From: Sasha Levin Date: Wed, 12 May 2021 11:50:04 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.4.119~26 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fdb7e7a75202e004f2d1d2e00dcc287fb71ce6ce;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch b/queue-4.19/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch new file mode 100644 index 00000000000..f2761166b17 --- /dev/null +++ b/queue-4.19/acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch @@ -0,0 +1,90 @@ +From 77a26516926577f1d2bae2ef92225ef9b62f80ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 14:30:48 -0700 +Subject: ACPI: CPPC: Replace cppc_attr with kobj_attribute + +From: Nathan Chancellor + +[ Upstream commit 2bc6262c6117dd18106d5aa50d53e945b5d99c51 ] + +All of the CPPC sysfs show functions are called via indirect call in +kobj_attr_show(), where they should be of type + +ssize_t (*show)(struct kobject *kobj, struct kobj_attribute *attr, char *buf); + +because that is the type of the ->show() member in +'struct kobj_attribute' but they are actually of type + +ssize_t (*show)(struct kobject *kobj, struct attribute *attr, char *buf); + +because of the ->show() member in 'struct cppc_attr', resulting in a +Control Flow Integrity violation [1]. + +$ cat /sys/devices/system/cpu/cpu0/acpi_cppc/highest_perf +3400 + +$ dmesg | grep "CFI failure" +[ 175.970559] CFI failure (target: show_highest_perf+0x0/0x8): + +As far as I can tell, the only difference between 'struct cppc_attr' +and 'struct kobj_attribute' aside from the type of the attr parameter +is the type of the count parameter in the ->store() member (ssize_t vs. +size_t), which does not actually matter because all of these nodes are +read-only. + +Eliminate 'struct cppc_attr' in favor of 'struct kobj_attribute' to fix +the violation. + +[1]: https://lore.kernel.org/r/20210401233216.2540591-1-samitolvanen@google.com/ + +Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") +Link: https://github.com/ClangBuiltLinux/linux/issues/1343 +Signed-off-by: Nathan Chancellor +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 5c6ecbb66608..1b43f8ebfabe 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -122,23 +122,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); + */ + #define NUM_RETRIES 500ULL + +-struct cppc_attr { +- struct attribute attr; +- ssize_t (*show)(struct kobject *kobj, +- struct attribute *attr, char *buf); +- ssize_t (*store)(struct kobject *kobj, +- struct attribute *attr, const char *c, ssize_t count); +-}; +- + #define define_one_cppc_ro(_name) \ +-static struct cppc_attr _name = \ ++static struct kobj_attribute _name = \ + __ATTR(_name, 0444, show_##_name, NULL) + + #define to_cpc_desc(a) container_of(a, struct cpc_desc, kobj) + + #define show_cppc_data(access_fn, struct_name, member_name) \ + static ssize_t show_##member_name(struct kobject *kobj, \ +- struct attribute *attr, char *buf) \ ++ struct kobj_attribute *attr, char *buf) \ + { \ + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \ + struct struct_name st_name = {0}; \ +@@ -164,7 +156,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + + static ssize_t show_feedback_ctrs(struct kobject *kobj, +- struct attribute *attr, char *buf) ++ struct kobj_attribute *attr, char *buf) + { + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); + struct cppc_perf_fb_ctrs fb_ctrs = {0}; +-- +2.30.2 + diff --git a/queue-4.19/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch b/queue-4.19/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch new file mode 100644 index 00000000000..86610fbb00c --- /dev/null +++ b/queue-4.19/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch @@ -0,0 +1,40 @@ +From afe65a975d8dfab064ccafedf5be7c75c1f96df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 13:19:23 +0200 +Subject: ALSA: core: remove redundant spin_lock pair in snd_card_disconnect + +From: Jia Zhou + +[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ] + +modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between +register and disconnect") resulting in this problem. + +Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect") +Signed-off-by: Jia Zhou +Signed-off-by: Yi Wang +Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/init.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/core/init.c b/sound/core/init.c +index 16b7cc7aa66b..3eafa15006f8 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -405,10 +405,8 @@ int snd_card_disconnect(struct snd_card *card) + return 0; + } + card->shutdown = 1; +- spin_unlock(&card->files_lock); + + /* replace file->f_op with special dummy operations */ +- spin_lock(&card->files_lock); + list_for_each_entry(mfile, &card->files_list, list) { + /* it's critical part, use endless loop */ + /* we have no room to fail */ +-- +2.30.2 + diff --git a/queue-4.19/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch b/queue-4.19/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch new file mode 100644 index 00000000000..84334ebe8dc --- /dev/null +++ b/queue-4.19/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch @@ -0,0 +1,136 @@ +From e1519cb981fa1e7f8e606d5a9983eba9bb6e2c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 13:35:34 +0200 +Subject: ALSA: usb-audio: Add error checks for usb_driver_claim_interface() + calls + +From: Takashi Iwai + +[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ] + +There are a few calls of usb_driver_claim_interface() but all of those +miss the proper error checks, as reported by Coverity. This patch +adds those missing checks. + +Along with it, replace the magic pointer with -1 with a constant +USB_AUDIO_IFACE_UNUSED for better readability. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1475943 ("Error handling issues") +Addresses-Coverity-ID: 1475944 ("Error handling issues") +Addresses-Coverity-ID: 1475945 ("Error handling issues") +Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once") +Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code") +Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook +Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 14 +++++++------- + sound/usb/quirks.c | 16 ++++++++++++---- + sound/usb/usbaudio.h | 2 ++ + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index ba096cb4a53e..ce8925e8419e 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -189,9 +189,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + ctrlif, interface); + return -EINVAL; + } +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); +- +- return 0; ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + if ((altsd->bInterfaceClass != USB_CLASS_AUDIO && +@@ -211,7 +210,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + + if (! snd_usb_parse_audio_interface(chip, interface)) { + usb_set_interface(dev, interface, 0); /* reset the current interface */ +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + return 0; +@@ -707,7 +707,7 @@ static void usb_audio_disconnect(struct usb_interface *intf) + struct snd_card *card; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return; + + card = chip->card; +@@ -807,7 +807,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + struct usb_mixer_interface *mixer; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + if (!chip->num_suspended_intf++) { +@@ -839,7 +839,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + struct list_head *p; + int err = 0; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + atomic_inc(&chip->active); /* avoid autopm */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 717edf3b5d3e..b5f2b18b8b42 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip, + if (!iface) + continue; + if (quirk->ifnum != probed_ifnum && +- !usb_interface_claimed(iface)) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ !usb_interface_claimed(iface)) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +@@ -401,8 +405,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip, + continue; + + err = create_autodetect_quirk(chip, iface, driver); +- if (err >= 0) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ if (err >= 0) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index 0d620c267e7a..0c7ea78317fc 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -68,6 +68,8 @@ struct snd_usb_audio { + struct usb_host_interface *ctrl_intf; /* the audio control interface */ + }; + ++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) ++ + #define usb_audio_err(chip, fmt, args...) \ + dev_err(&(chip)->dev->dev, fmt, ##args) + #define usb_audio_warn(chip, fmt, args...) \ +-- +2.30.2 + diff --git a/queue-4.19/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch b/queue-4.19/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch new file mode 100644 index 00000000000..3ad860659c8 --- /dev/null +++ b/queue-4.19/alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch @@ -0,0 +1,43 @@ +From 76f4a3e5e4d0c5a528835158512ec1519013faff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 14:47:19 +0100 +Subject: ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check + fails + +From: Colin Ian King + +[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ] + +Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL) +the error return path returns -ENOMEM via the exit label "error". Other +uses of the same error exit label set the err variable to -ENOMEM but this +is not being used. I believe the original intent was for the error exit +path to return the value in err rather than the hard coded -ENOMEM, so +return this rather than the hard coded -ENOMEM. + +Addresses-Coverity: ("Unused value") +Fixes: 738d9edcfd44 ("ALSA: usb-audio: Add sanity checks for invalid EPs") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210420134719.381409-1-colin.king@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/midi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 26548f760bc1..4553db0ef084 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1333,7 +1333,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi, + + error: + snd_usbmidi_in_endpoint_delete(ep); +- return -ENOMEM; ++ return err; + } + + /* +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch b/queue-4.19/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch new file mode 100644 index 00000000000..b25f702c423 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch @@ -0,0 +1,38 @@ +From 41946c7a89695419e531dcf6f4a724f784fcd28f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:19 +0100 +Subject: ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit 8a45f33bd36efbb624198cfa9fdf1f66fd1c3d26 ] + +The Maxim fuel gauge datasheets describe the interrupt line as active +low with a requirement of acknowledge from the CPU. The falling edge +interrupt will mostly work but it's not correct. + +Fixes: e8614292cd41 ("ARM: dts: Add Maxim 77693 fuel gauge node for exynos4412-trats2") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-3-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index c0476c290977..d4bb5f65b9f3 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -187,7 +187,7 @@ + max77693-fuel-gauge@36 { + compatible = "maxim,max17047"; + interrupt-parent = <&gpx2>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77693_fuel_irq>; + reg = <0x36>; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch b/queue-4.19/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..457ff622daf --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch @@ -0,0 +1,42 @@ +From 722d428516cb411f7d421c7e5feb3bd8d1e0b7be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:20 +0100 +Subject: ARM: dts: exynos: correct MUIC interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit 15107e443ab8c6cb35eff10438993e4bc944d9ae ] + +The Maxim MUIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 7eec1266751b ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-4-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index d4bb5f65b9f3..c6cc3d2a1121 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -139,7 +139,7 @@ + max77693@66 { + compatible = "maxim,max77693"; + interrupt-parent = <&gpx1>; +- interrupts = <5 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77693_irq>; + reg = <0x66>; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..e9c3f67ac7d --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch @@ -0,0 +1,42 @@ +From d4b0e4afe116d2b91176db55e81f249047eb3a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:21 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Midas + family + +From: Krzysztof Kozlowski + +[ Upstream commit e52dcd6e70fab51f53292e53336ecb007bb60889 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 15dfdfad2d4a ("ARM: dts: Add basic dts for Exynos4412-based Trats 2 board") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-5-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi +index c6cc3d2a1121..60fbad25b5f2 100644 +--- a/arch/arm/boot/dts/exynos4412-midas.dtsi ++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi +@@ -579,7 +579,7 @@ + max77686: max77686_pmic@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx0>; +- interrupts = <7 IRQ_TYPE_NONE>; ++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>; + pinctrl-0 = <&max77686_irq>; + pinctrl-names = "default"; + reg = <0x09>; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-20378 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-20378 new file mode 100644 index 00000000000..3c91b0b2cd8 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-20378 @@ -0,0 +1,41 @@ +From b6203affb028a8f0d97f3a00c10b9437d2e93356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:24 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 + +From: Krzysztof Kozlowski + +[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index d5e66189ed2a..594b246afbed 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -132,7 +132,7 @@ + compatible = "maxim,max77686"; + reg = <0x09>; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6931 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6931 new file mode 100644 index 00000000000..9beed07b2a3 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6931 @@ -0,0 +1,42 @@ +From ed6363665593385351c7662b0a3c8feb4d574253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:22 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 + family + +From: Krzysztof Kozlowski + +[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: eea6653aae7b ("ARM: dts: Enable PMIC interrupts for exynos4412-odroid-common") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-6-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +index 00820d239753..dbca8eeefae1 100644 +--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi ++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +@@ -265,7 +265,7 @@ + max77686: pmic@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + reg = <0x09>; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-9622 b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-9622 new file mode 100644 index 00000000000..2cfafa1e32f --- /dev/null +++ b/queue-4.19/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-9622 @@ -0,0 +1,41 @@ +From 69c4f8386a95509d42166d72fcba9c1a4e0d5095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:25 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Snow + +From: Krzysztof Kozlowski + +[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +index fd9226d3b207..3981acb00b5e 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi ++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +@@ -292,7 +292,7 @@ + max77686: max77686@9 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +-- +2.30.2 + diff --git a/queue-4.19/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch b/queue-4.19/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch new file mode 100644 index 00000000000..98737587d59 --- /dev/null +++ b/queue-4.19/arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch @@ -0,0 +1,42 @@ +From 1bab24860182d07b77847ad6bf5e1037bc1aa8cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 02:31:48 +0900 +Subject: ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins + for RTL8211E + +From: Kunihiko Hayashi + +[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ] + +UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX +delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins. + +After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the delays are working correctly, however, "rgmii" means +no delay and the phy doesn't work. So need to set the phy-mode to +"rgmii-id" to show that RX/TX delays are enabled. + +Fixes: e3cc931921d2 ("ARM: dts: uniphier: add AVE ethernet node") +Signed-off-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi +index e2d1a22c5950..d8a32104aad0 100644 +--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi ++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi +@@ -513,7 +513,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +-- +2.30.2 + diff --git a/queue-4.19/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch b/queue-4.19/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch new file mode 100644 index 00000000000..cf83c3b39f5 --- /dev/null +++ b/queue-4.19/arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch @@ -0,0 +1,66 @@ +From 204cf9f9903bb95b4811cb2acc9c1cc566600941 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 02:31:49 +0900 +Subject: arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay + pins for RTL8211E + +From: Kunihiko Hayashi + +[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ] + +UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have +the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY +pins. + +After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the delays are working correctly, however, "rgmii" means +no delay and the phy doesn't work. So need to set the phy-mode to +"rgmii-id" to show that RX/TX delays are enabled. + +Fixes: c73730ee4c9a ("arm64: dts: uniphier: add AVE ethernet node") +Signed-off-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- + arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +index caf112629caa..62429c412b33 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +@@ -610,7 +610,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +index 2a4cf427f5d3..8fe9a57b9562 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +@@ -416,7 +416,7 @@ + clocks = <&sys_clk 6>; + reset-names = "ether"; + resets = <&sys_rst 6>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 0>; + +@@ -437,7 +437,7 @@ + clocks = <&sys_clk 7>; + reset-names = "ether"; + resets = <&sys_rst 7>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + local-mac-address = [00 00 00 00 00 00]; + socionext,syscon-phy-mode = <&soc_glue 1>; + +-- +2.30.2 + diff --git a/queue-4.19/asoc-ak5558-correct-reset-polarity.patch b/queue-4.19/asoc-ak5558-correct-reset-polarity.patch new file mode 100644 index 00000000000..15ec73ccc72 --- /dev/null +++ b/queue-4.19/asoc-ak5558-correct-reset-polarity.patch @@ -0,0 +1,46 @@ +From 93d1df275c7604a994374372a45a750e08f7a82d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:33:43 +0800 +Subject: ASoC: ak5558: correct reset polarity + +From: Shengjiu Wang + +[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ] + +Reset (aka power off) happens when the reset gpio is made active. +The reset gpio is GPIO_ACTIVE_LOW + +Fixes: 920884777480 ("ASoC: ak5558: Add support for AK5558 ADC driver") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1618382024-31725-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak5558.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c +index 73c418517f8d..dda165b14222 100644 +--- a/sound/soc/codecs/ak5558.c ++++ b/sound/soc/codecs/ak5558.c +@@ -271,7 +271,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558) + if (!ak5558->reset_gpiod) + return; + +- gpiod_set_value_cansleep(ak5558->reset_gpiod, 0); ++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 1); + usleep_range(1000, 2000); + } + +@@ -280,7 +280,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558) + if (!ak5558->reset_gpiod) + return; + +- gpiod_set_value_cansleep(ak5558->reset_gpiod, 1); ++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 0); + usleep_range(1000, 2000); + } + +-- +2.30.2 + diff --git a/queue-4.19/ata-libahci_platform-fix-irq-check.patch b/queue-4.19/ata-libahci_platform-fix-irq-check.patch new file mode 100644 index 00000000000..6bfb8ec6cc8 --- /dev/null +++ b/queue-4.19/ata-libahci_platform-fix-irq-check.patch @@ -0,0 +1,44 @@ +From 388c32b622c75669a65d8d9599227c1e6d3d76c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 23:15:06 +0300 +Subject: ata: libahci_platform: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ] + +Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0 +early (as if the call was successful). Override IRQ0 with -EINVAL instead +as the 'libata' regards 0 as "no IRQ" (thus polling) anyway... + +Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libahci_platform.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 522b543f718d..6a55aac0c60f 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -544,11 +544,13 @@ int ahci_platform_init_host(struct platform_device *pdev, + int i, irq, n_ports, rc; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + if (irq != -EPROBE_DEFER) + dev_err(dev, "no irq\n"); + return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv->irq = irq; + +-- +2.30.2 + diff --git a/queue-4.19/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch b/queue-4.19/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch new file mode 100644 index 00000000000..271fbe2a2f0 --- /dev/null +++ b/queue-4.19/ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch @@ -0,0 +1,43 @@ +From 382c524a61f2ef158b76eef2f7c27606e27ee366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 17:02:28 -0600 +Subject: ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without + lock + +From: Shuah Khan + +[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ] + +ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock +winthout locking it first when peer reason doesn't match the valid +cases for this function. + +Add a default case to return without unlocking. + +Fixes: 09078368d516 ("ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()") +Reported-by: Pavel Machek +Signed-off-by: Shuah Khan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210406230228.31301-1-skhan@linuxfoundation.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 04dc5714aa72..243887fdb343 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -465,6 +465,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) + GFP_ATOMIC + ); + break; ++ default: ++ kfree(tb); ++ return; + } + + exit: +-- +2.30.2 + diff --git a/queue-4.19/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch b/queue-4.19/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch new file mode 100644 index 00000000000..7045a046c0c --- /dev/null +++ b/queue-4.19/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch @@ -0,0 +1,61 @@ +From dc749a82866b1394743ed73928886700cbfe4eaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 19:08:19 +0100 +Subject: ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ] + +When the error check in ath9k_hw_read_revisions() was added, it checked for +-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, +for plain ath9k, the register read function uses ioread32(), which just +returns -1 on error. So if such a read fails, it still gets passed through +and ends up as a weird mac revision in the log output. + +Fix this by changing ath9k_regread() to return -1 on error like ioread32() +does, and fix the error check to look for that instead of -EIO. + +Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register") +Signed-off-by: Toke Høiland-Jørgensen +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- + drivers/net/wireless/ath/ath9k/hw.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 27d9fe6799f5..cb136d9d4621 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset) + if (unlikely(r)) { + ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n", + reg_offset, r); +- return -EIO; ++ return -1; + } + + return be32_to_cpu(val); +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index b4f7ee423d40..9f438d8e59f2 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) + + srev = REG_READ(ah, AR_SREV); + +- if (srev == -EIO) { ++ if (srev == -1) { + ath_err(ath9k_hw_common(ah), + "Failed to read SREV register"); + return false; +-- +2.30.2 + diff --git a/queue-4.19/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch b/queue-4.19/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch new file mode 100644 index 00000000000..7408931b191 --- /dev/null +++ b/queue-4.19/bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch @@ -0,0 +1,43 @@ +From 890472662ff156f8b71682af818ad65ef13719b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 12:10:28 +0300 +Subject: bnxt_en: fix ternary sign extension bug in bnxt_show_temp() + +From: Dan Carpenter + +[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ] + +The problem is that bnxt_show_temp() returns long but "rc" is an int +and "len" is a u32. With ternary operations the type promotion is quite +tricky. The negative "rc" is first promoted to u32 and then to long so +it ends up being a high positive value instead of a a negative as we +intended. + +Fix this by removing the ternary. + +Fixes: d69753fa1ecb ("bnxt_en: return proper error codes in bnxt_show_temp") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 44ed2f6e2d96..6033970fb667 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6851,7 +6851,9 @@ static ssize_t bnxt_show_temp(struct device *dev, + if (!rc) + len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); +- return rc ?: len; ++ if (rc) ++ return rc; ++ return len; + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +-- +2.30.2 + diff --git a/queue-4.19/bug-remove-redundant-condition-check-in-report_bug.patch b/queue-4.19/bug-remove-redundant-condition-check-in-report_bug.patch new file mode 100644 index 00000000000..3d2321faf45 --- /dev/null +++ b/queue-4.19/bug-remove-redundant-condition-check-in-report_bug.patch @@ -0,0 +1,79 @@ +From 154996ef7c9a9f755fd0885775de6667fe15bb80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 14:33:07 +0000 +Subject: bug: Remove redundant condition check in report_bug + +From: Andrew Scull + +[ Upstream commit 3ad1a6cb0abc63d036fc866bd7c2c5983516dec5 ] + +report_bug() will return early if it cannot find a bug corresponding to +the provided address. The subsequent test for the bug will always be +true so remove it. + +Fixes: 1b4cfe3c0a30d ("lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()") +Signed-off-by: Andrew Scull +Cc: Peter Zijlstra +Cc: "Steven Rostedt (VMware)" +Reviewed-by: Steven Rostedt (VMware) +Acked-by: Will Deacon +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210318143311.839894-2-ascull@google.com +Signed-off-by: Sasha Levin +--- + lib/bug.c | 33 +++++++++++++++------------------ + 1 file changed, 15 insertions(+), 18 deletions(-) + +diff --git a/lib/bug.c b/lib/bug.c +index 1077366f496b..f4fcac5dd766 100644 +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -155,30 +155,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) + + file = NULL; + line = 0; +- warning = 0; + +- if (bug) { + #ifdef CONFIG_DEBUG_BUGVERBOSE + #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS +- file = bug->file; ++ file = bug->file; + #else +- file = (const char *)bug + bug->file_disp; ++ file = (const char *)bug + bug->file_disp; + #endif +- line = bug->line; ++ line = bug->line; + #endif +- warning = (bug->flags & BUGFLAG_WARNING) != 0; +- once = (bug->flags & BUGFLAG_ONCE) != 0; +- done = (bug->flags & BUGFLAG_DONE) != 0; +- +- if (warning && once) { +- if (done) +- return BUG_TRAP_TYPE_WARN; +- +- /* +- * Since this is the only store, concurrency is not an issue. +- */ +- bug->flags |= BUGFLAG_DONE; +- } ++ warning = (bug->flags & BUGFLAG_WARNING) != 0; ++ once = (bug->flags & BUGFLAG_ONCE) != 0; ++ done = (bug->flags & BUGFLAG_DONE) != 0; ++ ++ if (warning && once) { ++ if (done) ++ return BUG_TRAP_TYPE_WARN; ++ ++ /* ++ * Since this is the only store, concurrency is not an issue. ++ */ ++ bug->flags |= BUGFLAG_DONE; + } + + if (warning) { +-- +2.30.2 + diff --git a/queue-4.19/bus-qcom-put-child-node-before-return.patch b/queue-4.19/bus-qcom-put-child-node-before-return.patch new file mode 100644 index 00000000000..94e82c6ffa2 --- /dev/null +++ b/queue-4.19/bus-qcom-put-child-node-before-return.patch @@ -0,0 +1,43 @@ +From 69f728e66dae4b415c9837764455c966af67b526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 03:49:07 -0800 +Subject: bus: qcom: Put child node before return + +From: Pan Bian + +[ Upstream commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 ] + +Put child node before return to fix potential reference count leak. +Generally, the reference count of child is incremented and decremented +automatically in the macro for_each_available_child_of_node() and should +be decremented manually if the loop is broken in loop body. + +Reviewed-by: Linus Walleij +Fixes: 335a12754808 ("bus: qcom: add EBI2 driver") +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/20210121114907.109267-1-bianpan2016@163.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/bus/qcom-ebi2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c +index a6444244c411..bfb67aa00bec 100644 +--- a/drivers/bus/qcom-ebi2.c ++++ b/drivers/bus/qcom-ebi2.c +@@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) + + /* Figure out the chipselect */ + ret = of_property_read_u32(child, "reg", &csindex); +- if (ret) ++ if (ret) { ++ of_node_put(child); + return ret; ++ } + + if (csindex > 5) { + dev_err(dev, +-- +2.30.2 + diff --git a/queue-4.19/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch b/queue-4.19/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch new file mode 100644 index 00000000000..708ac5ba9c2 --- /dev/null +++ b/queue-4.19/clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch @@ -0,0 +1,74 @@ +From 29247d7e74c8239096e6763467652ea79bce49fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:18 +0200 +Subject: clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz + to 1 GHz +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 4decb9187589f61fe9fc2bc4d9b01160b0a610c5 ] + +It was observed that the workaround introduced by commit 61c40f35f5cd +("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to +1.2GHz") when base CPU frequency is 1.2 GHz is also required when base +CPU frequency is 1 GHz. Otherwise switching CPU frequency directly from +L2 (250 MHz) to L0 (1 GHz) causes a crash. + +When base CPU frequency is just 800 MHz no crashed were observed during +switch from L2 to L0. + +Signed-off-by: Pali Rohár +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index a7e40ff3e57d..a05449cb0e3b 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -475,8 +475,10 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + } + + /* +- * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz +- * respectively) to L0 frequency (1.2 Ghz) requires a significant ++ * Workaround when base CPU frequnecy is 1000 or 1200 MHz ++ * ++ * Switching the CPU from the L2 or L3 frequencies (250/300 or 200 MHz ++ * respectively) to L0 frequency (1/1.2 GHz) requires a significant + * amount of time to let VDD stabilize to the appropriate + * voltage. This amount of time is large enough that it cannot be + * covered by the hardware countdown register. Due to this, the CPU +@@ -486,15 +488,15 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + * To work around this problem, we prevent switching directly from the + * L2/L3 frequencies to the L0 frequency, and instead switch to the L1 + * frequency in-between. The sequence therefore becomes: +- * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ) ++ * 1. First switch from L2/L3 (200/250/300 MHz) to L1 (500/600 MHz) + * 2. Sleep 20ms for stabling VDD voltage +- * 3. Then switch from L1(600MHZ) to L0(1200Mhz). ++ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz). + */ + static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base) + { + unsigned int cur_level; + +- if (rate != 1200 * 1000 * 1000) ++ if (rate < 1000 * 1000 * 1000) + return; + + regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level); +-- +2.30.2 + diff --git a/queue-4.19/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch b/queue-4.19/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch new file mode 100644 index 00000000000..6da1c4aec71 --- /dev/null +++ b/queue-4.19/clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch @@ -0,0 +1,122 @@ +From f19ed38543a45992b16ef955f1f435e88fd06d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:19 +0200 +Subject: clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 + to L0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit e93033aff684641f71a436ca7a9d2a742126baaf ] + +When CPU frequency is at 250 MHz and set_rate() is called with 500 MHz (L1) +quickly followed by a call with 1 GHz (L0), the CPU does not necessarily +stay in L1 for at least 20ms as is required by Marvell errata. + +This situation happens frequently with the ondemand cpufreq governor and +can be also reproduced with userspace governor. In most cases it causes CPU +to crash. + +This change fixes the above issue and ensures that the CPU always stays in +L1 for at least 20ms when switching from any state to L0. + +Signed-off-by: Marek Behún +Signed-off-by: Pali Rohár +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 61c40f35f5cd ("clk: mvebu: armada-37xx-periph: Fix switching CPU rate from 300Mhz to 1.2GHz") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 45 ++++++++++++++++++++++---- + 1 file changed, 39 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index a05449cb0e3b..5d10733d6c04 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -74,6 +74,7 @@ struct clk_pm_cpu { + void __iomem *reg_div; + u8 shift_div; + struct regmap *nb_pm_base; ++ unsigned long l1_expiration; + }; + + #define to_clk_double_div(_hw) container_of(_hw, struct clk_double_div, hw) +@@ -492,22 +493,52 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + * 2. Sleep 20ms for stabling VDD voltage + * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz). + */ +-static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base) ++static void clk_pm_cpu_set_rate_wa(struct clk_pm_cpu *pm_cpu, ++ unsigned int new_level, unsigned long rate, ++ struct regmap *base) + { + unsigned int cur_level; + +- if (rate < 1000 * 1000 * 1000) +- return; +- + regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level); + cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK; +- if (cur_level <= ARMADA_37XX_DVFS_LOAD_1) ++ ++ if (cur_level == new_level) ++ return; ++ ++ /* ++ * System wants to go to L1 on its own. If we are going from L2/L3, ++ * remember when 20ms will expire. If from L0, set the value so that ++ * next switch to L0 won't have to wait. ++ */ ++ if (new_level == ARMADA_37XX_DVFS_LOAD_1) { ++ if (cur_level == ARMADA_37XX_DVFS_LOAD_0) ++ pm_cpu->l1_expiration = jiffies; ++ else ++ pm_cpu->l1_expiration = jiffies + msecs_to_jiffies(20); + return; ++ } ++ ++ /* ++ * If we are setting to L2/L3, just invalidate L1 expiration time, ++ * sleeping is not needed. ++ */ ++ if (rate < 1000*1000*1000) ++ goto invalidate_l1_exp; ++ ++ /* ++ * We are going to L0 with rate >= 1GHz. Check whether we have been at ++ * L1 for long enough time. If not, go to L1 for 20ms. ++ */ ++ if (pm_cpu->l1_expiration && jiffies >= pm_cpu->l1_expiration) ++ goto invalidate_l1_exp; + + regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD, + ARMADA_37XX_NB_CPU_LOAD_MASK, + ARMADA_37XX_DVFS_LOAD_1); + msleep(20); ++ ++invalidate_l1_exp: ++ pm_cpu->l1_expiration = 0; + } + + static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -541,7 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + reg = ARMADA_37XX_NB_CPU_LOAD; + mask = ARMADA_37XX_NB_CPU_LOAD_MASK; + +- clk_pm_cpu_set_rate_wa(rate, base); ++ /* Apply workaround when base CPU frequency is 1000 or 1200 MHz */ ++ if (parent_rate >= 1000*1000*1000) ++ clk_pm_cpu_set_rate_wa(pm_cpu, load_level, rate, base); + + regmap_update_bits(base, reg, mask, load_level); + +-- +2.30.2 + diff --git a/queue-4.19/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch b/queue-4.19/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch new file mode 100644 index 00000000000..dd9ae16568b --- /dev/null +++ b/queue-4.19/clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch @@ -0,0 +1,83 @@ +From e37b17c5bc36923585675184fe7115a3d2167235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:16 +0200 +Subject: clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM + clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 4e435a9dd26c46ac018997cc0562d50b1a96f372 ] + +Remove the .set_parent method in clk_pm_cpu_ops. + +This method was supposed to be needed by the armada-37xx-cpufreq driver, +but was never actually called due to wrong assumptions in the cpufreq +driver. After this was fixed in the cpufreq driver, this method is not +needed anymore. + +Signed-off-by: Marek Behún +Acked-by: Stephen Boyd +Acked-by: Gregory CLEMENT +Tested-by: Pali Rohár +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 2089dc33ea0e ("clk: mvebu: armada-37xx-periph: add DVFS support for cpu clocks") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-37xx-periph.c | 28 -------------------------- + 1 file changed, 28 deletions(-) + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index 499f5962c8b0..a7e40ff3e57d 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -428,33 +428,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw) + return val; + } + +-static int clk_pm_cpu_set_parent(struct clk_hw *hw, u8 index) +-{ +- struct clk_pm_cpu *pm_cpu = to_clk_pm_cpu(hw); +- struct regmap *base = pm_cpu->nb_pm_base; +- int load_level; +- +- /* +- * We set the clock parent only if the DVFS is available but +- * not enabled. +- */ +- if (IS_ERR(base) || armada_3700_pm_dvfs_is_enabled(base)) +- return -EINVAL; +- +- /* Set the parent clock for all the load level */ +- for (load_level = 0; load_level < LOAD_LEVEL_NR; load_level++) { +- unsigned int reg, mask, val, +- offset = ARMADA_37XX_NB_TBG_SEL_OFF; +- +- armada_3700_pm_dvfs_update_regs(load_level, ®, &offset); +- +- val = index << offset; +- mask = ARMADA_37XX_NB_TBG_SEL_MASK << offset; +- regmap_update_bits(base, reg, mask, val); +- } +- return 0; +-} +- + static unsigned long clk_pm_cpu_recalc_rate(struct clk_hw *hw, + unsigned long parent_rate) + { +@@ -580,7 +553,6 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops clk_pm_cpu_ops = { + .get_parent = clk_pm_cpu_get_parent, +- .set_parent = clk_pm_cpu_set_parent, + .round_rate = clk_pm_cpu_round_rate, + .set_rate = clk_pm_cpu_set_rate, + .recalc_rate = clk_pm_cpu_recalc_rate, +-- +2.30.2 + diff --git a/queue-4.19/clk-qcom-a53-pll-add-missing-module_device_table.patch b/queue-4.19/clk-qcom-a53-pll-add-missing-module_device_table.patch new file mode 100644 index 00000000000..9db59a143ea --- /dev/null +++ b/queue-4.19/clk-qcom-a53-pll-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From db721d37a96bbbe6d3e3bb95c985f14a9357a4ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 16:23:51 +0800 +Subject: clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE + +From: Chen Hui + +[ Upstream commit 790b516ada10a4dcc0f0a56dc0ced475d86d5820 ] + +CONFIG_QCOM_A53PLL is tristate option and therefore this driver can be +compiled as a module. This patch adds missing MODULE_DEVICE_TABLE +definition which generates correct modalias for automatic loading of +this driver when it is built as an external module. + +Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support") +Signed-off-by: Chen Hui +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20210409082352.233810-3-clare.chenhui@huawei.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/a53-pll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c +index 45cfc57bff92..af6ac17c7dae 100644 +--- a/drivers/clk/qcom/a53-pll.c ++++ b/drivers/clk/qcom/a53-pll.c +@@ -93,6 +93,7 @@ static const struct of_device_id qcom_a53pll_match_table[] = { + { .compatible = "qcom,msm8916-a53pll" }, + { } + }; ++MODULE_DEVICE_TABLE(of, qcom_a53pll_match_table); + + static struct platform_driver qcom_a53pll_driver = { + .probe = qcom_a53pll_probe, +-- +2.30.2 + diff --git a/queue-4.19/clk-uniphier-fix-potential-infinite-loop.patch b/queue-4.19/clk-uniphier-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..6ea30665adb --- /dev/null +++ b/queue-4.19/clk-uniphier-fix-potential-infinite-loop.patch @@ -0,0 +1,47 @@ +From 9e2cd66ca8c9d44ad43176b086d000e9306f4025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 10:01:03 +0100 +Subject: clk: uniphier: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit f6b1340dc751a6caa2a0567b667d0f4f4172cd58 ] + +The for-loop iterates with a u8 loop counter i and compares this +with the loop upper limit of num_parents that is an int type. +There is a potential infinite loop if num_parents is larger than +the u8 loop counter. Fix this by making the loop counter the same +type as num_parents. Also make num_parents an unsigned int to +match the return type of the call to clk_hw_get_num_parents. + +Addresses-Coverity: ("Infinite loop") +Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clock driver") +Signed-off-by: Colin Ian King +Reviewed-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20210409090104.629722-1-colin.king@canonical.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/uniphier/clk-uniphier-mux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c +index 2c243a894f3b..3a52ab968ac2 100644 +--- a/drivers/clk/uniphier/clk-uniphier-mux.c ++++ b/drivers/clk/uniphier/clk-uniphier-mux.c +@@ -40,10 +40,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index) + static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw) + { + struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw); +- int num_parents = clk_hw_get_num_parents(hw); ++ unsigned int num_parents = clk_hw_get_num_parents(hw); + int ret; + unsigned int val; +- u8 i; ++ unsigned int i; + + ret = regmap_read(mux->regmap, mux->reg, &val); + if (ret) +-- +2.30.2 + diff --git a/queue-4.19/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch b/queue-4.19/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch new file mode 100644 index 00000000000..9c7bfddeb53 --- /dev/null +++ b/queue-4.19/cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch @@ -0,0 +1,52 @@ +From ec08c059007d2aba844bc3f9afe1f44af32bfa64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:21 +0200 +Subject: cpufreq: armada-37xx: Fix determining base CPU frequency +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 8bad3bf23cbc40abe1d24cec08a114df6facf858 ] + +When current CPU load is not L0 then loading armada-37xx-cpufreq.ko driver +fails with following error: + + # modprobe armada-37xx-cpufreq + [ 502.702097] Unsupported CPU frequency 250 MHz + +This issue was partially fixed by commit 8db82563451f ("cpufreq: +armada-37xx: fix frequency calculation for opp"), but only for calculating +CPU frequency for opp. + +Fix this also for determination of base CPU frequency. + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 6a4ac26ac6a8..a36452bd9612 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -471,7 +471,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + return -EINVAL; + } + +- dvfs = armada_37xx_cpu_freq_info_get(cur_frequency); ++ dvfs = armada_37xx_cpu_freq_info_get(base_frequency); + if (!dvfs) { + clk_put(clk); + return -EINVAL; +-- +2.30.2 + diff --git a/queue-4.19/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch b/queue-4.19/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch new file mode 100644 index 00000000000..385c0d0e03b --- /dev/null +++ b/queue-4.19/cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch @@ -0,0 +1,47 @@ +From a8a8ec93d9f9632a9fc1426123b1be9d09b29658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:20 +0200 +Subject: cpufreq: armada-37xx: Fix driver cleanup when registration failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 92963903a8e11b9576eb7249f8e81eefa93b6f96 ] + +Commit 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for +opp") changed calculation of frequency passed to the dev_pm_opp_add() +function call. But the code for dev_pm_opp_remove() function call was not +updated, so the driver cleanup phase does not work when registration fails. + +This fixes the issue by using the same frequency in both calls. + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 8db82563451f ("cpufreq: armada-37xx: fix frequency calculation for opp") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index dacb17e28305..6a4ac26ac6a8 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -523,7 +523,7 @@ disable_dvfs: + remove_opp: + /* clean-up the already added opp before leaving */ + while (load_lvl-- > ARMADA_37XX_DVFS_LOAD_0) { +- freq = cur_frequency / dvfs->divider[load_lvl]; ++ freq = base_frequency / dvfs->divider[load_lvl]; + dev_pm_opp_remove(cpu_dev, freq); + } + +-- +2.30.2 + diff --git a/queue-4.19/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch b/queue-4.19/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch new file mode 100644 index 00000000000..9bd142a5d17 --- /dev/null +++ b/queue-4.19/cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch @@ -0,0 +1,153 @@ +From 4ab38446754ecfffc7165faa5e7322c3bfe7ef96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:15 +0200 +Subject: cpufreq: armada-37xx: Fix setting TBG parent for load levels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 22592df194e31baf371906cc720da38fa0ab68f5 ] + +With CPU frequency determining software [1] we have discovered that +after this driver does one CPU frequency change, the base frequency of +the CPU is set to the frequency of TBG-A-P clock, instead of the TBG +that is parent to the CPU. + +This can be reproduced on EspressoBIN and Turris MOX: + cd /sys/devices/system/cpu/cpufreq/policy0 + echo powersave >scaling_governor + echo performance >scaling_governor + +Running the mhz tool before this driver is loaded reports 1000 MHz, and +after loading the driver and executing commands above the tool reports +800 MHz. + +The change of TBG clock selector is supposed to happen in function +armada37xx_cpufreq_dvfs_setup. Before the function returns, it does +this: + parent = clk_get_parent(clk); + clk_set_parent(clk, parent); + +The armada-37xx-periph clock driver has the .set_parent method +implemented correctly for this, so if the method was actually called, +this would work. But since the introduction of the common clock +framework in commit b2476490ef11 ("clk: introduce the common clock..."), +the clk_set_parent function checks whether the parent is actually +changing, and if the requested new parent is same as the old parent +(which is obviously the case for the code above), the .set_parent method +is not called at all. + +This patch fixes this issue by filling the correct TBG clock selector +directly in the armada37xx_cpufreq_dvfs_setup during the filling of +other registers at the same address. But the determination of CPU TBG +index cannot be done via the common clock framework, therefore we need +to access the North Bridge Peripheral Clock registers directly in this +driver. + +[1] https://github.com/wtarreau/mhz + +Signed-off-by: Marek Behún +Acked-by: Gregory CLEMENT +Tested-by: Pali Rohár +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 35 ++++++++++++++++++--------- + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 9b0b490d70ff..99fb0ae7e2d7 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -25,6 +25,10 @@ + + #include "cpufreq-dt.h" + ++/* Clk register set */ ++#define ARMADA_37XX_CLK_TBG_SEL 0 ++#define ARMADA_37XX_CLK_TBG_SEL_CPU_OFF 22 ++ + /* Power management in North Bridge register set */ + #define ARMADA_37XX_NB_L0L1 0x18 + #define ARMADA_37XX_NB_L2L3 0x1C +@@ -120,10 +124,15 @@ static struct armada_37xx_dvfs *armada_37xx_cpu_freq_info_get(u32 freq) + * will be configured then the DVFS will be enabled. + */ + static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, +- struct clk *clk, u8 *divider) ++ struct regmap *clk_base, u8 *divider) + { ++ u32 cpu_tbg_sel; + int load_lvl; +- struct clk *parent; ++ ++ /* Determine to which TBG clock is CPU connected */ ++ regmap_read(clk_base, ARMADA_37XX_CLK_TBG_SEL, &cpu_tbg_sel); ++ cpu_tbg_sel >>= ARMADA_37XX_CLK_TBG_SEL_CPU_OFF; ++ cpu_tbg_sel &= ARMADA_37XX_NB_TBG_SEL_MASK; + + for (load_lvl = 0; load_lvl < LOAD_LEVEL_NR; load_lvl++) { + unsigned int reg, mask, val, offset = 0; +@@ -142,6 +151,11 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, + mask = (ARMADA_37XX_NB_CLK_SEL_MASK + << ARMADA_37XX_NB_CLK_SEL_OFF); + ++ /* Set TBG index, for all levels we use the same TBG */ ++ val = cpu_tbg_sel << ARMADA_37XX_NB_TBG_SEL_OFF; ++ mask = (ARMADA_37XX_NB_TBG_SEL_MASK ++ << ARMADA_37XX_NB_TBG_SEL_OFF); ++ + /* + * Set cpu divider based on the pre-computed array in + * order to have balanced step. +@@ -160,14 +174,6 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base, + + regmap_update_bits(base, reg, mask, val); + } +- +- /* +- * Set cpu clock source, for all the level we keep the same +- * clock source that the one already configured. For this one +- * we need to use the clock framework +- */ +- parent = clk_get_parent(clk); +- clk_set_parent(clk, parent); + } + + /* +@@ -360,11 +366,16 @@ static int __init armada37xx_cpufreq_driver_init(void) + struct platform_device *pdev; + unsigned long freq; + unsigned int cur_frequency, base_frequency; +- struct regmap *nb_pm_base, *avs_base; ++ struct regmap *nb_clk_base, *nb_pm_base, *avs_base; + struct device *cpu_dev; + int load_lvl, ret; + struct clk *clk, *parent; + ++ nb_clk_base = ++ syscon_regmap_lookup_by_compatible("marvell,armada-3700-periph-clock-nb"); ++ if (IS_ERR(nb_clk_base)) ++ return -ENODEV; ++ + nb_pm_base = + syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm"); + +@@ -441,7 +452,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + armada37xx_cpufreq_avs_configure(avs_base, dvfs); + armada37xx_cpufreq_avs_setup(avs_base, dvfs); + +- armada37xx_cpufreq_dvfs_setup(nb_pm_base, clk, dvfs->divider); ++ armada37xx_cpufreq_dvfs_setup(nb_pm_base, nb_clk_base, dvfs->divider); + clk_put(clk); + + for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR; +-- +2.30.2 + diff --git a/queue-4.19/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch b/queue-4.19/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch new file mode 100644 index 00000000000..c4b8efd8e70 --- /dev/null +++ b/queue-4.19/cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch @@ -0,0 +1,127 @@ +From 283641129a5062de9794738f9758f834633932e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:42:17 +0200 +Subject: cpufreq: armada-37xx: Fix the AVS value for load L1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit d118ac2062b5b8331c8768ac81e016617e0996ee ] + +The original CPU voltage value for load L1 is too low for Armada 37xx SoC +when base CPU frequency is 1000 or 1200 MHz. It leads to instabilities +where CPU gets stuck soon after dynamic voltage scaling from load L1 to L0. + +Update the CPU voltage value for load L1 accordingly when base frequency is +1000 or 1200 MHz. The minimal L1 value for base CPU frequency 1000 MHz is +updated from the original 1.05V to 1.108V and for 1200 MHz is updated to +1.155V. This minimal L1 value is used only in the case when it is lower +than value for L0. + +This change fixes CPU instability issues on 1 GHz and 1.2 GHz variants of +Espressobin and 1 GHz Turris Mox. + +Marvell previously for 1 GHz variant of Espressobin provided a patch [1] +suitable only for their Marvell Linux kernel 4.4 fork which workarounded +this issue. Patch forced CPU voltage value to 1.108V in all loads. But +such change does not fix CPU instability issues on 1.2 GHz variants of +Armada 3720 SoC. + +During testing we come to the conclusion that using 1.108V as minimal +value for L1 load makes 1 GHz variants of Espressobin and Turris Mox boards +stable. And similarly 1.155V for 1.2 GHz variant of Espressobin. + +These two values 1.108V and 1.155V are documented in Armada 3700 Hardware +Specifications as typical initial CPU voltage values. + +Discussion about this issue is also at the Armbian forum [2]. + +[1] - https://github.com/MarvellEmbeddedProcessors/linux-marvell/commit/dc33b62c90696afb6adc7dbcc4ebbd48bedec269 +[2] - https://forum.armbian.com/topic/10429-how-to-make-espressobin-v7-stable/ + +Signed-off-by: Pali Rohár +Acked-by: Gregory CLEMENT +Tested-by: Tomasz Maciej Nowak +Tested-by: Anders Trier Olesen +Tested-by: Philip Soares +Fixes: 1c3528232f4b ("cpufreq: armada-37xx: Add AVS support") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 37 +++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 99fb0ae7e2d7..dacb17e28305 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -73,6 +73,8 @@ + #define LOAD_LEVEL_NR 4 + + #define MIN_VOLT_MV 1000 ++#define MIN_VOLT_MV_FOR_L1_1000MHZ 1108 ++#define MIN_VOLT_MV_FOR_L1_1200MHZ 1155 + + /* AVS value for the corresponding voltage (in mV) */ + static int avs_map[] = { +@@ -208,6 +210,8 @@ static u32 armada_37xx_avs_val_match(int target_vm) + * - L2 & L3 voltage should be about 150mv smaller than L0 voltage. + * This function calculates L1 & L2 & L3 AVS values dynamically based + * on L0 voltage and fill all AVS values to the AVS value table. ++ * When base CPU frequency is 1000 or 1200 MHz then there is additional ++ * minimal avs value for load L1. + */ + static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + struct armada_37xx_dvfs *dvfs) +@@ -239,6 +243,19 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + for (load_level = 1; load_level < LOAD_LEVEL_NR; load_level++) + dvfs->avs[load_level] = avs_min; + ++ /* ++ * Set the avs values for load L0 and L1 when base CPU frequency ++ * is 1000/1200 MHz to its typical initial values according to ++ * the Armada 3700 Hardware Specifications. ++ */ ++ if (dvfs->cpu_freq_max >= 1000*1000*1000) { ++ if (dvfs->cpu_freq_max >= 1200*1000*1000) ++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ); ++ else ++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ); ++ dvfs->avs[0] = dvfs->avs[1] = avs_min; ++ } ++ + return; + } + +@@ -258,6 +275,26 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base, + target_vm = avs_map[l0_vdd_min] - 150; + target_vm = target_vm > MIN_VOLT_MV ? target_vm : MIN_VOLT_MV; + dvfs->avs[2] = dvfs->avs[3] = armada_37xx_avs_val_match(target_vm); ++ ++ /* ++ * Fix the avs value for load L1 when base CPU frequency is 1000/1200 MHz, ++ * otherwise the CPU gets stuck when switching from load L1 to load L0. ++ * Also ensure that avs value for load L1 is not higher than for L0. ++ */ ++ if (dvfs->cpu_freq_max >= 1000*1000*1000) { ++ u32 avs_min_l1; ++ ++ if (dvfs->cpu_freq_max >= 1200*1000*1000) ++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ); ++ else ++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ); ++ ++ if (avs_min_l1 > dvfs->avs[0]) ++ avs_min_l1 = dvfs->avs[0]; ++ ++ if (dvfs->avs[1] < avs_min_l1) ++ dvfs->avs[1] = avs_min_l1; ++ } + } + + static void __init armada37xx_cpufreq_avs_setup(struct regmap *base, +-- +2.30.2 + diff --git a/queue-4.19/crypto-qat-adf_status_pf_running-should-be-set-after.patch b/queue-4.19/crypto-qat-adf_status_pf_running-should-be-set-after.patch new file mode 100644 index 00000000000..631295a9c69 --- /dev/null +++ b/queue-4.19/crypto-qat-adf_status_pf_running-should-be-set-after.patch @@ -0,0 +1,96 @@ +From 1d854b3e890d59dd1cc7db6fa70c093360b9f83a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 23:40:00 -0400 +Subject: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init + +From: Tong Zhang + +[ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ] + +ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() +before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the +vf2pf_lock is initialized in adf_dev_init(), which can fail and when it +fail, the vf2pf_lock is either not initialized or destroyed, a subsequent +use of vf2pf_lock will cause issue. +To fix this issue, only set this flag if adf_dev_init() returns 0. + +[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 +[ 7.180345] Call Trace: +[ 7.182576] mutex_lock+0xc9/0xd0 +[ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] +[ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] +[ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] +[ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf] + +Signed-off-by: Tong Zhang +Reviewed-by: Andy Shevchenko +Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running") +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++-- + drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++-- + drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +index 613c7d5644ce..e87b7c466bdb 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +index 278452b8ef81..a8f3f2ecae70 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +index 3da0f951cb59..1b954abf67fb 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +-- +2.30.2 + diff --git a/queue-4.19/crypto-qat-don-t-release-uninitialized-resources.patch b/queue-4.19/crypto-qat-don-t-release-uninitialized-resources.patch new file mode 100644 index 00000000000..e0442d5f9fc --- /dev/null +++ b/queue-4.19/crypto-qat-don-t-release-uninitialized-resources.patch @@ -0,0 +1,68 @@ +From 0a1f0419cfe135e177e331eefeff52408919c435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 23:39:59 -0400 +Subject: crypto: qat - don't release uninitialized resources + +From: Tong Zhang + +[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ] + +adf_vf_isr_resource_alloc() is not unwinding correctly when error +happens and it want to release uninitialized resources. +To fix this, only release initialized resources. + +[ 1.792845] Trying to free already-free IRQ 11 +[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380 +[ 1.801340] Call Trace: +[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat] +[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat] +[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat] + +Signed-off-by: Tong Zhang +Reviewed-by: Andy Shevchenko +Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver") +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c +index 4a73fc70f7a9..df9a1f35b832 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c +@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + goto err_out; + + if (adf_setup_pf2vf_bh(accel_dev)) +- goto err_out; ++ goto err_disable_msi; + + if (adf_setup_bh(accel_dev)) +- goto err_out; ++ goto err_cleanup_pf2vf_bh; + + if (adf_request_msi_irq(accel_dev)) +- goto err_out; ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_cleanup_pf2vf_bh: ++ adf_cleanup_pf2vf_bh(accel_dev); ++ ++err_disable_msi: ++ adf_disable_msi(accel_dev); ++ + err_out: +- adf_vf_isr_resource_free(accel_dev); + return -EFAULT; + } + EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc); +-- +2.30.2 + diff --git a/queue-4.19/crypto-qat-fix-a-double-free-in-adf_create_ring.patch b/queue-4.19/crypto-qat-fix-a-double-free-in-adf_create_ring.patch new file mode 100644 index 00000000000..26259342f74 --- /dev/null +++ b/queue-4.19/crypto-qat-fix-a-double-free-in-adf_create_ring.patch @@ -0,0 +1,40 @@ +From 7c07dcdaaf1698875fc6d04235f0a3370d8fc5ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 10:13:48 -0700 +Subject: crypto: qat - Fix a double free in adf_create_ring + +From: Lv Yunlong + +[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ] + +In adf_create_ring, if the callee adf_init_ring() failed, the callee will +free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then +adf_create_ring will goto err and the ring->base_addr will be freed again +in adf_cleanup_ring(). + +My patch sets ring->base_addr to NULL after the first freed to avoid the +double free. + +Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code") +Signed-off-by: Lv Yunlong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_transport.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c +index 57d2622728a5..4c0067f8c079 100644 +--- a/drivers/crypto/qat/qat_common/adf_transport.c ++++ b/drivers/crypto/qat/qat_common/adf_transport.c +@@ -197,6 +197,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring) + dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n"); + dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes, + ring->base_addr, ring->dma_addr); ++ ring->base_addr = NULL; + return -EFAULT; + } + +-- +2.30.2 + diff --git a/queue-4.19/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch b/queue-4.19/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch new file mode 100644 index 00000000000..2049f2e49cb --- /dev/null +++ b/queue-4.19/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch @@ -0,0 +1,70 @@ +From 4f846daf7d6b9cbde818855da42cbbea86fb37ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:34:18 +0000 +Subject: crypto: qat - fix error path in adf_isr_resource_alloc() + +From: Giovanni Cabiddu + +[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ] + +The function adf_isr_resource_alloc() is not unwinding correctly in case +of error. +This patch fixes the error paths and propagate the errors to the caller. + +Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_isr.c | 29 ++++++++++++++++++------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c +index cd1cdf5305bc..4898ef41fd9f 100644 +--- a/drivers/crypto/qat/qat_common/adf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_isr.c +@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + + ret = adf_isr_alloc_msix_entry_table(accel_dev); + if (ret) +- return ret; +- if (adf_enable_msix(accel_dev)) + goto err_out; + +- if (adf_setup_bh(accel_dev)) +- goto err_out; ++ ret = adf_enable_msix(accel_dev); ++ if (ret) ++ goto err_free_msix_table; + +- if (adf_request_irqs(accel_dev)) +- goto err_out; ++ ret = adf_setup_bh(accel_dev); ++ if (ret) ++ goto err_disable_msix; ++ ++ ret = adf_request_irqs(accel_dev); ++ if (ret) ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_disable_msix: ++ adf_disable_msix(&accel_dev->accel_pci_dev); ++ ++err_free_msix_table: ++ adf_isr_free_msix_entry_table(accel_dev); ++ + err_out: +- adf_isr_resource_free(accel_dev); +- return -EFAULT; ++ return ret; + } + EXPORT_SYMBOL_GPL(adf_isr_resource_alloc); +-- +2.30.2 + diff --git a/queue-4.19/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch b/queue-4.19/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch new file mode 100644 index 00000000000..17cbfdf1632 --- /dev/null +++ b/queue-4.19/drivers-block-null_blk-main-fix-a-double-free-in-nul.patch @@ -0,0 +1,44 @@ +From 4dea939470ebeb9d9a0d18f672f5b5710e696adb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 07:32:29 -0700 +Subject: drivers/block/null_blk/main: Fix a double free in null_init. + +From: Lv Yunlong + +[ Upstream commit 72ce11ddfa4e9e1879103581a60b7e34547eaa0a ] + +In null_init, null_add_dev(dev) is called. +In null_add_dev, it calls null_free_zoned_dev(dev) to free dev->zones +via kvfree(dev->zones) in out_cleanup_zone branch and returns err. +Then null_init accept the err code and then calls null_free_dev(dev). + +But in null_free_dev(dev), dev->zones is freed again by +null_free_zoned_dev(). + +My patch set dev->zones to NULL in null_free_zoned_dev() after +kvfree(dev->zones) is called, to avoid the double free. + +Fixes: 2984c8684f962 ("nullb: factor disk parameters") +Signed-off-by: Lv Yunlong +Link: https://lore.kernel.org/r/20210426143229.7374-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk_zoned.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c +index 079ed33fd806..ba018f1da512 100644 +--- a/drivers/block/null_blk_zoned.c ++++ b/drivers/block/null_blk_zoned.c +@@ -56,6 +56,7 @@ int null_zone_init(struct nullb_device *dev) + void null_zone_exit(struct nullb_device *dev) + { + kvfree(dev->zones); ++ dev->zones = NULL; + } + + static void null_zone_fill_bio(struct nullb_device *dev, struct bio *bio, +-- +2.30.2 + diff --git a/queue-4.19/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch b/queue-4.19/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch new file mode 100644 index 00000000000..29fd98def63 --- /dev/null +++ b/queue-4.19/drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch @@ -0,0 +1,98 @@ +From e7f15e0307147a8dcca8c533825ab85e1b36765d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 21:48:09 -0700 +Subject: Drivers: hv: vmbus: Increase wait time for VMbus unload + +From: Michael Kelley + +[ Upstream commit 77db0ec8b7764cb9b09b78066ebfd47b2c0c1909 ] + +When running in Azure, disks may be connected to a Linux VM with +read/write caching enabled. If a VM panics and issues a VMbus +UNLOAD request to Hyper-V, the response is delayed until all dirty +data in the disk cache is flushed. In extreme cases, this flushing +can take 10's of seconds, depending on the disk speed and the amount +of dirty data. If kdump is configured for the VM, the current 10 second +timeout in vmbus_wait_for_unload() may be exceeded, and the UNLOAD +complete message may arrive well after the kdump kernel is already +running, causing problems. Note that no problem occurs if kdump is +not enabled because Hyper-V waits for the cache flush before doing +a reboot through the BIOS/UEFI code. + +Fix this problem by increasing the timeout in vmbus_wait_for_unload() +to 100 seconds. Also output periodic messages so that if anyone is +watching the serial console, they won't think the VM is completely +hung. + +Fixes: 911e1987efc8 ("Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload") +Signed-off-by: Michael Kelley +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/1618894089-126662-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel_mgmt.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index ac9617671757..cdd4392c589d 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -773,6 +773,12 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type) + free_cpumask_var(available_mask); + } + ++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */ ++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */ ++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) ++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */ ++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) ++ + static void vmbus_wait_for_unload(void) + { + int cpu; +@@ -790,12 +796,17 @@ static void vmbus_wait_for_unload(void) + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. + * +- * Wait no more than 10 seconds so that the panic path can't get +- * hung forever in case the response message isn't seen. ++ * Wait up to 100 seconds since an Azure host must writeback any dirty ++ * data in its disk cache before the VMbus UNLOAD request will ++ * complete. This flushing has been empirically observed to take up ++ * to 50 seconds in cases with a lot of dirty data, so allow additional ++ * leeway and for inaccuracies in mdelay(). But eventually time out so ++ * that the panic path can't get hung forever in case the response ++ * message isn't seen. + */ +- for (i = 0; i < 1000; i++) { ++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) { + if (completion_done(&vmbus_connection.unload_event)) +- break; ++ goto completed; + + for_each_online_cpu(cpu) { + struct hv_per_cpu_context *hv_cpu +@@ -818,9 +829,18 @@ static void vmbus_wait_for_unload(void) + vmbus_signal_eom(msg, message_type); + } + +- mdelay(10); ++ /* ++ * Give a notice periodically so someone watching the ++ * serial output won't think it is completely hung. ++ */ ++ if (!(i % UNLOAD_MSG_LOOPS)) ++ pr_notice("Waiting for VMBus UNLOAD to complete\n"); ++ ++ mdelay(UNLOAD_DELAY_UNIT_MS); + } ++ pr_err("Continuing even though VMBus UNLOAD did not complete\n"); + ++completed: + /* + * We're crashing and already got the UNLOAD_RESPONSE, cleanup all + * maybe-pending messages on all CPUs to be able to receive new +-- +2.30.2 + diff --git a/queue-4.19/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch b/queue-4.19/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch new file mode 100644 index 00000000000..790c6cd1857 --- /dev/null +++ b/queue-4.19/drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch @@ -0,0 +1,106 @@ +From 9e626090a368917d29ecbfc29448c537cad91c3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 22:15:42 -0500 +Subject: drm/amdkfd: fix build error with AMD_IOMMU_V2=m +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit 1e87068570a2cc4db5f95a881686add71729e769 ] + +Using 'imply AMD_IOMMU_V2' does not guarantee that the driver can link +against the exported functions. If the GPU driver is built-in but the +IOMMU driver is a loadable module, the kfd_iommu.c file is indeed +built but does not work: + +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_bind_process_to_device': +kfd_iommu.c:(.text+0x516): undefined reference to `amd_iommu_bind_pasid' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_unbind_process': +kfd_iommu.c:(.text+0x691): undefined reference to `amd_iommu_unbind_pasid' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_suspend': +kfd_iommu.c:(.text+0x966): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0x97f): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0x9a4): undefined reference to `amd_iommu_free_device' +x86_64-linux-ld: drivers/gpu/drm/amd/amdkfd/kfd_iommu.o: in function `kfd_iommu_resume': +kfd_iommu.c:(.text+0xa9a): undefined reference to `amd_iommu_init_device' +x86_64-linux-ld: kfd_iommu.c:(.text+0xadc): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xaff): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xc72): undefined reference to `amd_iommu_bind_pasid' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe08): undefined reference to `amd_iommu_set_invalidate_ctx_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe26): undefined reference to `amd_iommu_set_invalid_ppr_cb' +x86_64-linux-ld: kfd_iommu.c:(.text+0xe42): undefined reference to `amd_iommu_free_device' + +Use IS_REACHABLE to only build IOMMU-V2 support if the amd_iommu symbols +are reachable by the amdkfd driver. Output a warning if they are not, +because that may not be what the user was expecting. + +Fixes: 64d1c3a43a6f ("drm/amdkfd: Centralize IOMMUv2 code and make it conditional") +Reported-by: Arnd Bergmann +Signed-off-by: Felix Kuehling +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 6 ++++++ + drivers/gpu/drm/amd/amdkfd/kfd_iommu.h | 9 +++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c +index 01494752c36a..f3a526ed8059 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c +@@ -20,6 +20,10 @@ + * OTHER DEALINGS IN THE SOFTWARE. + */ + ++#include ++ ++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2) ++ + #include + #include + #include +@@ -366,3 +370,5 @@ int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev) + + return 0; + } ++ ++#endif +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h +index dd23d9fdf6a8..afd420b01a0c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h +@@ -23,7 +23,9 @@ + #ifndef __KFD_IOMMU_H__ + #define __KFD_IOMMU_H__ + +-#if defined(CONFIG_AMD_IOMMU_V2_MODULE) || defined(CONFIG_AMD_IOMMU_V2) ++#include ++ ++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2) + + #define KFD_SUPPORT_IOMMU_V2 + +@@ -46,6 +48,9 @@ static inline int kfd_iommu_check_device(struct kfd_dev *kfd) + } + static inline int kfd_iommu_device_init(struct kfd_dev *kfd) + { ++#if IS_MODULE(CONFIG_AMD_IOMMU_V2) ++ WARN_ONCE(1, "iommu_v2 module is not usable by built-in KFD"); ++#endif + return 0; + } + +@@ -73,6 +78,6 @@ static inline int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev) + return 0; + } + +-#endif /* defined(CONFIG_AMD_IOMMU_V2) */ ++#endif /* IS_REACHABLE(CONFIG_AMD_IOMMU_V2) */ + + #endif /* __KFD_IOMMU_H__ */ +-- +2.30.2 + diff --git a/queue-4.19/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch b/queue-4.19/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch new file mode 100644 index 00000000000..7999df7036f --- /dev/null +++ b/queue-4.19/drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch @@ -0,0 +1,68 @@ +From e329a867baa0fbd96cdbdecb5fad36bdea5d90f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 09:01:38 +0300 +Subject: drm/i915/gvt: Fix error code in intel_gvt_init_device() + +From: Dan Carpenter + +[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ] + +The intel_gvt_init_vgpu_type_groups() function is only called from +intel_gvt_init_device(). If it fails then the intel_gvt_init_device() +prints the error code and propagates it back again. That's a bug +because false is zero/success. The fix is to modify it to return zero +or negative error codes and make everything consistent. + +Fixes: c5d71cb31723 ("drm/i915/gvt: Move vGPU type related code into gvt file") +Signed-off-by: Dan Carpenter +Signed-off-by: Zhenyu Wang +Link: http://patchwork.freedesktop.org/patch/msgid/YHaFQtk/DIVYK1u5@mwanda +Reviewed-by: Zhenyu Wang +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c +index 46c8b720e336..3e3876d141ce 100644 +--- a/drivers/gpu/drm/i915/gvt/gvt.c ++++ b/drivers/gpu/drm/i915/gvt/gvt.c +@@ -128,7 +128,7 @@ static bool intel_get_gvt_attrs(struct attribute ***type_attrs, + return true; + } + +-static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) ++static int intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) + { + int i, j; + struct intel_vgpu_type *type; +@@ -146,7 +146,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) + gvt_vgpu_type_groups[i] = group; + } + +- return true; ++ return 0; + + unwind: + for (j = 0; j < i; j++) { +@@ -154,7 +154,7 @@ unwind: + kfree(group); + } + +- return false; ++ return -ENOMEM; + } + + static void intel_gvt_cleanup_vgpu_type_groups(struct intel_gvt *gvt) +@@ -416,7 +416,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv) + goto out_clean_thread; + + ret = intel_gvt_init_vgpu_type_groups(gvt); +- if (ret == false) { ++ if (ret) { + gvt_err("failed to init vgpu type groups: %d\n", ret); + goto out_clean_types; + } +-- +2.30.2 + diff --git a/queue-4.19/firmware-qcom-scm-fix-qcom_scm-configuration.patch b/queue-4.19/firmware-qcom-scm-fix-qcom_scm-configuration.patch new file mode 100644 index 00000000000..dab1a344183 --- /dev/null +++ b/queue-4.19/firmware-qcom-scm-fix-qcom_scm-configuration.patch @@ -0,0 +1,47 @@ +From 29136ba19bb28fda0d726078a792b0375e1fde17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 05:42:00 -0400 +Subject: firmware: qcom-scm: Fix QCOM_SCM configuration + +From: He Ying + +[ Upstream commit 2954a6f12f250890ec2433cec03ba92784d613e8 ] + +When CONFIG_QCOM_SCM is y and CONFIG_HAVE_ARM_SMCCC +is not set, compiling errors are encountered as follows: + +drivers/firmware/qcom_scm-smc.o: In function `__scm_smc_do_quirk': +qcom_scm-smc.c:(.text+0x36): undefined reference to `__arm_smccc_smc' +drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call': +qcom_scm-legacy.c:(.text+0xe2): undefined reference to `__arm_smccc_smc' +drivers/firmware/qcom_scm-legacy.o: In function `scm_legacy_call_atomic': +qcom_scm-legacy.c:(.text+0x1f0): undefined reference to `__arm_smccc_smc' + +Note that __arm_smccc_smc is defined when HAVE_ARM_SMCCC is y. +So add dependency on HAVE_ARM_SMCCC in QCOM_SCM configuration. + +Fixes: 916f743da354 ("firmware: qcom: scm: Move the scm driver to drivers/firmware") +Reported-by: Hulk Robot +Signed-off-by: He Ying +Link: https://lore.kernel.org/r/20210406094200.60952-1-heying24@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig +index ed212c8b4108..1c419e4cea83 100644 +--- a/drivers/firmware/Kconfig ++++ b/drivers/firmware/Kconfig +@@ -248,6 +248,7 @@ config FW_CFG_SYSFS_CMDLINE + config QCOM_SCM + bool + depends on ARM || ARM64 ++ depends on HAVE_ARM_SMCCC + select RESET_CONTROLLER + + config QCOM_SCM_32 +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-complete-out-requests-on-short-packets.patch b/queue-4.19/fotg210-udc-complete-out-requests-on-short-packets.patch new file mode 100644 index 00000000000..368584016b2 --- /dev/null +++ b/queue-4.19/fotg210-udc-complete-out-requests-on-short-packets.patch @@ -0,0 +1,47 @@ +From be60c74af7486d0dcae354b11558fde441d79333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:15 +0100 +Subject: fotg210-udc: Complete OUT requests on short packets + +From: Fabian Vogt + +[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ] + +A short packet indicates the end of a transfer and marks the request as +complete. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 7ae0243c32e5..785822ecc3f1 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -853,12 +853,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep) + { + struct fotg210_request *req = list_entry(ep->queue.next, + struct fotg210_request, queue); ++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1); + + fotg210_start_dma(ep, req); + +- /* finish out transfer */ ++ /* Complete the request when it's full or a short packet arrived. ++ * Like other drivers, short_not_ok isn't handled. ++ */ ++ + if (req->req.length == req->req.actual || +- req->req.actual < ep->ep.maxpacket) ++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1))) + fotg210_done(ep, req, 0); + } + +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch b/queue-4.19/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch new file mode 100644 index 00000000000..7bc03d6c378 --- /dev/null +++ b/queue-4.19/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch @@ -0,0 +1,40 @@ +From 7ffbdd4d6ff53a896a0fd611f078fdfbc257303e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:14 +0100 +Subject: fotg210-udc: Don't DMA more than the buffer can take + +From: Fabian Vogt + +[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ] + +Before this, it wrote as much as available into the buffer, even if it +didn't fit. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 41cc5babd50d..7ae0243c32e5 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -337,8 +337,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + } else { + buffer = req->req.buf + req->req.actual; + length = ioread32(ep->fotg210->reg + +- FOTG210_FIBCR(ep->epnum - 1)); +- length &= FIBCR_BCFX; ++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX; ++ if (length > req->req.length - req->req.actual) ++ length = req->req.length - req->req.actual; + } + } else { + buffer = req->req.buf + req->req.actual; +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch b/queue-4.19/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch new file mode 100644 index 00000000000..221a0f159eb --- /dev/null +++ b/queue-4.19/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch @@ -0,0 +1,40 @@ +From fe409296de633a5bcbd8de12abee8238347beeac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:09 +0100 +Subject: fotg210-udc: Fix DMA on EP0 for length > max packet size + +From: Fabian Vogt + +[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ] + +For a 75 Byte request, it would send the first 64 separately, then detect +that the remaining 11 Byte fit into a single DMA, but due to this bug set +the length to the original 75 Bytes. This leads to a DMA failure (which is +ignored...) and the request completes without the remaining bytes having +been sent. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index bc6abaea907d..d698d4ab121b 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -345,7 +345,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + if (req->req.length - req->req.actual > ep->ep.maxpacket) + length = ep->ep.maxpacket; + else +- length = req->req.length; ++ length = req->req.length - req->req.actual; + } + + d = dma_map_single(NULL, buffer, length, +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch b/queue-4.19/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch new file mode 100644 index 00000000000..e349e5a779e --- /dev/null +++ b/queue-4.19/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch @@ -0,0 +1,38 @@ +From 5001ff95c1ca0eafb9e24078b88509636fd4b980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:10 +0100 +Subject: fotg210-udc: Fix EP0 IN requests bigger than two packets + +From: Fabian Vogt + +[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ] + +For a 134 Byte packet, it sends the first two 64 Byte packets just fine, +but then notice that less than a packet is remaining and call fotg210_done +without actually sending the rest. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index d698d4ab121b..a35a55eff429 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -824,7 +824,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210) + if (req->req.length) + fotg210_start_dma(ep, req); + +- if ((req->req.length - req->req.actual) < ep->ep.maxpacket) ++ if (req->req.actual == req->req.length) + fotg210_done(ep, req, 0); + } else { + fotg210_set_cxdone(fotg210); +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch b/queue-4.19/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch new file mode 100644 index 00000000000..cf0d1566414 --- /dev/null +++ b/queue-4.19/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch @@ -0,0 +1,42 @@ +From 51d64415f9e60a9af86959037c35c82e8bbec89f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:12 +0100 +Subject: fotg210-udc: Mask GRP2 interrupts we don't handle + +From: Fabian Vogt + +[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ] + +Currently it leaves unhandled interrupts unmasked, but those are never +acked. In the case of a "device idle" interrupt, this leads to an +effectively frozen system until plugging it in. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 6e284332b11f..41cc5babd50d 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -1030,6 +1030,12 @@ static void fotg210_init(struct fotg210_udc *fotg210) + value &= ~DMCR_GLINT_EN; + iowrite32(value, fotg210->reg + FOTG210_DMCR); + ++ /* enable only grp2 irqs we handle */ ++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT ++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT ++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT), ++ fotg210->reg + FOTG210_DMISGR2); ++ + /* disable all fifo interrupt */ + iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1); + +-- +2.30.2 + diff --git a/queue-4.19/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch b/queue-4.19/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch new file mode 100644 index 00000000000..5f076052d09 --- /dev/null +++ b/queue-4.19/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch @@ -0,0 +1,40 @@ +From 30b729620ffd8ee127031991801c801733c890b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:11 +0100 +Subject: fotg210-udc: Remove a dubious condition leading to fotg210_done + +From: Fabian Vogt + +[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ] + +When the EP0 IN request was not completed but less than a packet sent, +it would complete the request successfully. That doesn't make sense +and can't really happen as fotg210_start_dma always sends +min(length, maxpkt) bytes. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index a35a55eff429..6e284332b11f 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -382,8 +382,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep, + } + if (ep->dir_in) { /* if IN */ + fotg210_start_dma(ep, req); +- if ((req->req.length == req->req.actual) || +- (req->req.actual < ep->ep.maxpacket)) ++ if (req->req.length == req->req.actual) + fotg210_done(ep, req, 0); + } else { /* OUT */ + u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0); +-- +2.30.2 + diff --git a/queue-4.19/hid-plantronics-workaround-for-double-volume-key-pre.patch b/queue-4.19/hid-plantronics-workaround-for-double-volume-key-pre.patch new file mode 100644 index 00000000000..bb88c6d984a --- /dev/null +++ b/queue-4.19/hid-plantronics-workaround-for-double-volume-key-pre.patch @@ -0,0 +1,181 @@ +From 05648ebf7df5abf160bd4d943cb7620b7dd482a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Feb 2021 16:47:40 +0200 +Subject: HID: plantronics: Workaround for double volume key presses + +From: Maxim Mikityanskiy + +[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ] + +Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice +for each volume key press. This patch adds a quirk to hid-plantronics +for this product ID, which will ignore the second volume key press if +it happens within 5 ms from the last one that was handled. + +The patch was tested on the mentioned model only, it shouldn't affect +other models, however, this quirk might be needed for them too. +Auto-repeat (when a key is held pressed) is not affected, because the +rate is about 3 times per second, which is far less frequent than once +in 5 ms. + +Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++-- + include/linux/hid.h | 2 ++ + 3 files changed, 61 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 68908dac5835..75342f3dfb86 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -904,6 +904,7 @@ + #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003 + + #define USB_VENDOR_ID_PLANTRONICS 0x047f ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056 + + #define USB_VENDOR_ID_PANASONIC 0x04da + #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044 +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index 584b10d3fc3d..460711c1124a 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + + #define PLT_HID_1_0_PAGE 0xffa00000 + #define PLT_HID_2_0_PAGE 0xffa20000 +@@ -39,6 +40,16 @@ + #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ + (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) + ++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) ++ ++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */ ++ ++struct plt_drv_data { ++ unsigned long device_type; ++ unsigned long last_volume_key_ts; ++ u32 quirks; ++}; ++ + static int plantronics_input_mapping(struct hid_device *hdev, + struct hid_input *hi, + struct hid_field *field, +@@ -46,7 +57,8 @@ static int plantronics_input_mapping(struct hid_device *hdev, + unsigned long **bit, int *max) + { + unsigned short mapped_key; +- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ unsigned long plt_type = drv_data->device_type; + + /* special case for PTT products */ + if (field->application == HID_GD_JOYSTICK) +@@ -108,6 +120,30 @@ mapped: + return 1; + } + ++static int plantronics_event(struct hid_device *hdev, struct hid_field *field, ++ struct hid_usage *usage, __s32 value) ++{ ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ ++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) { ++ unsigned long prev_ts, cur_ts; ++ ++ /* Usages are filtered in plantronics_usages. */ ++ ++ if (!value) /* Handle key presses only. */ ++ return 0; ++ ++ prev_ts = drv_data->last_volume_key_ts; ++ cur_ts = jiffies; ++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT) ++ return 1; /* Ignore the repeated key. */ ++ ++ drv_data->last_volume_key_ts = cur_ts; ++ } ++ ++ return 0; ++} ++ + static unsigned long plantronics_device_type(struct hid_device *hdev) + { + unsigned i, col_page; +@@ -136,15 +172,24 @@ exit: + static int plantronics_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { ++ struct plt_drv_data *drv_data; + int ret; + ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); ++ if (!drv_data) ++ return -ENOMEM; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); + goto err; + } + +- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev)); ++ drv_data->device_type = plantronics_device_type(hdev); ++ drv_data->quirks = id->driver_data; ++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); ++ ++ hid_set_drvdata(hdev, drv_data); + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT | + HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE); +@@ -156,15 +201,26 @@ err: + } + + static const struct hid_device_id plantronics_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, + { } + }; + MODULE_DEVICE_TABLE(hid, plantronics_devices); + ++static const struct hid_usage_id plantronics_usages[] = { ++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID }, ++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID }, ++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR } ++}; ++ + static struct hid_driver plantronics_driver = { + .name = "plantronics", + .id_table = plantronics_devices, ++ .usage_table = plantronics_usages, + .input_mapping = plantronics_input_mapping, ++ .event = plantronics_event, + .probe = plantronics_probe, + }; + module_hid_driver(plantronics_driver); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index a46b6832b373..4dcce83ca378 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -270,6 +270,8 @@ struct hid_item { + #define HID_CP_SELECTION 0x000c0080 + #define HID_CP_MEDIASELECTION 0x000c0087 + #define HID_CP_SELECTDISC 0x000c00ba ++#define HID_CP_VOLUMEUP 0x000c00e9 ++#define HID_CP_VOLUMEDOWN 0x000c00ea + #define HID_CP_PLAYBACKSPEED 0x000c00f1 + #define HID_CP_PROXIMITY 0x000c0109 + #define HID_CP_SPEAKERSYSTEM 0x000c0160 +-- +2.30.2 + diff --git a/queue-4.19/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch b/queue-4.19/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch new file mode 100644 index 00000000000..04fdf466e18 --- /dev/null +++ b/queue-4.19/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch @@ -0,0 +1,46 @@ +From a1a7404edfb965fc745629dba8c892f13101e7eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:08:17 +0300 +Subject: HSI: core: fix resource leaks in hsi_add_client_from_dt() + +From: Dan Carpenter + +[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ] + +If some of the allocations fail between the dev_set_name() and the +device_register() then the name will not be freed. Fix this by +moving dev_set_name() directly in front of the call to device_register(). + +Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices") +Signed-off-by: Dan Carpenter +Reviewed-by: Jason Gunthorpe +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/hsi_core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c +index 9065efd21851..71895da63810 100644 +--- a/drivers/hsi/hsi_core.c ++++ b/drivers/hsi/hsi_core.c +@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + if (err) + goto err; + +- dev_set_name(&cl->device, "%s", name); +- + err = hsi_of_property_parse_mode(client, "hsi-mode", &mode); + if (err) { + err = hsi_of_property_parse_mode(client, "hsi-rx-mode", +@@ -306,6 +304,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + cl->device.release = hsi_client_release; + cl->device.of_node = client; + ++ dev_set_name(&cl->device, "%s", name); + if (device_register(&cl->device) < 0) { + pr_err("hsi: failed to register client: %s\n", name); + put_device(&cl->device); +-- +2.30.2 + diff --git a/queue-4.19/i2c-cadence-add-irq-check.patch b/queue-4.19/i2c-cadence-add-irq-check.patch new file mode 100644 index 00000000000..fb5eb9ea6c1 --- /dev/null +++ b/queue-4.19/i2c-cadence-add-irq-check.patch @@ -0,0 +1,42 @@ +From f954fde65c333310dca92164cc43410a959d364f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:14:35 +0300 +Subject: i2c: cadence: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index b13605718291..c5475bb4fae6 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -906,7 +906,10 @@ static int cdns_i2c_probe(struct platform_device *pdev) + if (IS_ERR(id->membase)) + return PTR_ERR(id->membase); + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.owner = THIS_MODULE; + id->adap.dev.of_node = pdev->dev.of_node; +-- +2.30.2 + diff --git a/queue-4.19/i2c-emev2-add-irq-check.patch b/queue-4.19/i2c-emev2-add-irq-check.patch new file mode 100644 index 00000000000..787f2dbb537 --- /dev/null +++ b/queue-4.19/i2c-emev2-add-irq-check.patch @@ -0,0 +1,42 @@ +From 344cbc144cd381ccdbb604ebfd4e056a1ecef712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:16:41 +0300 +Subject: i2c: emev2: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: 5faf6e1f58b4 ("i2c: emev2: add driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-emev2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index 959d4912ec0d..0230a13a6ab7 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -397,7 +397,10 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- priv->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err_clk; ++ priv->irq = ret; + ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) +-- +2.30.2 + diff --git a/queue-4.19/i2c-jz4780-add-irq-check.patch b/queue-4.19/i2c-jz4780-add-irq-check.patch new file mode 100644 index 00000000000..3a3d5e750b9 --- /dev/null +++ b/queue-4.19/i2c-jz4780-add-irq-check.patch @@ -0,0 +1,42 @@ +From 63d2810a59c894e28392604a148ddd81d765788c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:18:31 +0300 +Subject: i2c: jz4780: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-jz4780.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c +index 41ca9ff7b5da..4dd800c0db14 100644 +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -760,7 +760,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev) + + jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0); + +- i2c->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err; ++ i2c->irq = ret; + ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0, + dev_name(&pdev->dev), i2c); + if (ret) +-- +2.30.2 + diff --git a/queue-4.19/i2c-sh7760-add-irq-check.patch b/queue-4.19/i2c-sh7760-add-irq-check.patch new file mode 100644 index 00000000000..e063d5cebf6 --- /dev/null +++ b/queue-4.19/i2c-sh7760-add-irq-check.patch @@ -0,0 +1,42 @@ +From 009ee6d3c7179728ad7d292b64c85845522c20b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:25:10 +0300 +Subject: i2c: sh7760: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c2005c789d2b..c79c9f542c5a 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + goto out2; + } + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.nr = pdev->id; + id->adap.algo = &sh7760_i2c_algo; +-- +2.30.2 + diff --git a/queue-4.19/i2c-sh7760-fix-irq-error-path.patch b/queue-4.19/i2c-sh7760-fix-irq-error-path.patch new file mode 100644 index 00000000000..aaa477022db --- /dev/null +++ b/queue-4.19/i2c-sh7760-fix-irq-error-path.patch @@ -0,0 +1,38 @@ +From 5f0aeaea8f4f8852f01da46ecb64e50001430c64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 22:05:05 +0300 +Subject: i2c: sh7760: fix IRQ error path + +From: Sergey Shtylyov + +[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ] + +While adding the invalid IRQ check after calling platform_get_irq(), +I managed to overlook that the driver has a complex error path in its +probe() method, thus a simple *return* couldn't be used. Use a proper +*goto* instead! + +Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c79c9f542c5a..319d1fa617c8 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + + ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto out3; + id->irq = ret; + + id->adap.nr = pdev->id; +-- +2.30.2 + diff --git a/queue-4.19/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch b/queue-4.19/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch new file mode 100644 index 00000000000..0686fa4fc7b --- /dev/null +++ b/queue-4.19/ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch @@ -0,0 +1,37 @@ +From d1d60b6b27d88c9df4ea06e1f42fd21d578285e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:40 +0000 +Subject: IB/hfi1: Fix error return code in parse_platform_config() + +From: Wang Wensheng + +[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20210408113140.103032-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/firmware.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c +index 2b57ba70ddd6..c09080712485 100644 +--- a/drivers/infiniband/hw/hfi1/firmware.c ++++ b/drivers/infiniband/hw/hfi1/firmware.c +@@ -1924,6 +1924,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + dd_dev_err(dd, "%s: Failed CRC check at offset %ld\n", + __func__, (ptr - + (u32 *)dd->platform_config.data)); ++ ret = -EINVAL; + goto bail; + } + /* Jump the CRC DWORD */ +-- +2.30.2 + diff --git a/queue-4.19/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch b/queue-4.19/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch new file mode 100644 index 00000000000..30864186c86 --- /dev/null +++ b/queue-4.19/irqchip-gic-v3-fix-of_bad_addr-error-handling.patch @@ -0,0 +1,43 @@ +From 1665f83566fb9432a2c7033cfb1cd477374ad8b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 14:18:35 +0100 +Subject: irqchip/gic-v3: Fix OF_BAD_ADDR error handling + +From: Arnd Bergmann + +[ Upstream commit 8e13d96670a4c050d4883e6743a9e9858e5cfe10 ] + +When building with extra warnings enabled, clang points out a +mistake in the error handling: + +drivers/irqchip/irq-gic-v3-mbi.c:306:21: error: result of comparison of constant 18446744073709551615 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] + if (mbi_phys_base == OF_BAD_ADDR) { + +Truncate the constant to the same type as the variable it gets compared +to, to shut make the check work and void the warning. + +Fixes: 505287525c24 ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller") +Signed-off-by: Arnd Bergmann +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210323131842.2773094-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-mbi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c +index fbfa7ff6deb1..9d011281d4b5 100644 +--- a/drivers/irqchip/irq-gic-v3-mbi.c ++++ b/drivers/irqchip/irq-gic-v3-mbi.c +@@ -297,7 +297,7 @@ int __init mbi_init(struct fwnode_handle *fwnode, struct irq_domain *parent) + reg = of_get_property(np, "mbi-alias", NULL); + if (reg) { + mbi_phys_base = of_translate_address(np, reg); +- if (mbi_phys_base == OF_BAD_ADDR) { ++ if (mbi_phys_base == (phys_addr_t)OF_BAD_ADDR) { + ret = -ENXIO; + goto err_free_mbi; + } +-- +2.30.2 + diff --git a/queue-4.19/kfifo-fix-ternary-sign-extension-bugs.patch b/queue-4.19/kfifo-fix-ternary-sign-extension-bugs.patch new file mode 100644 index 00000000000..046dcc1454a --- /dev/null +++ b/queue-4.19/kfifo-fix-ternary-sign-extension-bugs.patch @@ -0,0 +1,120 @@ +From c473b5b0ce42353cc2681c43e65919b409c4b5bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:54:15 -0700 +Subject: kfifo: fix ternary sign extension bugs + +From: Dan Carpenter + +[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ] + +The intent with this code was to return negative error codes but instead +it returns positives. + +The problem is how type promotion works with ternary operations. These +functions return long, "ret" is an int and "copied" is a u32. The +negative error code is first cast to u32 so it becomes a high positive and +then cast to long where it's still a positive. + +We could fix this by declaring "ret" as a ssize_t but let's just get rid +of the ternaries instead. + +Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda +Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory") +Signed-off-by: Dan Carpenter +Cc: Stefani Seibold +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/kfifo/bytestream-example.c | 8 ++++++-- + samples/kfifo/inttype-example.c | 8 ++++++-- + samples/kfifo/record-example.c | 8 ++++++-- + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c +index 2fca916d9edf..a7f5ee8b6edc 100644 +--- a/samples/kfifo/bytestream-example.c ++++ b/samples/kfifo/bytestream-example.c +@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c +index 8dc3c2e7105a..a326a37e9163 100644 +--- a/samples/kfifo/inttype-example.c ++++ b/samples/kfifo/inttype-example.c +@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c +index 2d7529eeb294..deb87a2e4e6b 100644 +--- a/samples/kfifo/record-example.c ++++ b/samples/kfifo/record-example.c +@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +-- +2.30.2 + diff --git a/queue-4.19/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch b/queue-4.19/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch new file mode 100644 index 00000000000..bf15b8b8e5f --- /dev/null +++ b/queue-4.19/kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch @@ -0,0 +1,211 @@ +From 450633b22425c0eab1dc300194a433e054da8587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 15:48:57 +0100 +Subject: KVM: arm64: Initialize VCPU mdcr_el2 before loading it + +From: Alexandru Elisei + +[ Upstream commit 263d6287da1433aba11c5b4046388f2cdf49675c ] + +When a VCPU is created, the kvm_vcpu struct is initialized to zero in +kvm_vm_ioctl_create_vcpu(). On VHE systems, the first time +vcpu.arch.mdcr_el2 is loaded on hardware is in vcpu_load(), before it is +set to a sensible value in kvm_arm_setup_debug() later in the run loop. The +result is that KVM executes for a short time with MDCR_EL2 set to zero. + +This has several unintended consequences: + +* Setting MDCR_EL2.HPMN to 0 is constrained unpredictable according to ARM + DDI 0487G.a, page D13-3820. The behavior specified by the architecture + in this case is for the PE to behave as if MDCR_EL2.HPMN is set to a + value less than or equal to PMCR_EL0.N, which means that an unknown + number of counters are now disabled by MDCR_EL2.HPME, which is zero. + +* The host configuration for the other debug features controlled by + MDCR_EL2 is temporarily lost. This has been harmless so far, as Linux + doesn't use the other fields, but that might change in the future. + +Let's avoid both issues by initializing the VCPU's mdcr_el2 field in +kvm_vcpu_vcpu_first_run_init(), thus making sure that the MDCR_EL2 register +has a consistent value after each vcpu_load(). + +Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") +Signed-off-by: Alexandru Elisei +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210407144857.199746-3-alexandru.elisei@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/kvm_host.h | 1 + + arch/arm64/kvm/debug.c | 88 +++++++++++++++++++++---------- + virt/kvm/arm/arm.c | 2 + + 3 files changed, 63 insertions(+), 28 deletions(-) + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 151e69a93e34..07472c138ced 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -455,6 +455,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {} + static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {} + + void kvm_arm_init_debug(void); ++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu); + void kvm_arm_setup_debug(struct kvm_vcpu *vcpu); + void kvm_arm_clear_debug(struct kvm_vcpu *vcpu); + void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu); +diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c +index 3606f6b89094..7fe195ef7c3f 100644 +--- a/arch/arm64/kvm/debug.c ++++ b/arch/arm64/kvm/debug.c +@@ -79,6 +79,64 @@ void kvm_arm_init_debug(void) + __this_cpu_write(mdcr_el2, kvm_call_hyp(__kvm_get_mdcr_el2)); + } + ++/** ++ * kvm_arm_setup_mdcr_el2 - configure vcpu mdcr_el2 value ++ * ++ * @vcpu: the vcpu pointer ++ * ++ * This ensures we will trap access to: ++ * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR) ++ * - Debug ROM Address (MDCR_EL2_TDRA) ++ * - OS related registers (MDCR_EL2_TDOSA) ++ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB) ++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF) ++ */ ++static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu) ++{ ++ /* ++ * This also clears MDCR_EL2_E2PB_MASK to disable guest access ++ * to the profiling buffer. ++ */ ++ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK; ++ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM | ++ MDCR_EL2_TPMS | ++ MDCR_EL2_TTRF | ++ MDCR_EL2_TPMCR | ++ MDCR_EL2_TDRA | ++ MDCR_EL2_TDOSA); ++ ++ /* Is the VM being debugged by userspace? */ ++ if (vcpu->guest_debug) ++ /* Route all software debug exceptions to EL2 */ ++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE; ++ ++ /* ++ * Trap debug register access when one of the following is true: ++ * - Userspace is using the hardware to debug the guest ++ * (KVM_GUESTDBG_USE_HW is set). ++ * - The guest is not using debug (KVM_ARM64_DEBUG_DIRTY is clear). ++ */ ++ if ((vcpu->guest_debug & KVM_GUESTDBG_USE_HW) || ++ !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY)) ++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA; ++ ++ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); ++} ++ ++/** ++ * kvm_arm_vcpu_init_debug - setup vcpu debug traps ++ * ++ * @vcpu: the vcpu pointer ++ * ++ * Set vcpu initial mdcr_el2 value. ++ */ ++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu) ++{ ++ preempt_disable(); ++ kvm_arm_setup_mdcr_el2(vcpu); ++ preempt_enable(); ++} ++ + /** + * kvm_arm_reset_debug_ptr - reset the debug ptr to point to the vcpu state + */ +@@ -94,13 +152,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) + * @vcpu: the vcpu pointer + * + * This is called before each entry into the hypervisor to setup any +- * debug related registers. Currently this just ensures we will trap +- * access to: +- * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR) +- * - Debug ROM Address (MDCR_EL2_TDRA) +- * - OS related registers (MDCR_EL2_TDOSA) +- * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB) +- * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF) ++ * debug related registers. + * + * Additionally, KVM only traps guest accesses to the debug registers if + * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY +@@ -112,28 +164,14 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) + + void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + { +- bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY); + unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2; + + trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug); + +- /* +- * This also clears MDCR_EL2_E2PB_MASK to disable guest access +- * to the profiling buffer. +- */ +- vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK; +- vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM | +- MDCR_EL2_TPMS | +- MDCR_EL2_TTRF | +- MDCR_EL2_TPMCR | +- MDCR_EL2_TDRA | +- MDCR_EL2_TDOSA); ++ kvm_arm_setup_mdcr_el2(vcpu); + + /* Is Guest debugging in effect? */ + if (vcpu->guest_debug) { +- /* Route all software debug exceptions to EL2 */ +- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE; +- + /* Save guest debug state */ + save_guest_debug_regs(vcpu); + +@@ -187,7 +225,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + + vcpu->arch.debug_ptr = &vcpu->arch.external_debug_state; + vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; +- trap_debug = true; + + trace_kvm_arm_set_regset("BKPTS", get_num_brps(), + &vcpu->arch.debug_ptr->dbg_bcr[0], +@@ -202,10 +239,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + BUG_ON(!vcpu->guest_debug && + vcpu->arch.debug_ptr != &vcpu->arch.vcpu_debug_state); + +- /* Trap debug register access */ +- if (trap_debug) +- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA; +- + /* If KDE or MDE are set, perform a full save/restore cycle. */ + if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE)) + vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; +@@ -214,7 +247,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) + if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2) + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + +- trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); + trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1)); + } + +diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c +index d982650deb33..39706799ecdf 100644 +--- a/virt/kvm/arm/arm.c ++++ b/virt/kvm/arm/arm.c +@@ -574,6 +574,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) + + vcpu->arch.has_run_once = true; + ++ kvm_arm_vcpu_init_debug(vcpu); ++ + if (likely(irqchip_in_kernel(kvm))) { + /* + * Map the VGIC hardware resources before running a vcpu the +-- +2.30.2 + diff --git a/queue-4.19/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch b/queue-4.19/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch new file mode 100644 index 00000000000..4d33502a772 --- /dev/null +++ b/queue-4.19/liquidio-fix-unintented-sign-extension-of-a-left-shi.patch @@ -0,0 +1,48 @@ +From f714f43dd35d5d263ef1af82daaf935689523fdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:12:48 +0100 +Subject: liquidio: Fix unintented sign extension of a left shift of a u16 + +From: Colin Ian King + +[ Upstream commit 298b58f00c0f86868ea717426beb5c1198772f81 ] + +The macro CN23XX_PEM_BAR1_INDEX_REG is being used to shift oct->pcie_port +(a u16) left 24 places. There are two subtle issues here, first the +shift gets promoted to an signed int and then sign extended to a u64. +If oct->pcie_port is 0x80 or more then the upper bits get sign extended +to 1. Secondly shfiting a u16 24 bits will lead to an overflow so it +needs to be cast to a u64 for all the bits to not overflow. + +It is entirely possible that the u16 port value is never large enough +for this to fail, but it is useful to fix unintended overflows such +as this. + +Fix this by casting the port parameter to the macro to a u64 before +the shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 5bc67f587ba7 ("liquidio: CN23XX register definitions") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +index e6d4ad99cc38..3f1c189646f4 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +@@ -521,7 +521,7 @@ + #define CN23XX_BAR1_INDEX_OFFSET 3 + + #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \ +- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \ ++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \ + ((idx) << CN23XX_BAR1_INDEX_OFFSET)) + + /*############################ DPI #########################*/ +-- +2.30.2 + diff --git a/queue-4.19/mac80211-bail-out-if-cipher-schemes-are-invalid.patch b/queue-4.19/mac80211-bail-out-if-cipher-schemes-are-invalid.patch new file mode 100644 index 00000000000..15bfb0408c9 --- /dev/null +++ b/queue-4.19/mac80211-bail-out-if-cipher-schemes-are-invalid.patch @@ -0,0 +1,44 @@ +From 9447eb8460cade2c1f39e8e363114cbb7116f134 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 14:31:50 +0200 +Subject: mac80211: bail out if cipher schemes are invalid + +From: Johannes Berg + +[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ] + +If any of the cipher schemes specified by the driver are invalid, bail +out and fail the registration rather than just warning. Otherwise, we +might later crash when we try to use the invalid cipher scheme, e.g. +if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd +have an out-of-bounds access in RX validation. + +Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support") +Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index f44d00f35fe7..e8c4e9c0c5a0 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1080,8 +1080,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + if (local->hw.wiphy->max_scan_ie_len) + local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; + +- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, +- local->hw.n_cipher_schemes)); ++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, ++ local->hw.n_cipher_schemes))) { ++ result = -EINVAL; ++ goto fail_workqueue; ++ } + + result = ieee80211_init_cipher_suites(local); + if (result < 0) +-- +2.30.2 + diff --git a/queue-4.19/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch b/queue-4.19/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch new file mode 100644 index 00000000000..1fda4db9f11 --- /dev/null +++ b/queue-4.19/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch @@ -0,0 +1,56 @@ +From 85895a403be37771180b0fd2d1dc25288bfea4aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 14:16:28 +0200 +Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays + +From: Colin Ian King + +[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ] + +There a 3 array for-loops that don't check the upper bounds of the +index into arrays and this may lead to potential out-of-bounds +reads. Fix this by adding array size upper bounds checks to be +full safe. + +Addresses-Coverity: ("Out-of-bounds read") + +Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com +Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/m88rs6000t.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c +index 3df2f23a40be..3fe13de48777 100644 +--- a/drivers/media/tuners/m88rs6000t.c ++++ b/drivers/media/tuners/m88rs6000t.c +@@ -534,7 +534,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + PGA2_cri = PGA2_GC >> 2; + PGA2_crf = PGA2_GC & 0x03; + +- for (i = 0; i <= RF_GC; i++) ++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++) + RFG += RFGS[i]; + + if (RF_GC == 0) +@@ -546,12 +546,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + if (RF_GC == 3) + RFG += 100; + +- for (i = 0; i <= IF_GC; i++) ++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++) + IFG += IFGS[i]; + + TIAG = TIA_GC * TIA_GS; + +- for (i = 0; i <= BB_GC; i++) ++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++) + BBG += BBGS[i]; + + PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; +-- +2.30.2 + diff --git a/queue-4.19/media-omap4iss-return-error-code-when-omap4iss_get-f.patch b/queue-4.19/media-omap4iss-return-error-code-when-omap4iss_get-f.patch new file mode 100644 index 00000000000..60a09ff71ce --- /dev/null +++ b/queue-4.19/media-omap4iss-return-error-code-when-omap4iss_get-f.patch @@ -0,0 +1,40 @@ +From 501d1d6b4ff2aa92058f7ae167dd6aa8a2cd7dbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 03:50:41 +0100 +Subject: media: omap4iss: return error code when omap4iss_get() failed + +From: Yang Yingliang + +[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ] + +If omap4iss_get() failed, it need return error code in iss_probe(). + +Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/omap4iss/iss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c +index b1036baebb03..d796e754610c 100644 +--- a/drivers/staging/media/omap4iss/iss.c ++++ b/drivers/staging/media/omap4iss/iss.c +@@ -1244,8 +1244,10 @@ static int iss_probe(struct platform_device *pdev) + if (ret < 0) + goto error; + +- if (!omap4iss_get(iss)) ++ if (!omap4iss_get(iss)) { ++ ret = -EINVAL; + goto error; ++ } + + ret = iss_reset(iss); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-4.19/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch b/queue-4.19/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch new file mode 100644 index 00000000000..2320dfcf482 --- /dev/null +++ b/queue-4.19/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch @@ -0,0 +1,41 @@ +From 32ab1feda4d141350ee0b9844e3b1a98de213107 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 16:43:27 +0100 +Subject: media: vivid: fix assignment of dev->fbuf_out_flags + +From: Colin Ian King + +[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ] + +Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise +mask and the following statement should be bit-wise or'ing in the new flag +bits but instead is making a direct assignment. Fix this by using the |= +operator rather than an assignment. + +Addresses-Coverity: ("Unused value") + +Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-vid-out.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c +index 0f909500a0b8..ecd9e36ef3f6 100644 +--- a/drivers/media/platform/vivid/vivid-vid-out.c ++++ b/drivers/media/platform/vivid/vivid-vid-out.c +@@ -998,7 +998,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh, + return -EINVAL; + } + dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags); +- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags); ++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags); + return 0; + } + +-- +2.30.2 + diff --git a/queue-4.19/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch b/queue-4.19/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch new file mode 100644 index 00000000000..e225c7e1ce6 --- /dev/null +++ b/queue-4.19/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch @@ -0,0 +1,53 @@ +From 567eedb288a99ca1be33e2778d46999abb160f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 19:38:21 +0000 +Subject: memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] + +From: Colin Ian King + +[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ] + +Currently the array gpmc_cs is indexed by cs before it cs is range checked +and the pointer read from this out-of-index read is dereferenced. Fix this +by performing the range check on cs before the read and the following +pointer dereference. + +Addresses-Coverity: ("Negative array index read") +Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select") +Signed-off-by: Colin Ian King +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/omap-gpmc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index 2ca507f3a58c..d8f2cacea750 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(gpmc_cs_request); + + void gpmc_cs_free(int cs) + { +- struct gpmc_cs_data *gpmc = &gpmc_cs[cs]; +- struct resource *res = &gpmc->mem; ++ struct gpmc_cs_data *gpmc; ++ struct resource *res; + + spin_lock(&gpmc_mem_lock); + if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) { +@@ -1038,6 +1038,9 @@ void gpmc_cs_free(int cs) + spin_unlock(&gpmc_mem_lock); + return; + } ++ gpmc = &gpmc_cs[cs]; ++ res = &gpmc->mem; ++ + gpmc_cs_disable_mem(cs); + if (res->flags) + release_resource(res); +-- +2.30.2 + diff --git a/queue-4.19/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch b/queue-4.19/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch new file mode 100644 index 00000000000..57511a44a3d --- /dev/null +++ b/queue-4.19/mfd-stm32-timers-avoid-clearing-auto-reload-register.patch @@ -0,0 +1,58 @@ +From 3e32e44efb0b0e912ccba4217a65214e210901ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 18:51:35 +0100 +Subject: mfd: stm32-timers: Avoid clearing auto reload register + +From: Fabrice Gasnier + +[ Upstream commit 4917e498c6894ba077867aff78f82cffd5ffbb5c ] + +The ARR register is cleared unconditionally upon probing, after the maximum +value has been read. This initial condition is rather not intuitive, when +considering the counter child driver. It rather expects the maximum value +by default: +- The counter interface shows a zero value by default for 'ceiling' + attribute. +- Enabling the counter without any prior configuration makes it doesn't + count. + +The reset value of ARR register is the maximum. So Choice here +is to backup it, and restore it then, instead of clearing its value. +It also fixes the initial condition seen by the counter driver. + +Fixes: d0f949e220fd ("mfd: Add STM32 Timers driver") +Signed-off-by: Fabrice Gasnier +Acked-by: William Breathitt Gray +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stm32-timers.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/stm32-timers.c b/drivers/mfd/stm32-timers.c +index efcd4b980c94..1adba6a46dcb 100644 +--- a/drivers/mfd/stm32-timers.c ++++ b/drivers/mfd/stm32-timers.c +@@ -158,13 +158,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = { + + static void stm32_timers_get_arr_size(struct stm32_timers *ddata) + { ++ u32 arr; ++ ++ /* Backup ARR to restore it after getting the maximum value */ ++ regmap_read(ddata->regmap, TIM_ARR, &arr); ++ + /* + * Only the available bits will be written so when readback + * we get the maximum value of auto reload register + */ + regmap_write(ddata->regmap, TIM_ARR, ~0L); + regmap_read(ddata->regmap, TIM_ARR, &ddata->max_arr); +- regmap_write(ddata->regmap, TIM_ARR, 0x0); ++ regmap_write(ddata->regmap, TIM_ARR, arr); + } + + static void stm32_timers_dma_probe(struct device *dev, +-- +2.30.2 + diff --git a/queue-4.19/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch b/queue-4.19/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch new file mode 100644 index 00000000000..74539382970 --- /dev/null +++ b/queue-4.19/mips-pci-legacy-stop-using-of_pci_range_to_resource.patch @@ -0,0 +1,62 @@ +From 96799840993d51e3adb343289196d066093bc60a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 20:12:37 -0700 +Subject: MIPS: pci-legacy: stop using of_pci_range_to_resource + +From: Ilya Lipnitskiy + +[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ] + +Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after +of_pci_range_to_resource() change"). + +Most MIPS platforms do not define PCI_IOBASE, nor implement +pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS +platforms. of_pci_range_to_resource passes the _start address_ of the IO +range into pci_address_to_pio, which then checks it against +IO_SPACE_LIMIT and fails, because for MIPS platforms that use +pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much +higher than 0xffff. + +In fact, pci-mt7621 in staging already works around this problem, see +commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set +resource limits") + +So just stop using of_pci_range_to_resource, which does not work for +MIPS. + +Fixes PCI errors like: + pci_bus 0000:00: root bus resource [io 0xffffffff] + +Fixes: 0b0b0893d49b ("of/pci: Fix the conversion of IO ranges into IO resources") +Signed-off-by: Ilya Lipnitskiy +Cc: Liviu Dudau +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pci-legacy.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index 3c3b1e6abb53..e8b0751d5b76 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -169,8 +169,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) + res = hose->mem_resource; + break; + } +- if (res != NULL) +- of_pci_range_to_resource(&range, node, res); ++ if (res != NULL) { ++ res->name = node->full_name; ++ res->flags = range.flags; ++ res->start = range.cpu_addr; ++ res->end = range.cpu_addr + range.size - 1; ++ res->parent = res->child = res->sibling = NULL; ++ } + } + } + +-- +2.30.2 + diff --git a/queue-4.19/mm-memory-failure-unnecessary-amount-of-unmapping.patch b/queue-4.19/mm-memory-failure-unnecessary-amount-of-unmapping.patch new file mode 100644 index 00000000000..14da9008bbf --- /dev/null +++ b/queue-4.19/mm-memory-failure-unnecessary-amount-of-unmapping.patch @@ -0,0 +1,42 @@ +From 8dbe8a6a72989b34bc6b660995c52e646690f3a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 23:02:19 -0700 +Subject: mm/memory-failure: unnecessary amount of unmapping + +From: Jane Chu + +[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ] + +It appears that unmap_mapping_range() actually takes a 'size' as its third +argument rather than a location, the current calling fashion causes +unnecessary amount of unmapping to occur. + +Link: https://lkml.kernel.org/r/20210420002821.2749748-1-jane.chu@oracle.com +Fixes: 6100e34b2526e ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages") +Signed-off-by: Jane Chu +Reviewed-by: Dan Williams +Reviewed-by: Naoya Horiguchi +Cc: Dave Jiang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memory-failure.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 148fdd929a19..034607a68ccb 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1220,7 +1220,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags, + * communicated in siginfo, see kill_proc() + */ + start = (page->index << PAGE_SHIFT) & ~(size - 1); +- unmap_mapping_range(page->mapping, start, start + size, 0); ++ unmap_mapping_range(page->mapping, start, size, 0); + } + kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags); + rc = 0; +-- +2.30.2 + diff --git a/queue-4.19/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch b/queue-4.19/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch new file mode 100644 index 00000000000..1596a086bed --- /dev/null +++ b/queue-4.19/mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch @@ -0,0 +1,42 @@ +From 493a52c7204ae9149a39bd159a026074d6c5dfbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:57:58 -0700 +Subject: mm/sparse: add the missing sparse_buffer_fini() in error branch + +From: Wang Wensheng + +[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ] + +sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a +WARN issue would be through the next time sparse_buffer_init() runs. + +Add the missing sparse_buffer_fini() in error branch. + +Link: https://lkml.kernel.org/r/20210325113155.118574-1-wangwensheng4@huawei.com +Fixes: 85c77f791390 ("mm/sparse: add new sparse_init_nid() and sparse_init()") +Signed-off-by: Wang Wensheng +Reviewed-by: David Hildenbrand +Reviewed-by: Oscar Salvador +Cc: Pavel Tatashin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/sparse.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mm/sparse.c b/mm/sparse.c +index 3b24ba903d9e..ed60f0a375fe 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -467,6 +467,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin, + pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.", + __func__, nid); + pnum_begin = pnum; ++ sparse_buffer_fini(); + goto failed; + } + check_usemap_section_nr(nid, usemap); +-- +2.30.2 + diff --git a/queue-4.19/mt7601u-fix-always-true-expression.patch b/queue-4.19/mt7601u-fix-always-true-expression.patch new file mode 100644 index 00000000000..9743e47daae --- /dev/null +++ b/queue-4.19/mt7601u-fix-always-true-expression.patch @@ -0,0 +1,47 @@ +From 3ff0920a339aecc8f6e6768b3442f71c8ac7f203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 18:32:41 +0000 +Subject: mt7601u: fix always true expression + +From: Colin Ian King + +[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ] + +Currently the expression ~nic_conf1 is always true because nic_conf1 +is a u16 and according to 6.5.3.3 of the C standard the ~ operator +promotes the u16 to an integer before flipping all the bits. Thus +the top 16 bits of the integer result are all set so the expression +is always true. If the intention was to flip all the bits of nic_conf1 +then casting the integer result back to a u16 is a suitabel fix. + +Interestingly static analyzers seem to thing a bitwise ! should be +used instead of ~ for this scenario, so I think the original intent +of the expression may need some extra consideration. + +Addresses-Coverity: ("Logical vs. bitwise operator") +Fixes: c869f77d6abb ("add mt7601u driver") +Signed-off-by: Colin Ian King +Acked-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +index 76117b402880..6ab1035e4a12 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +@@ -107,7 +107,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) + { + u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1); + +- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); ++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); + } + + static void +-- +2.30.2 + diff --git a/queue-4.19/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch b/queue-4.19/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch new file mode 100644 index 00000000000..76c3ad40f08 --- /dev/null +++ b/queue-4.19/mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch @@ -0,0 +1,49 @@ +From 8341b65fa3c32bb1d318bf1d3afc21d324905e71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 18:57:56 +0530 +Subject: mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() + +From: Manivannan Sadhasivam + +[ Upstream commit 08608adb520e51403be7592c2214846fa440a23a ] + +There are chances that the parse_mtd_partitions() function will return +-EPROBE_DEFER in mtd_device_parse_register(). This might happen when +the dependency is not available for the parser. For instance, on SDX55 +the MTD_QCOMSMEM_PARTS parser depends on the QCOM_SMEM driver to parse +the partitions defined in the shared memory region. With the current +flow, the error returned from parse_mtd_partitions() will be discarded +in favor of trying to add the fallback partition. + +This will prevent the driver to end up in probe deferred pool and the +partitions won't be parsed even after the QCOM_SMEM driver is available. + +Fix this issue by bailing out of mtd_device_parse_register() when +-EPROBE_DEFER error is returned from parse_mtd_partitions() function and +propagate the error code to the driver core for probing later. + +Fixes: 5ac67ce36cfe ("mtd: move code adding (registering) partitions to the parse_mtd_partitions()") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index 97ac219c082e..a0b1a7814e2e 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -712,6 +712,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types, + + /* Prefer parsed partitions over driver-provided fallback */ + ret = parse_mtd_partitions(mtd, types, parser_data); ++ if (ret == -EPROBE_DEFER) ++ goto out; ++ + if (ret > 0) + ret = 0; + else if (nr_parts) +-- +2.30.2 + diff --git a/queue-4.19/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch b/queue-4.19/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch new file mode 100644 index 00000000000..310f8697787 --- /dev/null +++ b/queue-4.19/mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch @@ -0,0 +1,48 @@ +From be73fab1e543b16d93b33c113ac9a4749324e6e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 09:02:10 +0100 +Subject: mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit f5200c14242fb8fa4a9b93f7fd4064d237e58785 ] + +Hamming ECC doesn't cover the OOB data, so reading or writing OOB shall +always be done without ECC enabled. +This is a problem when adding JFFS2 cleanmarkers to erased blocks. If JFFS2 +clenmarkers are added to the OOB with ECC enabled, OOB bytes will be changed +from ff ff ff to 00 00 00, reporting incorrect ECC errors. + +Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller") +Signed-off-by: Álvaro Fernández Rojas +Acked-by: Brian Norris +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210224080210.23686-1-noltari@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +index aad8d107b85d..774ffa9e23f3 100644 +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -2239,6 +2239,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip) + + ret = brcmstb_choose_ecc_layout(host); + ++ /* If OOB is written with ECC enabled it will cause ECC errors */ ++ if (is_hamming_ecc(host->ctrl, &host->hwcfg)) { ++ chip->ecc.write_oob = brcmnand_write_oob_raw; ++ chip->ecc.read_oob = brcmnand_read_oob_raw; ++ } ++ + return ret; + } + +-- +2.30.2 + diff --git a/queue-4.19/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch b/queue-4.19/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch new file mode 100644 index 00000000000..ea671fca1e6 --- /dev/null +++ b/queue-4.19/mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch @@ -0,0 +1,42 @@ +From c46f7a884ba6ec46ffe77fa9025a73239266b4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 18:58:49 +0300 +Subject: mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() + +From: Dan Carpenter + +[ Upstream commit e7a97528e3c787802d8c643d6ab2f428511bb047 ] + +If dma_request_channel() fails then the probe fails and it should +return a negative error code, but currently it returns success. + +fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support") +Signed-off-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/YCqaOZ83OvPOzLwh@mwanda +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsmc_nand.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index 25d354e9448e..a31bb1da44ec 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -1099,11 +1099,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev) + host->read_dma_chan = dma_request_channel(mask, filter, NULL); + if (!host->read_dma_chan) { + dev_err(&pdev->dev, "Unable to get read dma channel\n"); ++ ret = -ENODEV; + goto disable_clk; + } + host->write_dma_chan = dma_request_channel(mask, filter, NULL); + if (!host->write_dma_chan) { + dev_err(&pdev->dev, "Unable to get write dma channel\n"); ++ ret = -ENODEV; + goto release_dma_read_chan; + } + } +-- +2.30.2 + diff --git a/queue-4.19/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch b/queue-4.19/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch new file mode 100644 index 00000000000..cd8c3325d47 --- /dev/null +++ b/queue-4.19/mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch @@ -0,0 +1,47 @@ +From 60a9d06918bad9287ad7fda5afcce432a4bb5046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 23:09:05 -0700 +Subject: mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init + +From: Lv Yunlong + +[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ] + +If the callee gpmi_alloc_dma_buffer() failed to alloc memory for +this->raw_buffer, gpmi_free_dma_buffer() will be called to free +this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL +and valid ptr. + +Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer() +is called again to free this->auxiliary_virt in err_out. This causes +a double free. + +As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's +error path, so it should return err directly instead of releasing the dma +buffer again. + +Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path") +Signed-off-by: Lv Yunlong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index fe99d9323d4a..6bd414bac34d 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -1931,7 +1931,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this) + this->bch_geometry.auxiliary_size = 128; + ret = gpmi_alloc_dma_buffer(this); + if (ret) +- goto err_out; ++ return ret; + + chip->dummy_controller.ops = &gpmi_nand_controller_ops; + ret = nand_scan(chip, GPMI_IS_MX6(this) ? 2 : 1); +-- +2.30.2 + diff --git a/queue-4.19/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch b/queue-4.19/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch new file mode 100644 index 00000000000..ab9b8b05ecb --- /dev/null +++ b/queue-4.19/mtd-rawnand-qcom-return-actual-error-code-instead-of.patch @@ -0,0 +1,53 @@ +From 2dd3e294cfd81b98daed8323f9851bd4512961e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 18:57:57 +0530 +Subject: mtd: rawnand: qcom: Return actual error code instead of -ENODEV + +From: Manivannan Sadhasivam + +[ Upstream commit 55fbb9ba4f06cb6aff32daca1e1910173c13ec51 ] + +In qcom_probe_nand_devices() function, the error code returned by +qcom_nand_host_init_and_register() is converted to -ENODEV in the case +of failure. This poses issue if -EPROBE_DEFER is returned when the +dependency is not available for a component like parser. + +So let's restructure the error handling logic a bit and return the +actual error code in case of qcom_nand_host_init_and_register() failure. + +Fixes: c76b78d8ec05 ("mtd: nand: Qualcomm NAND controller driver") +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/qcom_nandc.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c +index 2726f1824233..148c7a16f318 100644 +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -2865,7 +2865,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) + struct device *dev = nandc->dev; + struct device_node *dn = dev->of_node, *child; + struct qcom_nand_host *host; +- int ret; ++ int ret = -ENODEV; + + for_each_available_child_of_node(dn, child) { + host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL); +@@ -2883,10 +2883,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) + list_add_tail(&host->node, &nandc->host_list); + } + +- if (list_empty(&nandc->host_list)) +- return -ENODEV; +- +- return 0; ++ return ret; + } + + /* parse custom DT properties here */ +-- +2.30.2 + diff --git a/queue-4.19/mtd-require-write-permissions-for-locking-and-badblo.patch b/queue-4.19/mtd-require-write-permissions-for-locking-and-badblo.patch new file mode 100644 index 00000000000..6300014b4ad --- /dev/null +++ b/queue-4.19/mtd-require-write-permissions-for-locking-and-badblo.patch @@ -0,0 +1,69 @@ +From 1ed09e6c1c4df43fd46297ea7b5c4127caae9dbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:57:35 +0100 +Subject: mtd: require write permissions for locking and badblock ioctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Walle + +[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ] + +MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require +write permission. Depending on the hardware MEMLOCK might even be +write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK +is always write-once. + +MEMSETBADBLOCK modifies the bad block table. + +Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions") +Signed-off-by: Michael Walle +Reviewed-by: Greg Kroah-Hartman +Acked-by: Rafał Miłecki +Acked-by: Richard Weinberger +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdchar.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 5afc653c09e2..82d38001d517 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -663,16 +663,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: +- case MEMLOCK: +- case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: +- case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: +- case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: +@@ -683,9 +679,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: ++ case MEMLOCK: ++ case MEMUNLOCK: ++ case MEMSETBADBLOCK: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: ++ case OTPLOCK: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; +-- +2.30.2 + diff --git a/queue-4.19/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch b/queue-4.19/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch new file mode 100644 index 00000000000..f6dfd6292b4 --- /dev/null +++ b/queue-4.19/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch @@ -0,0 +1,43 @@ +From 611d671ff486819efdded2423c8d1491a704f746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 11:26:27 -0700 +Subject: mwl8k: Fix a double Free in mwl8k_probe_hw + +From: Lv Yunlong + +[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ] + +In mwl8k_probe_hw, hw->priv->txq is freed at the first time by +dma_free_coherent() in the call chain: +if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i). + +Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed +at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent(). + +My patch set txq->txd to NULL after the first free to avoid the +double free. + +Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver") +Signed-off-by: Lv Yunlong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwl8k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index ffc565ac2192..6769b0c5a5cd 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -1469,6 +1469,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) + txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL); + if (txq->skb == NULL) { + pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma); ++ txq->txd = NULL; + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-4.19/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch b/queue-4.19/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch new file mode 100644 index 00000000000..c237a5e685c --- /dev/null +++ b/queue-4.19/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch @@ -0,0 +1,48 @@ +From 90cd0b05c01be37fdee7c324b254be836b65a7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 18:16:14 +0100 +Subject: net: davinci_emac: Fix incorrect masking of tx and rx error channel + +From: Colin Ian King + +[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ] + +The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) +are incorrect and always lead to a zero result. The mask values are +currently the incorrect post-right shifted values, fix this by setting +them to the currect values. + +(I double checked these against the TMS320TCI6482 data sheet, section +5.30, page 127 to ensure I had the correct mask values for the TXERRCH +and RXERRCH fields in the MACSTATUS register). + +Addresses-Coverity: ("Operands don't affect result") +Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index f270beebb428..9bb84d83afc1 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1"; + /* EMAC mac_status register */ + #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000) + #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) +-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000) + #define EMAC_MACSTATUS_TXERRCH_SHIFT (16) + #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000) + #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) +-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700) + #define EMAC_MACSTATUS_RXERRCH_SHIFT (8) + + /* EMAC RX register masks */ +-- +2.30.2 + diff --git a/queue-4.19/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch b/queue-4.19/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch new file mode 100644 index 00000000000..7a562376c71 --- /dev/null +++ b/queue-4.19/net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch @@ -0,0 +1,53 @@ +From 1bfc0100f3a0229e286a69034bd2834bdc41451f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 09:06:25 -0700 +Subject: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send + +From: Lv Yunlong + +[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ] + +In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). +If some error happens in emac_tx_fill_tpd(), the skb will be freed via +dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). +But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). + +As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, +thus my patch assigns skb->len to 'len' before the possible free and +use 'len' instead of skb->len later. + +Fixes: b9b17debc69d2 ("net: emac: emac gigabit ethernet controller driver") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +index 031f6e6ee9c1..351a90698010 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +@@ -1449,6 +1449,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, + { + struct emac_tpd tpd; + u32 prod_idx; ++ int len; + + memset(&tpd, 0, sizeof(tpd)); + +@@ -1468,9 +1469,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, + if (skb_network_offset(skb) != ETH_HLEN) + TPD_TYP_SET(&tpd, 1); + ++ len = skb->len; + emac_tx_fill_tpd(adpt, tx_q, skb, &tpd); + +- netdev_sent_queue(adpt->netdev, skb->len); ++ netdev_sent_queue(adpt->netdev, len); + + /* Make sure the are enough free descriptors to hold one + * maximum-sized SKB. We need one desc for each fragment, +-- +2.30.2 + diff --git a/queue-4.19/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch b/queue-4.19/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch new file mode 100644 index 00000000000..ece632e9588 --- /dev/null +++ b/queue-4.19/net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch @@ -0,0 +1,57 @@ +From 12e14480c8145a1ecfcab8fa6ad96d2aa046cae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 00:49:45 +0100 +Subject: net: geneve: modify IP header check in geneve6_xmit_skb and + geneve_xmit_skb + +From: Phillip Potter + +[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ] + +Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb +to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes +two kernel selftest failures introduced by the commit introducing the +checks: +IPv4 over geneve6: PMTU exceptions +IPv4 over geneve6: PMTU exceptions - nexthop objects + +It does this by correctly accounting for the fact that IPv4 packets may +transit over geneve IPv6 tunnels (and vice versa), and still fixes the +uninit-value bug fixed by the original commit. + +Reported-by: kernel test robot +Fixes: 6628ddfec758 ("net: geneve: check skb is large enough for IPv4/IPv6 header") +Suggested-by: Sabrina Dubroca +Signed-off-by: Phillip Potter +Acked-by: Sabrina Dubroca +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index ce6fecf421f8..8c458c8f57a3 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -839,7 +839,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 df; + int err; + +- if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) ++ if (!pskb_inet_may_pull(skb)) + return -EINVAL; + + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); +@@ -885,7 +885,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 sport; + int err; + +- if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) ++ if (!pskb_inet_may_pull(skb)) + return -EINVAL; + + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); +-- +2.30.2 + diff --git a/queue-4.19/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch b/queue-4.19/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch new file mode 100644 index 00000000000..5c917d2e942 --- /dev/null +++ b/queue-4.19/net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch @@ -0,0 +1,44 @@ +From e9e48d8dabeeaadaaf93b2c971cecfc1b699f619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Apr 2021 18:28:25 +0100 +Subject: net: hns3: Limiting the scope of vector_ring_chain variable + +From: Salil Mehta + +[ Upstream commit d392ecd1bc29ae15b0e284d5f732c2d36f244271 ] + +Limiting the scope of the variable vector_ring_chain to the block where it +is used. + +Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC") +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 3eb8b85f6afb..3b89673f09da 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2639,7 +2639,6 @@ static void hns3_add_ring_to_group(struct hns3_enet_ring_group *group, + + static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) + { +- struct hnae3_ring_chain_node vector_ring_chain; + struct hnae3_handle *h = priv->ae_handle; + struct hns3_enet_tqp_vector *tqp_vector; + int ret = 0; +@@ -2669,6 +2668,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) + } + + for (i = 0; i < priv->vector_num; i++) { ++ struct hnae3_ring_chain_node vector_ring_chain; ++ + tqp_vector = &priv->tqp_vector[i]; + + tqp_vector->rx_group.total_bytes = 0; +-- +2.30.2 + diff --git a/queue-4.19/net-lapbether-prevent-racing-when-checking-whether-t.patch b/queue-4.19/net-lapbether-prevent-racing-when-checking-whether-t.patch new file mode 100644 index 00000000000..78c018e2bd7 --- /dev/null +++ b/queue-4.19/net-lapbether-prevent-racing-when-checking-whether-t.patch @@ -0,0 +1,140 @@ +From 1012cfb960afc288ab854290e255202460a20534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 23:23:09 -0800 +Subject: net: lapbether: Prevent racing when checking whether the netif is + running + +From: Xie He + +[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ] + +There are two "netif_running" checks in this driver. One is in +"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make +sure that the LAPB APIs called in these functions are called before +"lapb_unregister" is called by the "ndo_stop" function. + +However, these "netif_running" checks are unreliable, because it's +possible that immediately after "netif_running" returns true, "ndo_stop" +is called (which causes "lapb_unregister" to be called). + +This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can +reliably check and ensure the netif is running while doing their work. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Acked-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index fad5fc8b9edb..3ec922bed2d8 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -56,6 +56,8 @@ struct lapbethdev { + struct list_head node; + struct net_device *ethdev; /* link to ethernet device */ + struct net_device *axdev; /* lapbeth device (lapb#) */ ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static LIST_HEAD(lapbeth_devices); +@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + rcu_read_lock(); + lapbeth = lapbeth_get_x25_dev(dev); + if (!lapbeth) +- goto drop_unlock; +- if (!netif_running(lapbeth->axdev)) ++ goto drop_unlock_rcu; ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop_unlock; + + len = skb->data[0] + skb->data[1] * 256; +@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + goto drop_unlock; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + rcu_read_unlock(); + return 0; + drop_unlock: + kfree_skb(skb); + goto out; ++drop_unlock_rcu: ++ rcu_read_unlock(); + drop: + kfree_skb(skb); + return 0; +@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb) + static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + +- /* +- * Just to be *really* sure not to send anything if the interface +- * is down, the ethernet device may have gone. +- */ +- if (!netif_running(dev)) ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + goto drop; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + return NETDEV_TX_OK; + drop: + kfree_skb(skb); +@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = { + */ + static int lapbeth_open(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + + if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) { +@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev) + return -ENODEV; + } + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = true; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + return 0; + } + + static int lapbeth_close(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = false; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + if ((err = lapb_unregister(dev)) != LAPB_OK) + pr_err("lapb_unregister error: %d\n", err); + +@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev) + dev_hold(dev); + lapbeth->ethdev = dev; + ++ lapbeth->up = false; ++ spin_lock_init(&lapbeth->up_lock); ++ + rc = -EIO; + if (register_netdevice(ndev)) + goto fail; +-- +2.30.2 + diff --git a/queue-4.19/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch b/queue-4.19/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch new file mode 100644 index 00000000000..dd527f3d500 --- /dev/null +++ b/queue-4.19/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch @@ -0,0 +1,41 @@ +From d5aa20d2f0166b54c22c6addf5c05d5d22299ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 09:22:58 -0700 +Subject: net:nfc:digital: Fix a double free in digital_tg_recv_dep_req + +From: Lv Yunlong + +[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ] + +In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). +If nfc_tm_data_received() failed, the callee will free the resp via +kfree_skb() and return error. But in the exit branch, the resp +will be freed again. + +My patch sets resp to NULL if nfc_tm_data_received() failed, to +avoid the double free. + +Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/digital_dep.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c +index 4f9a973988b2..1eed0cf59190 100644 +--- a/net/nfc/digital_dep.c ++++ b/net/nfc/digital_dep.c +@@ -1285,6 +1285,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, + } + + rc = nfc_tm_data_received(ddev->nfc_dev, resp); ++ if (rc) ++ resp = NULL; + + exit: + kfree_skb(ddev->chaining_skb); +-- +2.30.2 + diff --git a/queue-4.19/net-thunderx-fix-unintentional-sign-extension-issue.patch b/queue-4.19/net-thunderx-fix-unintentional-sign-extension-issue.patch new file mode 100644 index 00000000000..1d4a2ffac13 --- /dev/null +++ b/queue-4.19/net-thunderx-fix-unintentional-sign-extension-issue.patch @@ -0,0 +1,42 @@ +From f137237723e57a4c8e581767fd7d2d85170660bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:07:26 +0100 +Subject: net: thunderx: Fix unintentional sign extension issue + +From: Colin Ian King + +[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ] + +The shifting of the u8 integers rq->caching by 26 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that rq->caching is +greater than 0x1f then all then all the upper 32 bits of +the u64 end up as also being set because of the int +sign-extension. Fix this by casting the u8 values to a +u64 before the 26 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +index 9a4cfa61ed93..d9bcbe469ab9 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -779,7 +779,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, + mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG; + mbx.rq.qs_num = qs->vnic_id; + mbx.rq.rq_num = qidx; +- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) | ++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) | + (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | + (rq->cont_qs_rbdr_idx << 8) | + (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); +-- +2.30.2 + diff --git a/queue-4.19/nfc-pn533-prevent-potential-memory-corruption.patch b/queue-4.19/nfc-pn533-prevent-potential-memory-corruption.patch new file mode 100644 index 00000000000..e0720d4ded9 --- /dev/null +++ b/queue-4.19/nfc-pn533-prevent-potential-memory-corruption.patch @@ -0,0 +1,39 @@ +From 4528af432d32205362687b8de9fc1553b7c0093d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 14:44:42 +0300 +Subject: nfc: pn533: prevent potential memory corruption + +From: Dan Carpenter + +[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ] + +If the "type_a->nfcid_len" is too large then it would lead to memory +corruption in pn533_target_found_type_a() when we do: + + memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len); + +Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/pn533/pn533.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index a0cc1cc45292..01da9331f4cb 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -692,6 +692,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a, + if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0) + return false; + ++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE) ++ return false; ++ + return true; + } + +-- +2.30.2 + diff --git a/queue-4.19/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch b/queue-4.19/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch new file mode 100644 index 00000000000..158d04941f4 --- /dev/null +++ b/queue-4.19/nvme-retrigger-ana-log-update-if-group-descriptor-is.patch @@ -0,0 +1,43 @@ +From 055a2b1da9456a8ca332f125a69253144d2892e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 16:29:01 +0100 +Subject: nvme: retrigger ANA log update if group descriptor isn't found + +From: Hannes Reinecke + +[ Upstream commit dd8f7fa908f66dd44abcd83cbb50410524b9f8ef ] + +If ANA is enabled but no ANA group descriptor is found when creating +a new namespace the ANA log is most likely out of date, so trigger +a re-read. The namespace will be tagged with the NS_ANA_PENDING flag +to exclude it from path selection until the ANA log has been re-read. + +Fixes: 32acab3181c7 ("nvme: implement multipath access to nvme subsystems") +Reported-by: Martin George +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 4ef05fe00dac..64f699a1afd7 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -516,6 +516,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id) + if (desc.state) { + /* found the group desc: update */ + nvme_update_ns_ana_state(&desc, ns); ++ } else { ++ /* group desc not found: trigger a re-read */ ++ set_bit(NVME_NS_ANA_PENDING, &ns->flags); ++ queue_work(nvme_wq, &ns->ctrl->ana_work); + } + } else { + mutex_lock(&ns->head->lock); +-- +2.30.2 + diff --git a/queue-4.19/pata_arasan_cf-fix-irq-check.patch b/queue-4.19/pata_arasan_cf-fix-irq-check.patch new file mode 100644 index 00000000000..4ced91f8646 --- /dev/null +++ b/queue-4.19/pata_arasan_cf-fix-irq-check.patch @@ -0,0 +1,56 @@ +From df85c19fa7fd83f20401de67d17deacaac759c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:50:24 +0300 +Subject: pata_arasan_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking code +to pass the positive IRQ #s to ata_host_activate(), propagate upstream +-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors +and IRQ0 (libata treats IRQ #0 as a polling mode anyway)... + +Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller") +Signed-off-by: Sergey Shtylyov +Acked-by: Viresh Kumar +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_arasan_cf.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index ebecab8c3f36..7c1c399450f3 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -817,12 +817,19 @@ static int arasan_cf_probe(struct platform_device *pdev) + else + quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */ + +- /* if irq is 0, support only PIO */ +- acdev->irq = platform_get_irq(pdev, 0); +- if (acdev->irq) ++ /* ++ * If there's an error getting IRQ (or we do get IRQ0), ++ * support only PIO ++ */ ++ ret = platform_get_irq(pdev, 0); ++ if (ret > 0) { ++ acdev->irq = ret; + irq_handler = arasan_cf_interrupt; +- else ++ } else if (ret == -EPROBE_DEFER) { ++ return ret; ++ } else { + quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA; ++ } + + acdev->pbase = res->start; + acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start, +-- +2.30.2 + diff --git a/queue-4.19/pata_ipx4xx_cf-fix-irq-check.patch b/queue-4.19/pata_ipx4xx_cf-fix-irq-check.patch new file mode 100644 index 00000000000..48eb3ce0c53 --- /dev/null +++ b/queue-4.19/pata_ipx4xx_cf-fix-irq-check.patch @@ -0,0 +1,45 @@ +From 504e296861c963ce552f626d07241fc49f6a2af8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:51:10 +0300 +Subject: pata_ipx4xx_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking +code to pass the positive IRQ #s to ata_host_activate(), propagate errors +upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code +treats 0 as an indication that polling should be used anyway... + +Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ixp4xx_cf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c +index 0b0d93065f5a..867621f8c387 100644 +--- a/drivers/ata/pata_ixp4xx_cf.c ++++ b/drivers/ata/pata_ixp4xx_cf.c +@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev) + return -ENOMEM; + + irq = platform_get_irq(pdev, 0); +- if (irq) ++ if (irq > 0) + irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING); ++ else if (irq < 0) ++ return irq; ++ else ++ return -EINVAL; + + /* Setup expansion bus chip selects */ + *data->cs0_cfg = data->cs0_bits; +-- +2.30.2 + diff --git a/queue-4.19/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch b/queue-4.19/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch new file mode 100644 index 00000000000..732f06d0c5f --- /dev/null +++ b/queue-4.19/perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch @@ -0,0 +1,44 @@ +From b08a4e5c70f6ca5315765fa9afbc43fe985a190f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 11:17:51 -0300 +Subject: perf symbols: Fix dso__fprintf_symbols_by_name() to return the number + of printed chars + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 210e4c89ef61432040c6cd828fefa441f4887186 ] + +The 'ret' variable was initialized to zero but then it was not updated +from the fprintf() return, fix it. + +Reported-by: Yang Li +cc: Alexander Shishkin +cc: Ingo Molnar +cc: Jiri Olsa +cc: Mark Rutland +cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Srikar Dronamraju +Fixes: 90f18e63fbd00513 ("perf symbols: List symbols in a dso in ascending name order") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol_fprintf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c +index ed0205cc7942..1fd175bb4600 100644 +--- a/tools/perf/util/symbol_fprintf.c ++++ b/tools/perf/util/symbol_fprintf.c +@@ -66,7 +66,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso, + + for (nd = rb_first(&dso->symbol_names); nd; nd = rb_next(nd)) { + pos = rb_entry(nd, struct symbol_name_rb_node, rb_node); +- fprintf(fp, "%s\n", pos->sym.name); ++ ret += fprintf(fp, "%s\n", pos->sym.name); + } + + return ret; +-- +2.30.2 + diff --git a/queue-4.19/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch b/queue-4.19/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch new file mode 100644 index 00000000000..51f63b13156 --- /dev/null +++ b/queue-4.19/phy-marvell-armada375_usbcluster_phy-should-not-defa.patch @@ -0,0 +1,41 @@ +From 752012319c246f166ff01565257ee04548f9b954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 16:02:52 +0100 +Subject: phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, + unconditionally + +From: Geert Uytterhoeven + +[ Upstream commit 6cb17707aad869de163d7bf42c253caf501be4e2 ] + +Merely enabling CONFIG_COMPILE_TEST should not enable additional code. +To fix this, restrict the automatic enabling of ARMADA375_USBCLUSTER_PHY +to MACH_ARMADA_375, and ask the user in case of compile-testing. + +Fixes: eee47538ec1f2619 ("phy: add support for USB cluster on the Armada 375 SoC") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20210208150252.424706-1-geert+renesas@glider.be +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/marvell/Kconfig b/drivers/phy/marvell/Kconfig +index 68e321225400..ed4d3904e53f 100644 +--- a/drivers/phy/marvell/Kconfig ++++ b/drivers/phy/marvell/Kconfig +@@ -2,8 +2,8 @@ + # Phy drivers for Marvell platforms + # + config ARMADA375_USBCLUSTER_PHY +- def_bool y +- depends on MACH_ARMADA_375 || COMPILE_TEST ++ bool "Armada 375 USB cluster PHY support" if COMPILE_TEST ++ default y if MACH_ARMADA_375 + depends on OF && HAS_IOMEM + select GENERIC_PHY + +-- +2.30.2 + diff --git a/queue-4.19/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch b/queue-4.19/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch new file mode 100644 index 00000000000..d35033ae3c8 --- /dev/null +++ b/queue-4.19/platform-x86-pmc_atom-match-all-beckhoff-automation-.patch @@ -0,0 +1,74 @@ +From 28498ed5e1f7f833dbf09645cafe83e671fafbde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 15:30:06 +0200 +Subject: platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards + with critclk_systems DMI table + +From: Steffen Dirkwinkel + +[ Upstream commit d21e5abd3a005253eb033090aab2e43bce090d89 ] + +pmc_plt_clk* clocks are used for ethernet controllers, so need to stay +turned on. This adds the affected board family to critclk_systems DMI +table, so the clocks are marked as CLK_CRITICAL and not turned off. + +This replaces the previously listed boards with a match for the whole +device family CBxx63. CBxx63 matches only baytrail devices. +There are new affected boards that would otherwise need to be listed. +There are unaffected boards in the family, but having the clocks +turned on is not an issue. + +Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") +Reviewed-by: Andy Shevchenko +Signed-off-by: Steffen Dirkwinkel +Link: https://lore.kernel.org/r/20210412133006.397679-1-linux-kernel-dev@beckhoff.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/pmc_atom.c | 28 ++-------------------------- + 1 file changed, 2 insertions(+), 26 deletions(-) + +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index 26351e9e0aaf..682fc49d172c 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -423,34 +423,10 @@ static const struct dmi_system_id critclk_systems[] = { + }, + { + /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB3163", ++ .ident = "Beckhoff Baytrail", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB3163"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB4063", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB4063"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB6263", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB6263"), +- }, +- }, +- { +- /* pmc_plt_clk* - are used for ethernet controllers */ +- .ident = "Beckhoff CB6363", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"), +- DMI_MATCH(DMI_BOARD_NAME, "CB6363"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"), + }, + }, + { +-- +2.30.2 + diff --git a/queue-4.19/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch b/queue-4.19/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch new file mode 100644 index 00000000000..fe41180da54 --- /dev/null +++ b/queue-4.19/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch @@ -0,0 +1,47 @@ +From 57451b7180d4aeaa75e228f0f39bde6184ad5e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 17:24:03 +0000 +Subject: powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of + 'add') + +From: Christophe Leroy + +[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ] + + AS arch/powerpc/platforms/52xx/lite5200_sleep.o +arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages: +arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression + +In the following code, 'addi' is wrong, has to be 'add' + + /* local udelay in sram is needed */ + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ + addi r12, r13, r12 /* end */ + +Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S +index 3a9969c429b3..054f927bfef9 100644 +--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S ++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S +@@ -181,7 +181,7 @@ sram_code: + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ +- addi r12, r13, r12 /* end */ ++ add r12, r13, r12 /* end */ + 1: + mftb r13 /* current */ + cmp cr0, r13, r12 +-- +2.30.2 + diff --git a/queue-4.19/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch b/queue-4.19/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch new file mode 100644 index 00000000000..2b1d28f5796 --- /dev/null +++ b/queue-4.19/powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch @@ -0,0 +1,148 @@ +From e71a8f4c3833d4cd965f07ffc9d40e80c321e555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Feb 2021 14:29:56 +1100 +Subject: powerpc/64s: Fix pte update for kernel memory on radix + +From: Jordan Niethe + +[ Upstream commit b8b2f37cf632434456182e9002d63cbc4cccc50c ] + +When adding a PTE a ptesync is needed to order the update of the PTE +with subsequent accesses otherwise a spurious fault may be raised. + +radix__set_pte_at() does not do this for performance gains. For +non-kernel memory this is not an issue as any faults of this kind are +corrected by the page fault handler. For kernel memory these faults +are not handled. The current solution is that there is a ptesync in +flush_cache_vmap() which should be called when mapping from the +vmalloc region. + +However, map_kernel_page() does not call flush_cache_vmap(). This is +troublesome in particular for code patching with Strict RWX on radix. +In do_patch_instruction() the page frame that contains the instruction +to be patched is mapped and then immediately patched. With no ordering +or synchronization between setting up the PTE and writing to the page +it is possible for faults. + +As the code patching is done using __put_user_asm_goto() the resulting +fault is obscured - but using a normal store instead it can be seen: + + BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c + Faulting instruction address: 0xc00000000008bd74 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV + Modules linked in: nop_module(PO+) [last unloaded: nop_module] + CPU: 4 PID: 757 Comm: sh Tainted: P O 5.10.0-rc5-01361-ge3c1b78c8440-dirty #43 + NIP: c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810 + REGS: c000000016f634a0 TRAP: 0300 Tainted: P O (5.10.0-rc5-01361-ge3c1b78c8440-dirty) + MSR: 9000000000009033 CR: 44002884 XER: 00000000 + CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1 + +This results in the kind of issue reported here: + https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/ + +Chris Riedl suggested a reliable way to reproduce the issue: + $ mount -t debugfs none /sys/kernel/debug + $ (while true; do echo function > /sys/kernel/debug/tracing/current_tracer ; echo nop > /sys/kernel/debug/tracing/current_tracer ; done) & + +Turning ftrace on and off does a large amount of code patching which +in usually less then 5min will crash giving a trace like: + + ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000) + ------------[ ftrace bug ]------------ + ftrace failed to modify + [] napi_busy_loop+0xc/0x390 + actual: 11:3b:47:4b + Setting ftrace call site to call ftrace function + ftrace record flags: 80000001 + (1) + expected tramp: c00000000006c96c + ------------[ cut here ]------------ + WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8 + Modules linked in: nop_module(PO-) [last unloaded: nop_module] + CPU: 4 PID: 809 Comm: sh Tainted: P O 5.10.0-rc5-01360-gf878ccaf250a #1 + NIP: c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0 + REGS: c000000004c8b760 TRAP: 0700 Tainted: P O (5.10.0-rc5-01360-gf878ccaf250a) + MSR: 900000000282b033 CR: 28008848 XER: 20040000 + CFAR: c0000000001a9c98 IRQMASK: 0 + GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022 + GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8 + GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118 + GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000 + GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008 + GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8 + GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020 + GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0 + NIP ftrace_bug+0x28c/0x2e8 + LR ftrace_bug+0x288/0x2e8 + Call Trace: + ftrace_bug+0x288/0x2e8 (unreliable) + ftrace_modify_all_code+0x168/0x210 + arch_ftrace_update_code+0x18/0x30 + ftrace_run_update_code+0x44/0xc0 + ftrace_startup+0xf8/0x1c0 + register_ftrace_function+0x4c/0xc0 + function_trace_init+0x80/0xb0 + tracing_set_tracer+0x2a4/0x4f0 + tracing_set_trace_write+0xd4/0x130 + vfs_write+0xf0/0x330 + ksys_write+0x84/0x140 + system_call_exception+0x14c/0x230 + system_call_common+0xf0/0x27c + +To fix this when updating kernel memory PTEs using ptesync. + +Fixes: f1cb8f9beba8 ("powerpc/64s/radix: avoid ptesync after set_pte and ptep_set_access_flags") +Signed-off-by: Jordan Niethe +Reviewed-by: Nicholas Piggin +[mpe: Tidy up change log slightly] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210208032957.1232102-1-jniethe5@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/radix.h | 6 ++++-- + arch/powerpc/mm/pgtable-radix.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h +index da01badef0cb..04b2bffbc5c9 100644 +--- a/arch/powerpc/include/asm/book3s/64/radix.h ++++ b/arch/powerpc/include/asm/book3s/64/radix.h +@@ -204,8 +204,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr, + * from ptesync, it should probably go into update_mmu_cache, rather + * than set_pte_at (which is used to set ptes unrelated to faults). + * +- * Spurious faults to vmalloc region are not tolerated, so there is +- * a ptesync in flush_cache_vmap. ++ * Spurious faults from the kernel memory are not tolerated, so there ++ * is a ptesync in flush_cache_vmap, and __map_kernel_page() follows ++ * the pte update sequence from ISA Book III 6.10 Translation Table ++ * Update Synchronization Requirements. + */ + } + +diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c +index 5404a631d583..9ee235fca427 100644 +--- a/arch/powerpc/mm/pgtable-radix.c ++++ b/arch/powerpc/mm/pgtable-radix.c +@@ -115,7 +115,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa, + + set_the_pte: + set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags)); +- smp_wmb(); ++ asm volatile("ptesync": : :"memory"); + return 0; + } + +@@ -169,7 +169,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa, + + set_the_pte: + set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags)); +- smp_wmb(); ++ asm volatile("ptesync": : :"memory"); + return 0; + } + +-- +2.30.2 + diff --git a/queue-4.19/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch b/queue-4.19/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch new file mode 100644 index 00000000000..918e3d2b582 --- /dev/null +++ b/queue-4.19/powerpc-fix-have_hardlockup_detector_arch-build-conf.patch @@ -0,0 +1,54 @@ +From 11a087c5554a9f714ab7469b2a9e503b7f6b2aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 09:49:00 +0000 +Subject: powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen Huang + +[ Upstream commit 4fe529449d85e78972fa327999961ecc83a0b6db ] + +When compiling the powerpc with the SMP disabled, it shows the issue: + +arch/powerpc/kernel/watchdog.c: In function ‘watchdog_smp_panic’: +arch/powerpc/kernel/watchdog.c:177:4: error: implicit declaration of function ‘smp_send_nmi_ipi’; did you mean ‘smp_send_stop’? [-Werror=implicit-function-declaration] + 177 | smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000); + | ^~~~~~~~~~~~~~~~ + | smp_send_stop +cc1: all warnings being treated as errors +make[2]: *** [scripts/Makefile.build:273: arch/powerpc/kernel/watchdog.o] Error 1 +make[1]: *** [scripts/Makefile.build:534: arch/powerpc/kernel] Error 2 +make: *** [Makefile:1980: arch/powerpc] Error 2 +make: *** Waiting for unfinished jobs.... + +We found that powerpc used ipi to implement hardlockup watchdog, so the +HAVE_HARDLOCKUP_DETECTOR_ARCH should depend on the SMP. + +Fixes: 2104180a5369 ("powerpc/64s: implement arch-specific hardlockup watchdog") +Reported-by: Hulk Robot +Signed-off-by: Chen Huang +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210327094900.938555-1-chenhuang5@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 6dd2a14e1ebc..f0e09d5f0bed 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -208,7 +208,7 @@ config PPC + select HAVE_MEMBLOCK_NODE_MAP + select HAVE_MOD_ARCH_SPECIFIC + select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S) +- select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S) ++ select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP + select HAVE_OPROFILE + select HAVE_OPTPROBES if PPC64 + select HAVE_PERF_EVENTS +-- +2.30.2 + diff --git a/queue-4.19/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch b/queue-4.19/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch new file mode 100644 index 00000000000..caeb7d13bac --- /dev/null +++ b/queue-4.19/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch @@ -0,0 +1,44 @@ +From 772f9b77df2d2294d78047a3e187b40d7f83f98b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 12:26:23 -0700 +Subject: powerpc: iommu: fix build when neither PCI or IBMVIO is set + +From: Randy Dunlap + +[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ] + +When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a +build error. The fault injection code is not useful in that kernel config, +so make the FAIL_IOMMU option depend on PCI || IBMVIO. + +Prevents this build error (warning escalated to error): +../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable] + 178 | static struct notifier_block fail_iommu_bus_notifier = { + +Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection") +Reported-by: kernel test robot +Suggested-by: Michael Ellerman +Signed-off-by: Randy Dunlap +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index fd63cd914a74..ffe0cf0f0bea 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -350,6 +350,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR + config FAIL_IOMMU + bool "Fault-injection capability for IOMMU" + depends on FAULT_INJECTION ++ depends on PCI || IBMVIO + help + Provide fault-injection capability for IOMMU. Each device can + be selectively enabled via the fail_iommu property. +-- +2.30.2 + diff --git a/queue-4.19/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch b/queue-4.19/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch new file mode 100644 index 00000000000..54deb13b97b --- /dev/null +++ b/queue-4.19/powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch @@ -0,0 +1,66 @@ +From 1aa6f6040c4e6f9c404ca3bd0bc2a3aef367eecc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 12:16:01 -0400 +Subject: powerpc/perf: Fix PMU constraint check for EBB events + +From: Athira Rajeev + +[ Upstream commit 10f8f96179ecc7f69c927f6d231f6d02736cea83 ] + +The power PMU group constraints includes check for EBB events to make +sure all events in a group must agree on EBB. This will prevent +scheduling EBB and non-EBB events together. But in the existing check, +settings for constraint mask and value is interchanged. Patch fixes the +same. + +Before the patch, PMU selftest "cpu_event_pinned_vs_ebb_test" fails with +below in dmesg logs. This happens because EBB event gets enabled along +with a non-EBB cpu event. + + [35600.453346] cpu_event_pinne[41326]: illegal instruction (4) + at 10004a18 nip 10004a18 lr 100049f8 code 1 in + cpu_event_pinned_vs_ebb_test[10000000+10000] + +Test results after the patch: + + $ ./pmu/ebb/cpu_event_pinned_vs_ebb_test + test: cpu_event_pinned_vs_ebb + tags: git_version:v5.12-rc5-93-gf28c3125acd3-dirty + Binding to cpu 8 + EBB Handler is at 0x100050c8 + read error on event 0x7fffe6bd4040! + PM_RUN_INST_CMPL: result 9872 running/enabled 37930432 + success: cpu_event_pinned_vs_ebb + +This bug was hidden by other logic until commit 1908dc911792 (perf: +Tweak perf_event_attr::exclusive semantics). + +Fixes: 4df489991182 ("powerpc/perf: Add power8 EBB support") +Reported-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Athira Rajeev +[mpe: Mention commit 1908dc911792] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1617725761-1464-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/isa207-common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 69a2dc2b16cf..a1ff4142cc6a 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -359,8 +359,8 @@ ebb_bhrb: + * EBB events are pinned & exclusive, so this should never actually + * hit, but we leave it as a fallback in case. + */ +- mask |= CNST_EBB_VAL(ebb); +- value |= CNST_EBB_MASK; ++ mask |= CNST_EBB_MASK; ++ value |= CNST_EBB_VAL(ebb); + + *maskp = mask; + *valp = value; +-- +2.30.2 + diff --git a/queue-4.19/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch b/queue-4.19/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch new file mode 100644 index 00000000000..18ade02d38a --- /dev/null +++ b/queue-4.19/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch @@ -0,0 +1,60 @@ +From cbc41a99e551d4c68e9a19993342934fc2aeef45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 13:08:29 -0700 +Subject: powerpc/prom: Mark identical_pvr_fixup as __init + +From: Nathan Chancellor + +[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ] + +If identical_pvr_fixup() is not inlined, there are two modpost warnings: + +WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:of_get_flat_dt_prop() +The function identical_pvr_fixup() references +the function __init of_get_flat_dt_prop(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of of_get_flat_dt_prop is wrong. + +WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:identify_cpu() +The function identical_pvr_fixup() references +the function __init identify_cpu(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of identify_cpu is wrong. + +identical_pvr_fixup() calls two functions marked as __init and is only +called by a function marked as __init so it should be marked as __init +as well. At the same time, remove the inline keywork as it is not +necessary to inline this function. The compiler is still free to do so +if it feels it is worthwhile since commit 889b3c1245de ("compiler: +remove CONFIG_OPTIMIZE_INLINING entirely"). + +Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround") +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://github.com/ClangBuiltLinux/linux/issues/1316 +Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index fd04692412db..f8c49e5d4bd3 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -266,7 +266,7 @@ static struct feature_property { + }; + + #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU) +-static inline void identical_pvr_fixup(unsigned long node) ++static __init void identical_pvr_fixup(unsigned long node) + { + unsigned int pvr; + const char *model = of_get_flat_dt_prop(node, "model", NULL); +-- +2.30.2 + diff --git a/queue-4.19/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch b/queue-4.19/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch new file mode 100644 index 00000000000..79c40b3beb0 --- /dev/null +++ b/queue-4.19/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch @@ -0,0 +1,51 @@ +From 242eb5d40673d440630ccfd42374adc78fc7901c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 12:24:35 -0600 +Subject: powerpc/pseries: extract host bridge from pci_bus prior to bus + removal + +From: Tyrel Datwyler + +[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ] + +The pci_bus->bridge reference may no longer be valid after +pci_bus_remove() resulting in passing a bad value to device_unregister() +for the associated bridge device. + +Store the host_bridge reference in a separate variable prior to +pci_bus_remove(). + +Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal") +Signed-off-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c +index 561917fa54a8..afca4b737e80 100644 +--- a/arch/powerpc/platforms/pseries/pci_dlpar.c ++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c +@@ -66,6 +66,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic); + int remove_phb_dynamic(struct pci_controller *phb) + { + struct pci_bus *b = phb->bus; ++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge); + struct resource *res; + int rc, i; + +@@ -92,7 +93,8 @@ int remove_phb_dynamic(struct pci_controller *phb) + /* Remove the PCI bus and unregister the bridge device from sysfs */ + phb->bus = NULL; + pci_remove_bus(b); +- device_unregister(b->bridge); ++ host_bridge->bus = NULL; ++ device_unregister(&host_bridge->dev); + + /* Now release the IO resource */ + if (res->flags & IORESOURCE_IO) +-- +2.30.2 + diff --git a/queue-4.19/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch b/queue-4.19/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch new file mode 100644 index 00000000000..fa7c6150037 --- /dev/null +++ b/queue-4.19/rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch @@ -0,0 +1,45 @@ +From 0b7336db96e3a2440e16be246e8fb868f43ef98c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 07:06:14 -0700 +Subject: RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res + +From: Lv Yunlong + +[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ] + +In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside +bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via +pci_iounmap() in unmap_io error branch. After the callee returns err code, +bnxt_qplib_alloc_res calls +bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then +dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap(). + +My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by +pci_iounmap() in the first time, to avoid the double free. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Lv Yunlong +Reviewed-by: Leon Romanovsky +Acked-by: Devesh Sharma +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c +index 539a5d44e6db..655952a6c0e6 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -725,6 +725,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res, + + unmap_io: + pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem); ++ dpit->dbr_bar_reg_iomem = NULL; + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-4.19/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch b/queue-4.19/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch new file mode 100644 index 00000000000..fea8a5825e6 --- /dev/null +++ b/queue-4.19/rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch @@ -0,0 +1,58 @@ +From 0b536d68c189d9dc55255d801c61af17284d0a36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 19:21:04 -0500 +Subject: RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails + +From: Sindhu Devale + +[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ] + +When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk +entry in the PBLE info list. + +Fix it by adding the chunk entry to the PBLE info list only after +successful addition of SD in i40iw_hmc_sd_one. + +This fixes a static checker warning reported here: + https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/ + +Fixes: 9715830157be ("i40iw: add pble resource files") +Link: https://lore.kernel.org/r/20210416002104.323-1-shiraz.saleem@intel.com +Reported-by: Dan Carpenter +Signed-off-by: Sindhu Devale +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c +index 540aab5e502d..3fafc5424e76 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c +@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n", + pble_rsrc->next_fpm_addr, chunk->size, chunk->size); + pble_rsrc->unallocated_pble -= (chunk->size >> 3); +- list_add(&chunk->list, &pble_rsrc->pinfo.clist); + sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ? + sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; +- if (sd_entry->valid) +- return 0; +- if (dev->is_pf) { ++ if (dev->is_pf && !sd_entry->valid) { + ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id, + sd_reg_val, idx->sd_idx, + sd_entry->entry_type, true); +@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + } + + sd_entry->valid = true; ++ list_add(&chunk->list, &pble_rsrc->pinfo.clist); + return 0; + error: + kfree(chunk); +-- +2.30.2 + diff --git a/queue-4.19/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch b/queue-4.19/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch new file mode 100644 index 00000000000..8a6da293673 --- /dev/null +++ b/queue-4.19/rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch @@ -0,0 +1,38 @@ +From 41e3a88824857a8ddda49df246b32bb9baed3086 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 11:31:32 +0000 +Subject: RDMA/srpt: Fix error return code in srpt_cm_req_recv() + +From: Wang Wensheng + +[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: db7683d7deb2 ("IB/srpt: Fix login-related race conditions") +Link: https://lore.kernel.org/r/20210408113132.87250-1-wangwensheng4@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Wang Wensheng +Reviewed-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index bc979a85a505..6090f1ce0c56 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2301,6 +2301,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev, + pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n", + sdev->device->name, port_num); + mutex_unlock(&sport->mutex); ++ ret = -EINVAL; + goto reject; + } + +-- +2.30.2 + diff --git a/queue-4.19/regmap-set-debugfs_name-to-null-after-it-is-freed.patch b/queue-4.19/regmap-set-debugfs_name-to-null-after-it-is-freed.patch new file mode 100644 index 00000000000..5e82469625b --- /dev/null +++ b/queue-4.19/regmap-set-debugfs_name-to-null-after-it-is-freed.patch @@ -0,0 +1,45 @@ +From 4fa40ed1c6d58ea8a12de6c1f5358ce1da95b352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 10:17:37 +0800 +Subject: regmap: set debugfs_name to NULL after it is freed + +From: Meng Li + +[ Upstream commit e41a962f82e7afb5b1ee644f48ad0b3aee656268 ] + +There is a upstream commit cffa4b2122f5("regmap:debugfs: +Fix a memory leak when calling regmap_attach_dev") that +adds a if condition when create name for debugfs_name. +With below function invoking logical, debugfs_name is +freed in regmap_debugfs_exit(), but it is not created again +because of the if condition introduced by above commit. +regmap_reinit_cache() + regmap_debugfs_exit() + ... + regmap_debugfs_init() +So, set debugfs_name to NULL after it is freed. + +Fixes: cffa4b2122f5 ("regmap: debugfs: Fix a memory leak when calling regmap_attach_dev") +Signed-off-by: Meng Li +Link: https://lore.kernel.org/r/20210226021737.7690-1-Meng.Li@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index c9e5381a887b..de706734b921 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -665,6 +665,7 @@ void regmap_debugfs_exit(struct regmap *map) + regmap_debugfs_free_dump_cache(map); + mutex_unlock(&map->cache_lock); + kfree(map->debugfs_name); ++ map->debugfs_name = NULL; + } else { + struct regmap_debugfs_node *node, *tmp; + +-- +2.30.2 + diff --git a/queue-4.19/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch b/queue-4.19/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch new file mode 100644 index 00000000000..459140f6e16 --- /dev/null +++ b/queue-4.19/rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch @@ -0,0 +1,830 @@ +From 466cae6f8c7ea4df0eb721da30c4fa152bc13413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 13:26:07 +0800 +Subject: rtlwifi: 8821ae: upgrade PHY and RF parameters + +From: Ping-Ke Shih + +[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ] + +The signal strength of 5G is quite low, so user can't connect to an AP far +away. New parameters with new format and its parser are updated by the commit +84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but +some parameters are missing. Use this commit to update to the novel parameters +that use new format. + +Fixes: 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser") +Signed-off-by: Ping-Ke Shih +Tested-by: Kai-Heng Feng +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210219052607.7323-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- + 1 file changed, 370 insertions(+), 130 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +index f87f9d03b9fa..ac44fd5d0597 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +@@ -272,7 +272,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = { + 0x824, 0x00030FE0, + 0x828, 0x00000000, + 0x82C, 0x002081DD, +- 0x830, 0x2AAA8E24, ++ 0x830, 0x2AAAEEC8, + 0x834, 0x0037A706, + 0x838, 0x06489B44, + 0x83C, 0x0000095B, +@@ -347,10 +347,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = { + 0x9D8, 0x00000000, + 0x9DC, 0x00000000, + 0x9E0, 0x00005D00, +- 0x9E4, 0x00000002, ++ 0x9E4, 0x00000003, + 0x9E8, 0x00000001, + 0xA00, 0x00D047C8, +- 0xA04, 0x01FF000C, ++ 0xA04, 0x01FF800C, + 0xA08, 0x8C8A8300, + 0xA0C, 0x2E68000F, + 0xA10, 0x9500BB78, +@@ -1343,7 +1343,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x083, 0x00021800, + 0x084, 0x00028000, + 0x085, 0x00048000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x086, 0x0009483A, ++ 0xA0000000, 0x00000000, + 0x086, 0x00094838, ++ 0xB0000000, 0x00000000, + 0x087, 0x00044980, + 0x088, 0x00048000, + 0x089, 0x0000D480, +@@ -1432,36 +1436,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x03C, 0x000CA000, + 0x0EF, 0x00000000, + 0x0EF, 0x00001100, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF3, + 0x034, 0x00049DF0, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF3, + 0x034, 0x00049DF0, +- 0xFF0F0404, 0xCDEF, +- 0x034, 0x0004ADF3, +- 0x034, 0x00049DF0, +- 0xFF0F0200, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004ADF5, + 0x034, 0x00049DF2, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004A0F3, ++ 0x034, 0x000490B1, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0004A0F3, + 0x034, 0x000490B1, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004ADF5, ++ 0x034, 0x00049DF2, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0004ADF3, ++ 0x034, 0x00049DF0, ++ 0xA0000000, 0x00000000, + 0x034, 0x0004ADF7, + 0x034, 0x00049DF3, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00048DED, +- 0x034, 0x00047DEA, +- 0x034, 0x00046DE7, +- 0x034, 0x00045CE9, +- 0x034, 0x00044CE6, +- 0x034, 0x000438C6, +- 0x034, 0x00042886, +- 0x034, 0x00041486, +- 0x034, 0x00040447, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00048DED, + 0x034, 0x00047DEA, + 0x034, 0x00046DE7, +@@ -1471,7 +1471,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042886, + 0x034, 0x00041486, + 0x034, 0x00040447, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00048DED, + 0x034, 0x00047DEA, + 0x034, 0x00046DE7, +@@ -1481,7 +1481,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042886, + 0x034, 0x00041486, + 0x034, 0x00040447, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000480AE, ++ 0x034, 0x000470AB, ++ 0x034, 0x0004608B, ++ 0x034, 0x00045069, ++ 0x034, 0x00044048, ++ 0x034, 0x00043045, ++ 0x034, 0x00042026, ++ 0x034, 0x00041023, ++ 0x034, 0x00040002, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000480AE, + 0x034, 0x000470AB, + 0x034, 0x0004608B, +@@ -1491,7 +1501,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00042026, + 0x034, 0x00041023, + 0x034, 0x00040002, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00048DED, ++ 0x034, 0x00047DEA, ++ 0x034, 0x00046DE7, ++ 0x034, 0x00045CE9, ++ 0x034, 0x00044CE6, ++ 0x034, 0x000438C6, ++ 0x034, 0x00042886, ++ 0x034, 0x00041486, ++ 0x034, 0x00040447, ++ 0xA0000000, 0x00000000, + 0x034, 0x00048DEF, + 0x034, 0x00047DEC, + 0x034, 0x00046DE9, +@@ -1501,38 +1521,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x0004248A, + 0x034, 0x0004108D, + 0x034, 0x0004008A, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0200, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0002ADF4, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0002A0F3, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0002A0F3, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0002ADF4, ++ 0xA0000000, 0x00000000, + 0x034, 0x0002ADF7, +- 0xFF0F0200, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00029DF4, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF4, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF4, +- 0xFF0F0200, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00029DF1, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000290F0, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000290F0, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00029DF1, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00029DF4, ++ 0xA0000000, 0x00000000, + 0x034, 0x00029DF2, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00028DF1, +- 0x034, 0x00027DEE, +- 0x034, 0x00026DEB, +- 0x034, 0x00025CEC, +- 0x034, 0x00024CE9, +- 0x034, 0x000238CA, +- 0x034, 0x00022889, +- 0x034, 0x00021489, +- 0x034, 0x0002044A, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00028DF1, + 0x034, 0x00027DEE, + 0x034, 0x00026DEB, +@@ -1542,7 +1560,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022889, + 0x034, 0x00021489, + 0x034, 0x0002044A, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00028DF1, + 0x034, 0x00027DEE, + 0x034, 0x00026DEB, +@@ -1552,7 +1570,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022889, + 0x034, 0x00021489, + 0x034, 0x0002044A, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x000280AF, + 0x034, 0x000270AC, + 0x034, 0x0002608B, +@@ -1562,7 +1580,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022026, + 0x034, 0x00021023, + 0x034, 0x00020002, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x000280AF, ++ 0x034, 0x000270AC, ++ 0x034, 0x0002608B, ++ 0x034, 0x00025069, ++ 0x034, 0x00024048, ++ 0x034, 0x00023045, ++ 0x034, 0x00022026, ++ 0x034, 0x00021023, ++ 0x034, 0x00020002, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00028DF1, ++ 0x034, 0x00027DEE, ++ 0x034, 0x00026DEB, ++ 0x034, 0x00025CEC, ++ 0x034, 0x00024CE9, ++ 0x034, 0x000238CA, ++ 0x034, 0x00022889, ++ 0x034, 0x00021489, ++ 0x034, 0x0002044A, ++ 0xA0000000, 0x00000000, + 0x034, 0x00028DEE, + 0x034, 0x00027DEB, + 0x034, 0x00026CCD, +@@ -1572,27 +1610,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00022849, + 0x034, 0x00021449, + 0x034, 0x0002004D, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F02C0, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0000A0D7, ++ 0x034, 0x000090D3, ++ 0x034, 0x000080B1, ++ 0x034, 0x000070AE, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0000A0D7, + 0x034, 0x000090D3, + 0x034, 0x000080B1, + 0x034, 0x000070AE, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x034, 0x0000ADF7, + 0x034, 0x00009DF4, + 0x034, 0x00008DF1, + 0x034, 0x00007DEE, +- 0xFF0F02C0, 0xDEAD, +- 0xFF0F0104, 0xABCD, +- 0x034, 0x00006DEB, +- 0x034, 0x00005CEC, +- 0x034, 0x00004CE9, +- 0x034, 0x000038CA, +- 0x034, 0x00002889, +- 0x034, 0x00001489, +- 0x034, 0x0000044A, +- 0xFF0F0204, 0xCDEF, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00006DEB, + 0x034, 0x00005CEC, + 0x034, 0x00004CE9, +@@ -1600,7 +1635,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002889, + 0x034, 0x00001489, + 0x034, 0x0000044A, +- 0xFF0F0404, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x00006DEB, + 0x034, 0x00005CEC, + 0x034, 0x00004CE9, +@@ -1608,7 +1643,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002889, + 0x034, 0x00001489, + 0x034, 0x0000044A, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x034, 0x0000608D, + 0x034, 0x0000506B, + 0x034, 0x0000404A, +@@ -1616,7 +1651,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002044, + 0x034, 0x00001025, + 0x034, 0x00000004, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x0000608D, ++ 0x034, 0x0000506B, ++ 0x034, 0x0000404A, ++ 0x034, 0x00003047, ++ 0x034, 0x00002044, ++ 0x034, 0x00001025, ++ 0x034, 0x00000004, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x034, 0x00006DEB, ++ 0x034, 0x00005CEC, ++ 0x034, 0x00004CE9, ++ 0x034, 0x000038CA, ++ 0x034, 0x00002889, ++ 0x034, 0x00001489, ++ 0x034, 0x0000044A, ++ 0xA0000000, 0x00000000, + 0x034, 0x00006DCD, + 0x034, 0x00005CCD, + 0x034, 0x00004CCA, +@@ -1624,11 +1675,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x034, 0x00002888, + 0x034, 0x00001488, + 0x034, 0x00000486, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000040, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1638,7 +1689,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1648,7 +1699,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000128, ++ 0x035, 0x00008128, ++ 0x035, 0x00010128, ++ 0x035, 0x000201C8, ++ 0x035, 0x000281C8, ++ 0x035, 0x000301C8, ++ 0x035, 0x000401C8, ++ 0x035, 0x000481C8, ++ 0x035, 0x000501C8, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000145, ++ 0x035, 0x00008145, ++ 0x035, 0x00010145, ++ 0x035, 0x00020196, ++ 0x035, 0x00028196, ++ 0x035, 0x00030196, ++ 0x035, 0x000401C7, ++ 0x035, 0x000481C7, ++ 0x035, 0x000501C7, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x035, 0x00000128, ++ 0x035, 0x00008128, ++ 0x035, 0x00010128, ++ 0x035, 0x000201C8, ++ 0x035, 0x000281C8, ++ 0x035, 0x000301C8, ++ 0x035, 0x000401C8, ++ 0x035, 0x000481C8, ++ 0x035, 0x000501C8, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x035, 0x00000187, + 0x035, 0x00008187, + 0x035, 0x00010187, +@@ -1658,7 +1739,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x00040188, + 0x035, 0x00048188, + 0x035, 0x00050188, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x035, 0x00000145, + 0x035, 0x00008145, + 0x035, 0x00010145, +@@ -1668,11 +1749,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x035, 0x000401C7, + 0x035, 0x000481C7, + 0x035, 0x000501C7, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000010, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1685,7 +1766,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1698,7 +1779,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000063B5, ++ 0x036, 0x0000E3B5, ++ 0x036, 0x000163B5, ++ 0x036, 0x0001E3B5, ++ 0x036, 0x000263B5, ++ 0x036, 0x0002E3B5, ++ 0x036, 0x000363B5, ++ 0x036, 0x0003E3B5, ++ 0x036, 0x000463B5, ++ 0x036, 0x0004E3B5, ++ 0x036, 0x000563B5, ++ 0x036, 0x0005E3B5, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000056B3, ++ 0x036, 0x0000D6B3, ++ 0x036, 0x000156B3, ++ 0x036, 0x0001D6B3, ++ 0x036, 0x00026634, ++ 0x036, 0x0002E634, ++ 0x036, 0x00036634, ++ 0x036, 0x0003E634, ++ 0x036, 0x000467B4, ++ 0x036, 0x0004E7B4, ++ 0x036, 0x000567B4, ++ 0x036, 0x0005E7B4, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x036, 0x000063B5, ++ 0x036, 0x0000E3B5, ++ 0x036, 0x000163B5, ++ 0x036, 0x0001E3B5, ++ 0x036, 0x000263B5, ++ 0x036, 0x0002E3B5, ++ 0x036, 0x000363B5, ++ 0x036, 0x0003E3B5, ++ 0x036, 0x000463B5, ++ 0x036, 0x0004E3B5, ++ 0x036, 0x000563B5, ++ 0x036, 0x0005E3B5, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x036, 0x00085733, + 0x036, 0x0008D733, + 0x036, 0x00095733, +@@ -1711,7 +1831,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x000CE4B4, + 0x036, 0x000D64B4, + 0x036, 0x000DE4B4, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x036, 0x000056B3, + 0x036, 0x0000D6B3, + 0x036, 0x000156B3, +@@ -1724,103 +1844,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x036, 0x0004E7B4, + 0x036, 0x000567B4, + 0x036, 0x0005E7B4, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x0EF, 0x00000008, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x000001B6, ++ 0x03C, 0x00000492, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x0000022A, ++ 0x03C, 0x00000594, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x000001B6, ++ 0x03C, 0x00000492, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x000001C8, + 0x03C, 0x00000492, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x03C, 0x0000022A, + 0x03C, 0x00000594, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000800, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x03C, 0x00000820, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000820, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000800, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x03C, 0x00000800, ++ 0xA0000000, 0x00000000, + 0x03C, 0x00000900, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x018, 0x0001712A, + 0x0EF, 0x00000002, +- 0xFF0F0104, 0xABCD, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x008, 0x00002000, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x008, 0x0004E400, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x008, 0x00002000, +- 0xFF0F0104, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x0EF, 0x00000000, + 0x0DF, 0x000000C0, +- 0x01F, 0x00040064, +- 0xFF0F0104, 0xABCD, ++ 0x01F, 0x00000064, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xFF0F0404, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x058, 0x00081184, ++ 0x059, 0x0006016C, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x058, 0x000A7284, + 0x059, 0x000600EC, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x058, 0x00081184, + 0x059, 0x0006016C, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EFD83, ++ 0x062, 0x00093FCC, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EAD53, ++ 0x062, 0x00093BC4, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x061, 0x000EFD83, ++ 0x062, 0x00093FCC, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x061, 0x000E8D73, + 0x062, 0x00093FC5, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x061, 0x000EAD53, + 0x062, 0x00093BC4, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0204, 0xCDEF, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0404, 0xCDEF, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110EB, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xFF0F0200, 0xCDEF, +- 0x063, 0x000710E9, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x063, 0x000110E9, +- 0xCDCDCDCD, 0xCDCD, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110EB, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, ++ 0x063, 0x000110E9, ++ 0xA0000000, 0x00000000, + 0x063, 0x000714E9, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0104, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C27C, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C27C, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xFF0F0204, 0xCDEF, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x064, 0x0001C67C, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xFF0F0404, 0xCDEF, ++ 0x90000410, 0x00000000, 0x40000000, 0x00000000, + 0x064, 0x0001C27C, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x064, 0x0001C67C, +- 0xFF0F0104, 0xDEAD, +- 0xFF0F0200, 0xABCD, ++ 0xB0000000, 0x00000000, ++ 0x80000111, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00091016, ++ 0x90000110, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00091016, ++ 0x90000210, 0x00000000, 0x40000000, 0x00000000, + 0x065, 0x00093016, +- 0xFF0F02C0, 0xCDEF, ++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000, + 0x065, 0x00093015, +- 0xCDCDCDCD, 0xCDCD, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00093015, ++ 0x90000200, 0x00000000, 0x40000000, 0x00000000, ++ 0x065, 0x00093016, ++ 0xA0000000, 0x00000000, + 0x065, 0x00091016, +- 0xFF0F0200, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x018, 0x00000006, + 0x0EF, 0x00002000, + 0x03B, 0x0003824B, +@@ -1918,9 +2097,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = { + 0x0B4, 0x0001214C, + 0x0B7, 0x0003000C, + 0x01C, 0x000539D2, ++ 0x0C4, 0x000AFE00, + 0x018, 0x0001F12A, +- 0x0FE, 0x00000000, +- 0x0FE, 0x00000000, ++ 0xFFE, 0x00000000, ++ 0xFFE, 0x00000000, + 0x018, 0x0001712A, + + }; +@@ -2040,6 +2220,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = { + u32 RTL8812AE_MAC_1T_ARRAYLEN = ARRAY_SIZE(RTL8812AE_MAC_REG_ARRAY); + + u32 RTL8821AE_MAC_REG_ARRAY[] = { ++ 0x421, 0x0000000F, + 0x428, 0x0000000A, + 0x429, 0x00000010, + 0x430, 0x00000000, +@@ -2508,7 +2689,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0xA6360001, + 0x81C, 0xA5380001, + 0x81C, 0xA43A0001, +- 0x81C, 0xA33C0001, ++ 0x81C, 0x683C0001, + 0x81C, 0x673E0001, + 0x81C, 0x66400001, + 0x81C, 0x65420001, +@@ -2542,7 +2723,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x017A0001, + 0x81C, 0x017C0001, + 0x81C, 0x017E0001, +- 0xFF0F02C0, 0xABCD, ++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000, ++ 0x81C, 0xFB000101, ++ 0x81C, 0xFA020101, ++ 0x81C, 0xF9040101, ++ 0x81C, 0xF8060101, ++ 0x81C, 0xF7080101, ++ 0x81C, 0xF60A0101, ++ 0x81C, 0xF50C0101, ++ 0x81C, 0xF40E0101, ++ 0x81C, 0xF3100101, ++ 0x81C, 0xF2120101, ++ 0x81C, 0xF1140101, ++ 0x81C, 0xF0160101, ++ 0x81C, 0xEF180101, ++ 0x81C, 0xEE1A0101, ++ 0x81C, 0xED1C0101, ++ 0x81C, 0xEC1E0101, ++ 0x81C, 0xEB200101, ++ 0x81C, 0xEA220101, ++ 0x81C, 0xE9240101, ++ 0x81C, 0xE8260101, ++ 0x81C, 0xE7280101, ++ 0x81C, 0xE62A0101, ++ 0x81C, 0xE52C0101, ++ 0x81C, 0xE42E0101, ++ 0x81C, 0xE3300101, ++ 0x81C, 0xA5320101, ++ 0x81C, 0xA4340101, ++ 0x81C, 0xA3360101, ++ 0x81C, 0x87380101, ++ 0x81C, 0x863A0101, ++ 0x81C, 0x853C0101, ++ 0x81C, 0x843E0101, ++ 0x81C, 0x69400101, ++ 0x81C, 0x68420101, ++ 0x81C, 0x67440101, ++ 0x81C, 0x66460101, ++ 0x81C, 0x49480101, ++ 0x81C, 0x484A0101, ++ 0x81C, 0x474C0101, ++ 0x81C, 0x2A4E0101, ++ 0x81C, 0x29500101, ++ 0x81C, 0x28520101, ++ 0x81C, 0x27540101, ++ 0x81C, 0x26560101, ++ 0x81C, 0x25580101, ++ 0x81C, 0x245A0101, ++ 0x81C, 0x235C0101, ++ 0x81C, 0x055E0101, ++ 0x81C, 0x04600101, ++ 0x81C, 0x03620101, ++ 0x81C, 0x02640101, ++ 0x81C, 0x01660101, ++ 0x81C, 0x01680101, ++ 0x81C, 0x016A0101, ++ 0x81C, 0x016C0101, ++ 0x81C, 0x016E0101, ++ 0x81C, 0x01700101, ++ 0x81C, 0x01720101, ++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000, + 0x81C, 0xFB000101, + 0x81C, 0xFA020101, + 0x81C, 0xF9040101, +@@ -2601,7 +2841,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x016E0101, + 0x81C, 0x01700101, + 0x81C, 0x01720101, +- 0xCDCDCDCD, 0xCDCD, ++ 0xA0000000, 0x00000000, + 0x81C, 0xFF000101, + 0x81C, 0xFF020101, + 0x81C, 0xFE040101, +@@ -2660,7 +2900,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = { + 0x81C, 0x046E0101, + 0x81C, 0x03700101, + 0x81C, 0x02720101, +- 0xFF0F02C0, 0xDEAD, ++ 0xB0000000, 0x00000000, + 0x81C, 0x01740101, + 0x81C, 0x01760101, + 0x81C, 0x01780101, +-- +2.30.2 + diff --git a/queue-4.19/sata_mv-add-irq-checks.patch b/queue-4.19/sata_mv-add-irq-checks.patch new file mode 100644 index 00000000000..acf3d542a4a --- /dev/null +++ b/queue-4.19/sata_mv-add-irq-checks.patch @@ -0,0 +1,47 @@ +From 86ff5ea5fc6aac5fb268e308f56491b3ef527ff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 00:13:49 +0300 +Subject: sata_mv: add IRQ checks + +From: Sergey Shtylyov + +[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ] + +The function mv_platform_probe() neglects to check the results of the +calls to platform_get_irq() and irq_of_parse_and_map() and blithely +passes them to ata_host_activate() -- while the latter only checks +for IRQ0 (treating it as a polling mode indicattion) and passes the +negative values to devm_request_irq() causing it to fail as it takes +unsigned values for the IRQ #... + +Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ +#s to ata_host_activate(), propagate upstream the negative error codes, +and override the IRQ0 with -EINVAL (as we don't want the polling mode). + +Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_mv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index 2910b22fac11..57ef11ecbb9b 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -4110,6 +4110,10 @@ static int mv_platform_probe(struct platform_device *pdev) + n_ports = mv_platform_data->n_ports; + irq = platform_get_irq(pdev, 0); + } ++ if (irq < 0) ++ return irq; ++ if (!irq) ++ return -EINVAL; + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); + hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL); +-- +2.30.2 + diff --git a/queue-4.19/sched-debug-fix-cgroup_path-serialization.patch b/queue-4.19/sched-debug-fix-cgroup_path-serialization.patch new file mode 100644 index 00000000000..93174c48f19 --- /dev/null +++ b/queue-4.19/sched-debug-fix-cgroup_path-serialization.patch @@ -0,0 +1,158 @@ +From 2cf73f605c5537727762316f70ac806d08f5910d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 15:54:26 -0400 +Subject: sched/debug: Fix cgroup_path[] serialization + +From: Waiman Long + +[ Upstream commit ad789f84c9a145f8a18744c0387cec22ec51651e ] + +The handling of sysrq key can be activated by echoing the key to +/proc/sysrq-trigger or via the magic key sequence typed into a terminal +that is connected to the system in some way (serial, USB or other mean). +In the former case, the handling is done in a user context. In the +latter case, it is likely to be in an interrupt context. + +Currently in print_cpu() of kernel/sched/debug.c, sched_debug_lock is +taken with interrupt disabled for the whole duration of the calls to +print_*_stats() and print_rq() which could last for the quite some time +if the information dump happens on the serial console. + +If the system has many cpus and the sched_debug_lock is somehow busy +(e.g. parallel sysrq-t), the system may hit a hard lockup panic +depending on the actually serial console implementation of the +system. + +The purpose of sched_debug_lock is to serialize the use of the global +cgroup_path[] buffer in print_cpu(). The rests of the printk calls don't +need serialization from sched_debug_lock. + +Calling printk() with interrupt disabled can still be problematic if +multiple instances are running. Allocating a stack buffer of PATH_MAX +bytes is not feasible because of the limited size of the kernel stack. + +The solution implemented in this patch is to allow only one caller at a +time to use the full size group_path[], while other simultaneous callers +will have to use shorter stack buffers with the possibility of path +name truncation. A "..." suffix will be printed if truncation may have +happened. The cgroup path name is provided for informational purpose +only, so occasional path name truncation should not be a big problem. + +Fixes: efe25c2c7b3a ("sched: Reinstate group names in /proc/sched_debug") +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415195426.6677-1-longman@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 42 +++++++++++++++++++++++++++++------------- + 1 file changed, 29 insertions(+), 13 deletions(-) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 78fadf0438ea..9518606fa1e5 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -11,8 +11,6 @@ + */ + #include "sched.h" + +-static DEFINE_SPINLOCK(sched_debug_lock); +- + /* + * This allows printing both to /proc/sched_debug and + * to the console +@@ -434,16 +432,37 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group + #endif + + #ifdef CONFIG_CGROUP_SCHED ++static DEFINE_SPINLOCK(sched_debug_lock); + static char group_path[PATH_MAX]; + +-static char *task_group_path(struct task_group *tg) ++static void task_group_path(struct task_group *tg, char *path, int plen) + { +- if (autogroup_path(tg, group_path, PATH_MAX)) +- return group_path; ++ if (autogroup_path(tg, path, plen)) ++ return; + +- cgroup_path(tg->css.cgroup, group_path, PATH_MAX); ++ cgroup_path(tg->css.cgroup, path, plen); ++} + +- return group_path; ++/* ++ * Only 1 SEQ_printf_task_group_path() caller can use the full length ++ * group_path[] for cgroup path. Other simultaneous callers will have ++ * to use a shorter stack buffer. A "..." suffix is appended at the end ++ * of the stack buffer so that it will show up in case the output length ++ * matches the given buffer size to indicate possible path name truncation. ++ */ ++#define SEQ_printf_task_group_path(m, tg, fmt...) \ ++{ \ ++ if (spin_trylock(&sched_debug_lock)) { \ ++ task_group_path(tg, group_path, sizeof(group_path)); \ ++ SEQ_printf(m, fmt, group_path); \ ++ spin_unlock(&sched_debug_lock); \ ++ } else { \ ++ char buf[128]; \ ++ char *bufend = buf + sizeof(buf) - 3; \ ++ task_group_path(tg, buf, bufend - buf); \ ++ strcpy(bufend - 1, "..."); \ ++ SEQ_printf(m, fmt, buf); \ ++ } \ + } + #endif + +@@ -470,7 +489,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p) + SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p)); + #endif + #ifdef CONFIG_CGROUP_SCHED +- SEQ_printf(m, " %s", task_group_path(task_group(p))); ++ SEQ_printf_task_group_path(m, task_group(p), " %s") + #endif + + SEQ_printf(m, "\n"); +@@ -507,7 +526,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) + + #ifdef CONFIG_FAIR_GROUP_SCHED + SEQ_printf(m, "\n"); +- SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg)); ++ SEQ_printf_task_group_path(m, cfs_rq->tg, "cfs_rq[%d]:%s\n", cpu); + #else + SEQ_printf(m, "\n"); + SEQ_printf(m, "cfs_rq[%d]:\n", cpu); +@@ -579,7 +598,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq) + { + #ifdef CONFIG_RT_GROUP_SCHED + SEQ_printf(m, "\n"); +- SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg)); ++ SEQ_printf_task_group_path(m, rt_rq->tg, "rt_rq[%d]:%s\n", cpu); + #else + SEQ_printf(m, "\n"); + SEQ_printf(m, "rt_rq[%d]:\n", cpu); +@@ -631,7 +650,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) + static void print_cpu(struct seq_file *m, int cpu) + { + struct rq *rq = cpu_rq(cpu); +- unsigned long flags; + + #ifdef CONFIG_X86 + { +@@ -690,13 +708,11 @@ do { \ + } + #undef P + +- spin_lock_irqsave(&sched_debug_lock, flags); + print_cfs_stats(m, cpu); + print_rt_stats(m, cpu); + print_dl_stats(m, cpu); + + print_rq(m, rq, cpu); +- spin_unlock_irqrestore(&sched_debug_lock, flags); + SEQ_printf(m, "\n"); + } + +-- +2.30.2 + diff --git a/queue-4.19/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch b/queue-4.19/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch new file mode 100644 index 00000000000..c1e8eb18812 --- /dev/null +++ b/queue-4.19/scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch @@ -0,0 +1,132 @@ +From 92882ba9c0f3d4f3914b38f6353ad4deb03253ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 18:10:09 -0600 +Subject: scsi: ibmvfc: Fix invalid state machine BUG_ON() + +From: Brian King + +[ Upstream commit 15cfef8623a449d40d16541687afd58e78033be3 ] + +This fixes an issue hitting the BUG_ON() in ibmvfc_do_work(). When going +through a host action of IBMVFC_HOST_ACTION_RESET, we change the action to +IBMVFC_HOST_ACTION_TGT_DEL, then drop the host lock, and reset the CRQ, +which changes the host state to IBMVFC_NO_CRQ. If, prior to setting the +host state to IBMVFC_NO_CRQ, ibmvfc_init_host() is called, it can then end +up changing the host action to IBMVFC_HOST_ACTION_INIT. If we then change +the host state to IBMVFC_NO_CRQ, we will then hit the BUG_ON(). + +Make a couple of changes to avoid this. Leave the host action to be +IBMVFC_HOST_ACTION_RESET or IBMVFC_HOST_ACTION_REENABLE until after we drop +the host lock and reset or reenable the CRQ. Also harden the host state +machine to ensure we cannot leave the reset / reenable state until we've +finished processing the reset or reenable. + +Link: https://lore.kernel.org/r/20210413001009.902400-1-tyreld@linux.ibm.com +Fixes: 73ee5d867287 ("[SCSI] ibmvfc: Fix soft lockup on resume") +Signed-off-by: Brian King +[tyreld: added fixes tag] +Signed-off-by: Tyrel Datwyler +[mkp: fix comment checkpatch warnings] +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 57 ++++++++++++++++++++++------------ + 1 file changed, 38 insertions(+), 19 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 50078a199fea..b811436a46d0 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -506,8 +506,17 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost, + if (vhost->action == IBMVFC_HOST_ACTION_ALLOC_TGTS) + vhost->action = action; + break; ++ case IBMVFC_HOST_ACTION_REENABLE: ++ case IBMVFC_HOST_ACTION_RESET: ++ vhost->action = action; ++ break; + case IBMVFC_HOST_ACTION_INIT: + case IBMVFC_HOST_ACTION_TGT_DEL: ++ case IBMVFC_HOST_ACTION_LOGO: ++ case IBMVFC_HOST_ACTION_QUERY_TGTS: ++ case IBMVFC_HOST_ACTION_TGT_DEL_FAILED: ++ case IBMVFC_HOST_ACTION_NONE: ++ default: + switch (vhost->action) { + case IBMVFC_HOST_ACTION_RESET: + case IBMVFC_HOST_ACTION_REENABLE: +@@ -517,15 +526,6 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost, + break; + } + break; +- case IBMVFC_HOST_ACTION_LOGO: +- case IBMVFC_HOST_ACTION_QUERY_TGTS: +- case IBMVFC_HOST_ACTION_TGT_DEL_FAILED: +- case IBMVFC_HOST_ACTION_NONE: +- case IBMVFC_HOST_ACTION_RESET: +- case IBMVFC_HOST_ACTION_REENABLE: +- default: +- vhost->action = action; +- break; + } + } + +@@ -4346,26 +4346,45 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost) + case IBMVFC_HOST_ACTION_INIT_WAIT: + break; + case IBMVFC_HOST_ACTION_RESET: +- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + rc = ibmvfc_reset_crq(vhost); ++ + spin_lock_irqsave(vhost->host->host_lock, flags); +- if (rc == H_CLOSED) ++ if (!rc || rc == H_CLOSED) + vio_enable_interrupts(to_vio_dev(vhost->dev)); +- if (rc || (rc = ibmvfc_send_crq_init(vhost)) || +- (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) { +- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); +- dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc); ++ if (vhost->action == IBMVFC_HOST_ACTION_RESET) { ++ /* ++ * The only action we could have changed to would have ++ * been reenable, in which case, we skip the rest of ++ * this path and wait until we've done the re-enable ++ * before sending the crq init. ++ */ ++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; ++ ++ if (rc || (rc = ibmvfc_send_crq_init(vhost)) || ++ (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) { ++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); ++ dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc); ++ } + } + break; + case IBMVFC_HOST_ACTION_REENABLE: +- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; + spin_unlock_irqrestore(vhost->host->host_lock, flags); + rc = ibmvfc_reenable_crq_queue(vhost); ++ + spin_lock_irqsave(vhost->host->host_lock, flags); +- if (rc || (rc = ibmvfc_send_crq_init(vhost))) { +- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); +- dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc); ++ if (vhost->action == IBMVFC_HOST_ACTION_REENABLE) { ++ /* ++ * The only action we could have changed to would have ++ * been reset, in which case, we skip the rest of this ++ * path and wait until we've done the reset before ++ * sending the crq init. ++ */ ++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL; ++ if (rc || (rc = ibmvfc_send_crq_init(vhost))) { ++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD); ++ dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc); ++ } + } + break; + case IBMVFC_HOST_ACTION_LOGO: +-- +2.30.2 + diff --git a/queue-4.19/scsi-jazz_esp-add-irq-check.patch b/queue-4.19/scsi-jazz_esp-add-irq-check.patch new file mode 100644 index 00000000000..9d9425dc246 --- /dev/null +++ b/queue-4.19/scsi-jazz_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From f3a551096eae8f30263492f778965f80321f4a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:43:23 +0300 +Subject: scsi: jazz_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru +Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/jazz_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c +index 6eb5ff3e2e61..7dfe4237e5e8 100644 +--- a/drivers/scsi/jazz_esp.c ++++ b/drivers/scsi/jazz_esp.c +@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp); + if (err < 0) + goto fail_unmap_command_block; +-- +2.30.2 + diff --git a/queue-4.19/scsi-sni_53c710-add-irq-check.patch b/queue-4.19/scsi-sni_53c710-add-irq-check.patch new file mode 100644 index 00000000000..049ac60b838 --- /dev/null +++ b/queue-4.19/scsi-sni_53c710-add-irq-check.patch @@ -0,0 +1,49 @@ +From f529c8dcd97587c7237fb9cbc08d89992d7ce957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:45:12 +0300 +Subject: scsi: sni_53c710: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV +further below). Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru +Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sni_53c710.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c +index 3102a75984d3..aed91afb79b6 100644 +--- a/drivers/scsi/sni_53c710.c ++++ b/drivers/scsi/sni_53c710.c +@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev) + struct NCR_700_Host_Parameters *hostdata; + struct Scsi_Host *host; + struct resource *res; ++ int rc; + + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (!res) +@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev) + goto out_kfree; + host->this_id = 7; + host->base = base; +- host->irq = platform_get_irq(dev, 0); ++ host->irq = rc = platform_get_irq(dev, 0); ++ if (rc < 0) ++ goto out_put_host; + if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) { + printk(KERN_ERR "snirm710: request_irq failed!\n"); + goto out_put_host; +-- +2.30.2 + diff --git a/queue-4.19/scsi-sun3x_esp-add-irq-check.patch b/queue-4.19/scsi-sun3x_esp-add-irq-check.patch new file mode 100644 index 00000000000..8b08eabc4f3 --- /dev/null +++ b/queue-4.19/scsi-sun3x_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From c75176ddb5b829352b37ce2bad136d864c0103ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:44:08 +0300 +Subject: scsi: sun3x_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru +Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sun3x_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c +index 0b1421cdf8a0..f9aa95e48eee 100644 +--- a/drivers/scsi/sun3x_esp.c ++++ b/drivers/scsi/sun3x_esp.c +@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs_dma; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, + "SUN3X ESP", esp); + if (err < 0) +-- +2.30.2 + diff --git a/queue-4.19/serial-stm32-fix-incorrect-characters-on-console.patch b/queue-4.19/serial-stm32-fix-incorrect-characters-on-console.patch new file mode 100644 index 00000000000..cc0fee1ed93 --- /dev/null +++ b/queue-4.19/serial-stm32-fix-incorrect-characters-on-console.patch @@ -0,0 +1,59 @@ +From da91c7054da55d799f9aebedbbead110290b1611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:22:58 +0100 +Subject: serial: stm32: fix incorrect characters on console + +From: Erwan Le Ray + +[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ] + +Incorrect characters are observed on console during boot. This issue occurs +when init/main.c is modifying termios settings to open /dev/console on the +rootfs. + +This patch adds a waiting loop in set_termios to wait for TX shift register +empty (and TX FIFO if any) before stopping serial port. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-4-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index bce4ac1787ad..09cecd34d13e 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -637,8 +637,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + unsigned int baud, bits; + u32 usartdiv, mantissa, fraction, oversampling; + tcflag_t cflag = termios->c_cflag; +- u32 cr1, cr2, cr3; ++ u32 cr1, cr2, cr3, isr; + unsigned long flags; ++ int ret; + + if (!stm32_port->hw_flow_control) + cflag &= ~CRTSCTS; +@@ -647,6 +648,15 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + + spin_lock_irqsave(&port->lock, flags); + ++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, ++ isr, ++ (isr & USART_SR_TC), ++ 10, 100000); ++ ++ /* Send the TC error message only when ISR_TC is not set. */ ++ if (ret) ++ dev_err(port->dev, "Transmission is not complete\n"); ++ + /* Stop serial port and reset value */ + writel_relaxed(0, port->membase + ofs->cr1); + +-- +2.30.2 + diff --git a/queue-4.19/serial-stm32-fix-tx_empty-condition.patch b/queue-4.19/serial-stm32-fix-tx_empty-condition.patch new file mode 100644 index 00000000000..fea18e265e2 --- /dev/null +++ b/queue-4.19/serial-stm32-fix-tx_empty-condition.patch @@ -0,0 +1,61 @@ +From 468aecda9402355f5af43d8c045e74b4480050cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:23:07 +0100 +Subject: serial: stm32: fix tx_empty condition + +From: Erwan Le Ray + +[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ] + +In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of +TXE) to check transmission data register has been transmitted independently +of the FIFO mode. TC indicates that both transmit register and shift +register are empty. When shift register is empty, tx_empty should return +TIOCSER_TEMT instead of TC value. + +Cleans the USART_CR_TC TCCF register define (transmission complete clear +flag) as it is duplicate of USART_ICR_TCCF. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Link: https://lore.kernel.org/r/20210304162308.8984-13-erwan.leray@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 ++++- + drivers/tty/serial/stm32-usart.h | 3 --- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 09cecd34d13e..50073ead5881 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -472,7 +472,10 @@ static unsigned int stm32_tx_empty(struct uart_port *port) + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + +- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE; ++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC) ++ return TIOCSER_TEMT; ++ ++ return 0; + } + + static void stm32_set_mctrl(struct uart_port *port, unsigned int mctrl) +diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h +index 30d2433e27c3..00daee7f83ee 100644 +--- a/drivers/tty/serial/stm32-usart.h ++++ b/drivers/tty/serial/stm32-usart.h +@@ -123,9 +123,6 @@ struct stm32_usart_info stm32h7_info = { + /* Dummy bits */ + #define USART_SR_DUMMY_RX BIT(16) + +-/* USART_ICR (F7) */ +-#define USART_CR_TC BIT(6) +- + /* USART_DR */ + #define USART_DR_MASK GENMASK(8, 0) + +-- +2.30.2 + diff --git a/queue-4.19/series b/queue-4.19/series index ebb64c73109..7b67e1d1f8f 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -164,3 +164,137 @@ kvm-s390-split-kvm_s390_real_to_abs.patch kvm-s390-extend-kvm_s390_shadow_fault-to-return-entry-pointer.patch ovl-fix-missing-revert_creds-on-error-path.patch usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch +memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch +arm-dts-exynos-correct-fuel-gauge-interrupt-trigger-.patch +arm-dts-exynos-correct-muic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-6931 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-20378 +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-9622 +serial-stm32-fix-incorrect-characters-on-console.patch +serial-stm32-fix-tx_empty-condition.patch +usb-typec-tcpci-check-role_control-while-interpretin.patch +regmap-set-debugfs_name-to-null-after-it-is-freed.patch +mtd-rawnand-fsmc-fix-error-code-in-fsmc_nand_probe.patch +mtd-rawnand-brcmnand-fix-oob-r-w-with-hamming-ecc.patch +mtd-handle-possible-eprobe_defer-from-parse_mtd_part.patch +mtd-rawnand-qcom-return-actual-error-code-instead-of.patch +x86-microcode-check-for-offline-cpus-before-requesti.patch +usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch +usb-gadget-pch_udc-check-if-driver-is-present-before.patch +usb-gadget-pch_udc-check-for-dma-mapping-error.patch +crypto-qat-don-t-release-uninitialized-resources.patch +crypto-qat-adf_status_pf_running-should-be-set-after.patch +fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch +fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch +fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch +fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch +fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch +fotg210-udc-complete-out-requests-on-short-packets.patch +mtd-require-write-permissions-for-locking-and-badblo.patch +bus-qcom-put-child-node-before-return.patch +soundwire-bus-fix-device-found-flag-correctly.patch +phy-marvell-armada375_usbcluster_phy-should-not-defa.patch +crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch +usb-gadget-aspeed-fix-dma-map-failure.patch +usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch +soundwire-stream-fix-memory-leak-in-stream-config-er.patch +mtd-rawnand-gpmi-fix-a-double-free-in-gpmi_nand_init.patch +irqchip-gic-v3-fix-of_bad_addr-error-handling.patch +staging-rtl8192u-fix-potential-infinite-loop.patch +staging-greybus-uart-fix-unprivileged-tioccserial.patch +spi-fix-use-after-free-with-devm_spi_alloc_.patch +soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch +soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch +acpi-cppc-replace-cppc_attr-with-kobj_attribute.patch +crypto-qat-fix-a-double-free-in-adf_create_ring.patch +cpufreq-armada-37xx-fix-setting-tbg-parent-for-load-.patch +clk-mvebu-armada-37xx-periph-remove-.set_parent-meth.patch +cpufreq-armada-37xx-fix-the-avs-value-for-load-l1.patch +clk-mvebu-armada-37xx-periph-fix-switching-cpu-freq-.patch +clk-mvebu-armada-37xx-periph-fix-workaround-for-swit.patch +cpufreq-armada-37xx-fix-driver-cleanup-when-registra.patch +cpufreq-armada-37xx-fix-determining-base-cpu-frequen.patch +usb-gadget-r8a66597-add-missing-null-check-on-return.patch +usb-cdc-acm-fix-unprivileged-tioccserial.patch +tty-actually-undefine-superseded-async-flags.patch +tty-fix-return-value-for-unsupported-ioctls.patch +firmware-qcom-scm-fix-qcom_scm-configuration.patch +usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch +platform-x86-pmc_atom-match-all-beckhoff-automation-.patch +x86-platform-uv-fix-kexec-build-failure.patch +drivers-hv-vmbus-increase-wait-time-for-vmbus-unload.patch +usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch +usb-dwc2-fix-hibernation-between-host-and-device-mod.patch +ttyprintk-add-tty-hangup-callback.patch +soc-aspeed-fix-a-ternary-sign-expansion-bug.patch +media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch +media-omap4iss-return-error-code-when-omap4iss_get-f.patch +media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch +drm-amdkfd-fix-build-error-with-amd_iommu_v2-m.patch +x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch +pata_arasan_cf-fix-irq-check.patch +pata_ipx4xx_cf-fix-irq-check.patch +sata_mv-add-irq-checks.patch +ata-libahci_platform-fix-irq-check.patch +nvme-retrigger-ana-log-update-if-group-descriptor-is.patch +vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch +clk-qcom-a53-pll-add-missing-module_device_table.patch +clk-uniphier-fix-potential-infinite-loop.patch +scsi-jazz_esp-add-irq-check.patch +scsi-sun3x_esp-add-irq-check.patch +scsi-sni_53c710-add-irq-check.patch +scsi-ibmvfc-fix-invalid-state-machine-bug_on.patch +mfd-stm32-timers-avoid-clearing-auto-reload-register.patch +hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch +x86-events-amd-iommu-fix-sysfs-type-mismatch.patch +sched-debug-fix-cgroup_path-serialization.patch +drivers-block-null_blk-main-fix-a-double-free-in-nul.patch +hid-plantronics-workaround-for-double-volume-key-pre.patch +perf-symbols-fix-dso__fprintf_symbols_by_name-to-ret.patch +net-lapbether-prevent-racing-when-checking-whether-t.patch +powerpc-prom-mark-identical_pvr_fixup-as-__init.patch +powerpc-fix-have_hardlockup_detector_arch-build-conf.patch +alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch +bug-remove-redundant-condition-check-in-report_bug.patch +nfc-pn533-prevent-potential-memory-corruption.patch +net-hns3-limiting-the-scope-of-vector_ring_chain-var.patch +alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch +kvm-arm64-initialize-vcpu-mdcr_el2-before-loading-it.patch +liquidio-fix-unintented-sign-extension-of-a-left-shi.patch +powerpc-64s-fix-pte-update-for-kernel-memory-on-radi.patch +powerpc-perf-fix-pmu-constraint-check-for-ebb-events.patch +powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch +mac80211-bail-out-if-cipher-schemes-are-invalid.patch +mt7601u-fix-always-true-expression.patch +ib-hfi1-fix-error-return-code-in-parse_platform_conf.patch +net-thunderx-fix-unintentional-sign-extension-issue.patch +rdma-srpt-fix-error-return-code-in-srpt_cm_req_recv.patch +i2c-cadence-add-irq-check.patch +i2c-emev2-add-irq-check.patch +i2c-jz4780-add-irq-check.patch +i2c-sh7760-add-irq-check.patch +asoc-ak5558-correct-reset-polarity.patch +drm-i915-gvt-fix-error-code-in-intel_gvt_init_device.patch +mips-pci-legacy-stop-using-of_pci_range_to_resource.patch +powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch +rtlwifi-8821ae-upgrade-phy-and-rf-parameters.patch +i2c-sh7760-fix-irq-error-path.patch +mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch +vsock-vmci-log-once-the-failed-queue-pair-allocation.patch +rdma-i40iw-fix-error-unwinding-when-i40iw_hmc_sd_one.patch +alsa-usb-midi-don-t-return-enomem-when-usb_urb_ep_ty.patch +net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch +ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch +ath10k-fix-ath10k_wmi_tlv_op_pull_peer_stats_info-un.patch +powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch +bnxt_en-fix-ternary-sign-extension-bug-in-bnxt_show_.patch +arm-dts-uniphier-change-phy-mode-to-rgmii-id-to-enab.patch +arm64-dts-uniphier-change-phy-mode-to-rgmii-id-to-en.patch +net-geneve-modify-ip-header-check-in-geneve6_xmit_sk.patch +net-emac-emac-mac-fix-a-use-after-free-in-emac_mac_t.patch +rdma-bnxt_re-fix-a-double-free-in-bnxt_qplib_alloc_r.patch +net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch +kfifo-fix-ternary-sign-extension-bugs.patch +mm-sparse-add-the-missing-sparse_buffer_fini-in-erro.patch +mm-memory-failure-unnecessary-amount-of-unmapping.patch diff --git a/queue-4.19/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch b/queue-4.19/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch new file mode 100644 index 00000000000..239b14a8e13 --- /dev/null +++ b/queue-4.19/soc-aspeed-fix-a-ternary-sign-expansion-bug.patch @@ -0,0 +1,51 @@ +From 63809289d2bdad40c70d05c878b5151f33acb4fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 09:39:19 +0930 +Subject: soc: aspeed: fix a ternary sign expansion bug + +From: Dan Carpenter + +[ Upstream commit 5ffa828534036348fa90fb3079ccc0972d202c4a ] + +The intent here was to return negative error codes but it actually +returns positive values. The problem is that type promotion with +ternary operations is quite complicated. + +"ret" is an int. "copied" is a u32. And the snoop_file_read() function +returns long. What happens is that "ret" is cast to u32 and becomes +positive then it's cast to long and it's still positive. + +Fix this by removing the ternary so that "ret" is type promoted directly +to long. + +Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") +Signed-off-by: Dan Carpenter +Signed-off-by: Joel Stanley +Reviewed-by: Patrick Venture +Link: https://lore.kernel.org/r/YIE90PSXsMTa2Y8n@mwanda +Link: https://lore.kernel.org/r/20210423000919.1249474-1-joel@jms.id.au' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/misc/aspeed-lpc-snoop.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/aspeed-lpc-snoop.c b/drivers/misc/aspeed-lpc-snoop.c +index b4a776bf44bc..e2cb0b9607d1 100644 +--- a/drivers/misc/aspeed-lpc-snoop.c ++++ b/drivers/misc/aspeed-lpc-snoop.c +@@ -99,8 +99,10 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer, + return -EINTR; + } + ret = kfifo_to_user(&chan->fifo, buffer, count, &copied); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static __poll_t snoop_file_poll(struct file *file, +-- +2.30.2 + diff --git a/queue-4.19/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch b/queue-4.19/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch new file mode 100644 index 00000000000..64e7019e8b1 --- /dev/null +++ b/queue-4.19/soc-qcom-mdt_loader-detect-truncated-read-of-segment.patch @@ -0,0 +1,48 @@ +From 767f680b2bfb7641b949c68d6d7be13ca1a09ccc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 15:25:26 -0800 +Subject: soc: qcom: mdt_loader: Detect truncated read of segments + +From: Bjorn Andersson + +[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ] + +Given that no validation of how much data the firmware loader read in +for a given segment truncated segment files would best case result in a +hash verification failure, without any indication of what went wrong. + +Improve this by validating that the firmware loader did return the +amount of data requested. + +Fixes: 445c2410a449 ("soc: qcom: mdt_loader: Use request_firmware_into_buf()") +Reviewed-by: Sibi Sankar +Link: https://lore.kernel.org/r/20210107232526.716989-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index 7584b81d06a1..47dffe7736ff 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -187,6 +187,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, + break; + } + ++ if (seg_fw->size != phdr->p_filesz) { ++ dev_err(dev, ++ "failed to load segment %d from truncated file %s\n", ++ i, fw_name); ++ release_firmware(seg_fw); ++ ret = -EINVAL; ++ break; ++ } ++ + release_firmware(seg_fw); + } + +-- +2.30.2 + diff --git a/queue-4.19/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch b/queue-4.19/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch new file mode 100644 index 00000000000..c2b1632fef1 --- /dev/null +++ b/queue-4.19/soc-qcom-mdt_loader-validate-that-p_filesz-p_memsz.patch @@ -0,0 +1,45 @@ +From f54526572c41ac9b3293dc4bda1deb13a185eccf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jan 2021 15:31:19 -0800 +Subject: soc: qcom: mdt_loader: Validate that p_filesz < p_memsz + +From: Bjorn Andersson + +[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ] + +The code validates that segments of p_memsz bytes of a segment will fit +in the provided memory region, but does not validate that p_filesz bytes +will, which means that an incorrectly crafted ELF header might write +beyond the provided memory region. + +Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5") +Reviewed-by: Sibi Sankar +Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index 1c488024c698..7584b81d06a1 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -168,6 +168,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, + break; + } + ++ if (phdr->p_filesz > phdr->p_memsz) { ++ dev_err(dev, ++ "refusing to load segment %d with p_filesz > p_memsz\n", ++ i); ++ ret = -EINVAL; ++ break; ++ } ++ + ptr = mem_region + offset; + + if (phdr->p_filesz) { +-- +2.30.2 + diff --git a/queue-4.19/soundwire-bus-fix-device-found-flag-correctly.patch b/queue-4.19/soundwire-bus-fix-device-found-flag-correctly.patch new file mode 100644 index 00000000000..6f55f08a050 --- /dev/null +++ b/queue-4.19/soundwire-bus-fix-device-found-flag-correctly.patch @@ -0,0 +1,49 @@ +From 5daa18d8a34dd9c56190e02b4db364d090bf3d15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:48:16 +0000 +Subject: soundwire: bus: Fix device found flag correctly + +From: Srinivas Kandagatla + +[ Upstream commit f03690f4f6992225d05dbd1171212e5be5a370dd ] + +found flag is used to indicate SoundWire devices that are +both enumerated on the bus and available in the device list. +However this flag is not reset correctly after one iteration, +This could miss some of the devices that are enumerated on the +bus but not in device list. So reset this correctly to fix this issue! + +Fixes: d52d7a1be02c ("soundwire: Add Slave status handling helpers") +Signed-off-by: Srinivas Kandagatla +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210309104816.20350-1-srinivas.kandagatla@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c +index df172bf3925f..0089b606b70d 100644 +--- a/drivers/soundwire/bus.c ++++ b/drivers/soundwire/bus.c +@@ -514,7 +514,7 @@ static int sdw_program_device_num(struct sdw_bus *bus) + struct sdw_slave *slave, *_s; + struct sdw_slave_id id; + struct sdw_msg msg; +- bool found = false; ++ bool found; + int count = 0, ret; + u64 addr; + +@@ -545,6 +545,7 @@ static int sdw_program_device_num(struct sdw_bus *bus) + + sdw_extract_slave_id(bus, addr, &id); + ++ found = false; + /* Now compare with entries */ + list_for_each_entry_safe(slave, _s, &bus->slaves, node) { + if (sdw_compare_devid(slave, id) == 0) { +-- +2.30.2 + diff --git a/queue-4.19/soundwire-stream-fix-memory-leak-in-stream-config-er.patch b/queue-4.19/soundwire-stream-fix-memory-leak-in-stream-config-er.patch new file mode 100644 index 00000000000..f3563b665da --- /dev/null +++ b/queue-4.19/soundwire-stream-fix-memory-leak-in-stream-config-er.patch @@ -0,0 +1,52 @@ +From 62ff3b4c376729c0e1f68b3955d1fb0faa133f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 08:46:10 +0800 +Subject: soundwire: stream: fix memory leak in stream config error path + +From: Rander Wang + +[ Upstream commit 48f17f96a81763c7c8bf5500460a359b9939359f ] + +When stream config is failed, master runtime will release all +slave runtime in the slave_rt_list, but slave runtime is not +added to the list at this time. This patch frees slave runtime +in the config error path to fix the memory leak. + +Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") +Signed-off-by: Rander Wang +Reviewed-by: Keyon Jie +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/stream.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index 907a548645b7..42bc701e2304 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, + } + + ret = sdw_config_stream(&slave->dev, stream, stream_config, true); +- if (ret) ++ if (ret) { ++ /* ++ * sdw_release_master_stream will release s_rt in slave_rt_list in ++ * stream_error case, but s_rt is only added to slave_rt_list ++ * when sdw_config_stream is successful, so free s_rt explicitly ++ * when sdw_config_stream is failed. ++ */ ++ kfree(s_rt); + goto stream_error; ++ } + + list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); + +-- +2.30.2 + diff --git a/queue-4.19/spi-fix-use-after-free-with-devm_spi_alloc_.patch b/queue-4.19/spi-fix-use-after-free-with-devm_spi_alloc_.patch new file mode 100644 index 00000000000..2ca248f96fc --- /dev/null +++ b/queue-4.19/spi-fix-use-after-free-with-devm_spi_alloc_.patch @@ -0,0 +1,96 @@ +From 332eb38b3eaee84d9c1e95b3ad2dbec0d61885f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 02:55:27 -0700 +Subject: spi: Fix use-after-free with devm_spi_alloc_* + +From: William A. Kennington III + +[ Upstream commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 ] + +We can't rely on the contents of the devres list during +spi_unregister_controller(), as the list is already torn down at the +time we perform devres_find() for devm_spi_release_controller. This +causes devices registered with devm_spi_alloc_{master,slave}() to be +mistakenly identified as legacy, non-devm managed devices and have their +reference counters decremented below 0. + +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 +[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) +[] (kobject_put) from [] (put_device+0x20/0x24) + r4:b6700140 +[] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) +[] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4) + r5:b6700180 r4:b6700100 +[] (release_nodes) from [] (devres_release_all+0x5c/0x60) + r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 +[] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec) + r5:b117ad94 r4:b163dc10 +[] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0) + r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 +[] (device_driver_detach) from [] (unbind_store+0xe4/0xf8) + +Instead, determine the devm allocation state as a flag on the +controller which is guaranteed to be stable during cleanup. + +Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") +Signed-off-by: William A. Kennington III +Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 9 ++------- + include/linux/spi/spi.h | 3 +++ + 2 files changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 7dabbc82b646..bbe33016d371 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2084,6 +2084,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev, + + ctlr = __spi_alloc_controller(dev, size, slave); + if (ctlr) { ++ ctlr->devm_allocated = true; + *ptr = ctlr; + devres_add(dev, ptr); + } else { +@@ -2344,11 +2345,6 @@ int devm_spi_register_controller(struct device *dev, + } + EXPORT_SYMBOL_GPL(devm_spi_register_controller); + +-static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) +-{ +- return *(struct spi_controller **)res == ctlr; +-} +- + static int __unregister(struct device *dev, void *null) + { + spi_unregister_device(to_spi_device(dev)); +@@ -2395,8 +2391,7 @@ void spi_unregister_controller(struct spi_controller *ctlr) + /* Release the last reference on the controller if its driver + * has not yet been converted to devm_spi_alloc_master/slave(). + */ +- if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, +- devm_spi_match_controller, ctlr)) ++ if (!ctlr->devm_allocated) + put_device(&ctlr->dev); + + /* free bus id */ +diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h +index 8ceba9b8e51e..16158fe097a8 100644 +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -450,6 +450,9 @@ struct spi_controller { + + #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */ + ++ /* flag indicating this is a non-devres managed controller */ ++ bool devm_allocated; ++ + /* flag indicating this is an SPI slave controller */ + bool slave; + +-- +2.30.2 + diff --git a/queue-4.19/staging-greybus-uart-fix-unprivileged-tioccserial.patch b/queue-4.19/staging-greybus-uart-fix-unprivileged-tioccserial.patch new file mode 100644 index 00000000000..079b24c47de --- /dev/null +++ b/queue-4.19/staging-greybus-uart-fix-unprivileged-tioccserial.patch @@ -0,0 +1,47 @@ +From cc9b92102cd5d5e810e74cd0fca59293376a5982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 12:23:24 +0200 +Subject: staging: greybus: uart: fix unprivileged TIOCCSERIAL + +From: Johan Hovold + +[ Upstream commit 60c6b305c11b5fd167ce5e2ce42f3a9098c388f0 ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the greybus implementation which instead indicated that the +TIOCSSERIAL ioctl was not even implemented when a non-privileged user +set the current values. + +Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407102334.32361-7-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/uart.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index f36d470aed24..2343914f7548 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -656,8 +656,6 @@ static int set_serial_info(struct gb_tty *gb_tty, + if ((close_delay != gb_tty->port.close_delay) || + (closing_wait != gb_tty->port.closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + gb_tty->port.close_delay = close_delay; + gb_tty->port.closing_wait = closing_wait; +-- +2.30.2 + diff --git a/queue-4.19/staging-rtl8192u-fix-potential-infinite-loop.patch b/queue-4.19/staging-rtl8192u-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..3e92937396a --- /dev/null +++ b/queue-4.19/staging-rtl8192u-fix-potential-infinite-loop.patch @@ -0,0 +1,41 @@ +From 0468d69fe8371de866797cee95fc70bece5d10cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 16:03:08 +0100 +Subject: staging: rtl8192u: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ] + +The for-loop iterates with a u8 loop counter i and compares this +with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum +that is a u16 type. There is a potential infinite loop if SlotNum +is larger than the u8 loop counter. Fix this by making the loop +counter the same type as SlotNum. + +Addresses-Coverity: ("Infinite loop") +Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/r8192U_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 87244a208976..cc12e6c36fed 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -3379,7 +3379,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum, + u32 *TotalRxDataNum) + { + u16 SlotIndex; +- u8 i; ++ u16 i; + + *TotalRxBcnNum = 0; + *TotalRxDataNum = 0; +-- +2.30.2 + diff --git a/queue-4.19/tty-actually-undefine-superseded-async-flags.patch b/queue-4.19/tty-actually-undefine-superseded-async-flags.patch new file mode 100644 index 00000000000..e486eea0433 --- /dev/null +++ b/queue-4.19/tty-actually-undefine-superseded-async-flags.patch @@ -0,0 +1,49 @@ +From b46d51b83e475690ffcca4b733e73010d299f444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:01 +0200 +Subject: tty: actually undefine superseded ASYNC flags + +From: Johan Hovold + +[ Upstream commit d09845e98a05850a8094ea8fd6dd09a8e6824fff ] + +Some kernel-internal ASYNC flags have been superseded by tty-port flags +and should no longer be used by kernel drivers. + +Fix the misspelled "__KERNEL__" compile guards which failed their sole +purpose to break out-of-tree drivers that have not yet been updated. + +Fixes: 5c0517fefc92 ("tty: core: Undefine ASYNC_* flags superceded by TTY_PORT* flags") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/uapi/linux/tty_flags.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h +index 900a32e63424..6a3ac496a56c 100644 +--- a/include/uapi/linux/tty_flags.h ++++ b/include/uapi/linux/tty_flags.h +@@ -39,7 +39,7 @@ + * WARNING: These flags are no longer used and have been superceded by the + * TTY_PORT_ flags in the iflags field (and not userspace-visible) + */ +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */ + #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */ + #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */ +@@ -81,7 +81,7 @@ + #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI) + #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI) + +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + /* These flags are no longer used (and were always masked from userspace) */ + #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED) + #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE) +-- +2.30.2 + diff --git a/queue-4.19/tty-fix-return-value-for-unsupported-ioctls.patch b/queue-4.19/tty-fix-return-value-for-unsupported-ioctls.patch new file mode 100644 index 00000000000..138b71123d0 --- /dev/null +++ b/queue-4.19/tty-fix-return-value-for-unsupported-ioctls.patch @@ -0,0 +1,85 @@ +From 25a3fe3ade541f868dcd34bced583d3d9893c65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:02 +0200 +Subject: tty: fix return value for unsupported ioctls + +From: Johan Hovold + +[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ] + +Drivers should return -ENOTTY ("Inappropriate I/O control operation") +when an ioctl isn't supported, while -EINVAL is used for invalid +arguments. + +Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned +-EINVAL when a tty driver did not implement the corresponding +operations. + +Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a +corresponding Fixes tag below. + +Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_io.c | 8 ++++---- + include/linux/tty_driver.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index ff6a360eef1e..9e9343adc2b4 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2432,14 +2432,14 @@ out: + * @p: pointer to result + * + * Obtain the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ + + static int tty_tiocmget(struct tty_struct *tty, int __user *p) + { +- int retval = -EINVAL; ++ int retval = -ENOTTY; + + if (tty->ops->tiocmget) { + retval = tty->ops->tiocmget(tty); +@@ -2457,7 +2457,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p) + * @p: pointer to desired bits + * + * Set the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ +@@ -2469,7 +2469,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd, + unsigned int set, clear, val; + + if (tty->ops->tiocmset == NULL) +- return -EINVAL; ++ return -ENOTTY; + + retval = get_user(val, p); + if (retval) +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index 71dbc891851a..e10b09672345 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -236,7 +236,7 @@ + * + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel + * structure to complete. This method is optional and will only be called +- * if provided (otherwise EINVAL will be returned). ++ * if provided (otherwise ENOTTY will be returned). + */ + + #include +-- +2.30.2 + diff --git a/queue-4.19/ttyprintk-add-tty-hangup-callback.patch b/queue-4.19/ttyprintk-add-tty-hangup-callback.patch new file mode 100644 index 00000000000..50bee116a1e --- /dev/null +++ b/queue-4.19/ttyprintk-add-tty-hangup-callback.patch @@ -0,0 +1,87 @@ +From 8b80aa2a0bfb2c5ce625b99c3e2bb60f23fbb4c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 09:22:22 +0900 +Subject: ttyprintk: Add TTY hangup callback. + +From: Tetsuo Handa + +[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ] + +syzbot is reporting hung task due to flood of + + tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__, + port->count); + +message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from +decrementing port->count due to tty_hung_up_p() == true. + +---------- +#include +#include +#include +#include +#include + +int main(int argc, char *argv[]) +{ + int i; + int fd[10]; + + for (i = 0; i < 10; i++) + fd[i] = open("/dev/ttyprintk", O_WRONLY); + ioctl(fd[0], TIOCVHANGUP); + for (i = 0; i < 10; i++) + close(fd[i]); + close(open("/dev/ttyprintk", O_WRONLY)); + return 0; +} +---------- + +When TTY hangup happens, port->count needs to be reset via +"struct tty_operations"->hangup callback. + +[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a + +Reported-by: syzbot +Reported-by: syzbot +Tested-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: 24b4b67d17c308aa ("add ttyprintk driver") +Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/ttyprintk.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c +index 774748497ace..e56ac5adb5fc 100644 +--- a/drivers/char/ttyprintk.c ++++ b/drivers/char/ttyprintk.c +@@ -159,12 +159,23 @@ static int tpk_ioctl(struct tty_struct *tty, + return 0; + } + ++/* ++ * TTY operations hangup function. ++ */ ++static void tpk_hangup(struct tty_struct *tty) ++{ ++ struct ttyprintk_port *tpkp = tty->driver_data; ++ ++ tty_port_hangup(&tpkp->port); ++} ++ + static const struct tty_operations ttyprintk_ops = { + .open = tpk_open, + .close = tpk_close, + .write = tpk_write, + .write_room = tpk_write_room, + .ioctl = tpk_ioctl, ++ .hangup = tpk_hangup, + }; + + static const struct tty_port_operations null_ops = { }; +-- +2.30.2 + diff --git a/queue-4.19/usb-cdc-acm-fix-unprivileged-tioccserial.patch b/queue-4.19/usb-cdc-acm-fix-unprivileged-tioccserial.patch new file mode 100644 index 00000000000..77d08216f90 --- /dev/null +++ b/queue-4.19/usb-cdc-acm-fix-unprivileged-tioccserial.patch @@ -0,0 +1,48 @@ +From 7563e3028648e463bedc7d0aabc70207e7bec4ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:16:01 +0200 +Subject: USB: cdc-acm: fix unprivileged TIOCCSERIAL + +From: Johan Hovold + +[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the cdc-acm implementation which instead indicated that the +TIOCSSERIAL ioctl was not even implemented when a non-privileged user +set the current values. + +Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)") +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 7f4f21ba8efc..738de8c9c354 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -987,8 +987,6 @@ static int set_serial_info(struct acm *acm, + if ((new_serial.close_delay != old_close_delay) || + (new_serial.closing_wait != old_closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; +-- +2.30.2 + diff --git a/queue-4.19/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch b/queue-4.19/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch new file mode 100644 index 00000000000..a7ca121218f --- /dev/null +++ b/queue-4.19/usb-dwc2-fix-hibernation-between-host-and-device-mod.patch @@ -0,0 +1,221 @@ +From 5034896a56e99f71f6b81cf7123e64c0e57316b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 16:47:14 +0400 +Subject: usb: dwc2: Fix hibernation between host and device modes. + +From: Artur Petrosyan + +[ Upstream commit 24d209dba5a3959b2ebde7cf3ad40c8015e814cf ] + +When core is in hibernation in host mode and a device cable +was connected then driver exited from device hibernation. +However, registers saved for host mode and when exited from +device hibernation register restore would be done for device +register which was wrong because there was no device registers +stored to restore. + +- Added dwc_handle_gpwrdn_disc_det() function which handles + gpwrdn disconnect detect flow and exits hibernation + without restoring the registers. +- Updated exiting from hibernation in GPWRDN_STS_CHGINT with + calling dwc_handle_gpwrdn_disc_det() function. Here no register + is restored which is the solution described above. + +Fixes: 65c9c4c6b01f ("usb: dwc2: Add dwc2_handle_gpwrdn_intr() handler") +Acked-by: Minas Harutyunyan +Signed-off-by: Artur Petrosyan +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/20210416124715.75355A005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/core_intr.c | 154 +++++++++++++++++++---------------- + 1 file changed, 83 insertions(+), 71 deletions(-) + +diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c +index 14efa28e048f..af26a8a20e0b 100644 +--- a/drivers/usb/dwc2/core_intr.c ++++ b/drivers/usb/dwc2/core_intr.c +@@ -653,6 +653,71 @@ static u32 dwc2_read_common_intr(struct dwc2_hsotg *hsotg) + return 0; + } + ++/** ++ * dwc_handle_gpwrdn_disc_det() - Handles the gpwrdn disconnect detect. ++ * Exits hibernation without restoring registers. ++ * ++ * @hsotg: Programming view of DWC_otg controller ++ * @gpwrdn: GPWRDN register ++ */ ++static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg, ++ u32 gpwrdn) ++{ ++ u32 gpwrdn_tmp; ++ ++ /* Switch-on voltage to the core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Reset core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Disable Power Down Clamp */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Deassert reset core */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp |= GPWRDN_PWRDNRSTN; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ udelay(5); ++ ++ /* Disable PMU interrupt */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PMUINTSEL; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ ++ /* De-assert Wakeup Logic */ ++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn_tmp &= ~GPWRDN_PMUACTV; ++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); ++ ++ hsotg->hibernated = 0; ++ hsotg->bus_suspended = 0; ++ ++ if (gpwrdn & GPWRDN_IDSTS) { ++ hsotg->op_state = OTG_STATE_B_PERIPHERAL; ++ dwc2_core_init(hsotg, false); ++ dwc2_enable_global_interrupts(hsotg); ++ dwc2_hsotg_core_init_disconnected(hsotg, false); ++ dwc2_hsotg_core_connect(hsotg); ++ } else { ++ hsotg->op_state = OTG_STATE_A_HOST; ++ ++ /* Initialize the Core for Host mode */ ++ dwc2_core_init(hsotg, false); ++ dwc2_enable_global_interrupts(hsotg); ++ dwc2_hcd_start(hsotg); ++ } ++} ++ + /* + * GPWRDN interrupt handler. + * +@@ -674,64 +739,14 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg) + + if ((gpwrdn & GPWRDN_DISCONN_DET) && + (gpwrdn & GPWRDN_DISCONN_DET_MSK) && !linestate) { +- u32 gpwrdn_tmp; +- + dev_dbg(hsotg->dev, "%s: GPWRDN_DISCONN_DET\n", __func__); +- +- /* Switch-on voltage to the core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Reset core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Disable Power Down Clamp */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Deassert reset core */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp |= GPWRDN_PWRDNRSTN; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- udelay(10); +- +- /* Disable PMU interrupt */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PMUINTSEL; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- +- /* De-assert Wakeup Logic */ +- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN); +- gpwrdn_tmp &= ~GPWRDN_PMUACTV; +- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN); +- +- hsotg->hibernated = 0; +- +- if (gpwrdn & GPWRDN_IDSTS) { +- hsotg->op_state = OTG_STATE_B_PERIPHERAL; +- dwc2_core_init(hsotg, false); +- dwc2_enable_global_interrupts(hsotg); +- dwc2_hsotg_core_init_disconnected(hsotg, false); +- dwc2_hsotg_core_connect(hsotg); +- } else { +- hsotg->op_state = OTG_STATE_A_HOST; +- +- /* Initialize the Core for Host mode */ +- dwc2_core_init(hsotg, false); +- dwc2_enable_global_interrupts(hsotg); +- dwc2_hcd_start(hsotg); +- } +- } +- +- if ((gpwrdn & GPWRDN_LNSTSCHG) && +- (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) { ++ /* ++ * Call disconnect detect function to exit from ++ * hibernation ++ */ ++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn); ++ } else if ((gpwrdn & GPWRDN_LNSTSCHG) && ++ (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) { + dev_dbg(hsotg->dev, "%s: GPWRDN_LNSTSCHG\n", __func__); + if (hsotg->hw_params.hibernation && + hsotg->hibernated) { +@@ -742,24 +757,21 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg) + dwc2_exit_hibernation(hsotg, 1, 0, 1); + } + } +- } +- if ((gpwrdn & GPWRDN_RST_DET) && (gpwrdn & GPWRDN_RST_DET_MSK)) { ++ } else if ((gpwrdn & GPWRDN_RST_DET) && ++ (gpwrdn & GPWRDN_RST_DET_MSK)) { + dev_dbg(hsotg->dev, "%s: GPWRDN_RST_DET\n", __func__); + if (!linestate && (gpwrdn & GPWRDN_BSESSVLD)) + dwc2_exit_hibernation(hsotg, 0, 1, 0); +- } +- if ((gpwrdn & GPWRDN_STS_CHGINT) && +- (gpwrdn & GPWRDN_STS_CHGINT_MSK) && linestate) { ++ } else if ((gpwrdn & GPWRDN_STS_CHGINT) && ++ (gpwrdn & GPWRDN_STS_CHGINT_MSK)) { + dev_dbg(hsotg->dev, "%s: GPWRDN_STS_CHGINT\n", __func__); +- if (hsotg->hw_params.hibernation && +- hsotg->hibernated) { +- if (gpwrdn & GPWRDN_IDSTS) { +- dwc2_exit_hibernation(hsotg, 0, 0, 0); +- call_gadget(hsotg, resume); +- } else { +- dwc2_exit_hibernation(hsotg, 1, 0, 1); +- } +- } ++ /* ++ * As GPWRDN_STS_CHGINT exit from hibernation flow is ++ * the same as in GPWRDN_DISCONN_DET flow. Call ++ * disconnect detect helper function to exit from ++ * hibernation. ++ */ ++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn); + } + } + +-- +2.30.2 + diff --git a/queue-4.19/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch b/queue-4.19/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch new file mode 100644 index 00000000000..93a340d32d7 --- /dev/null +++ b/queue-4.19/usb-dwc2-fix-host-mode-hibernation-exit-with-remote-.patch @@ -0,0 +1,47 @@ +From d0faa7f7a1a5ad796193f6c96ef8567ddd39b459 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 16:47:06 +0400 +Subject: usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. + +From: Artur Petrosyan + +[ Upstream commit c2db8d7b9568b10e014af83b3c15e39929e3579e ] + +Added setting "port_connect_status_change" flag to "1" in order +to re-enumerate, because after exit from hibernation port +connection status is not detected. + +Fixes: c5c403dc4336 ("usb: dwc2: Add host/device hibernation functions") +Acked-by: Minas Harutyunyan +Signed-off-by: Artur Petrosyan +Link: https://lore.kernel.org/r/20210416124707.5EEC2A005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/hcd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 91686e1b24d9..58e53e3d905b 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -5741,7 +5741,15 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup, + return ret; + } + +- dwc2_hcd_rem_wakeup(hsotg); ++ if (rem_wakeup) { ++ dwc2_hcd_rem_wakeup(hsotg); ++ /* ++ * Change "port_connect_status_change" flag to re-enumerate, ++ * because after exit from hibernation port connection status ++ * is not detected. ++ */ ++ hsotg->flags.b.port_connect_status_change = 1; ++ } + + hsotg->hibernated = 0; + hsotg->bus_suspended = 0; +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-aspeed-fix-dma-map-failure.patch b/queue-4.19/usb-gadget-aspeed-fix-dma-map-failure.patch new file mode 100644 index 00000000000..c624b9ff441 --- /dev/null +++ b/queue-4.19/usb-gadget-aspeed-fix-dma-map-failure.patch @@ -0,0 +1,87 @@ +From dbf5b12ed98f1a641530811a98f5b6061ff3541d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 21:58:31 -0700 +Subject: usb: gadget: aspeed: fix dma map failure + +From: Tao Ren + +[ Upstream commit bd4d607044b961cecbf8c4c2f3bb5da4fb156993 ] + +Currently the virtual port_dev device is passed to DMA API, and this is +wrong because the device passed to DMA API calls must be the actual +hardware device performing the DMA. + +The patch replaces usb_gadget_map_request/usb_gadget_unmap_request APIs +with usb_gadget_map_request_by_dev/usb_gadget_unmap_request_by_dev APIs +so the DMA capable platform device can be passed to the DMA APIs. + +The patch fixes below backtrace detected on Facebook AST2500 OpenBMC +platforms: + +[<80106550>] show_stack+0x20/0x24 +[<80106868>] dump_stack+0x28/0x30 +[<80823540>] __warn+0xfc/0x110 +[<8011ac30>] warn_slowpath_fmt+0xb0/0xc0 +[<8011ad44>] dma_map_page_attrs+0x24c/0x314 +[<8016a27c>] usb_gadget_map_request_by_dev+0x100/0x1e4 +[<805cedd8>] usb_gadget_map_request+0x1c/0x20 +[<805cefbc>] ast_vhub_epn_queue+0xa0/0x1d8 +[<7f02f710>] usb_ep_queue+0x48/0xc4 +[<805cd3e8>] ecm_do_notify+0xf8/0x248 +[<7f145920>] ecm_set_alt+0xc8/0x1d0 +[<7f145c34>] composite_setup+0x680/0x1d30 +[<7f00deb8>] ast_vhub_ep0_handle_setup+0xa4/0x1bc +[<7f02ee94>] ast_vhub_dev_irq+0x58/0x84 +[<7f0309e0>] ast_vhub_irq+0xb0/0x1c8 +[<7f02e118>] __handle_irq_event_percpu+0x50/0x19c +[<8015e5bc>] handle_irq_event_percpu+0x38/0x8c +[<8015e758>] handle_irq_event+0x38/0x4c + +Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub") +Reviewed-by: Joel Stanley +Signed-off-by: Tao Ren +Link: https://lore.kernel.org/r/20210331045831.28700-1-rentao.bupt@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/aspeed-vhub/core.c | 3 ++- + drivers/usb/gadget/udc/aspeed-vhub/epn.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/aspeed-vhub/core.c b/drivers/usb/gadget/udc/aspeed-vhub/core.c +index db3628be38c0..902e61be4d64 100644 +--- a/drivers/usb/gadget/udc/aspeed-vhub/core.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/core.c +@@ -36,6 +36,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req, + int status) + { + bool internal = req->internal; ++ struct ast_vhub *vhub = ep->vhub; + + EPVDBG(ep, "completing request @%p, status %d\n", req, status); + +@@ -46,7 +47,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req, + + if (req->req.dma) { + if (!WARN_ON(!ep->dev)) +- usb_gadget_unmap_request(&ep->dev->gadget, ++ usb_gadget_unmap_request_by_dev(&vhub->pdev->dev, + &req->req, ep->epn.is_in); + req->req.dma = 0; + } +diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c +index ae853cf36966..931f540a747e 100644 +--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c +@@ -376,7 +376,7 @@ static int ast_vhub_epn_queue(struct usb_ep* u_ep, struct usb_request *u_req, + if (ep->epn.desc_mode || + ((((unsigned long)u_req->buf & 7) == 0) && + (ep->epn.is_in || !(u_req->length & (u_ep->maxpacket - 1))))) { +- rc = usb_gadget_map_request(&ep->dev->gadget, u_req, ++ rc = usb_gadget_map_request_by_dev(&vhub->pdev->dev, u_req, + ep->epn.is_in); + if (rc) { + dev_warn(&vhub->pdev->dev, +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-pch_udc-check-for-dma-mapping-error.patch b/queue-4.19/usb-gadget-pch_udc-check-for-dma-mapping-error.patch new file mode 100644 index 00000000000..e10bc5d1699 --- /dev/null +++ b/queue-4.19/usb-gadget-pch_udc-check-for-dma-mapping-error.patch @@ -0,0 +1,39 @@ +From a03e7a124809117496e6c03f7358a1952c9c83d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:22 +0200 +Subject: usb: gadget: pch_udc: Check for DMA mapping error + +From: Andy Shevchenko + +[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ] + +DMA mapping might fail, we have to check it with dma_mapping_error(). +Otherwise DMA-API is not happy: + + DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single] + +Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index d87c9217cb57..14e99905cbee 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -2973,7 +2973,7 @@ static int init_dma_pools(struct pch_udc_dev *dev) + dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf, + UDC_EP0OUT_BUFF_SIZE * 4, + DMA_FROM_DEVICE); +- return 0; ++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr); + } + + static int pch_udc_start(struct usb_gadget *g, +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-pch_udc-check-if-driver-is-present-before.patch b/queue-4.19/usb-gadget-pch_udc-check-if-driver-is-present-before.patch new file mode 100644 index 00000000000..128de847589 --- /dev/null +++ b/queue-4.19/usb-gadget-pch_udc-check-if-driver-is-present-before.patch @@ -0,0 +1,99 @@ +From be3501697c334855b9b6d598687bd2c3a3ff3382 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:21 +0200 +Subject: usb: gadget: pch_udc: Check if driver is present before calling + ->setup() + +From: Andy Shevchenko + +[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ] + +Since we have a separate routine for VBUS sense, the interrupt may occur +before gadget driver is present. Hence, ->setup() call may oops the kernel: + +[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010 +... +[ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f +... +[ 55.245843] +[ 55.245843] ? pch_udc_svc_data_out+0x160/0x160 + +Check if driver is present before calling ->setup(). + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 527814361c3d..d87c9217cb57 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -2325,6 +2325,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num) + pch_udc_set_dma(dev, DMA_DIR_RX); + } + ++static int pch_udc_gadget_setup(struct pch_udc_dev *dev) ++ __must_hold(&dev->lock) ++{ ++ int rc; ++ ++ /* In some cases we can get an interrupt before driver gets setup */ ++ if (!dev->driver) ++ return -ESHUTDOWN; ++ ++ spin_unlock(&dev->lock); ++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); ++ return rc; ++} ++ + /** + * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts + * @dev: Reference to the device structure +@@ -2396,15 +2411,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev) + dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep; + else /* OUT */ + dev->gadget.ep0 = &ep->ep; +- spin_lock(&dev->lock); + /* If Mass storage Reset */ + if ((dev->setup_data.bRequestType == 0x21) && + (dev->setup_data.bRequest == 0xFF)) + dev->prot_stall = 0; + /* call gadget with setup data received */ +- setup_supported = dev->driver->setup(&dev->gadget, +- &dev->setup_data); +- spin_unlock(&dev->lock); ++ setup_supported = pch_udc_gadget_setup(dev); + + if (dev->setup_data.bRequestType & USB_DIR_IN) { + ep->td_data->status = (ep->td_data->status & +@@ -2652,9 +2664,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) + dev->ep[i].halted = 0; + } + dev->stall = 0; +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +@@ -2689,9 +2699,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) + dev->stall = 0; + + /* call gadget zero with setup data received */ +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch b/queue-4.19/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch new file mode 100644 index 00000000000..d721ac5b3d8 --- /dev/null +++ b/queue-4.19/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch @@ -0,0 +1,42 @@ +From e80cd5b8bb020dbddeaa4dbede27433e07983668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:20 +0200 +Subject: usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() + +From: Andy Shevchenko + +[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ] + +Either way ~0 will be in the correct byte order, hence +replace cpu_to_le32() by lower_32_bits(). Moreover, +it makes sparse happy, otherwise it complains: + +.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types) +.../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr +.../pch_udc.c:1813:27: got restricted __le32 [usertype] + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 8e304e9845d9..527814361c3d 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1782,7 +1782,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep, + } + /* prevent from using desc. - set HOST BUSY */ + dma_desc->status |= PCH_UDC_BS_HST_BSY; +- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID); ++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID); + req->td_data = dma_desc; + req->td_data_last = dma_desc; + req->chain_len = 1; +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-r8a66597-add-missing-null-check-on-return.patch b/queue-4.19/usb-gadget-r8a66597-add-missing-null-check-on-return.patch new file mode 100644 index 00000000000..fa91ca1d27c --- /dev/null +++ b/queue-4.19/usb-gadget-r8a66597-add-missing-null-check-on-return.patch @@ -0,0 +1,39 @@ +From 2b3aef868e90f496688ebcbbf5a0530ee53bdfc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 19:45:10 +0100 +Subject: usb: gadget: r8a66597: Add missing null check on return from + platform_get_resource + +From: Colin Ian King + +[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ] + +The call to platform_get_resource can potentially return a NULL pointer +on failure, so add this check and return -EINVAL if it fails. + +Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Dereference null return") +Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index 11e25a3f4f1f..a766476fd742 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1852,6 +1852,8 @@ static int r8a66597_probe(struct platform_device *pdev) + return PTR_ERR(reg); + + ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (!ires) ++ return -EINVAL; + irq = ires->start; + irq_trigger = ires->flags & IRQF_TRIGGER_MASK; + +-- +2.30.2 + diff --git a/queue-4.19/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch b/queue-4.19/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch new file mode 100644 index 00000000000..4bc280abc9e --- /dev/null +++ b/queue-4.19/usb-gadget-udc-fix-wrong-pointer-passed-to-is_err-an.patch @@ -0,0 +1,40 @@ +From 200c2b033d493cc753b0e9995b540f4b3d014b49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 21:01:59 +0800 +Subject: USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() + +From: Yang Yingliang + +[ Upstream commit 2e3d055bf27d70204cae349335a62a4f9b7c165a ] + +IS_ERR() and PTR_ERR() use wrong pointer, it should be +udc->virt_addr, fix it. + +Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210330130159.1051979-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/snps_udc_plat.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c +index 32f1d3e90c26..99805d60a7ab 100644 +--- a/drivers/usb/gadget/udc/snps_udc_plat.c ++++ b/drivers/usb/gadget/udc/snps_udc_plat.c +@@ -114,8 +114,8 @@ static int udc_plat_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + udc->virt_addr = devm_ioremap_resource(dev, res); +- if (IS_ERR(udc->regs)) +- return PTR_ERR(udc->regs); ++ if (IS_ERR(udc->virt_addr)) ++ return PTR_ERR(udc->virt_addr); + + /* udc csr registers base */ + udc->csr = udc->virt_addr + UDC_CSR_ADDR; +-- +2.30.2 + diff --git a/queue-4.19/usb-typec-tcpci-check-role_control-while-interpretin.patch b/queue-4.19/usb-typec-tcpci-check-role_control-while-interpretin.patch new file mode 100644 index 00000000000..f64f9c36d42 --- /dev/null +++ b/queue-4.19/usb-typec-tcpci-check-role_control-while-interpretin.patch @@ -0,0 +1,98 @@ +From 705740c20e1fe56bd11a5a9eee617a2bd11a941c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 23:09:31 -0800 +Subject: usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS + +From: Badhri Jagan Sridharan + +[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ] + +While interpreting CC_STATUS, ROLE_CONTROL has to be read to make +sure that CC1/CC2 is not forced presenting Rp/Rd. + +>From the TCPCI spec: + +4.4.5.2 ROLE_CONTROL (Normative): +The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes +to control the Rp/Rd directly instead of having the TCPC perform +DRP toggling autonomously. When controlling Rp/Rd directly, the +TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the +CC1/CC2 values. This control is used for TCPM-TCPC implementing +Source or Sink only as well as when a connection has been detected +via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk. + +Table 4-22. CC_STATUS Register Definition: +If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1) +00b: SNK.Open (Below maximum vRa) +01b: SNK.Default (Above minimum vRd-Connect) +10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A +11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A + +If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1) +00b: SNK.Open (Below maximum vRa) +01b: SNK.Default (Above minimum vRd-Connect) +10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A +11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A + +Fixes: 74e656d6b0551 ("staging: typec: Type-C Port Controller Interface driver (tcpci)") +Acked-by: Heikki Krogerus +Signed-off-by: Badhri Jagan Sridharan +Link: https://lore.kernel.org/r/20210304070931.1947316-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tcpci.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c +index dfae41fe1331..2c34add37708 100644 +--- a/drivers/usb/typec/tcpci.c ++++ b/drivers/usb/typec/tcpci.c +@@ -20,6 +20,15 @@ + + #define PD_RETRY_COUNT 3 + ++#define tcpc_presenting_cc1_rd(reg) \ ++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ ++ (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \ ++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT))) ++#define tcpc_presenting_cc2_rd(reg) \ ++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ ++ (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \ ++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT))) ++ + struct tcpci { + struct device *dev; + +@@ -168,19 +177,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc, + enum typec_cc_status *cc1, enum typec_cc_status *cc2) + { + struct tcpci *tcpci = tcpc_to_tcpci(tcpc); +- unsigned int reg; ++ unsigned int reg, role_control; + int ret; + ++ ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control); ++ if (ret < 0) ++ return ret; ++ + ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, ®); + if (ret < 0) + return ret; + + *cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) & + TCPC_CC_STATUS_CC1_MASK, +- reg & TCPC_CC_STATUS_TERM); ++ reg & TCPC_CC_STATUS_TERM || ++ tcpc_presenting_cc1_rd(role_control)); + *cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) & + TCPC_CC_STATUS_CC2_MASK, +- reg & TCPC_CC_STATUS_TERM); ++ reg & TCPC_CC_STATUS_TERM || ++ tcpc_presenting_cc2_rd(role_control)); + + return 0; + } +-- +2.30.2 + diff --git a/queue-4.19/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch b/queue-4.19/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch new file mode 100644 index 00000000000..52e20e47e3f --- /dev/null +++ b/queue-4.19/usbip-vudc-fix-missing-unlock-on-error-in-usbip_sock.patch @@ -0,0 +1,45 @@ +From 8ad4778db9334be6c7a1bef8a92009b09d0c23e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 19:23:05 +0800 +Subject: usbip: vudc: fix missing unlock on error in usbip_sockfd_store() + +From: Ye Bin + +[ Upstream commit 1d08ed588c6a85a35a24c82eb4cf0807ec2b366a ] + +Add the missing unlock before return from function usbip_sockfd_store() +in the error handling case. + +Fixes: bd8b82042269 ("usbip: vudc synchronize sysfs code paths") +Reported-by: Hulk Robot +Acked-by: Shuah Khan +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20210408112305.1022247-1-yebin10@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vudc_sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c +index de2babadd146..7b1437a51304 100644 +--- a/drivers/usb/usbip/vudc_sysfs.c ++++ b/drivers/usb/usbip/vudc_sysfs.c +@@ -157,12 +157,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, + tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); ++ mutex_unlock(&udc->ud.sysfs_lock); + return -EINVAL; + } + tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); ++ mutex_unlock(&udc->ud.sysfs_lock); + return -EINVAL; + } + +-- +2.30.2 + diff --git a/queue-4.19/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch b/queue-4.19/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch new file mode 100644 index 00000000000..86dbef5dde3 --- /dev/null +++ b/queue-4.19/vfio-mdev-do-not-allow-a-mdev_type-to-have-a-null-pa.patch @@ -0,0 +1,56 @@ +From 4e68e4b8a549752c056f4a17d55ad20ffa3e9e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 16:40:25 -0300 +Subject: vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer + +From: Jason Gunthorpe + +[ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ] + +There is a small race where the parent is NULL even though the kobj has +already been made visible in sysfs. + +For instance the attribute_group is made visible in sysfs_create_files() +and the mdev_type_attr_show() does: + + ret = attr->show(kobj, type->parent->dev, buf); + +Which will crash on NULL parent. Move the parent setup to before the type +pointer leaves the stack frame. + +Fixes: 7b96953bc640 ("vfio: Mediated device Core driver") +Reviewed-by: Christoph Hellwig +Reviewed-by: Kevin Tian +Reviewed-by: Max Gurtovoy +Reviewed-by: Cornelia Huck +Signed-off-by: Jason Gunthorpe +Message-Id: <2-v2-d36939638fc6+d54-vfio2_jgg@nvidia.com> +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/mdev/mdev_sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c +index 1692a0cc3036..c99fcc6c2eba 100644 +--- a/drivers/vfio/mdev/mdev_sysfs.c ++++ b/drivers/vfio/mdev/mdev_sysfs.c +@@ -108,6 +108,7 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, + return ERR_PTR(-ENOMEM); + + type->kobj.kset = parent->mdev_types_kset; ++ type->parent = parent; + + ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL, + "%s-%s", dev_driver_string(parent->dev), +@@ -135,7 +136,6 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, + } + + type->group = group; +- type->parent = parent; + return type; + + attrs_failed: +-- +2.30.2 + diff --git a/queue-4.19/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch b/queue-4.19/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch new file mode 100644 index 00000000000..21773b475d5 --- /dev/null +++ b/queue-4.19/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch @@ -0,0 +1,50 @@ +From 9ee315b33f6d73ce111a4b7fa1e0334e5cd47924 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 12:44:16 +0200 +Subject: vsock/vmci: log once the failed queue pair allocation + +From: Stefano Garzarella + +[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ] + +VMCI feature is not supported in conjunction with the vSphere Fault +Tolerance (FT) feature. + +VMware Tools can repeatedly try to create a vsock connection. If FT is +enabled the kernel logs is flooded with the following messages: + + qp_alloc_hypercall result = -20 + Could not attach to queue pair with -20 + +"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 +("VMCI: Stop log spew when qp allocation isn't possible"), but "Could +not attach to queue pair with -20" is still there flooding the log. + +Since the error message can be useful in some cases, print it only once. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: Stefano Garzarella +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index c3d5ab01fba7..42ab3e2ac060 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -584,8 +584,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, + peer, flags, VMCI_NO_PRIVILEGE_FLAGS); + out: + if (err < 0) { +- pr_err("Could not attach to queue pair with %d\n", +- err); ++ pr_err_once("Could not attach to queue pair with %d\n", err); + err = vmci_transport_error_to_vsock_error(err); + } + +-- +2.30.2 + diff --git a/queue-4.19/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch b/queue-4.19/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch new file mode 100644 index 00000000000..21cfaea0319 --- /dev/null +++ b/queue-4.19/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch @@ -0,0 +1,55 @@ +From 98b32b6dadb681eb0ffdd89f559e79aa5ad58eff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 17:11:11 -0700 +Subject: x86/events/amd/iommu: Fix sysfs type mismatch + +From: Nathan Chancellor + +[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ] + +dev_attr_show() calls _iommu_event_show() via an indirect call but +_iommu_event_show()'s type does not currently match the type of the +show() member in 'struct device_attribute', resulting in a Control Flow +Integrity violation. + +$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit +csource=0x0a + +$ dmesg | grep "CFI failure" +[ 3526.735140] CFI failure (target: _iommu_event_show...): + +Change _iommu_event_show() and 'struct amd_iommu_event_desc' to +'struct device_attribute' so that there is no more CFI violation. + +Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation") +Signed-off-by: Nathan Chancellor +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/iommu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c +index 0014d26391fa..c08bcba5c3a9 100644 +--- a/arch/x86/events/amd/iommu.c ++++ b/arch/x86/events/amd/iommu.c +@@ -84,12 +84,12 @@ static struct attribute_group amd_iommu_events_group = { + }; + + struct amd_iommu_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *event; + }; + +-static ssize_t _iommu_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++static ssize_t _iommu_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct amd_iommu_event_desc *event = + container_of(attr, struct amd_iommu_event_desc, attr); +-- +2.30.2 + diff --git a/queue-4.19/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch b/queue-4.19/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch new file mode 100644 index 00000000000..25087ae3f36 --- /dev/null +++ b/queue-4.19/x86-kprobes-fix-to-check-non-boostable-prefixes-corr.patch @@ -0,0 +1,73 @@ +From 1e0e76ca8f01bda2aae579c470977653481a1666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 19:08:31 +0900 +Subject: x86/kprobes: Fix to check non boostable prefixes correctly + +From: Masami Hiramatsu + +[ Upstream commit 6dd3b8c9f58816a1354be39559f630cd1bd12159 ] + +There are 2 bugs in the can_boost() function because of using +x86 insn decoder. Since the insn->opcode never has a prefix byte, +it can not find CS override prefix in it. And the insn->attr is +the attribute of the opcode, thus inat_is_address_size_prefix( +insn->attr) always returns false. + +Fix those by checking each prefix bytes with for_each_insn_prefix +loop and getting the correct attribute for each prefix byte. +Also, this removes unlikely, because this is a slow path. + +Fixes: a8d11cd0714f ("kprobes/x86: Consolidate insn decoder users for copying code") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/161666691162.1120877.2808435205294352583.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kprobes/core.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index dfc3ab44bc5d..3334e1400345 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -170,6 +170,8 @@ NOKPROBE_SYMBOL(skip_prefixes); + int can_boost(struct insn *insn, void *addr) + { + kprobe_opcode_t opcode; ++ insn_byte_t prefix; ++ int i; + + if (search_exception_tables((unsigned long)addr)) + return 0; /* Page fault may occur on this address. */ +@@ -182,9 +184,14 @@ int can_boost(struct insn *insn, void *addr) + if (insn->opcode.nbytes != 1) + return 0; + +- /* Can't boost Address-size override prefix */ +- if (unlikely(inat_is_address_size_prefix(insn->attr))) +- return 0; ++ for_each_insn_prefix(insn, i, prefix) { ++ insn_attr_t attr; ++ ++ attr = inat_get_opcode_attribute(prefix); ++ /* Can't boost Address-size override prefix and CS override prefix */ ++ if (prefix == 0x2e || inat_is_address_size_prefix(attr)) ++ return 0; ++ } + + opcode = insn->opcode.bytes[0]; + +@@ -209,8 +216,8 @@ int can_boost(struct insn *insn, void *addr) + /* clear and set flags are boostable */ + return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe)); + default: +- /* CS override prefix and call are not boostable */ +- return (opcode != 0x2e && opcode != 0x9a); ++ /* call is not boostable */ ++ return opcode != 0x9a; + } + } + +-- +2.30.2 + diff --git a/queue-4.19/x86-microcode-check-for-offline-cpus-before-requesti.patch b/queue-4.19/x86-microcode-check-for-offline-cpus-before-requesti.patch new file mode 100644 index 00000000000..8336b53688b --- /dev/null +++ b/queue-4.19/x86-microcode-check-for-offline-cpus-before-requesti.patch @@ -0,0 +1,90 @@ +From 220942d308920f020ae72bc79000c4b536678b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 09:55:15 -0700 +Subject: x86/microcode: Check for offline CPUs before requesting new microcode + +From: Otavio Pontes + +[ Upstream commit 7189b3c11903667808029ec9766a6e96de5012a5 ] + +Currently, the late microcode loading mechanism checks whether any CPUs +are offlined, and, in such a case, aborts the load attempt. + +However, this must be done before the kernel caches new microcode from +the filesystem. Otherwise, when offlined CPUs are onlined later, those +cores are going to be updated through the CPU hotplug notifier callback +with the new microcode, while CPUs previously onine will continue to run +with the older microcode. + +For example: + +Turn off one core (2 threads): + + echo 0 > /sys/devices/system/cpu/cpu3/online + echo 0 > /sys/devices/system/cpu/cpu1/online + +Install the ucode fails because a primary SMT thread is offline: + + cp intel-ucode/06-8e-09 /lib/firmware/intel-ucode/ + echo 1 > /sys/devices/system/cpu/microcode/reload + bash: echo: write error: Invalid argument + +Turn the core back on + + echo 1 > /sys/devices/system/cpu/cpu3/online + echo 1 > /sys/devices/system/cpu/cpu1/online + cat /proc/cpuinfo |grep microcode + microcode : 0x30 + microcode : 0xde + microcode : 0x30 + microcode : 0xde + +The rationale for why the update is aborted when at least one primary +thread is offline is because even if that thread is soft-offlined +and idle, it will still have to participate in broadcasted MCE's +synchronization dance or enter SMM, and in both examples it will execute +instructions so it better have the same microcode revision as the other +cores. + + [ bp: Heavily edit and extend commit message with the reasoning behind all + this. ] + +Fixes: 30ec26da9967 ("x86/microcode: Do not upload microcode if CPUs are offline") +Signed-off-by: Otavio Pontes +Signed-off-by: Borislav Petkov +Reviewed-by: Tony Luck +Acked-by: Ashok Raj +Link: https://lkml.kernel.org/r/20210319165515.9240-2-otavio.pontes@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/microcode/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index a96091d44a45..eab4de387ce6 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -627,16 +627,16 @@ static ssize_t reload_store(struct device *dev, + if (val != 1) + return size; + +- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); +- if (tmp_ret != UCODE_NEW) +- return size; +- + get_online_cpus(); + + ret = check_online_cpus(); + if (ret) + goto put; + ++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); ++ if (tmp_ret != UCODE_NEW) ++ goto put; ++ + mutex_lock(µcode_mutex); + ret = microcode_reload_late(); + mutex_unlock(µcode_mutex); +-- +2.30.2 + diff --git a/queue-4.19/x86-platform-uv-fix-kexec-build-failure.patch b/queue-4.19/x86-platform-uv-fix-kexec-build-failure.patch new file mode 100644 index 00000000000..2fcf5901cfa --- /dev/null +++ b/queue-4.19/x86-platform-uv-fix-kexec-build-failure.patch @@ -0,0 +1,64 @@ +From 2d7757967f3b2289ecb3b53ca90942c21ed2b5ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 09:47:42 +0200 +Subject: x86/platform/uv: Fix !KEXEC build failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ingo Molnar + +[ Upstream commit c2209ea55612efac75de0a58ef5f7394fae7fa0f ] + +When KEXEC is disabled, the UV build fails: + + arch/x86/platform/uv/uv_nmi.c:875:14: error: ‘uv_nmi_kexec_failed’ undeclared (first use in this function) + +Since uv_nmi_kexec_failed is only defined in the KEXEC_CORE #ifdef branch, +this code cannot ever have been build tested: + + if (main) + pr_err("UV: NMI kdump: KEXEC not supported in this kernel\n"); + atomic_set(&uv_nmi_kexec_failed, 1); + +Nor is this use possible in uv_handle_nmi(): + + atomic_set(&uv_nmi_kexec_failed, 0); + +These bugs were introduced in this commit: + + d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails") + +Which added the uv_nmi_kexec_failed assignments to !KEXEC code, while making the +definition KEXEC-only - apparently without testing the !KEXEC case. + +Instead of complicating the #ifdef maze, simplify the code by requiring X86_UV +to depend on KEXEC_CORE. This pattern is present in other architectures as well. + +( We'll remove the untested, 7 years old !KEXEC complications from the file in a + separate commit. ) + +Fixes: d0a9964e9873: ("x86/platform/uv: Implement simple dump failover if kdump fails") +Signed-off-by: Ingo Molnar +Cc: Mike Travis +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index af35f5caadbe..d994501d9179 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -533,6 +533,7 @@ config X86_UV + depends on X86_EXTENDED_PLATFORM + depends on NUMA + depends on EFI ++ depends on KEXEC_CORE + depends on X86_X2APIC + depends on PCI + ---help--- +-- +2.30.2 +