath10k_sdio_hif_stop(struct ath10k *ar) + + spin_unlock_bh(&ar_sdio->wr_async_lock); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + } + + #ifdef CONFIG_PM +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index 1c3307e3b108..af7ecef6bcde 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -915,8 +915,7 @@ static void ath10k_snoc_hif_stop(struct ath10k *ar) + if (!test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags)) + ath10k_snoc_irq_disable(ar); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + ath10k_snoc_buffer_cleanup(ar); + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n"); + } +@@ -926,7 +925,8 @@ static int ath10k_snoc_hif_start(struct ath10k *ar) + struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar); + + bitmap_clear(ar_snoc->pending_ce_irqs, 0, CE_COUNT_MAX); +- napi_enable(&ar->napi); ++ ++ ath10k_core_napi_enable(ar); + ath10k_snoc_irq_enable(ar); + ath10k_snoc_rx_post(ar); + +-- +2.30.1 + diff --git a/queue-5.11/bluetooth-add-new-hci_quirk_no_suspend_notifier-quir.patch b/queue-5.11/bluetooth-add-new-hci_quirk_no_suspend_notifier-quir.patch new file mode 100644 index 00000000000..2a52ff33c41 --- /dev/null +++ b/queue-5.11/bluetooth-add-new-hci_quirk_no_suspend_notifier-quir.patch @@ -0,0 +1,92 @@ +From 93108410738c666c7853a4c8fe3b90899f69008c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 17:33:12 +0100 +Subject: Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk + +From: Hans de Goede + +[ Upstream commit 219991e6be7f4a31d471611e265b72f75b2d0538 ] + +Some devices, e.g. the RTL8723BS bluetooth part, some USB attached devices, +completely drop from the bus on a system-suspend. These devices will +have their driver unbound and rebound on resume (when the dropping of +the bus gets detected) and will show up as a new HCI after resume. + +These devices do not benefit from the suspend / resume handling work done +by the hci_suspend_notifier. At best this unnecessarily adds some time to +the suspend/resume time. But this may also actually cause problems, if the +code doing the driver unbinding runs after the pm-notifier then the +hci_suspend_notifier code will try to talk to a device which is now in +an uninitialized state. + +This commit adds a new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk which allows +drivers to opt-out of the hci_suspend_notifier when they know beforehand +that their device will be fully re-initialized / reprobed on resume. + +Signed-off-by: Hans de Goede +Reviewed-by: Abhishek Pandit-Subedi +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 8 ++++++++ + net/bluetooth/hci_core.c | 18 +++++++++++------- + 2 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index c1504aa3d9cf..ba2f439bc04d 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -238,6 +238,14 @@ enum { + * during the hdev->setup vendor callback. + */ + HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, ++ ++ /* ++ * When this quirk is set, then the hci_suspend_notifier is not ++ * registered. This is intended for devices which drop completely ++ * from the bus on system-suspend and which will show up as a new ++ * HCI after resume. ++ */ ++ HCI_QUIRK_NO_SUSPEND_NOTIFIER, + }; + + /* HCI device flags */ +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index ed3380db0217..6ea2e16c57bd 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3830,10 +3830,12 @@ int hci_register_dev(struct hci_dev *hdev) + hci_sock_dev_event(hdev, HCI_DEV_REG); + hci_dev_hold(hdev); + +- hdev->suspend_notifier.notifier_call = hci_suspend_notifier; +- error = register_pm_notifier(&hdev->suspend_notifier); +- if (error) +- goto err_wqueue; ++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { ++ hdev->suspend_notifier.notifier_call = hci_suspend_notifier; ++ error = register_pm_notifier(&hdev->suspend_notifier); ++ if (error) ++ goto err_wqueue; ++ } + + queue_work(hdev->req_workqueue, &hdev->power_on); + +@@ -3868,9 +3870,11 @@ void hci_unregister_dev(struct hci_dev *hdev) + + cancel_work_sync(&hdev->power_on); + +- hci_suspend_clear_tasks(hdev); +- unregister_pm_notifier(&hdev->suspend_notifier); +- cancel_work_sync(&hdev->suspend_prepare); ++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { ++ hci_suspend_clear_tasks(hdev); ++ unregister_pm_notifier(&hdev->suspend_notifier); ++ cancel_work_sync(&hdev->suspend_prepare); ++ } + + hci_dev_do_close(hdev); + +-- +2.30.1 + diff --git a/queue-5.11/bluetooth-btusb-fix-memory-leak-on-suspend-and-resum.patch b/queue-5.11/bluetooth-btusb-fix-memory-leak-on-suspend-and-resum.patch new file mode 100644 index 00000000000..5a314459b8c --- /dev/null +++ b/queue-5.11/bluetooth-btusb-fix-memory-leak-on-suspend-and-resum.patch @@ -0,0 +1,139 @@ +From c1fe9f4473aea06a0d24679346517157c9fce253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 16:51:47 +0530 +Subject: Bluetooth: btusb: fix memory leak on suspend and resume + +From: Vamshi K Sthambamkadi + +[ Upstream commit 5ff20cbe6752a5bc06ff58fee8aa11a0d5075819 ] + +kmemleak report: +unreferenced object 0xffff9b1127f00500 (size 208): + comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 60 ed 05 11 9b ff ff 00 00 00 00 00 00 00 00 .`.............. + backtrace: + [<000000006ab3fd59>] kmem_cache_alloc_node+0x17a/0x480 + [<0000000051a5f6f9>] __alloc_skb+0x5b/0x1d0 + [<0000000037e2d252>] hci_prepare_cmd+0x32/0xc0 [bluetooth] + [<0000000010b586d5>] hci_req_add_ev+0x84/0xe0 [bluetooth] + [<00000000d2deb520>] hci_req_clear_event_filter+0x42/0x70 [bluetooth] + [<00000000f864bd8c>] hci_req_prepare_suspend+0x84/0x470 [bluetooth] + [<000000001deb2cc4>] hci_prepare_suspend+0x31/0x40 [bluetooth] + [<000000002677dd79>] process_one_work+0x209/0x3b0 + [<00000000aaa62b07>] worker_thread+0x34/0x400 + [<00000000826d176c>] kthread+0x126/0x140 + [<000000002305e558>] ret_from_fork+0x22/0x30 +unreferenced object 0xffff9b1125c6ee00 (size 512): + comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s) + hex dump (first 32 bytes): + 04 00 00 00 0d 00 00 00 05 0c 01 00 11 9b ff ff ................ + 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ + backtrace: + [<000000009f07c0cc>] slab_post_alloc_hook+0x59/0x270 + [<0000000049431dc2>] __kmalloc_node_track_caller+0x15f/0x330 + [<00000000027a42f6>] __kmalloc_reserve.isra.70+0x31/0x90 + [<00000000e8e3e76a>] __alloc_skb+0x87/0x1d0 + [<0000000037e2d252>] hci_prepare_cmd+0x32/0xc0 [bluetooth] + [<0000000010b586d5>] hci_req_add_ev+0x84/0xe0 [bluetooth] + [<00000000d2deb520>] hci_req_clear_event_filter+0x42/0x70 [bluetooth] + [<00000000f864bd8c>] hci_req_prepare_suspend+0x84/0x470 [bluetooth] + [<000000001deb2cc4>] hci_prepare_suspend+0x31/0x40 [bluetooth] + [<000000002677dd79>] process_one_work+0x209/0x3b0 + [<00000000aaa62b07>] worker_thread+0x34/0x400 + [<00000000826d176c>] kthread+0x126/0x140 + [<000000002305e558>] ret_from_fork+0x22/0x30 +unreferenced object 0xffff9b112b395788 (size 8): + comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s) + hex dump (first 8 bytes): + 20 00 00 00 00 00 04 00 ....... + backtrace: + [<0000000052dc28d2>] kmem_cache_alloc_trace+0x15e/0x460 + [<0000000046147591>] alloc_ctrl_urb+0x52/0xe0 [btusb] + [<00000000a2ed3e9e>] btusb_send_frame+0x91/0x100 [btusb] + [<000000001e66030e>] hci_send_frame+0x7e/0xf0 [bluetooth] + [<00000000bf6b7269>] hci_cmd_work+0xc5/0x130 [bluetooth] + [<000000002677dd79>] process_one_work+0x209/0x3b0 + [<00000000aaa62b07>] worker_thread+0x34/0x400 + [<00000000826d176c>] kthread+0x126/0x140 + [<000000002305e558>] ret_from_fork+0x22/0x30 + +In pm sleep-resume context, while the btusb device rebinds, it enters +hci_unregister_dev(), whilst there is a possibility of hdev receiving +PM_POST_SUSPEND suspend_notifier event, leading to generation of msg +frames. When hci_unregister_dev() completes, i.e. hdev context is +destroyed/freed, those intermittently sent msg frames cause memory +leak. + +BUG details: +Below is stack trace of thread that enters hci_unregister_dev(), marks +the hdev flag HCI_UNREGISTER to 1, and then goes onto to wait on notifier +lock - refer unregister_pm_notifier(). + + hci_unregister_dev+0xa5/0x320 [bluetoot] + btusb_disconnect+0x68/0x150 [btusb] + usb_unbind_interface+0x77/0x250 + ? kernfs_remove_by_name_ns+0x75/0xa0 + device_release_driver_internal+0xfe/0x1 + device_release_driver+0x12/0x20 + bus_remove_device+0xe1/0x150 + device_del+0x192/0x3e0 + ? usb_remove_ep_devs+0x1f/0x30 + usb_disable_device+0x92/0x1b0 + usb_disconnect+0xc2/0x270 + hub_event+0x9f6/0x15d0 + ? rpm_idle+0x23/0x360 + ? rpm_idle+0x26b/0x360 + process_one_work+0x209/0x3b0 + worker_thread+0x34/0x400 + ? process_one_work+0x3b0/0x3b0 + kthread+0x126/0x140 + ? kthread_park+0x90/0x90 + ret_from_fork+0x22/0x30 + +Below is stack trace of thread executing hci_suspend_notifier() which +processes the PM_POST_SUSPEND event, while the unbinding thread is +waiting on lock. + + hci_suspend_notifier.cold.39+0x5/0x2b [bluetooth] + blocking_notifier_call_chain+0x69/0x90 + pm_notifier_call_chain+0x1a/0x20 + pm_suspend.cold.9+0x334/0x352 + state_store+0x84/0xf0 + kobj_attr_store+0x12/0x20 + sysfs_kf_write+0x3b/0x40 + kernfs_fop_write+0xda/0x1c0 + vfs_write+0xbb/0x250 + ksys_write+0x61/0xe0 + __x64_sys_write+0x1a/0x20 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fix hci_suspend_notifer(), not to act on events when flag HCI_UNREGISTER +is set. + +Signed-off-by: Vamshi K Sthambamkadi +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 9f8573131b97..ed3380db0217 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3568,7 +3568,8 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, + } + + /* Suspend notifier should only act on events when powered. */ +- if (!hdev_is_powered(hdev)) ++ if (!hdev_is_powered(hdev) || ++ hci_dev_test_flag(hdev, HCI_UNREGISTER)) + goto done; + + if (action == PM_SUSPEND_PREPARE) { +-- +2.30.1 + diff --git a/queue-5.11/bluetooth-fix-null-pointer-dereference-in-amp_read_l.patch b/queue-5.11/bluetooth-fix-null-pointer-dereference-in-amp_read_l.patch new file mode 100644 index 00000000000..f3ff7cf098a --- /dev/null +++ b/queue-5.11/bluetooth-fix-null-pointer-dereference-in-amp_read_l.patch @@ -0,0 +1,57 @@ +From 8fd718e2ed1560d4e3b95c33d310fff4197fc3e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 15:12:30 +0530 +Subject: Bluetooth: Fix null pointer dereference in + amp_read_loc_assoc_final_data + +From: Gopal Tiwari + +[ Upstream commit e8bd76ede155fd54d8c41d045dda43cd3174d506 ] + +kernel panic trace looks like: + + #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7 + #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe + [exception RIP: amp_read_loc_assoc_final_data+63] + RIP: ffffffffc06ab54f RSP: ffffb9e08698fd68 RFLAGS: 00010246 + RAX: 0000000000000000 RBX: ffff8c8845a5a000 RCX: 0000000000000004 + RDX: 0000000000000000 RSI: ffff8c8b9153d000 RDI: ffff8c8845a5a000 + RBP: ffffb9e08698fe40 R8: 00000000000330e0 R9: ffffffffc0675c94 + R10: ffffb9e08698fe58 R11: 0000000000000001 R12: ffff8c8b9cbf6200 + R13: 0000000000000000 R14: 0000000000000000 R15: ffff8c8b2026da0b + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth] + #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth] + #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7 + +hcon->amp_mgr seems NULL triggered kernel panic in following line inside +function amp_read_loc_assoc_final_data + + set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state); + +Fixed by checking NULL for mgr. + +Signed-off-by: Gopal Tiwari +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/amp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c +index 9c711f0dfae3..be2d469d6369 100644 +--- a/net/bluetooth/amp.c ++++ b/net/bluetooth/amp.c +@@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev, + struct hci_request req; + int err; + ++ if (!mgr) ++ return; ++ + cp.phy_handle = hcon->handle; + cp.len_so_far = cpu_to_le16(0); + cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +-- +2.30.1 + diff --git a/queue-5.11/bluetooth-hci_h5-set-hci_quirk_simultaneous_discover.patch b/queue-5.11/bluetooth-hci_h5-set-hci_quirk_simultaneous_discover.patch new file mode 100644 index 00000000000..276cee21bcd --- /dev/null +++ b/queue-5.11/bluetooth-hci_h5-set-hci_quirk_simultaneous_discover.patch @@ -0,0 +1,38 @@ +From 56b0894befb502f06cd0b0556638956cb1e299fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 19:47:00 +0800 +Subject: Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl + +From: Claire Chang + +[ Upstream commit 7f9f2c3f7d99b8ae773459c74ac5e99a0dd46db9 ] + +Realtek Bluetooth controllers can do both LE scan and BR/EDR inquiry +at once, need to set HCI_QUIRK_SIMULTANEOUS_DISCOVERY quirk. + +Signed-off-by: Claire Chang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_h5.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 7be16a7f653b..95ecd30e6619 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -906,6 +906,11 @@ static int h5_btrtl_setup(struct h5 *h5) + /* Give the device some time before the hci-core sends it a reset */ + usleep_range(10000, 20000); + ++ /* Enable controller to do both LE scan and BR/EDR inquiry ++ * simultaneously. ++ */ ++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &h5->hu->hdev->quirks); ++ + out_free: + btrtl_free(btrtl_dev); + +-- +2.30.1 + diff --git a/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-predia-bas.patch b/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-predia-bas.patch new file mode 100644 index 00000000000..e9103287502 --- /dev/null +++ b/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-predia-bas.patch @@ -0,0 +1,60 @@ +From ee4b6af43d5551284a35689a798eb5e38dc39849 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 18:14:12 +0100 +Subject: brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet + +From: Hans de Goede + +[ Upstream commit af4b3a6f36d6c2fc5fca026bccf45e0fdcabddd9 ] + +The Predia Basic tablet contains quite generic names in the sys_vendor and +product_name DMI strings, without this patch brcmfmac will try to load: +brcmfmac43340-sdio.Insyde-CherryTrail.txt as nvram file which is a bit +too generic. + +Add a DMI quirk so that a unique and clearly identifiable nvram file name +is used on the Predia Basic tablet. + +Signed-off-by: Hans de Goede +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210129171413.139880-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +index 4aa2561934d7..824a79f24383 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -40,6 +40,10 @@ static const struct brcmf_dmi_data pov_tab_p1006w_data = { + BRCM_CC_43340_CHIP_ID, 2, "pov-tab-p1006w-data" + }; + ++static const struct brcmf_dmi_data predia_basic_data = { ++ BRCM_CC_43341_CHIP_ID, 2, "predia-basic" ++}; ++ + static const struct dmi_system_id dmi_platform_data[] = { + { + /* ACEPC T8 Cherry Trail Z8350 mini PC */ +@@ -111,6 +115,16 @@ static const struct dmi_system_id dmi_platform_data[] = { + }, + .driver_data = (void *)&pov_tab_p1006w_data, + }, ++ { ++ /* Predia Basic tablet (+ with keyboard dock) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"), ++ /* Mx.WT107.KUBNGEA02 with the version-nr dropped */ ++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"), ++ }, ++ .driver_data = (void *)&predia_basic_data, ++ }, + {} + }; + +-- +2.30.1 + diff --git a/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-voyo-winpa.patch b/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-voyo-winpa.patch new file mode 100644 index 00000000000..93901c0ab31 --- /dev/null +++ b/queue-5.11/brcmfmac-add-dmi-nvram-filename-quirk-for-voyo-winpa.patch @@ -0,0 +1,68 @@ +From 5016634b387add5a7bd1bc801af25ecf1f76ef33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 18:14:13 +0100 +Subject: brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet + +From: Hans de Goede + +[ Upstream commit a338c874d3d9d2463f031e89ae14942929b93db6 ] + +The Voyo winpad A15 tablet contains quite generic names in the sys_vendor +and product_name DMI strings, without this patch brcmfmac will try to load: +rcmfmac4330-sdio.To be filled by O.E.M.-To be filled by O.E.M..txt +as nvram file which is a bit too generic. + +Add a DMI quirk so that a unique and clearly identifiable nvram file name +is used on the Voyo winpad A15 tablet. + +While preparing a matching linux-firmware update I noticed that the nvram +is identical to the nvram used on the Prowise-PT301 tablet, so the new DMI +quirk entry simply points to the already existing Prowise-PT301 nvram file. + +Signed-off-by: Hans de Goede +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210129171413.139880-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + .../wireless/broadcom/brcm80211/brcmfmac/dmi.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +index 824a79f24383..6d5188b78f2d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -44,6 +44,14 @@ static const struct brcmf_dmi_data predia_basic_data = { + BRCM_CC_43341_CHIP_ID, 2, "predia-basic" + }; + ++/* Note the Voyo winpad A15 tablet uses the same Ampak AP6330 module, with the ++ * exact same nvram file as the Prowise-PT301 tablet. Since the nvram for the ++ * Prowise-PT301 is already in linux-firmware we just point to that here. ++ */ ++static const struct brcmf_dmi_data voyo_winpad_a15_data = { ++ BRCM_CC_4330_CHIP_ID, 4, "Prowise-PT301" ++}; ++ + static const struct dmi_system_id dmi_platform_data[] = { + { + /* ACEPC T8 Cherry Trail Z8350 mini PC */ +@@ -125,6 +133,16 @@ static const struct dmi_system_id dmi_platform_data[] = { + }, + .driver_data = (void *)&predia_basic_data, + }, ++ { ++ /* Voyo winpad A15 tablet */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"), ++ }, ++ .driver_data = (void *)&voyo_winpad_a15_data, ++ }, + {} + }; + +-- +2.30.1 + diff --git a/queue-5.11/btrfs-fix-error-handling-in-commit_fs_roots.patch b/queue-5.11/btrfs-fix-error-handling-in-commit_fs_roots.patch new file mode 100644 index 00000000000..1413cadda98 --- /dev/null +++ b/queue-5.11/btrfs-fix-error-handling-in-commit_fs_roots.patch @@ -0,0 +1,79 @@ +From c9e1ba8ac97698a06ee9af8a973adf900fbe8ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 09:53:23 -0500 +Subject: btrfs: fix error handling in commit_fs_roots + +From: Josef Bacik + +[ Upstream commit 4f4317c13a40194940acf4a71670179c4faca2b5 ] + +While doing error injection I would sometimes get a corrupt file system. +This is because I was injecting errors at btrfs_search_slot, but would +only do it one time per stack. This uncovered a problem in +commit_fs_roots, where if we get an error we would just break. However +we're in a nested loop, the first loop being a loop to find all the +dirty fs roots, and then subsequent root updates would succeed clearing +the error value. + +This isn't likely to happen in real scenarios, however we could +potentially get a random ENOMEM once and then not again, and we'd end up +with a corrupted file system. Fix this by moving the error checking +around a bit to the main loop, as this is the only place where something +will fail, and return the error as soon as it occurs. + +With this patch my reproducer no longer corrupts the file system. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/transaction.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 6af7f2bf92de..fbf93067642a 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1319,7 +1319,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + struct btrfs_root *gang[8]; + int i; + int ret; +- int err = 0; + + spin_lock(&fs_info->fs_roots_radix_lock); + while (1) { +@@ -1331,6 +1330,8 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + break; + for (i = 0; i < ret; i++) { + struct btrfs_root *root = gang[i]; ++ int ret2; ++ + radix_tree_tag_clear(&fs_info->fs_roots_radix, + (unsigned long)root->root_key.objectid, + BTRFS_ROOT_TRANS_TAG); +@@ -1350,17 +1351,17 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + root->node); + } + +- err = btrfs_update_root(trans, fs_info->tree_root, ++ ret2 = btrfs_update_root(trans, fs_info->tree_root, + &root->root_key, + &root->root_item); ++ if (ret2) ++ return ret2; + spin_lock(&fs_info->fs_roots_radix_lock); +- if (err) +- break; + btrfs_qgroup_free_meta_all_pertrans(root); + } + } + spin_unlock(&fs_info->fs_roots_radix_lock); +- return err; ++ return 0; + } + + /* +-- +2.30.1 + diff --git a/queue-5.11/can-flexcan-add-can-wakeup-function-for-i.mx8qm.patch b/queue-5.11/can-flexcan-add-can-wakeup-function-for-i.mx8qm.patch new file mode 100644 index 00000000000..f4c9e5c656a --- /dev/null +++ b/queue-5.11/can-flexcan-add-can-wakeup-function-for-i.mx8qm.patch @@ -0,0 +1,258 @@ +From f2b8bb12317466ed330cf0a68df38e095ac87350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 18:56:27 +0800 +Subject: can: flexcan: add CAN wakeup function for i.MX8QM + +From: Joakim Zhang + +[ Upstream commit 812f0116c66a3ebaf0b6062226aa85574dd79f67 ] + +The System Controller Firmware (SCFW) is a low-level system function +which runs on a dedicated Cortex-M core to provide power, clock, and +resource management. It exists on some i.MX8 processors. e.g. i.MX8QM +(QM, QP), and i.MX8QX (QXP, DX). SCU driver manages the IPC interface +between host CPU and the SCU firmware running on M4. + +For i.MX8QM, stop mode request is controlled by System Controller Unit(SCU) +firmware, this patch introduces FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW quirk +for this function. + +Signed-off-by: Joakim Zhang +Link: https://lore.kernel.org/r/20201106105627.31061-6-qiangqing.zhang@nxp.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 123 ++++++++++++++++++++++++++++++++------ + 1 file changed, 106 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 038fe1036df2..7ab20a6b0d1d 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -9,6 +9,7 @@ + // + // Based on code originally by Andrey Volkov + ++#include + #include + #include + #include +@@ -17,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -242,6 +244,8 @@ + #define FLEXCAN_QUIRK_SUPPORT_FD BIT(9) + /* support memory detection and correction */ + #define FLEXCAN_QUIRK_SUPPORT_ECC BIT(10) ++/* Setup stop mode with SCU firmware to support wakeup */ ++#define FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW BIT(11) + + /* Structure of the message buffer */ + struct flexcan_mb { +@@ -347,6 +351,7 @@ struct flexcan_priv { + u8 mb_count; + u8 mb_size; + u8 clk_src; /* clock source of CAN Protocol Engine */ ++ u8 scu_idx; + + u64 rx_mask; + u64 tx_mask; +@@ -358,6 +363,9 @@ struct flexcan_priv { + struct regulator *reg_xceiver; + struct flexcan_stop_mode stm; + ++ /* IPC handle when setup stop mode by System Controller firmware(scfw) */ ++ struct imx_sc_ipc *sc_ipc_handle; ++ + /* Read and Write APIs */ + u32 (*read)(void __iomem *addr); + void (*write)(u32 val, void __iomem *addr); +@@ -387,7 +395,7 @@ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = { + static const struct flexcan_devtype_data fsl_imx8qm_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | + FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | FLEXCAN_QUIRK_BROKEN_PERR_STATE | +- FLEXCAN_QUIRK_SUPPORT_FD, ++ FLEXCAN_QUIRK_SUPPORT_FD | FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW, + }; + + static struct flexcan_devtype_data fsl_imx8mp_devtype_data = { +@@ -546,18 +554,42 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + priv->write(reg_mcr, ®s->mcr); + } + ++static int flexcan_stop_mode_enable_scfw(struct flexcan_priv *priv, bool enabled) ++{ ++ u8 idx = priv->scu_idx; ++ u32 rsrc_id, val; ++ ++ rsrc_id = IMX_SC_R_CAN(idx); ++ ++ if (enabled) ++ val = 1; ++ else ++ val = 0; ++ ++ /* stop mode request via scu firmware */ ++ return imx_sc_misc_set_control(priv->sc_ipc_handle, rsrc_id, ++ IMX_SC_C_IPG_STOP, val); ++} ++ + static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; + u32 reg_mcr; ++ int ret; + + reg_mcr = priv->read(®s->mcr); + reg_mcr |= FLEXCAN_MCR_SLF_WAK; + priv->write(reg_mcr, ®s->mcr); + + /* enable stop request */ +- regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, +- 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) { ++ ret = flexcan_stop_mode_enable_scfw(priv, true); ++ if (ret < 0) ++ return ret; ++ } else { ++ regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, ++ 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); ++ } + + return flexcan_low_power_enter_ack(priv); + } +@@ -566,10 +598,17 @@ static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; + u32 reg_mcr; ++ int ret; + + /* remove stop request */ +- regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, +- 1 << priv->stm.req_bit, 0); ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) { ++ ret = flexcan_stop_mode_enable_scfw(priv, false); ++ if (ret < 0) ++ return ret; ++ } else { ++ regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, ++ 1 << priv->stm.req_bit, 0); ++ } + + reg_mcr = priv->read(®s->mcr); + reg_mcr &= ~FLEXCAN_MCR_SLF_WAK; +@@ -1867,7 +1906,7 @@ static void unregister_flexcandev(struct net_device *dev) + unregister_candev(dev); + } + +-static int flexcan_setup_stop_mode(struct platform_device *pdev) ++static int flexcan_setup_stop_mode_gpr(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); + struct device_node *np = pdev->dev.of_node; +@@ -1912,11 +1951,6 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) + "gpr %s req_gpr=0x02%x req_bit=%u\n", + gpr_np->full_name, priv->stm.req_gpr, priv->stm.req_bit); + +- device_set_wakeup_capable(&pdev->dev, true); +- +- if (of_property_read_bool(np, "wakeup-source")) +- device_set_wakeup_enable(&pdev->dev, true); +- + return 0; + + out_put_node: +@@ -1924,6 +1958,58 @@ out_put_node: + return ret; + } + ++static int flexcan_setup_stop_mode_scfw(struct platform_device *pdev) ++{ ++ struct net_device *dev = platform_get_drvdata(pdev); ++ struct flexcan_priv *priv; ++ u8 scu_idx; ++ int ret; ++ ++ ret = of_property_read_u8(pdev->dev.of_node, "fsl,scu-index", &scu_idx); ++ if (ret < 0) { ++ dev_dbg(&pdev->dev, "failed to get scu index\n"); ++ return ret; ++ } ++ ++ priv = netdev_priv(dev); ++ priv->scu_idx = scu_idx; ++ ++ /* this function could be defered probe, return -EPROBE_DEFER */ ++ return imx_scu_get_handle(&priv->sc_ipc_handle); ++} ++ ++/* flexcan_setup_stop_mode - Setup stop mode for wakeup ++ * ++ * Return: = 0 setup stop mode successfully or doesn't support this feature ++ * < 0 fail to setup stop mode (could be defered probe) ++ */ ++static int flexcan_setup_stop_mode(struct platform_device *pdev) ++{ ++ struct net_device *dev = platform_get_drvdata(pdev); ++ struct flexcan_priv *priv; ++ int ret; ++ ++ priv = netdev_priv(dev); ++ ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) ++ ret = flexcan_setup_stop_mode_scfw(pdev); ++ else if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) ++ ret = flexcan_setup_stop_mode_gpr(pdev); ++ else ++ /* return 0 directly if doesn't support stop mode feature */ ++ return 0; ++ ++ if (ret) ++ return ret; ++ ++ device_set_wakeup_capable(&pdev->dev, true); ++ ++ if (of_property_read_bool(pdev->dev.of_node, "wakeup-source")) ++ device_set_wakeup_enable(&pdev->dev, true); ++ ++ return 0; ++} ++ + static const struct of_device_id flexcan_of_match[] = { + { .compatible = "fsl,imx8qm-flexcan", .data = &fsl_imx8qm_devtype_data, }, + { .compatible = "fsl,imx8mp-flexcan", .data = &fsl_imx8mp_devtype_data, }, +@@ -2054,17 +2140,20 @@ static int flexcan_probe(struct platform_device *pdev) + goto failed_register; + } + ++ err = flexcan_setup_stop_mode(pdev); ++ if (err < 0) { ++ if (err != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "setup stop mode failed\n"); ++ goto failed_setup_stop_mode; ++ } ++ + of_can_transceiver(dev); + devm_can_led_init(dev); + +- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) { +- err = flexcan_setup_stop_mode(pdev); +- if (err) +- dev_dbg(&pdev->dev, "failed to setup stop-mode\n"); +- } +- + return 0; + ++ failed_setup_stop_mode: ++ unregister_flexcandev(dev); + failed_register: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.30.1 + diff --git a/queue-5.11/crypto-tcrypt-avoid-signed-overflow-in-byte-count.patch b/queue-5.11/crypto-tcrypt-avoid-signed-overflow-in-byte-count.patch new file mode 100644 index 00000000000..de09a54e6d6 --- /dev/null +++ b/queue-5.11/crypto-tcrypt-avoid-signed-overflow-in-byte-count.patch @@ -0,0 +1,86 @@ +From 8fdbf555b00121dfbe7783bc5983e2002f5de56a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 15:34:41 +0100 +Subject: crypto: tcrypt - avoid signed overflow in byte count + +From: Ard Biesheuvel + +[ Upstream commit 303fd3e1c771077e32e96e5788817f025f0067e2 ] + +The signed long type used for printing the number of bytes processed in +tcrypt benchmarks limits the range to -/+ 2 GiB, which is not sufficient +to cover the performance of common accelerated ciphers such as AES-NI +when benchmarked with sec=1. So switch to u64 instead. + +While at it, fix up a missing printk->pr_cont conversion in the AEAD +benchmark. + +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/tcrypt.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index a647bb298fbc..a4a11d2b57bd 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -199,8 +199,8 @@ static int test_mb_aead_jiffies(struct test_mb_aead_data *data, int enc, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -471,8 +471,8 @@ static int test_aead_jiffies(struct aead_request *req, int enc, + return ret; + } + +- printk("%d operations in %d seconds (%ld bytes)\n", +- bcount, secs, (long)bcount * blen); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount, secs, (u64)bcount * blen); + return 0; + } + +@@ -764,8 +764,8 @@ static int test_mb_ahash_jiffies(struct test_mb_ahash_data *data, int blen, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -1201,8 +1201,8 @@ static int test_mb_acipher_jiffies(struct test_mb_skcipher_data *data, int enc, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -1441,8 +1441,8 @@ static int test_acipher_jiffies(struct skcipher_request *req, int enc, + return ret; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount, secs, (long)bcount * blen); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount, secs, (u64)bcount * blen); + return 0; + } + +-- +2.30.1 + diff --git a/queue-5.11/drm-amd-amdgpu-add-error-handling-to-amdgpu_virt_rea.patch b/queue-5.11/drm-amd-amdgpu-add-error-handling-to-amdgpu_virt_rea.patch new file mode 100644 index 00000000000..0b13c0ad3bb --- /dev/null +++ b/queue-5.11/drm-amd-amdgpu-add-error-handling-to-amdgpu_virt_rea.patch @@ -0,0 +1,48 @@ +From 08bad15c274515b1e23ee74489581fb2e5985bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 16:54:50 +0800 +Subject: drm/amd/amdgpu: add error handling to amdgpu_virt_read_pf2vf_data + +From: Jingwen Chen + +[ Upstream commit 64dcf2f01d59cf9fad19b1a387bd39736a8f4d69 ] + +[Why] +when vram lost happened in guest, try to write vram can lead to +kernel stuck. + +[How] +When the readback data is invalid, don't do write work, directly +reschedule a new work. + +Signed-off-by: Jingwen Chen +Reviewed-by: Monk Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 2d51b7694d1f..572153d08ad1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -560,10 +560,14 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work) + { + struct amdgpu_device *adev = container_of(work, struct amdgpu_device, virt.vf2pf_work.work); ++ int ret; + +- amdgpu_virt_read_pf2vf_data(adev); ++ ret = amdgpu_virt_read_pf2vf_data(adev); ++ if (ret) ++ goto out; + amdgpu_virt_write_vf2pf_data(adev); + ++out: + schedule_delayed_work(&(adev->virt.vf2pf_work), adev->virt.vf2pf_update_interval_ms); + } + +-- +2.30.1 + diff --git a/queue-5.11/drm-amd-display-guard-against-null-pointer-deref-whe.patch b/queue-5.11/drm-amd-display-guard-against-null-pointer-deref-whe.patch new file mode 100644 index 00000000000..1a6ca6bf54c --- /dev/null +++ b/queue-5.11/drm-amd-display-guard-against-null-pointer-deref-whe.patch @@ -0,0 +1,47 @@ +From a8a358030563a7ef6ce0b6999601e1d3fd1a4b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Dec 2020 12:14:00 -0500 +Subject: drm/amd/display: Guard against NULL pointer deref when get_i2c_info + fails + +From: Nicholas Kazlauskas + +[ Upstream commit 44a09e3d95bd2b7b0c224100f78f335859c4e193 ] + +[Why] +If the BIOS table is invalid or corrupt then get_i2c_info can fail +and we dereference a NULL pointer. + +[How] +Check that ddc_pin is not NULL before using it and log an error if it +is because this is unexpected. + +Tested-by: Daniel Wheeler +Signed-off-by: Nicholas Kazlauskas +Reviewed-by: Eric Yang +Acked-by: Anson Jacob +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index f4a2088ab179..278ade3a90cc 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1470,6 +1470,11 @@ static bool dc_link_construct(struct dc_link *link, + goto ddc_create_fail; + } + ++ if (!link->ddc->ddc_pin) { ++ DC_ERROR("Failed to get I2C info for connector!\n"); ++ goto ddc_create_fail; ++ } ++ + link->ddc_hw_inst = + dal_ddc_get_line(dal_ddc_service_get_ddc_pin(link->ddc)); + +-- +2.30.1 + diff --git a/queue-5.11/drm-amdgpu-add-check-to-prevent-ih-overflow.patch b/queue-5.11/drm-amdgpu-add-check-to-prevent-ih-overflow.patch new file mode 100644 index 00000000000..1e01b11a8b5 --- /dev/null +++ b/queue-5.11/drm-amdgpu-add-check-to-prevent-ih-overflow.patch @@ -0,0 +1,177 @@ +From 1a70d5468d892fb960a34db8b299b97c556d86c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jan 2021 00:06:39 +0800 +Subject: drm/amdgpu: Add check to prevent IH overflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Defang Bo + +[ Upstream commit e4180c4253f3f2da09047f5139959227f5cf1173 ] + +Similar to commit ("drm/amdgpu: fix IH overflow on Vega10 v2"). +When an ring buffer overflow happens the appropriate bit is set in the WPTR +register which is also written back to memory. But clearing the bit in the +WPTR doesn't trigger another memory writeback. + +So what can happen is that we end up processing the buffer overflow over and +over again because the bit is never cleared. Resulting in a random system +lockup because of an infinite loop in an interrupt handler. + +Reviewed-by: Christian König +Signed-off-by: Defang Bo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cz_ih.c | 37 ++++++++++++++++--------- + drivers/gpu/drm/amd/amdgpu/iceland_ih.c | 36 +++++++++++++++--------- + drivers/gpu/drm/amd/amdgpu/tonga_ih.c | 37 ++++++++++++++++--------- + 3 files changed, 71 insertions(+), 39 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cz_ih.c b/drivers/gpu/drm/amd/amdgpu/cz_ih.c +index da37f8a900af..307c01301c87 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cz_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/cz_ih.c +@@ -194,19 +194,30 @@ static u32 cz_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++ ++out: + return (wptr & ih->ptr_mask); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c +index 37d8b6ca4dab..cc957471f31e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c +@@ -194,19 +194,29 @@ static u32 iceland_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++ ++out: + return (wptr & ih->ptr_mask); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c +index ce3319993b4b..249fcbee7871 100644 +--- a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c +@@ -196,19 +196,30 @@ static u32 tonga_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++out: + return (wptr & ih->ptr_mask); + } + +-- +2.30.1 + diff --git a/queue-5.11/drm-amdgpu-enable-only-one-high-prio-compute-queue.patch b/queue-5.11/drm-amdgpu-enable-only-one-high-prio-compute-queue.patch new file mode 100644 index 00000000000..4bb9bda3231 --- /dev/null +++ b/queue-5.11/drm-amdgpu-enable-only-one-high-prio-compute-queue.patch @@ -0,0 +1,148 @@ +From c600a1fe05eceaa1c6f8a766b483b85257d9398b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Feb 2021 12:12:34 +0100 +Subject: drm/amdgpu: enable only one high prio compute queue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nirmoy Das + +[ Upstream commit 8c0225d79273968a65e73a4204fba023ae02714d ] + +For high priority compute to work properly we need to enable +wave limiting on gfx pipe. Wave limiting is done through writing +into mmSPI_WCL_PIPE_PERCENT_GFX register. Enable only one high +priority compute queue to avoid race condition between multiple +high priority compute queues writing that register simultaneously. + +Signed-off-by: Nirmoy Das +Acked-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 15 ++++++++------- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 2 +- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 ++---- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 6 ++---- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 ++----- + 5 files changed, 15 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index cd2c676a2797..8e0a6c62322e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -193,15 +193,16 @@ static bool amdgpu_gfx_is_multipipe_capable(struct amdgpu_device *adev) + } + + bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev, +- int pipe, int queue) ++ struct amdgpu_ring *ring) + { +- bool multipipe_policy = amdgpu_gfx_is_multipipe_capable(adev); +- int cond; +- /* Policy: alternate between normal and high priority */ +- cond = multipipe_policy ? pipe : queue; +- +- return ((cond % 2) != 0); ++ /* Policy: use 1st queue as high priority compute queue if we ++ * have more than one compute queue. ++ */ ++ if (adev->gfx.num_compute_rings > 1 && ++ ring == &adev->gfx.compute_ring[0]) ++ return true; + ++ return false; + } + + void amdgpu_gfx_compute_queue_acquire(struct amdgpu_device *adev) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h +index 6b5a8f4642cc..72dbcd2bc6a6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h +@@ -380,7 +380,7 @@ void amdgpu_queue_mask_bit_to_mec_queue(struct amdgpu_device *adev, int bit, + bool amdgpu_gfx_is_mec_queue_enabled(struct amdgpu_device *adev, int mec, + int pipe, int queue); + bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev, +- int pipe, int queue); ++ struct amdgpu_ring *ring); + int amdgpu_gfx_me_queue_to_bit(struct amdgpu_device *adev, int me, + int pipe, int queue); + void amdgpu_gfx_bit_to_me_queue(struct amdgpu_device *adev, int bit, +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index e7d6da05011f..3a291befcddc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4495,8 +4495,7 @@ static int gfx_v10_0_compute_ring_init(struct amdgpu_device *adev, int ring_id, + irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP + + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec) + + ring->pipe; +- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe, +- ring->queue) ? ++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ? + AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL; + /* type-2 packets are deprecated on MEC, use type-3 instead */ + r = amdgpu_ring_init(adev, ring, 1024, +@@ -6545,8 +6544,7 @@ static void gfx_v10_0_compute_mqd_set_priority(struct amdgpu_ring *ring, struct + struct amdgpu_device *adev = ring->adev; + + if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) { +- if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe, +- ring->queue)) { ++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) { + mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH; + mqd->cp_hqd_queue_priority = + AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 37639214cbbb..b0284c4659ba 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -1923,8 +1923,7 @@ static int gfx_v8_0_compute_ring_init(struct amdgpu_device *adev, int ring_id, + + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec) + + ring->pipe; + +- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe, +- ring->queue) ? ++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ? + AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_RING_PRIO_DEFAULT; + /* type-2 packets are deprecated on MEC, use type-3 instead */ + r = amdgpu_ring_init(adev, ring, 1024, +@@ -4442,8 +4441,7 @@ static void gfx_v8_0_mqd_set_priority(struct amdgpu_ring *ring, struct vi_mqd *m + struct amdgpu_device *adev = ring->adev; + + if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) { +- if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe, +- ring->queue)) { ++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) { + mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH; + mqd->cp_hqd_queue_priority = + AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 5f4805e4d04a..3e800193a604 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2228,8 +2228,7 @@ static int gfx_v9_0_compute_ring_init(struct amdgpu_device *adev, int ring_id, + irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP + + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec) + + ring->pipe; +- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe, +- ring->queue) ? ++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ? + AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL; + /* type-2 packets are deprecated on MEC, use type-3 instead */ + return amdgpu_ring_init(adev, ring, 1024, +@@ -3391,9 +3390,7 @@ static void gfx_v9_0_mqd_set_priority(struct amdgpu_ring *ring, struct v9_mqd *m + struct amdgpu_device *adev = ring->adev; + + if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) { +- if (amdgpu_gfx_is_high_priority_compute_queue(adev, +- ring->pipe, +- ring->queue)) { ++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) { + mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH; + mqd->cp_hqd_queue_priority = + AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM; +-- +2.30.1 + diff --git a/queue-5.11/drm-hisilicon-fix-use-after-free.patch b/queue-5.11/drm-hisilicon-fix-use-after-free.patch new file mode 100644 index 00000000000..82fabba018a --- /dev/null +++ b/queue-5.11/drm-hisilicon-fix-use-after-free.patch @@ -0,0 +1,106 @@ +From 6b18336860ebb6f83fb505454078fcbdf93341ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 18:32:53 +0800 +Subject: drm/hisilicon: Fix use-after-free + +From: Tian Tao + +[ Upstream commit c855af2f9c5c60760fd1bed7889a81bc37d2591d ] + +Fix the problem of dev being released twice. +------------[ cut here ]------------ +refcount_t: underflow; use-after-free. +WARNING: CPU: 75 PID: 15700 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x150 +CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3 +Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019 +pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) +pc : refcount_warn_saturate+0xd4/0x150 +lr : refcount_warn_saturate+0xd4/0x150 +sp : ffff2028150cbc00 +x29: ffff2028150cbc00 x28: ffff2028150121c0 +x27: 0000000000000000 x26: 0000000000000000 +x25: 0000000000000000 x24: 0000000000000003 +x23: 0000000000000000 x22: ffff2028150cbc90 +x21: ffff2020038a30a8 x20: ffff2028150cbc90 +x19: ffff0020cd938020 x18: 0000000000000010 +x17: 0000000000000000 x16: 0000000000000000 +x15: ffffffffffffffff x14: ffff2028950cb88f +x13: ffff2028150cb89d x12: 0000000000000000 +x11: 0000000005f5e0ff x10: ffff2028150cb800 +x9 : 00000000ffffffd0 x8 : 75203b776f6c6672 +x7 : ffff800011a6f7c8 x6 : 0000000000000001 +x5 : 0000000000000000 x4 : 0000000000000000 +x3 : 0000000000000000 x2 : ffff202ffe2f9dc0 +x1 : ffffa02fecf40000 x0 : 0000000000000026 +Call trace: + refcount_warn_saturate+0xd4/0x150 + devm_drm_dev_init_release+0x50/0x70 + devm_action_release+0x20/0x30 + release_nodes+0x13c/0x218 + devres_release_all+0x80/0x170 + device_release_driver_internal+0x128/0x1f0 + driver_detach+0x6c/0xe0 + bus_remove_driver+0x74/0x100 + driver_unregister+0x34/0x60 + pci_unregister_driver+0x24/0xd8 + hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm] + __arm64_sys_delete_module+0x1fc/0x2d0 + el0_svc_common.constprop.3+0xa8/0x188 + do_el0_svc+0x80/0xa0 + el0_sync_handler+0x8c/0xb0 + el0_sync+0x15c/0x180 +CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3 +Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019 +Call trace: + dump_backtrace+0x0/0x208 + show_stack+0x2c/0x40 + dump_stack+0xd8/0x10c + __warn+0xac/0x128 + report_bug+0xcc/0x180 + bug_handler+0x24/0x78 + call_break_hook+0x80/0xa0 + brk_handler+0x28/0x68 + do_debug_exception+0x9c/0x148 + el1_sync_handler+0x7c/0x128 + el1_sync+0x80/0x100 + refcount_warn_saturate+0xd4/0x150 + devm_drm_dev_init_release+0x50/0x70 + devm_action_release+0x20/0x30 + release_nodes+0x13c/0x218 + devres_release_all+0x80/0x170 + device_release_driver_internal+0x128/0x1f0 + driver_detach+0x6c/0xe0 + bus_remove_driver+0x74/0x100 + driver_unregister+0x34/0x60 + pci_unregister_driver+0x24/0xd8 + hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm] + __arm64_sys_delete_module+0x1fc/0x2d0 + el0_svc_common.constprop.3+0xa8/0x188 + do_el0_svc+0x80/0xa0 + el0_sync_handler+0x8c/0xb0 + el0_sync+0x15c/0x180 +---[ end trace 00718630d6e5ff18 ]--- + +Signed-off-by: Tian Tao +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/1607941973-32287-1-git-send-email-tiantao6@hisilicon.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +index d845657fd99c..426f5fb20fad 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +@@ -366,7 +366,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev) + + drm_dev_unregister(dev); + hibmc_unload(dev); +- drm_dev_put(dev); + } + + static const struct pci_device_id hibmc_pci_table[] = { +-- +2.30.1 + diff --git a/queue-5.11/edac-amd64-do-not-load-on-family-0x15-model-0x13.patch b/queue-5.11/edac-amd64-do-not-load-on-family-0x15-model-0x13.patch new file mode 100644 index 00000000000..af7032dc330 --- /dev/null +++ b/queue-5.11/edac-amd64-do-not-load-on-family-0x15-model-0x13.patch @@ -0,0 +1,60 @@ +From d9d04c263beccecd9a69589189a2d6e774b09040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 15:20:28 +0100 +Subject: EDAC/amd64: Do not load on family 0x15, model 0x13 + +From: Borislav Petkov + +[ Upstream commit 6c13d7ff81e6d2f01f62ccbfa49d1b8d87f274d0 ] + +Those were only laptops and are very very unlikely to have ECC memory. +Currently, when the driver attempts to load, it issues: + + EDAC amd64: Error: F1 not found: device 0x1601 (broken BIOS?) + +because the PCI device is the wrong one (it uses the F15h default one). + +So do not load the driver on them as that is pointless. + +Reported-by: Don Curtis +Signed-off-by: Borislav Petkov +Tested-by: Don Curtis +Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1179763 +Link: https://lkml.kernel.org/r/20201218160622.20146-1-bp@alien8.de +Signed-off-by: Sasha Levin +--- + drivers/edac/amd64_edac.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index f7087ddddb90..5754f429a8d2 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -3342,10 +3342,13 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt) + fam_type = &family_types[F15_M60H_CPUS]; + pvt->ops = &family_types[F15_M60H_CPUS].ops; + break; ++ /* Richland is only client */ ++ } else if (pvt->model == 0x13) { ++ return NULL; ++ } else { ++ fam_type = &family_types[F15_CPUS]; ++ pvt->ops = &family_types[F15_CPUS].ops; + } +- +- fam_type = &family_types[F15_CPUS]; +- pvt->ops = &family_types[F15_CPUS].ops; + break; + + case 0x16: +@@ -3539,6 +3542,7 @@ static int probe_one_instance(unsigned int nid) + pvt->mc_node_id = nid; + pvt->F3 = F3; + ++ ret = -ENODEV; + fam_type = per_family_init(pvt); + if (!fam_type) + goto err_enable; +-- +2.30.1 + diff --git a/queue-5.11/f2fs-fix-to-set-clear-i_linkable-under-i_lock.patch b/queue-5.11/f2fs-fix-to-set-clear-i_linkable-under-i_lock.patch new file mode 100644 index 00000000000..997fccce0e9 --- /dev/null +++ b/queue-5.11/f2fs-fix-to-set-clear-i_linkable-under-i_lock.patch @@ -0,0 +1,88 @@ +From 02a3ab1d483207efb375272bcfa24c51b6d0a451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jan 2021 09:55:09 +0800 +Subject: f2fs: fix to set/clear I_LINKABLE under i_lock + +From: Chao Yu + +[ Upstream commit 46085f37fc9e12d5c3539fb768b5ad7951e72acf ] + +fsstress + fault injection test case reports a warning message as +below: + +WARNING: CPU: 13 PID: 6226 at fs/inode.c:361 inc_nlink+0x32/0x40 +Call Trace: + f2fs_init_inode_metadata+0x25c/0x4a0 [f2fs] + f2fs_add_inline_entry+0x153/0x3b0 [f2fs] + f2fs_add_dentry+0x75/0x80 [f2fs] + f2fs_do_add_link+0x108/0x160 [f2fs] + f2fs_rename2+0x6ab/0x14f0 [f2fs] + vfs_rename+0x70c/0x940 + do_renameat2+0x4d8/0x4f0 + __x64_sys_renameat2+0x4b/0x60 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Following race case can cause this: +Thread A Kworker +- f2fs_rename + - f2fs_create_whiteout + - __f2fs_tmpfile + - f2fs_i_links_write + - f2fs_mark_inode_dirty_sync + - mark_inode_dirty_sync + - writeback_single_inode + - __writeback_single_inode + - spin_lock(&inode->i_lock) + - inode->i_state |= I_LINKABLE + - inode->i_state &= ~dirty + - spin_unlock(&inode->i_lock) + - f2fs_add_link + - f2fs_do_add_link + - f2fs_add_dentry + - f2fs_add_inline_entry + - f2fs_init_inode_metadata + - f2fs_i_links_write + - inc_nlink + - WARN_ON(!(inode->i_state & I_LINKABLE)) + +Fix to add i_lock to avoid i_state update race condition. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/namei.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 6edb1ab579a1..887804968576 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -855,7 +855,11 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry, + + if (whiteout) { + f2fs_i_links_write(inode, false); ++ ++ spin_lock(&inode->i_lock); + inode->i_state |= I_LINKABLE; ++ spin_unlock(&inode->i_lock); ++ + *whiteout = inode; + } else { + d_tmpfile(dentry, inode); +@@ -1041,7 +1045,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, + err = f2fs_add_link(old_dentry, whiteout); + if (err) + goto put_out_dir; ++ ++ spin_lock(&whiteout->i_lock); + whiteout->i_state &= ~I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + iput(whiteout); + } + +-- +2.30.1 + diff --git a/queue-5.11/f2fs-handle-unallocated-section-and-zone-on-pinned-a.patch b/queue-5.11/f2fs-handle-unallocated-section-and-zone-on-pinned-a.patch new file mode 100644 index 00000000000..831854bcc3d --- /dev/null +++ b/queue-5.11/f2fs-handle-unallocated-section-and-zone-on-pinned-a.patch @@ -0,0 +1,44 @@ +From a71c16b58bd9cb04bf73439cd60ae6060f6b08e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 11:44:25 -0800 +Subject: f2fs: handle unallocated section and zone on pinned/atgc + +From: Jaegeuk Kim + +[ Upstream commit 632faca72938f9f63049e48a8c438913828ac7a9 ] + +If we have large section/zone, unallocated segment makes them corrupted. + +E.g., + + - Pinned file: -1 119304647 119304647 + - ATGC data: -1 119304647 119304647 + +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index e81eb0748e2a..229814b4f4a6 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -101,11 +101,11 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi, + #define BLKS_PER_SEC(sbi) \ + ((sbi)->segs_per_sec * (sbi)->blocks_per_seg) + #define GET_SEC_FROM_SEG(sbi, segno) \ +- ((segno) / (sbi)->segs_per_sec) ++ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec) + #define GET_SEG_FROM_SEC(sbi, secno) \ + ((secno) * (sbi)->segs_per_sec) + #define GET_ZONE_FROM_SEC(sbi, secno) \ +- ((secno) / (sbi)->secs_per_zone) ++ (((secno) == -1) ? -1: (secno) / (sbi)->secs_per_zone) + #define GET_ZONE_FROM_SEG(sbi, segno) \ + GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno)) + +-- +2.30.1 + diff --git a/queue-5.11/fs-make-unlazy_walk-error-handling-consistent.patch b/queue-5.11/fs-make-unlazy_walk-error-handling-consistent.patch new file mode 100644 index 00000000000..9795bcce481 --- /dev/null +++ b/queue-5.11/fs-make-unlazy_walk-error-handling-consistent.patch @@ -0,0 +1,173 @@ +From eac0e2f7139cb7a8d30c34df659d3236dc3e508b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Dec 2020 09:19:08 -0700 +Subject: fs: make unlazy_walk() error handling consistent + +From: Jens Axboe + +[ Upstream commit e36cffed20a324e116f329a94061ae30dd26fb51 ] + +Most callers check for non-zero return, and assume it's -ECHILD (which +it always will be). One caller uses the actual error return. Clean this +up and make it fully consistent, by having unlazy_walk() return a bool +instead. Rename it to try_to_unlazy() and return true on success, and +failure on error. That's easier to read. + +No functional changes in this patch. + +Cc: Al Viro +Signed-off-by: Jens Axboe +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/namei.c | 43 +++++++++++++++++-------------------------- + 1 file changed, 17 insertions(+), 26 deletions(-) + +diff --git a/fs/namei.c b/fs/namei.c +index 78443a85480a..dd85e12ac85a 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -669,17 +669,17 @@ static bool legitimize_root(struct nameidata *nd) + */ + + /** +- * unlazy_walk - try to switch to ref-walk mode. ++ * try_to_unlazy - try to switch to ref-walk mode. + * @nd: nameidata pathwalk data +- * Returns: 0 on success, -ECHILD on failure ++ * Returns: true on success, false on failure + * +- * unlazy_walk attempts to legitimize the current nd->path and nd->root ++ * try_to_unlazy attempts to legitimize the current nd->path and nd->root + * for ref-walk mode. + * Must be called from rcu-walk context. +- * Nothing should touch nameidata between unlazy_walk() failure and ++ * Nothing should touch nameidata between try_to_unlazy() failure and + * terminate_walk(). + */ +-static int unlazy_walk(struct nameidata *nd) ++static bool try_to_unlazy(struct nameidata *nd) + { + struct dentry *parent = nd->path.dentry; + +@@ -694,14 +694,14 @@ static int unlazy_walk(struct nameidata *nd) + goto out; + rcu_read_unlock(); + BUG_ON(nd->inode != parent->d_inode); +- return 0; ++ return true; + + out1: + nd->path.mnt = NULL; + nd->path.dentry = NULL; + out: + rcu_read_unlock(); +- return -ECHILD; ++ return false; + } + + /** +@@ -792,7 +792,7 @@ static int complete_walk(struct nameidata *nd) + */ + if (!(nd->flags & (LOOKUP_ROOT | LOOKUP_IS_SCOPED))) + nd->root.mnt = NULL; +- if (unlikely(unlazy_walk(nd))) ++ if (!try_to_unlazy(nd)) + return -ECHILD; + } + +@@ -1466,7 +1466,7 @@ static struct dentry *lookup_fast(struct nameidata *nd, + unsigned seq; + dentry = __d_lookup_rcu(parent, &nd->last, &seq); + if (unlikely(!dentry)) { +- if (unlazy_walk(nd)) ++ if (!try_to_unlazy(nd)) + return ERR_PTR(-ECHILD); + return NULL; + } +@@ -1567,10 +1567,8 @@ static inline int may_lookup(struct nameidata *nd) + { + if (nd->flags & LOOKUP_RCU) { + int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); +- if (err != -ECHILD) ++ if (err != -ECHILD || !try_to_unlazy(nd)) + return err; +- if (unlazy_walk(nd)) +- return -ECHILD; + } + return inode_permission(nd->inode, MAY_EXEC); + } +@@ -1592,7 +1590,7 @@ static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq) + // unlazy even if we fail to grab the link - cleanup needs it + bool grabbed_link = legitimize_path(nd, link, seq); + +- if (unlazy_walk(nd) != 0 || !grabbed_link) ++ if (!try_to_unlazy(nd) != 0 || !grabbed_link) + return -ECHILD; + + if (nd_alloc_stack(nd)) +@@ -1634,7 +1632,7 @@ static const char *pick_link(struct nameidata *nd, struct path *link, + touch_atime(&last->link); + cond_resched(); + } else if (atime_needs_update(&last->link, inode)) { +- if (unlikely(unlazy_walk(nd))) ++ if (!try_to_unlazy(nd)) + return ERR_PTR(-ECHILD); + touch_atime(&last->link); + } +@@ -1651,11 +1649,8 @@ static const char *pick_link(struct nameidata *nd, struct path *link, + get = inode->i_op->get_link; + if (nd->flags & LOOKUP_RCU) { + res = get(NULL, inode, &last->done); +- if (res == ERR_PTR(-ECHILD)) { +- if (unlikely(unlazy_walk(nd))) +- return ERR_PTR(-ECHILD); ++ if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd)) + res = get(link->dentry, inode, &last->done); +- } + } else { + res = get(link->dentry, inode, &last->done); + } +@@ -2195,7 +2190,7 @@ OK: + } + if (unlikely(!d_can_lookup(nd->path.dentry))) { + if (nd->flags & LOOKUP_RCU) { +- if (unlazy_walk(nd)) ++ if (!try_to_unlazy(nd)) + return -ECHILD; + } + return -ENOTDIR; +@@ -3129,7 +3124,6 @@ static const char *open_last_lookups(struct nameidata *nd, + struct inode *inode; + struct dentry *dentry; + const char *res; +- int error; + + nd->flags |= op->intent; + +@@ -3153,9 +3147,8 @@ static const char *open_last_lookups(struct nameidata *nd, + } else { + /* create side of things */ + if (nd->flags & LOOKUP_RCU) { +- error = unlazy_walk(nd); +- if (unlikely(error)) +- return ERR_PTR(error); ++ if (!try_to_unlazy(nd)) ++ return ERR_PTR(-ECHILD); + } + audit_inode(nd->name, dir, AUDIT_INODE_PARENT); + /* trailing slashes? */ +@@ -3164,9 +3157,7 @@ static const char *open_last_lookups(struct nameidata *nd, + } + + if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { +- error = mnt_want_write(nd->path.mnt); +- if (!error) +- got_write = true; ++ got_write = !mnt_want_write(nd->path.mnt); + /* + * do _not_ fail yet - we might not need that or fail with + * a different error; let lookup_open() decide; we'll be +-- +2.30.1 + diff --git a/queue-5.11/media-uvcvideo-allow-entities-with-no-pads.patch b/queue-5.11/media-uvcvideo-allow-entities-with-no-pads.patch new file mode 100644 index 00000000000..b4e3cb6ca35 --- /dev/null +++ b/queue-5.11/media-uvcvideo-allow-entities-with-no-pads.patch @@ -0,0 +1,48 @@ +From e36cf0dae2db1ac64e7196776aeb5fe05c41408f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Dec 2020 14:35:19 +0100 +Subject: media: uvcvideo: Allow entities with no pads + +From: Ricardo Ribalda + +[ Upstream commit 7532dad6634031d083df7af606fac655b8d08b5c ] + +Avoid an underflow while calculating the number of inputs for entities +with zero pads. + +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index ddb9eaa11be7..5ad528264135 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1028,7 +1028,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id, + unsigned int i; + + extra_size = roundup(extra_size, sizeof(*entity->pads)); +- num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1; ++ if (num_pads) ++ num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; ++ else ++ num_inputs = 0; + size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads + + num_inputs; + entity = kzalloc(size, GFP_KERNEL); +@@ -1044,7 +1047,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id, + + for (i = 0; i < num_inputs; ++i) + entity->pads[i].flags = MEDIA_PAD_FL_SINK; +- if (!UVC_ENTITY_IS_OTERM(entity)) ++ if (!UVC_ENTITY_IS_OTERM(entity) && num_pads) + entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE; + + entity->bNrInPins = num_inputs; +-- +2.30.1 + diff --git a/queue-5.11/mt76-mt7615-reset-token-when-mac_reset-happens.patch b/queue-5.11/mt76-mt7615-reset-token-when-mac_reset-happens.patch new file mode 100644 index 00000000000..5ddfa2ffa58 --- /dev/null +++ b/queue-5.11/mt76-mt7615-reset-token-when-mac_reset-happens.patch @@ -0,0 +1,105 @@ +From e9503a940a72b4227eb624db2b89f5b29f0acd0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 02:51:38 +0800 +Subject: mt76: mt7615: reset token when mac_reset happens + +From: Ryder Lee + +[ Upstream commit a6275e934605646ef81b02d8d1164f21343149c9 ] + +Reset token in mt7615_mac_reset_work() to avoid possible leakege. + +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7615/mac.c | 20 +++++++++++++++++++ + .../wireless/mediatek/mt76/mt7615/mt7615.h | 2 +- + .../wireless/mediatek/mt76/mt7615/pci_init.c | 12 +---------- + 3 files changed, 22 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 0f360be0b885..fb10a6497ed0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -2058,6 +2058,23 @@ void mt7615_dma_reset(struct mt7615_dev *dev) + } + EXPORT_SYMBOL_GPL(mt7615_dma_reset); + ++void mt7615_tx_token_put(struct mt7615_dev *dev) ++{ ++ struct mt76_txwi_cache *txwi; ++ int id; ++ ++ spin_lock_bh(&dev->token_lock); ++ idr_for_each_entry(&dev->token, txwi, id) { ++ mt7615_txp_skb_unmap(&dev->mt76, txwi); ++ if (txwi->skb) ++ dev_kfree_skb_any(txwi->skb); ++ mt76_put_txwi(&dev->mt76, txwi); ++ } ++ spin_unlock_bh(&dev->token_lock); ++ idr_destroy(&dev->token); ++} ++EXPORT_SYMBOL_GPL(mt7615_tx_token_put); ++ + void mt7615_mac_reset_work(struct work_struct *work) + { + struct mt7615_phy *phy2; +@@ -2101,6 +2118,9 @@ void mt7615_mac_reset_work(struct work_struct *work) + + mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_PDMA_STOPPED); + ++ mt7615_tx_token_put(dev); ++ idr_init(&dev->token); ++ + if (mt7615_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) { + mt7615_dma_reset(dev); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +index 99b8abdbb08f..d697ff2ea56e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +@@ -583,7 +583,7 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct mt76_tx_info *tx_info); + + void mt7615_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e); +- ++void mt7615_tx_token_put(struct mt7615_dev *dev); + void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, + struct sk_buff *skb); + void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +index 27fcb1374685..58a0ec1bf8d7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +@@ -160,9 +160,7 @@ int mt7615_register_device(struct mt7615_dev *dev) + + void mt7615_unregister_device(struct mt7615_dev *dev) + { +- struct mt76_txwi_cache *txwi; + bool mcu_running; +- int id; + + mcu_running = mt7615_wait_for_mcu_init(dev); + +@@ -172,15 +170,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev) + mt7615_mcu_exit(dev); + mt7615_dma_cleanup(dev); + +- spin_lock_bh(&dev->token_lock); +- idr_for_each_entry(&dev->token, txwi, id) { +- mt7615_txp_skb_unmap(&dev->mt76, txwi); +- if (txwi->skb) +- dev_kfree_skb_any(txwi->skb); +- mt76_put_txwi(&dev->mt76, txwi); +- } +- spin_unlock_bh(&dev->token_lock); +- idr_destroy(&dev->token); ++ mt7615_tx_token_put(dev); + + tasklet_disable(&dev->irq_tasklet); + +-- +2.30.1 + diff --git a/queue-5.11/mt76-mt7915-reset-token-when-mac_reset-happens.patch b/queue-5.11/mt76-mt7915-reset-token-when-mac_reset-happens.patch new file mode 100644 index 00000000000..9e0b67f7c1c --- /dev/null +++ b/queue-5.11/mt76-mt7915-reset-token-when-mac_reset-happens.patch @@ -0,0 +1,113 @@ +From 65b9b5770681168321e8a9fc3d64e06c7244551d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 02:51:37 +0800 +Subject: mt76: mt7915: reset token when mac_reset happens + +From: Ryder Lee + +[ Upstream commit f285dfb98562e8380101095d168910df1d07d8be ] + +Reset buffering token in mt7915_mac_reset_work() to avoid possible leakege, +which leads to Tx stop after mac reset. + +Tested-by: Bo Jiao +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7915/init.c | 18 +------------- + .../net/wireless/mediatek/mt76/mt7915/mac.c | 24 +++++++++++++++++++ + .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 + + 3 files changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 102a8f14c22d..2ec18aaa8280 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -672,28 +672,12 @@ int mt7915_register_device(struct mt7915_dev *dev) + + void mt7915_unregister_device(struct mt7915_dev *dev) + { +- struct mt76_txwi_cache *txwi; +- int id; +- + mt7915_unregister_ext_phy(dev); + mt76_unregister_device(&dev->mt76); + mt7915_mcu_exit(dev); + mt7915_dma_cleanup(dev); + +- spin_lock_bh(&dev->token_lock); +- idr_for_each_entry(&dev->token, txwi, id) { +- mt7915_txp_skb_unmap(&dev->mt76, txwi); +- if (txwi->skb) { +- struct ieee80211_hw *hw; +- +- hw = mt76_tx_status_get_hw(&dev->mt76, txwi->skb); +- ieee80211_free_txskb(hw, txwi->skb); +- } +- mt76_put_txwi(&dev->mt76, txwi); +- dev->token_count--; +- } +- spin_unlock_bh(&dev->token_lock); +- idr_destroy(&dev->token); ++ mt7915_tx_token_put(dev); + + mt76_free_device(&dev->mt76); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index f504eeb221f9..1b4d65310b88 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1485,6 +1485,27 @@ mt7915_dma_reset(struct mt7915_phy *phy) + MT_WFDMA1_GLO_CFG_TX_DMA_EN | MT_WFDMA1_GLO_CFG_RX_DMA_EN); + } + ++void mt7915_tx_token_put(struct mt7915_dev *dev) ++{ ++ struct mt76_txwi_cache *txwi; ++ int id; ++ ++ spin_lock_bh(&dev->token_lock); ++ idr_for_each_entry(&dev->token, txwi, id) { ++ mt7915_txp_skb_unmap(&dev->mt76, txwi); ++ if (txwi->skb) { ++ struct ieee80211_hw *hw; ++ ++ hw = mt76_tx_status_get_hw(&dev->mt76, txwi->skb); ++ ieee80211_free_txskb(hw, txwi->skb); ++ } ++ mt76_put_txwi(&dev->mt76, txwi); ++ dev->token_count--; ++ } ++ spin_unlock_bh(&dev->token_lock); ++ idr_destroy(&dev->token); ++} ++ + /* system error recovery */ + void mt7915_mac_reset_work(struct work_struct *work) + { +@@ -1525,6 +1546,9 @@ void mt7915_mac_reset_work(struct work_struct *work) + + mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED); + ++ mt7915_tx_token_put(dev); ++ idr_init(&dev->token); ++ + if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) { + mt7915_dma_reset(&dev->phy); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 0339abf360d3..94bed8a3a050 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -463,6 +463,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct ieee80211_sta *sta, + struct mt76_tx_info *tx_info); + void mt7915_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e); ++void mt7915_tx_token_put(struct mt7915_dev *dev); + int mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc); + void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, + struct sk_buff *skb); +-- +2.30.1 + diff --git a/queue-5.11/net-ipa-avoid-field-overflow.patch b/queue-5.11/net-ipa-avoid-field-overflow.patch new file mode 100644 index 00000000000..391ee2e149f --- /dev/null +++ b/queue-5.11/net-ipa-avoid-field-overflow.patch @@ -0,0 +1,80 @@ +From cff89b190444a12b0af2c7046a9c8eeac1d7560a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 16:11:00 -0600 +Subject: net: ipa: avoid field overflow + +From: Alex Elder + +[ Upstream commit cd1150098f2cc7bd05740c105488c293f6761f5a ] + +It's possible that the length passed to ipa_header_size_encoded() +is larger than what can be represented by the HDR_LEN field alone +(starting with IPA v4.5). If we attempted that, u32_encode_bits() +would trigger a build-time error. + +Avoid this problem by masking off high-order bits of the value +encoded as the lower portion of the header length. + +The same sort of problem exists in ipa_metadata_offset_encoded(), +so implement the same fix there. + +Signed-off-by: Alex Elder +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_reg.h | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ipa/ipa_reg.h b/drivers/net/ipa/ipa_reg.h +index e6b0827a244e..732e691e9aa6 100644 +--- a/drivers/net/ipa/ipa_reg.h ++++ b/drivers/net/ipa/ipa_reg.h +@@ -408,15 +408,18 @@ enum ipa_cs_offload_en { + static inline u32 ipa_header_size_encoded(enum ipa_version version, + u32 header_size) + { ++ u32 size = header_size & field_mask(HDR_LEN_FMASK); + u32 val; + +- val = u32_encode_bits(header_size, HDR_LEN_FMASK); +- if (version < IPA_VERSION_4_5) ++ val = u32_encode_bits(size, HDR_LEN_FMASK); ++ if (version < IPA_VERSION_4_5) { ++ /* ipa_assert(header_size == size); */ + return val; ++ } + + /* IPA v4.5 adds a few more most-significant bits */ +- header_size >>= hweight32(HDR_LEN_FMASK); +- val |= u32_encode_bits(header_size, HDR_LEN_MSB_FMASK); ++ size = header_size >> hweight32(HDR_LEN_FMASK); ++ val |= u32_encode_bits(size, HDR_LEN_MSB_FMASK); + + return val; + } +@@ -425,15 +428,18 @@ static inline u32 ipa_header_size_encoded(enum ipa_version version, + static inline u32 ipa_metadata_offset_encoded(enum ipa_version version, + u32 offset) + { ++ u32 off = offset & field_mask(HDR_OFST_METADATA_FMASK); + u32 val; + +- val = u32_encode_bits(offset, HDR_OFST_METADATA_FMASK); +- if (version < IPA_VERSION_4_5) ++ val = u32_encode_bits(off, HDR_OFST_METADATA_FMASK); ++ if (version < IPA_VERSION_4_5) { ++ /* ipa_assert(offset == off); */ + return val; ++ } + + /* IPA v4.5 adds a few more most-significant bits */ +- offset >>= hweight32(HDR_OFST_METADATA_FMASK); +- val |= u32_encode_bits(offset, HDR_OFST_METADATA_MSB_FMASK); ++ off = offset >> hweight32(HDR_OFST_METADATA_FMASK); ++ val |= u32_encode_bits(off, HDR_OFST_METADATA_MSB_FMASK); + + return val; + } +-- +2.30.1 + diff --git a/queue-5.11/net-sfp-add-mode-quirk-for-gpon-module-ubiquiti-u-fi.patch b/queue-5.11/net-sfp-add-mode-quirk-for-gpon-module-ubiquiti-u-fi.patch new file mode 100644 index 00000000000..863dafa29f6 --- /dev/null +++ b/queue-5.11/net-sfp-add-mode-quirk-for-gpon-module-ubiquiti-u-fi.patch @@ -0,0 +1,105 @@ +From ad00d1a297e94e08f5524b7cef473741405c9f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 16:02:28 +0100 +Subject: net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit f0b4f847673299577c29b71d3f3acd3c313d81b7 ] + +The Ubiquiti U-Fiber Instant SFP GPON module has nonsensical information +stored in its EEPROM. It claims to support all transceiver types including +10G Ethernet. Clear all claimed modes and set only 1000baseX_Full, which is +the only one supported. + +This module has also phys_id set to SFF, and the SFP subsystem currently +does not allow to use SFP modules detected as SFFs. Add exception for this +module so it can be detected as supported. + +This change finally allows to detect and use SFP GPON module Ubiquiti +U-Fiber Instant on Linux system. + +EEPROM content of this SFP module is (where XX is serial number): + +00: 02 04 0b ff ff ff ff ff ff ff ff 03 0c 00 14 c8 ???........??.?? +10: 00 00 00 00 55 42 4e 54 20 20 20 20 20 20 20 20 ....UBNT +20: 20 20 20 20 00 18 e8 29 55 46 2d 49 4e 53 54 41 .??)UF-INSTA +30: 4e 54 20 20 20 20 20 20 34 20 20 20 05 1e 00 36 NT 4 ??.6 +40: 00 06 00 00 55 42 4e 54 XX XX XX XX XX XX XX XX .?..UBNTXXXXXXXX +50: 20 20 20 20 31 34 30 31 32 33 20 20 60 80 02 41 140123 `??A + +Signed-off-by: Pali Rohár +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp-bus.c | 15 +++++++++++++++ + drivers/net/phy/sfp.c | 17 +++++++++++++++-- + 2 files changed, 30 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index 20b91f5dfc6e..4cf874fb5c5b 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -44,6 +44,17 @@ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id, + phylink_set(modes, 2500baseX_Full); + } + ++static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id, ++ unsigned long *modes) ++{ ++ /* Ubiquiti U-Fiber Instant module claims that support all transceiver ++ * types including 10G Ethernet which is not truth. So clear all claimed ++ * modes and set only one mode which module supports: 1000baseX_Full. ++ */ ++ phylink_zero(modes); ++ phylink_set(modes, 1000baseX_Full); ++} ++ + static const struct sfp_quirk sfp_quirks[] = { + { + // Alcatel Lucent G-010S-P can operate at 2500base-X, but +@@ -63,6 +74,10 @@ static const struct sfp_quirk sfp_quirks[] = { + .vendor = "HUAWEI", + .part = "MA5671A", + .modes = sfp_quirk_2500basex, ++ }, { ++ .vendor = "UBNT", ++ .part = "UF-INSTANT", ++ .modes = sfp_quirk_ubnt_uf_instant, + }, + }; + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index f2b5e467a800..7a680b5177f5 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -273,8 +273,21 @@ static const struct sff_data sff_data = { + + static bool sfp_module_supported(const struct sfp_eeprom_id *id) + { +- return id->base.phys_id == SFF8024_ID_SFP && +- id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP; ++ if (id->base.phys_id == SFF8024_ID_SFP && ++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP) ++ return true; ++ ++ /* SFP GPON module Ubiquiti U-Fiber Instant has in its EEPROM stored ++ * phys id SFF instead of SFP. Therefore mark this module explicitly ++ * as supported based on vendor name and pn match. ++ */ ++ if (id->base.phys_id == SFF8024_ID_SFF_8472 && ++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP && ++ !memcmp(id->base.vendor_name, "UBNT ", 16) && ++ !memcmp(id->base.vendor_pn, "UF-INSTANT ", 16)) ++ return true; ++ ++ return false; + } + + static const struct sff_data sfp_data = { +-- +2.30.1 + diff --git a/queue-5.11/nvme-core-add-cancel-tagset-helpers.patch b/queue-5.11/nvme-core-add-cancel-tagset-helpers.patch new file mode 100644 index 00000000000..f2188e09ca7 --- /dev/null +++ b/queue-5.11/nvme-core-add-cancel-tagset-helpers.patch @@ -0,0 +1,67 @@ +From 86bd01d3e0db2c13ad791855f62db4190317ef0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 11:32:36 +0800 +Subject: nvme-core: add cancel tagset helpers + +From: Chao Leng + +[ Upstream commit 2547906982e2e6a0d42f8957f55af5bb51a7e55f ] + +Add nvme_cancel_tagset and nvme_cancel_admin_tagset for tear down and +reconnection error handling. + +Signed-off-by: Chao Leng +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 20 ++++++++++++++++++++ + drivers/nvme/host/nvme.h | 2 ++ + 2 files changed, 22 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index f13eb4ded95f..129e2b6bd6d3 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -371,6 +371,26 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + } + EXPORT_SYMBOL_GPL(nvme_cancel_request); + ++void nvme_cancel_tagset(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->tagset) { ++ blk_mq_tagset_busy_iter(ctrl->tagset, ++ nvme_cancel_request, ctrl); ++ blk_mq_tagset_wait_completed_request(ctrl->tagset); ++ } ++} ++EXPORT_SYMBOL_GPL(nvme_cancel_tagset); ++ ++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->admin_tagset) { ++ blk_mq_tagset_busy_iter(ctrl->admin_tagset, ++ nvme_cancel_request, ctrl); ++ blk_mq_tagset_wait_completed_request(ctrl->admin_tagset); ++ } ++} ++EXPORT_SYMBOL_GPL(nvme_cancel_admin_tagset); ++ + bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + enum nvme_ctrl_state new_state) + { +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 88a6b97247f5..a72f07181091 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -576,6 +576,8 @@ static inline bool nvme_is_aen_req(u16 qid, __u16 command_id) + + void nvme_complete_rq(struct request *req); + bool nvme_cancel_request(struct request *req, void *data, bool reserved); ++void nvme_cancel_tagset(struct nvme_ctrl *ctrl); ++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl); + bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + enum nvme_ctrl_state new_state); + bool nvme_wait_reset(struct nvme_ctrl *ctrl); +-- +2.30.1 + diff --git a/queue-5.11/nvme-rdma-add-clean-action-for-failed-reconnection.patch b/queue-5.11/nvme-rdma-add-clean-action-for-failed-reconnection.patch new file mode 100644 index 00000000000..4c177b0a6ee --- /dev/null +++ b/queue-5.11/nvme-rdma-add-clean-action-for-failed-reconnection.patch @@ -0,0 +1,82 @@ +From da8c0a9979bdb7ebb128287479396f444d69353f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 11:32:37 +0800 +Subject: nvme-rdma: add clean action for failed reconnection + +From: Chao Leng + +[ Upstream commit 958dc1d32c80566f58d18f05ef1f05bd32d172c1 ] + +A crash happens when inject failed reconnection. +If reconnect failed after start io queues, the queues will be unquiesced +and new requests continue to be delivered. Reconnection error handling +process directly free queues without cancel suspend requests. The +suppend request will time out, and then crash due to use the queue +after free. + +Add sync queues and cancel suppend requests for reconnection error +handling. + +Signed-off-by: Chao Leng +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index b7ce4f221d99..746392eade45 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -919,12 +919,16 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +- goto out_stop_queue; ++ goto out_quiesce_queue; + + return 0; + ++out_quiesce_queue: ++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ blk_sync_queue(ctrl->ctrl.admin_q); + out_stop_queue: + nvme_rdma_stop_queue(&ctrl->queues[0]); ++ nvme_cancel_admin_tagset(&ctrl->ctrl); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->ctrl.admin_q); +@@ -1001,8 +1005,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) + + out_wait_freeze_timed_out: + nvme_stop_queues(&ctrl->ctrl); ++ nvme_sync_io_queues(&ctrl->ctrl); + nvme_rdma_stop_io_queues(ctrl); + out_cleanup_connect_q: ++ nvme_cancel_tagset(&ctrl->ctrl); + if (new) + blk_cleanup_queue(ctrl->ctrl.connect_q); + out_free_tag_set: +@@ -1144,10 +1150,18 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) + return 0; + + destroy_io: +- if (ctrl->ctrl.queue_count > 1) ++ if (ctrl->ctrl.queue_count > 1) { ++ nvme_stop_queues(&ctrl->ctrl); ++ nvme_sync_io_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); ++ nvme_cancel_tagset(&ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, new); ++ } + destroy_admin: ++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ blk_sync_queue(ctrl->ctrl.admin_q); + nvme_rdma_stop_queue(&ctrl->queues[0]); ++ nvme_cancel_admin_tagset(&ctrl->ctrl); + nvme_rdma_destroy_admin_queue(ctrl, new); + return ret; + } +-- +2.30.1 + diff --git a/queue-5.11/nvme-tcp-add-clean-action-for-failed-reconnection.patch b/queue-5.11/nvme-tcp-add-clean-action-for-failed-reconnection.patch new file mode 100644 index 00000000000..46c93912e98 --- /dev/null +++ b/queue-5.11/nvme-tcp-add-clean-action-for-failed-reconnection.patch @@ -0,0 +1,81 @@ +From f1ebeb222a0847e1fb239175dbedd3fcebab7afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 11:32:38 +0800 +Subject: nvme-tcp: add clean action for failed reconnection + +From: Chao Leng + +[ Upstream commit 70a99574a79f1cd4dc7ad56ea37be40844bfb97b ] + +If reconnect failed after start io queues, the queues will be unquiesced +and new requests continue to be delivered. Reconnection error handling +process directly free queues without cancel suspend requests. The +suppend request will time out, and then crash due to use the queue +after free. + +Add sync queues and cancel suppend requests for reconnection error +handling. + +Signed-off-by: Chao Leng +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 881d28eb15e9..30d24a5a5b82 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1815,8 +1815,10 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new) + + out_wait_freeze_timed_out: + nvme_stop_queues(ctrl); ++ nvme_sync_io_queues(ctrl); + nvme_tcp_stop_io_queues(ctrl); + out_cleanup_connect_q: ++ nvme_cancel_tagset(ctrl); + if (new) + blk_cleanup_queue(ctrl->connect_q); + out_free_tag_set: +@@ -1878,12 +1880,16 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new) + + error = nvme_init_identify(ctrl); + if (error) +- goto out_stop_queue; ++ goto out_quiesce_queue; + + return 0; + ++out_quiesce_queue: ++ blk_mq_quiesce_queue(ctrl->admin_q); ++ blk_sync_queue(ctrl->admin_q); + out_stop_queue: + nvme_tcp_stop_queue(ctrl, 0); ++ nvme_cancel_admin_tagset(ctrl); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->admin_q); +@@ -2003,10 +2009,18 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new) + return 0; + + destroy_io: +- if (ctrl->queue_count > 1) ++ if (ctrl->queue_count > 1) { ++ nvme_stop_queues(ctrl); ++ nvme_sync_io_queues(ctrl); ++ nvme_tcp_stop_io_queues(ctrl); ++ nvme_cancel_tagset(ctrl); + nvme_tcp_destroy_io_queues(ctrl, new); ++ } + destroy_admin: ++ blk_mq_quiesce_queue(ctrl->admin_q); ++ blk_sync_queue(ctrl->admin_q); + nvme_tcp_stop_queue(ctrl, 0); ++ nvme_cancel_admin_tagset(ctrl); + nvme_tcp_destroy_admin_queue(ctrl, new); + return ret; + } +-- +2.30.1 + diff --git a/queue-5.11/parisc-bump-64-bit-irq-stack-size-to-64-kb.patch b/queue-5.11/parisc-bump-64-bit-irq-stack-size-to-64-kb.patch new file mode 100644 index 00000000000..e2334a94859 --- /dev/null +++ b/queue-5.11/parisc-bump-64-bit-irq-stack-size-to-64-kb.patch @@ -0,0 +1,41 @@ +From fe15d08c24fe8f2a1cabdb929971c5e31bbe0521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 18:12:30 -0500 +Subject: parisc: Bump 64-bit IRQ stack size to 64 KB + +From: John David Anglin + +[ Upstream commit 31680c1d1595a59e17c14ec036b192a95f8e5f4a ] + +Bump 64-bit IRQ stack size to 64 KB. + +I had a kernel IRQ stack overflow on the mx3210 debian buildd machine. This patch increases the +64-bit IRQ stack size to 64 KB. The 64-bit stack size needs to be larger than the 32-bit stack +size since registers are twice as big. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/irq.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c +index 49cd6d2caefb..1dfb439b0692 100644 +--- a/arch/parisc/kernel/irq.c ++++ b/arch/parisc/kernel/irq.c +@@ -373,7 +373,11 @@ static inline int eirr_to_irq(unsigned long eirr) + /* + * IRQ STACK - used for irq handler + */ ++#ifdef CONFIG_64BIT ++#define IRQ_STACK_SIZE (4096 << 4) /* 64k irq stack size */ ++#else + #define IRQ_STACK_SIZE (4096 << 3) /* 32k irq stack size */ ++#endif + + union irq_stack_union { + unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)]; +-- +2.30.1 + diff --git a/queue-5.11/pci-add-a-rebar-size-quirk-for-sapphire-rx-5600-xt-p.patch b/queue-5.11/pci-add-a-rebar-size-quirk-for-sapphire-rx-5600-xt-p.patch new file mode 100644 index 00000000000..33cd2d83648 --- /dev/null +++ b/queue-5.11/pci-add-a-rebar-size-quirk-for-sapphire-rx-5600-xt-p.patch @@ -0,0 +1,48 @@ +From 3e728456b6375fa676433d135c11c3e74bead08e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 12:26:55 +0100 +Subject: PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nirmoy Das + +[ Upstream commit 907830b0fc9e374d00f3c83de5e426157b482c01 ] + +RX 5600 XT Pulse advertises support for BAR 0 being 256MB, 512MB, +or 1GB, but it also supports 2GB, 4GB, and 8GB. Add a rebar +size quirk so that the BAR 0 is big enough to cover complete VARM. + +Signed-off-by: Christian König +Signed-off-by: Nirmoy Das +Acked-by: Bjorn Helgaas +Link: https://patchwork.kernel.org/project/dri-devel/patch/20210107175017.15893-5-nirmoy.das@amd.com +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 790393d1e318..ba791165ed19 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3596,7 +3596,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar) + return 0; + + pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap); +- return (cap & PCI_REBAR_CAP_SIZES) >> 4; ++ cap &= PCI_REBAR_CAP_SIZES; ++ ++ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */ ++ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f && ++ bar == 0 && cap == 0x7000) ++ cap = 0x3f000; ++ ++ return cap >> 4; + } + + /** +-- +2.30.1 + diff --git a/queue-5.11/perf-x86-kvm-add-cascade-lake-xeon-steppings-to-isol.patch b/queue-5.11/perf-x86-kvm-add-cascade-lake-xeon-steppings-to-isol.patch new file mode 100644 index 00000000000..d6d7bdb8ef8 --- /dev/null +++ b/queue-5.11/perf-x86-kvm-add-cascade-lake-xeon-steppings-to-isol.patch @@ -0,0 +1,45 @@ +From aef4be2ecd7aaa26be8df0b12da38a511ebc8a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 11:13:24 -0800 +Subject: perf/x86/kvm: Add Cascade Lake Xeon steppings to isolation_ucodes[] + +From: Jim Mattson + +[ Upstream commit b3c3361fe325074d4144c29d46daae4fc5a268d5 ] + +Cascade Lake Xeon parts have the same model number as Skylake Xeon +parts, so they are tagged with the intel_pebs_isolation +quirk. However, as with Skylake Xeon H0 stepping parts, the PEBS +isolation issue is fixed in all microcode versions. + +Add the Cascade Lake Xeon steppings (5, 6, and 7) to the +isolation_ucodes[] table so that these parts benefit from Andi's +optimization in commit 9b545c04abd4f ("perf/x86/kvm: Avoid unnecessary +work in guest filtering"). + +Signed-off-by: Jim Mattson +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andi Kleen +Link: https://lkml.kernel.org/r/20210205191324.2889006-1-jmattson@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index d4569bfa83e3..4faaef3a8f6c 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -4397,6 +4397,9 @@ static const struct x86_cpu_desc isolation_ucodes[] = { + INTEL_CPU_DESC(INTEL_FAM6_BROADWELL_X, 2, 0x0b000014), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 3, 0x00000021), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 4, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 5, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 6, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 7, 0x00000000), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_L, 3, 0x0000007c), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE, 3, 0x0000007c), + INTEL_CPU_DESC(INTEL_FAM6_KABYLAKE, 9, 0x0000004e), +-- +2.30.1 + diff --git a/queue-5.11/pktgen-fix-misuse-of-bug_on-in-pktgen_thread_worker.patch b/queue-5.11/pktgen-fix-misuse-of-bug_on-in-pktgen_thread_worker.patch new file mode 100644 index 00000000000..638392f9cc9 --- /dev/null +++ b/queue-5.11/pktgen-fix-misuse-of-bug_on-in-pktgen_thread_worker.patch @@ -0,0 +1,43 @@ +From ebb015aec807728f7d2604f4d83832636ba3deb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jan 2021 20:42:29 +0800 +Subject: pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() + +From: Di Zhu + +[ Upstream commit 275b1e88cabb34dbcbe99756b67e9939d34a99b6 ] + +pktgen create threads for all online cpus and bond these threads to +relevant cpu repecivtily. when this thread firstly be woken up, it +will compare cpu currently running with the cpu specified at the time +of creation and if the two cpus are not equal, BUG_ON() will take effect +causing panic on the system. +Notice that these threads could be migrated to other cpus before start +running because of the cpu hotplug after these threads have created. so the +BUG_ON() used here seems unreasonable and we can replace it with WARN_ON() +to just printf a warning other than panic the system. + +Signed-off-by: Di Zhu +Link: https://lore.kernel.org/r/20210125124229.19334-1-zhudi21@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/pktgen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 105978604ffd..3fba429f1f57 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -3464,7 +3464,7 @@ static int pktgen_thread_worker(void *arg) + struct pktgen_dev *pkt_dev = NULL; + int cpu = t->cpu; + +- BUG_ON(smp_processor_id() != cpu); ++ WARN_ON(smp_processor_id() != cpu); + + init_waitqueue_head(&t->queue); + complete(&t->start_done); +-- +2.30.1 + diff --git a/queue-5.11/sched-features-fix-hrtick-reprogramming.patch b/queue-5.11/sched-features-fix-hrtick-reprogramming.patch new file mode 100644 index 00000000000..ae8890a7699 --- /dev/null +++ b/queue-5.11/sched-features-fix-hrtick-reprogramming.patch @@ -0,0 +1,94 @@ +From d29326eaffc19e177a096427cec728592a5f89f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 08:35:53 +0100 +Subject: sched/features: Fix hrtick reprogramming + +From: Juri Lelli + +[ Upstream commit 156ec6f42b8d300dbbf382738ff35c8bad8f4c3a ] + +Hung tasks and RCU stall cases were reported on systems which were not +100% busy. Investigation of such unexpected cases (no sign of potential +starvation caused by tasks hogging the system) pointed out that the +periodic sched tick timer wasn't serviced anymore after a certain point +and that caused all machinery that depends on it (timers, RCU, etc.) to +stop working as well. This issues was however only reproducible if +HRTICK was enabled. + +Looking at core dumps it was found that the rbtree of the hrtimer base +used also for the hrtick was corrupted (i.e. next as seen from the base +root and actual leftmost obtained by traversing the tree are different). +Same base is also used for periodic tick hrtimer, which might get "lost" +if the rbtree gets corrupted. + +Much alike what described in commit 1f71addd34f4c ("tick/sched: Do not +mess with an enqueued hrtimer") there is a race window between +hrtimer_set_expires() in hrtick_start and hrtimer_start_expires() in +__hrtick_restart() in which the former might be operating on an already +queued hrtick hrtimer, which might lead to corruption of the base. + +Use hrtick_start() (which removes the timer before enqueuing it back) to +ensure hrtick hrtimer reprogramming is entirely guarded by the base +lock, so that no race conditions can occur. + +Signed-off-by: Juri Lelli +Signed-off-by: Luis Claudio R. Goncalves +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lkml.kernel.org/r/20210208073554.14629-2-juri.lelli@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 8 +++----- + kernel/sched/sched.h | 1 + + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 22f6748c16f6..fa1f83083a58 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -355,8 +355,9 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer) + static void __hrtick_restart(struct rq *rq) + { + struct hrtimer *timer = &rq->hrtick_timer; ++ ktime_t time = rq->hrtick_time; + +- hrtimer_start_expires(timer, HRTIMER_MODE_ABS_PINNED_HARD); ++ hrtimer_start(timer, time, HRTIMER_MODE_ABS_PINNED_HARD); + } + + /* +@@ -380,7 +381,6 @@ static void __hrtick_start(void *arg) + void hrtick_start(struct rq *rq, u64 delay) + { + struct hrtimer *timer = &rq->hrtick_timer; +- ktime_t time; + s64 delta; + + /* +@@ -388,9 +388,7 @@ void hrtick_start(struct rq *rq, u64 delay) + * doesn't make sense and can cause timer DoS. + */ + delta = max_t(s64, delay, 10000LL); +- time = ktime_add_ns(timer->base->get_time(), delta); +- +- hrtimer_set_expires(timer, time); ++ rq->hrtick_time = ktime_add_ns(timer->base->get_time(), delta); + + if (rq == this_rq()) + __hrtick_restart(rq); +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index bb09988451a0..282a6bbaacd7 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1031,6 +1031,7 @@ struct rq { + call_single_data_t hrtick_csd; + #endif + struct hrtimer hrtick_timer; ++ ktime_t hrtick_time; + #endif + + #ifdef CONFIG_SCHEDSTATS +-- +2.30.1 + diff --git a/queue-5.11/selftests-bpf-remove-memory-leak.patch b/queue-5.11/selftests-bpf-remove-memory-leak.patch new file mode 100644 index 00000000000..acfa46fec54 --- /dev/null +++ b/queue-5.11/selftests-bpf-remove-memory-leak.patch @@ -0,0 +1,38 @@ +From 63895af3aa586ec4dc39318bb5c487aea6e28e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jan 2021 16:47:17 +0100 +Subject: selftests/bpf: Remove memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 4896d7e37ea5217d42e210bfcf4d56964044704f ] + +The allocated entry is immediately overwritten by an assignment. Fix +that. + +Signed-off-by: Björn Töpel +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210122154725.22140-5-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/xdpxceiver.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/xdpxceiver.c b/tools/testing/selftests/bpf/xdpxceiver.c +index 1e722ee76b1f..e7945b6246c8 100644 +--- a/tools/testing/selftests/bpf/xdpxceiver.c ++++ b/tools/testing/selftests/bpf/xdpxceiver.c +@@ -729,7 +729,6 @@ static void worker_pkt_validate(void) + u32 payloadseqnum = -2; + + while (1) { +- pkt_node_rx_q = malloc(sizeof(struct pkt)); + pkt_node_rx_q = TAILQ_LAST(&head, head_s); + if (!pkt_node_rx_q) + break; +-- +2.30.1 + diff --git a/queue-5.11/series b/queue-5.11/series index d228f478717..ed52f706977 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -35,3 +35,55 @@ dt-bindings-ethernet-controller-fix-fixed-link-specification.patch dt-bindings-net-btusb-dt-fix-s-interrupt-name-interrupt-names.patch asoc-qcom-remove-useless-debug-print.patch soundwire-debugfs-use-controller-id-instead-of-link_id.patch +ath10k-prevent-deinitializing-napi-twice.patch +edac-amd64-do-not-load-on-family-0x15-model-0x13.patch +staging-fwserial-fix-error-handling-in-fwserial_crea.patch +x86-reboot-add-zotac-zbox-ci327-nano-pci-reboot-quir.patch +can-flexcan-add-can-wakeup-function-for-i.mx8qm.patch +vt-consolemap-do-font-sum-unsigned.patch +wlcore-fix-command-execute-failure-19-for-wl12xx.patch +bluetooth-hci_h5-set-hci_quirk_simultaneous_discover.patch +bluetooth-btusb-fix-memory-leak-on-suspend-and-resum.patch +selftests-bpf-remove-memory-leak.patch +mt76-mt7915-reset-token-when-mac_reset-happens.patch +mt76-mt7615-reset-token-when-mac_reset-happens.patch +pktgen-fix-misuse-of-bug_on-in-pktgen_thread_worker.patch +ath10k-fix-wmi-mgmt-tx-queue-full-due-to-race-condit.patch +net-sfp-add-mode-quirk-for-gpon-module-ubiquiti-u-fi.patch +bluetooth-add-new-hci_quirk_no_suspend_notifier-quir.patch +bluetooth-fix-null-pointer-dereference-in-amp_read_l.patch +staging-most-sound-add-sanity-check-for-function-arg.patch +staging-bcm2835-audio-replace-unsafe-strcpy-with-str.patch +net-ipa-avoid-field-overflow.patch +brcmfmac-add-dmi-nvram-filename-quirk-for-predia-bas.patch +brcmfmac-add-dmi-nvram-filename-quirk-for-voyo-winpa.patch +wilc1000-fix-use-of-void-pointer-as-a-wrong-struct-t.patch +drm-hisilicon-fix-use-after-free.patch +crypto-tcrypt-avoid-signed-overflow-in-byte-count.patch +fs-make-unlazy_walk-error-handling-consistent.patch +drm-amdgpu-add-check-to-prevent-ih-overflow.patch +pci-add-a-rebar-size-quirk-for-sapphire-rx-5600-xt-p.patch +asoc-intel-bytcr_rt5640-add-new-byt_rt5640_no_speake.patch +alsa-usb-audio-add-support-for-pioneer-djm-750.patch +drm-amd-display-guard-against-null-pointer-deref-whe.patch +drm-amd-amdgpu-add-error-handling-to-amdgpu_virt_rea.patch +media-uvcvideo-allow-entities-with-no-pads.patch +f2fs-handle-unallocated-section-and-zone-on-pinned-a.patch +f2fs-fix-to-set-clear-i_linkable-under-i_lock.patch +nvme-core-add-cancel-tagset-helpers.patch +nvme-rdma-add-clean-action-for-failed-reconnection.patch +nvme-tcp-add-clean-action-for-failed-reconnection.patch +alsa-usb-audio-add-djm450-to-pioneer-format-quirk.patch +alsa-usb-audio-add-djm-450-to-the-quirks-table.patch +asoc-intel-add-dmi-quirk-table-to-soc_intel_is_byt_c.patch +btrfs-fix-error-handling-in-commit_fs_roots.patch +drm-amdgpu-enable-only-one-high-prio-compute-queue.patch +perf-x86-kvm-add-cascade-lake-xeon-steppings-to-isol.patch +asoc-intel-sof-sdw-indent-and-add-quirks-consistentl.patch +asoc-intel-sof_sdw-detect-dmic-number-based-on-mach-.patch +parisc-bump-64-bit-irq-stack-size-to-64-kb.patch +sched-features-fix-hrtick-reprogramming.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-estar-beau.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-voyo-winpa.patch +asoc-intel-bytcr_rt5651-add-quirk-for-the-jumper-ezp.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-acer-one-s.patch diff --git a/queue-5.11/staging-bcm2835-audio-replace-unsafe-strcpy-with-str.patch b/queue-5.11/staging-bcm2835-audio-replace-unsafe-strcpy-with-str.patch new file mode 100644 index 00000000000..f2c3cb482a0 --- /dev/null +++ b/queue-5.11/staging-bcm2835-audio-replace-unsafe-strcpy-with-str.patch @@ -0,0 +1,143 @@ +From b8b2db54e087699647747edb1d888b6de39f1bc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Feb 2021 08:25:02 +0100 +Subject: staging: bcm2835-audio: Replace unsafe strcpy() with strscpy() + +From: Juerg Haefliger + +[ Upstream commit 4964a4300660d27907ceb655f219ac47e5941534 ] + +Replace strcpy() with strscpy() in bcm2835-audio/bcm2835.c to prevent the +following when loading snd-bcm2835: + +[ 58.480634] ------------[ cut here ]------------ +[ 58.485321] kernel BUG at lib/string.c:1149! +[ 58.489650] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +[ 58.495214] Modules linked in: snd_bcm2835(COE+) snd_pcm snd_timer snd dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua btsdio bluetooth ecdh_generic ecc bcm2835_v4l2(CE) bcm2835_codec(CE) brcmfmac bcm2835_isp(CE) bcm2835_mmal_vchiq(CE) brcmutil cfg80211 v4l2_mem2mem videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops raspberrypi_hwmon videobuf2_v4l2 videobuf2_common videodev bcm2835_gpiomem mc vc_sm_cma(CE) rpivid_mem uio_pdrv_genirq uio sch_fq_codel drm ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 multipath linear dwc2 roles spidev udc_core crct10dif_ce xhci_pci xhci_pci_renesas phy_generic aes_neon_bs aes_neon_blk crypto_simd cryptd +[ 58.563787] CPU: 3 PID: 1959 Comm: insmod Tainted: G C OE 5.11.0-1001-raspi #1 +[ 58.572172] Hardware name: Raspberry Pi 4 Model B Rev 1.2 (DT) +[ 58.578086] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 58.584178] pc : fortify_panic+0x20/0x24 +[ 58.588161] lr : fortify_panic+0x20/0x24 +[ 58.592136] sp : ffff800010a83990 +[ 58.595491] x29: ffff800010a83990 x28: 0000000000000002 +[ 58.600879] x27: ffffb0b07cb72928 x26: 0000000000000000 +[ 58.606268] x25: ffff39e884973838 x24: ffffb0b07cb74190 +[ 58.611655] x23: ffffb0b07cb72030 x22: 0000000000000000 +[ 58.617042] x21: ffff39e884973014 x20: ffff39e88b793010 +[ 58.622428] x19: ffffb0b07cb72670 x18: 0000000000000030 +[ 58.627814] x17: 0000000000000000 x16: ffffb0b092ce2c1c +[ 58.633200] x15: ffff39e88b901500 x14: 0720072007200720 +[ 58.638588] x13: 0720072007200720 x12: 0720072007200720 +[ 58.643979] x11: ffffb0b0936cbdf0 x10: 00000000fffff000 +[ 58.649366] x9 : ffffb0b09220cfa8 x8 : 0000000000000000 +[ 58.654752] x7 : ffffb0b093673df0 x6 : ffffb0b09364e000 +[ 58.660140] x5 : 0000000000000000 x4 : ffff39e93b7db948 +[ 58.665526] x3 : ffff39e93b7ebcf0 x2 : 0000000000000000 +[ 58.670913] x1 : 0000000000000000 x0 : 0000000000000022 +[ 58.676299] Call trace: +[ 58.678775] fortify_panic+0x20/0x24 +[ 58.682402] snd_bcm2835_alsa_probe+0x5b8/0x7d8 [snd_bcm2835] +[ 58.688247] platform_probe+0x74/0xe4 +[ 58.691963] really_probe+0xf0/0x510 +[ 58.695585] driver_probe_device+0xe0/0x100 +[ 58.699826] device_driver_attach+0xcc/0xd4 +[ 58.704068] __driver_attach+0xb0/0x17c +[ 58.707956] bus_for_each_dev+0x7c/0xd4 +[ 58.711843] driver_attach+0x30/0x40 +[ 58.715467] bus_add_driver+0x154/0x250 +[ 58.719354] driver_register+0x84/0x140 +[ 58.723242] __platform_driver_register+0x34/0x40 +[ 58.728013] bcm2835_alsa_driver_init+0x30/0x1000 [snd_bcm2835] +[ 58.734024] do_one_initcall+0x54/0x300 +[ 58.737914] do_init_module+0x60/0x280 +[ 58.741719] load_module+0x680/0x770 +[ 58.745344] __do_sys_finit_module+0xbc/0x130 +[ 58.749761] __arm64_sys_finit_module+0x2c/0x40 +[ 58.754356] el0_svc_common.constprop.0+0x88/0x220 +[ 58.759216] do_el0_svc+0x30/0xa0 +[ 58.762575] el0_svc+0x28/0x70 +[ 58.765669] el0_sync_handler+0x1a4/0x1b0 +[ 58.769732] el0_sync+0x178/0x180 +[ 58.773095] Code: aa0003e1 91366040 910003fd 97ffee21 (d4210000) +[ 58.779275] ---[ end trace 29be5b17497bd898 ]--- +[ 58.783955] note: insmod[1959] exited with preempt_count 1 +[ 58.791921] ------------[ cut here ]------------ + +For the sake of it, replace all the other occurences of strcpy() under +bcm2835-audio/ as well. + +Signed-off-by: Juerg Haefliger +Link: https://lore.kernel.org/r/20210205072502.10907-1-juergh@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c | 6 +++--- + drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 2 +- + drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 6 +++--- + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c +index 4c2cae99776b..3703409715da 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c +@@ -224,7 +224,7 @@ int snd_bcm2835_new_ctl(struct bcm2835_chip *chip) + { + int err; + +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + err = create_ctls(chip, ARRAY_SIZE(snd_bcm2835_ctl), snd_bcm2835_ctl); + if (err < 0) + return err; +@@ -261,7 +261,7 @@ static const struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = { + + int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip) + { +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_headphones_ctl), + snd_bcm2835_headphones_ctl); + } +@@ -295,7 +295,7 @@ static const struct snd_kcontrol_new snd_bcm2835_hdmi[] = { + + int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip) + { +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_hdmi), + snd_bcm2835_hdmi); + } +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c +index f783b632141b..096f2c54258a 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c +@@ -334,7 +334,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name, + + pcm->private_data = chip; + pcm->nonatomic = true; +- strcpy(pcm->name, name); ++ strscpy(pcm->name, name, sizeof(pcm->name)); + if (!spdif) { + chip->dest = route; + chip->volume = 0; +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +index cf5f80f5ca6b..c250fbef2fa3 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +@@ -185,9 +185,9 @@ static int snd_add_child_device(struct device *dev, + goto error; + } + +- strcpy(card->driver, audio_driver->driver.name); +- strcpy(card->shortname, audio_driver->shortname); +- strcpy(card->longname, audio_driver->longname); ++ strscpy(card->driver, audio_driver->driver.name, sizeof(card->driver)); ++ strscpy(card->shortname, audio_driver->shortname, sizeof(card->shortname)); ++ strscpy(card->longname, audio_driver->longname, sizeof(card->longname)); + + err = audio_driver->newpcm(chip, audio_driver->shortname, + audio_driver->route, +-- +2.30.1 + diff --git a/queue-5.11/staging-fwserial-fix-error-handling-in-fwserial_crea.patch b/queue-5.11/staging-fwserial-fix-error-handling-in-fwserial_crea.patch new file mode 100644 index 00000000000..fc708b4b651 --- /dev/null +++ b/queue-5.11/staging-fwserial-fix-error-handling-in-fwserial_crea.patch @@ -0,0 +1,45 @@ +From 1cebee29132bb067c9d7c43a380986d5137051cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Dec 2020 20:24:35 +0800 +Subject: staging: fwserial: Fix error handling in fwserial_create + +From: Dinghao Liu + +[ Upstream commit f31559af97a0eabd467e4719253675b7dccb8a46 ] + +When fw_core_add_address_handler() fails, we need to destroy +the port by tty_port_destroy(). Also we need to unregister +the address handler by fw_core_remove_address_handler() on +failure. + +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20201221122437.10274-1-dinghao.liu@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fwserial/fwserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c +index db83d34cd677..c368082aae1a 100644 +--- a/drivers/staging/fwserial/fwserial.c ++++ b/drivers/staging/fwserial/fwserial.c +@@ -2189,6 +2189,7 @@ static int fwserial_create(struct fw_unit *unit) + err = fw_core_add_address_handler(&port->rx_handler, + &fw_high_memory_region); + if (err) { ++ tty_port_destroy(&port->port); + kfree(port); + goto free_ports; + } +@@ -2271,6 +2272,7 @@ unregister_ttys: + + free_ports: + for (--i; i >= 0; --i) { ++ fw_core_remove_address_handler(&serial->ports[i]->rx_handler); + tty_port_destroy(&serial->ports[i]->port); + kfree(serial->ports[i]); + } +-- +2.30.1 + diff --git a/queue-5.11/staging-most-sound-add-sanity-check-for-function-arg.patch b/queue-5.11/staging-most-sound-add-sanity-check-for-function-arg.patch new file mode 100644 index 00000000000..414d48bfcc9 --- /dev/null +++ b/queue-5.11/staging-most-sound-add-sanity-check-for-function-arg.patch @@ -0,0 +1,37 @@ +From 65a58bae4ec3e773e39e5899c56f2987246de0b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 17:21:05 +0100 +Subject: staging: most: sound: add sanity check for function argument + +From: Christian Gromm + +[ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ] + +This patch checks the function parameter 'bytes' before doing the +subtraction to prevent memory corruption. + +Signed-off-by: Christian Gromm +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/most/sound/sound.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c +index 3a1a59058042..45befb8c1126 100644 +--- a/drivers/staging/most/sound/sound.c ++++ b/drivers/staging/most/sound/sound.c +@@ -86,6 +86,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes) + { + unsigned int i = 0; + ++ if (bytes < 2) ++ return; + while (i < bytes - 2) { + dest[i] = source[i + 2]; + dest[i + 1] = source[i + 1]; +-- +2.30.1 + diff --git a/queue-5.11/vt-consolemap-do-font-sum-unsigned.patch b/queue-5.11/vt-consolemap-do-font-sum-unsigned.patch new file mode 100644 index 00000000000..cfafad2fbd8 --- /dev/null +++ b/queue-5.11/vt-consolemap-do-font-sum-unsigned.patch @@ -0,0 +1,38 @@ +From be59fa8c2c1943f0d6444f328d0644e85b7dc69d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jan 2021 13:02:34 +0100 +Subject: vt/consolemap: do font sum unsigned + +From: Jiri Slaby + +[ Upstream commit 9777f8e60e718f7b022a94f2524f967d8def1931 ] + +The constant 20 makes the font sum computation signed which can lead to +sign extensions and signed wraps. It's not much of a problem as we build +with -fno-strict-overflow. But if we ever decide not to, be ready, so +switch the constant to unsigned. + +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20210105120239.28031-7-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vt/consolemap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c +index f7d015c67963..d815ac98b39e 100644 +--- a/drivers/tty/vt/consolemap.c ++++ b/drivers/tty/vt/consolemap.c +@@ -495,7 +495,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos) + + p2[unicode & 0x3f] = fontpos; + +- p->sum += (fontpos << 20) + unicode; ++ p->sum += (fontpos << 20U) + unicode; + + return 0; + } +-- +2.30.1 + diff --git a/queue-5.11/wilc1000-fix-use-of-void-pointer-as-a-wrong-struct-t.patch b/queue-5.11/wilc1000-fix-use-of-void-pointer-as-a-wrong-struct-t.patch new file mode 100644 index 00000000000..c4f98c847cc --- /dev/null +++ b/queue-5.11/wilc1000-fix-use-of-void-pointer-as-a-wrong-struct-t.patch @@ -0,0 +1,115 @@ +From 00b059f02bfa01d1ce6c25ea6baf7ba72d523e40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 20:40:24 +0200 +Subject: wilc1000: Fix use of void pointer as a wrong struct type + +From: Vsevolod Kozlov + +[ Upstream commit 6fe91b69ceceea832a73d35185df04b3e877f399 ] + +ac_classify() expects a struct sk_buff* as its second argument, which is +a member of struct tx_complete_data. priv happens to be a pointer to +struct tx_complete_data, so passing it directly to ac_classify() leads +to wrong behaviour and occasional panics. + +Since there is only one caller of wilc_wlan_txq_add_net_pkt and it +already knows the type behind this pointer, and the structure is already +in the header file, change the function signature to use the real type +instead of void* in order to prevent confusion. + +Signed-off-by: Vsevolod Kozlov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YCQomJ1mO5BLxYOT@Vsevolods-Mini.lan +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/netdev.c | 2 +- + drivers/net/wireless/microchip/wilc1000/wlan.c | 15 ++++++++------- + drivers/net/wireless/microchip/wilc1000/wlan.h | 3 ++- + 3 files changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 2a1fbbdd6a4b..0c188310919e 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -737,7 +737,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev) + + vif->netstats.tx_packets++; + vif->netstats.tx_bytes += tx_data->size; +- queue_count = wilc_wlan_txq_add_net_pkt(ndev, (void *)tx_data, ++ queue_count = wilc_wlan_txq_add_net_pkt(ndev, tx_data, + tx_data->buff, tx_data->size, + wilc_tx_complete); + +diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c +index c12f27be9f79..31d51385ba93 100644 +--- a/drivers/net/wireless/microchip/wilc1000/wlan.c ++++ b/drivers/net/wireless/microchip/wilc1000/wlan.c +@@ -408,7 +408,8 @@ static inline u8 ac_change(struct wilc *wilc, u8 *ac) + return 1; + } + +-int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, ++int wilc_wlan_txq_add_net_pkt(struct net_device *dev, ++ struct tx_complete_data *tx_data, u8 *buffer, + u32 buffer_size, + void (*tx_complete_fn)(void *, int)) + { +@@ -420,27 +421,27 @@ int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, + wilc = vif->wilc; + + if (wilc->quit) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + return 0; + } + + tqe = kmalloc(sizeof(*tqe), GFP_ATOMIC); + + if (!tqe) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + return 0; + } + tqe->type = WILC_NET_PKT; + tqe->buffer = buffer; + tqe->buffer_size = buffer_size; + tqe->tx_complete_func = tx_complete_fn; +- tqe->priv = priv; ++ tqe->priv = tx_data; + tqe->vif = vif; + +- q_num = ac_classify(wilc, priv); ++ q_num = ac_classify(wilc, tx_data->skb); + tqe->q_num = q_num; + if (ac_change(wilc, &q_num)) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + kfree(tqe); + return 0; + } +@@ -451,7 +452,7 @@ int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, + tcp_process(dev, tqe); + wilc_wlan_txq_add_to_tail(dev, q_num, tqe); + } else { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + kfree(tqe); + } + +diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.h b/drivers/net/wireless/microchip/wilc1000/wlan.h +index 3d2104f19819..d55eb6b3a12a 100644 +--- a/drivers/net/wireless/microchip/wilc1000/wlan.h ++++ b/drivers/net/wireless/microchip/wilc1000/wlan.h +@@ -399,7 +399,8 @@ int wilc_wlan_firmware_download(struct wilc *wilc, const u8 *buffer, + u32 buffer_size); + int wilc_wlan_start(struct wilc *wilc); + int wilc_wlan_stop(struct wilc *wilc, struct wilc_vif *vif); +-int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, ++int wilc_wlan_txq_add_net_pkt(struct net_device *dev, ++ struct tx_complete_data *tx_data, u8 *buffer, + u32 buffer_size, + void (*tx_complete_fn)(void *, int)); + int wilc_wlan_handle_txq(struct wilc *wl, u32 *txq_count); +-- +2.30.1 + diff --git a/queue-5.11/wlcore-fix-command-execute-failure-19-for-wl12xx.patch b/queue-5.11/wlcore-fix-command-execute-failure-19-for-wl12xx.patch new file mode 100644 index 00000000000..4fbb673e3fa --- /dev/null +++ b/queue-5.11/wlcore-fix-command-execute-failure-19-for-wl12xx.patch @@ -0,0 +1,127 @@ +From 990c4ae625c5de391d9ed6b7d0f4f2d8a50bdb4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jan 2021 08:56:13 +0200 +Subject: wlcore: Fix command execute failure 19 for wl12xx + +From: Tony Lindgren + +[ Upstream commit cb88d01b67383a095e3f7caeb4cdade5a6cf0417 ] + +We can currently get a "command execute failure 19" error on beacon loss +if the signal is weak: + +wlcore: Beacon loss detected. roles:0xff +wlcore: Connection loss work (role_id: 0). +... +wlcore: ERROR command execute failure 19 +... +WARNING: CPU: 0 PID: 1552 at drivers/net/wireless/ti/wlcore/main.c:803 +... +(wl12xx_queue_recovery_work.part.0 [wlcore]) +(wl12xx_cmd_role_start_sta [wlcore]) +(wl1271_op_bss_info_changed [wlcore]) +(ieee80211_prep_connection [mac80211]) + +Error 19 is defined as CMD_STATUS_WRONG_NESTING from the wlcore firmware, +and seems to mean that the firmware no longer wants to see the quirk +handling for WLCORE_QUIRK_START_STA_FAILS done. + +This quirk got added with commit 18eab430700d ("wlcore: workaround +start_sta problem in wl12xx fw"), and it seems that this already got fixed +in the firmware long time ago back in 2012 as wl18xx never had this quirk +in place to start with. + +As we no longer even support firmware that early, to me it seems that it's +safe to just drop WLCORE_QUIRK_START_STA_FAILS to fix the error. Looks +like earlier firmware got disabled back in 2013 with commit 0e284c074ef9 +("wl12xx: increase minimum singlerole firmware version required"). + +If it turns out we still need WLCORE_QUIRK_START_STA_FAILS with any +firmware that the driver works with, we can simply revert this patch and +add extra checks for firmware version used. + +With this fix wlcore reconnects properly after a beacon loss. + +Cc: Raz Bouganim +Signed-off-by: Tony Lindgren +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210115065613.7731-1-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wl12xx/main.c | 3 --- + drivers/net/wireless/ti/wlcore/main.c | 15 +-------------- + drivers/net/wireless/ti/wlcore/wlcore.h | 3 --- + 3 files changed, 1 insertion(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c +index 3c9c623bb428..9d7dbfe7fe0c 100644 +--- a/drivers/net/wireless/ti/wl12xx/main.c ++++ b/drivers/net/wireless/ti/wl12xx/main.c +@@ -635,7 +635,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_LEGACY_NVS | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + wl->sr_fw_name = WL127X_FW_NAME_SINGLE; + wl->mr_fw_name = WL127X_FW_NAME_MULTI; +@@ -659,7 +658,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_LEGACY_NVS | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + wl->plt_fw_name = WL127X_PLT_FW_NAME; + wl->sr_fw_name = WL127X_FW_NAME_SINGLE; +@@ -688,7 +686,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + + wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER, +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index 122c7a4b374f..0f9cc3de6aeb 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -2872,21 +2872,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif) + + if (is_ibss) + ret = wl12xx_cmd_role_start_ibss(wl, wlvif); +- else { +- if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) { +- /* +- * TODO: this is an ugly workaround for wl12xx fw +- * bug - we are not able to tx/rx after the first +- * start_sta, so make dummy start+stop calls, +- * and then call start_sta again. +- * this should be fixed in the fw. +- */ +- wl12xx_cmd_role_start_sta(wl, wlvif); +- wl12xx_cmd_role_stop_sta(wl, wlvif); +- } +- ++ else + ret = wl12xx_cmd_role_start_sta(wl, wlvif); +- } + + return ret; + } +diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h +index b7821311ac75..81c94d390623 100644 +--- a/drivers/net/wireless/ti/wlcore/wlcore.h ++++ b/drivers/net/wireless/ti/wlcore/wlcore.h +@@ -547,9 +547,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip, + /* Each RX/TX transaction requires an end-of-transaction transfer */ + #define WLCORE_QUIRK_END_OF_TRANSACTION BIT(0) + +-/* the first start_role(sta) sometimes doesn't work on wl12xx */ +-#define WLCORE_QUIRK_START_STA_FAILS BIT(1) +- + /* wl127x and SPI don't support SDIO block size alignment */ + #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN BIT(2) + +-- +2.30.1 + diff --git a/queue-5.11/x86-reboot-add-zotac-zbox-ci327-nano-pci-reboot-quir.patch b/queue-5.11/x86-reboot-add-zotac-zbox-ci327-nano-pci-reboot-quir.patch new file mode 100644 index 00000000000..7a1a4864e62 --- /dev/null +++ b/queue-5.11/x86-reboot-add-zotac-zbox-ci327-nano-pci-reboot-quir.patch @@ -0,0 +1,52 @@ +From d27b883900c7d93dead747e9db05fa5db4475005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 12:39:57 +0100 +Subject: x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk + +From: Heiner Kallweit + +[ Upstream commit 4b2d8ca9208be636b30e924b1cbcb267b0740c93 ] + +On this system the M.2 PCIe WiFi card isn't detected after reboot, only +after cold boot. reboot=pci fixes this behavior. In [0] the same issue +is described, although on another system and with another Intel WiFi +card. In case it's relevant, both systems have Celeron CPUs. + +Add a PCI reboot quirk on affected systems until a more generic fix is +available. + +[0] https://bugzilla.kernel.org/show_bug.cgi?id=202399 + + [ bp: Massage commit message. ] + +Signed-off-by: Heiner Kallweit +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/1524eafd-f89c-cfa4-ed70-0bde9e45eec9@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/reboot.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index efbaef8b4de9..b29657b76e3f 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -477,6 +477,15 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = { + }, + }, + ++ { /* PCIe Wifi card isn't detected after reboot otherwise */ ++ .callback = set_pci_reboot, ++ .ident = "Zotac ZBOX CI327 nano", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"), ++ }, ++ }, ++ + /* Sony */ + { /* Handle problems with rebooting on Sony VGN-Z540N */ + .callback = set_bios_reboot, +-- +2.30.1 +