From 225b59f53eee6d772797b8fb0042e087e9ba74fa Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Jul 2020 21:19:21 -0400 Subject: [PATCH] Fixes for 5.7 Signed-off-by: Sasha Levin --- ...-fixup-for-yet-another-intel-referen.patch | 35 +++ ...ts-n900-remove-mmc1-card-detect-gpio.patch | 64 ++++++ ...og-gt-8k-fix-switch-link-configurati.patch | 53 +++++ ...sk_thread_flag-for-checking-tif_sing.patch | 43 ++++ ...wb-allow-mmiowb_set_pending-when-pre.patch | 85 +++++++ ...-bytcht_es8316-add-missed-put_device.patch | 42 ++++ ...x88172a-fix-ax88172a_unbind-failures.patch | 36 +++ ...pletion-ring-sizing-with-tpa-enabled.patch | 65 ++++++ ...x-race-when-modifying-pause-settings.patch | 44 ++++ ...tool-link-settings-after-reading-upd.patch | 51 +++++ ...ror-value-of-register_netdevice-imme.patch | 90 ++++++++ ...turn-value-of-register_netdevice-in-.patch | 46 ++++ ...-tls-alert-messages-corrupted-by-tls.patch | 51 +++++ ...ma-fix-wrong-tcd-endianness-for-big-.patch | 75 ++++++ ...ix-hw-descriptor-fields-for-delta-re.patch | 41 ++++ ...etting-ioat-timeout-as-module-parame.patch | 62 +++++ ...10-adma-fix-runtime-pm-imbalance-on-.patch | 49 ++++ ...udma-add-missing-put_device-call-in-.patch | 37 +++ ...udma-fix-cleanup-code-for-alloc_chan.patch | 107 +++++++++ ...udma-fix-the-running-channel-handlin.patch | 39 ++++ ...fsl_mc_get_endpoint-for-is_err_or_nu.patch | 38 +++ ...e-possible-memleak-in-dpaa_eth_probe.patch | 36 +++ ...-kernel-panic-when-rmmod-pmu-modules.patch | 129 +++++++++++ ...vent-forced-unbinding-of-pmu-drivers.patch | 197 ++++++++++++++++ .../drm-amdgpu-fix-preemption-unit-test.patch | 70 ++++++ ...gpu-gfx10-fix-race-condition-for-kiq.patch | 60 +++++ ...m-sun4i-hdmi-fix-inverted-hpd-result.patch | 40 ++++ ...se-rt-service-availability-via-efiva.patch | 173 ++++++++++++++ ...ove-the-mdio-bus-on-pf-probe-bailout.patch | 74 ++++++ ...-dfl-fix-bug-in-port-reset-handshake.patch | 40 ++++ ...pci-reduce-the-scope-of-variable-ret.patch | 54 +++++ ...initialized-value-in-geneve_changeli.patch | 44 ++++ ...lps-support-devices-with-report-id-2.patch | 41 ++++ ...e-fn-key-key-re-mapping-on-clone-key.patch | 100 ++++++++ ...mediacom-flexbook-edge13-to-descript.patch | 41 ++++ ...m-fixes-race-in-handling-device-list.patch | 59 +++++ ...-used-in-a-pci_free_consistent-in-an.patch | 39 ++++ ...ke-sure-we-are-reading-enough-data-f.patch | 71 ++++++ ...-tacho-avoid-possible-buffer-overflo.patch | 41 ++++ ...cept-peci-calibration-as-temperature.patch | 52 +++++ ...otential-buffer-overflow-in-scmi_hwm.patch | 43 ++++ ...-i2c-qcom-geni-fix-dma-transfer-race.patch | 93 ++++++++ ...ys-clear-icsar-to-avoid-side-effects.patch | 48 ++++ ...ne-possible-memleak-in-adf7242_probe.patch | 46 ++++ queue-5.7/input-add-sw_machine_cover.patch | 54 +++++ ...only-increment-wakeup-count-on-touch.patch | 73 ++++++ ...enable-intertouch-for-thinkpad-x1e-1.patch | 36 +++ ...domain-rather-than-dev-as-tlb-cookie.patch | 139 +++++++++++ ...c-fix-up-filter-locks-and-debug-msgs.patch | 123 ++++++++++ .../ionic-keep-rss-hash-after-fw-update.patch | 41 ++++ .../ionic-update-filter-id-after-replay.patch | 77 +++++++ ...se-mutex-to-protect-queue-operations.patch | 177 ++++++++++++++ ...nic-use-offset-for-ethtool-regs-data.patch | 48 ++++ ...connection-sync-failed-in-some-cases.patch | 64 ++++++ ...e-killer-wireless-ac-1550-cards-work.patch | 41 ++++ ...e-target-builds-for-external-modules.patch | 40 ++++ ...rong-sfp-eeprom-reading-for-upper-pa.patch | 131 +++++++++++ ...rkqueue-when-trap_register-in-mlxsw_.patch | 45 ++++ ...-handling-mcu-timeouts-during-hw-res.patch | 216 ++++++++++++++++++ ...issed-clk_disable_unprepare-in-error.patch | 38 +++ ...-fix-error-returns-in-bcmgenet_probe.patch | 40 ++++ ...siocshwtstamp-to-update-the-struct-w.patch | 66 ++++++ ...p-call-phy_remove_link_mode-during-p.patch | 135 +++++++++++ ...xx-fix-in-band-an-link-establishment.patch | 96 ++++++++ ...et-ave-fix-error-returns-in-ave_init.patch | 39 ++++ ...ware-time-stamping-by-external-devic.patch | 110 +++++++++ ...-fix-error-handling-for-desc-filling.patch | 79 +++++++ ...-not-calculating-tx-bd-send-size-cor.patch | 61 +++++ ...urn-value-error-when-query-mac-link-.patch | 154 +++++++++++++ ...ossible-memory-leak-in-smc_drv_probe.patch | 47 ++++ ...fix-unbalaced-locking-in-nsim_create.patch | 49 ++++ ...f_tables-fix-nat-hook-table-deletion.patch | 156 +++++++++++++ ...ereference-in-nfsd-clients-display-c.patch | 85 +++++++ ...x86-asus-wmi-allow-bat1-battery-name.patch | 34 +++ ...form-x86-isst-add-new-pci-device-ids.patch | 62 +++++ ...-t-support-roce-iwarp-flooding-on-hw.patch | 61 +++++ ...se-positives-interrupt-error-message.patch | 148 ++++++++++++ ...-protect-access-to-remote_sidr_table.patch | 83 +++++++ ...ix-race-in-rdma_alloc_commit_uobject.patch | 87 +++++++ ...t-prefetch-from-racing-with-implicit.patch | 92 ++++++++ ...xa_lock_irq-when-access-to-srq-table.patch | 115 ++++++++++ ...t_regmap_match-fix-string-comparison.patch | 43 ++++ ...sume-ports-without-dll-link-active-t.patch | 101 ++++++++ ...ly-on-initrd_start-end-computed-duri.patch | 99 ++++++++ ...-smp_mb__after_spinlock-to-iorw-iorw.patch | 45 ++++ ...tacktrace-strip-basepath-from-all-pa.patch | 49 ++++ ...lx-symbols-gdb.error-while-loading-m.patch | 51 +++++ ...gpio-configuration-for-sealevel-card.patch | 58 +++++ queue-5.7/series | 98 ++++++++ ...n-gx-socinfo-fix-s905x3-and-s905d3-i.patch | 53 +++++ ...iatek-use-correct-spi_cfg2_reg-macro.patch | 76 ++++++ ...usb-cdns3-ep0-fix-some-endian-issues.patch | 99 ++++++++ ...b-cdns3-trace-fix-some-endian-issues.patch | 39 ++++ ...dd-support-for-the-intel-jasper-lake.patch | 44 ++++ ...-support-for-the-intel-tiger-lake-pc.patch | 43 ++++ ...r_udc-fix-memleak-on-error-handling-.patch | 45 ++++ ...nnotate-the_virtio_vsock-rcu-pointer.patch | 61 +++++ ...ot-don-t-add-the-efi-stub-to-targets.patch | 60 +++++ ...th-emu-fix-up-cmp-insn-for-clang-ias.patch | 43 ++++ 99 files changed, 6993 insertions(+) create mode 100644 queue-5.7/alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch create mode 100644 queue-5.7/arm-dts-n900-remove-mmc1-card-detect-gpio.patch create mode 100644 queue-5.7/arm64-dts-clearfog-gt-8k-fix-switch-link-configurati.patch create mode 100644 queue-5.7/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch create mode 100644 queue-5.7/asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch create mode 100644 queue-5.7/asoc-intel-bytcht_es8316-add-missed-put_device.patch create mode 100644 queue-5.7/ax88172a-fix-ax88172a_unbind-failures.patch create mode 100644 queue-5.7/bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch create mode 100644 queue-5.7/bnxt_en-fix-race-when-modifying-pause-settings.patch create mode 100644 queue-5.7/bnxt_en-init-ethtool-link-settings-after-reading-upd.patch create mode 100644 queue-5.7/bonding-check-error-value-of-register_netdevice-imme.patch create mode 100644 queue-5.7/bonding-check-return-value-of-register_netdevice-in-.patch create mode 100644 queue-5.7/crypto-chtls-fix-tls-alert-messages-corrupted-by-tls.patch create mode 100644 queue-5.7/dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch create mode 100644 queue-5.7/dmaengine-idxd-fix-hw-descriptor-fields-for-delta-re.patch create mode 100644 queue-5.7/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch create mode 100644 queue-5.7/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch create mode 100644 queue-5.7/dmaengine-ti-k3-udma-add-missing-put_device-call-in-.patch create mode 100644 queue-5.7/dmaengine-ti-k3-udma-fix-cleanup-code-for-alloc_chan.patch create mode 100644 queue-5.7/dmaengine-ti-k3-udma-fix-the-running-channel-handlin.patch create mode 100644 queue-5.7/dpaa2-eth-check-fsl_mc_get_endpoint-for-is_err_or_nu.patch create mode 100644 queue-5.7/dpaa_eth-fix-one-possible-memleak-in-dpaa_eth_probe.patch create mode 100644 queue-5.7/drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch create mode 100644 queue-5.7/drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch create mode 100644 queue-5.7/drm-amdgpu-fix-preemption-unit-test.patch create mode 100644 queue-5.7/drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch create mode 100644 queue-5.7/drm-sun4i-hdmi-fix-inverted-hpd-result.patch create mode 100644 queue-5.7/efi-efivars-expose-rt-service-availability-via-efiva.patch create mode 100644 queue-5.7/enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch create mode 100644 queue-5.7/fpga-dfl-fix-bug-in-port-reset-handshake.patch create mode 100644 queue-5.7/fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch create mode 100644 queue-5.7/geneve-fix-an-uninitialized-value-in-geneve_changeli.patch create mode 100644 queue-5.7/hid-alps-support-devices-with-report-id-2.patch create mode 100644 queue-5.7/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch create mode 100644 queue-5.7/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch create mode 100644 queue-5.7/hid-steam-fixes-race-in-handling-device-list.patch create mode 100644 queue-5.7/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch create mode 100644 queue-5.7/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch create mode 100644 queue-5.7/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch create mode 100644 queue-5.7/hwmon-nct6775-accept-peci-calibration-as-temperature.patch create mode 100644 queue-5.7/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch create mode 100644 queue-5.7/i2c-i2c-qcom-geni-fix-dma-transfer-race.patch create mode 100644 queue-5.7/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch create mode 100644 queue-5.7/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch create mode 100644 queue-5.7/input-add-sw_machine_cover.patch create mode 100644 queue-5.7/input-elan_i2c-only-increment-wakeup-count-on-touch.patch create mode 100644 queue-5.7/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch create mode 100644 queue-5.7/iommu-qcom-use-domain-rather-than-dev-as-tlb-cookie.patch create mode 100644 queue-5.7/ionic-fix-up-filter-locks-and-debug-msgs.patch create mode 100644 queue-5.7/ionic-keep-rss-hash-after-fw-update.patch create mode 100644 queue-5.7/ionic-update-filter-id-after-replay.patch create mode 100644 queue-5.7/ionic-use-mutex-to-protect-queue-operations.patch create mode 100644 queue-5.7/ionic-use-offset-for-ethtool-regs-data.patch create mode 100644 queue-5.7/ipvs-fix-the-connection-sync-failed-in-some-cases.patch create mode 100644 queue-5.7/iwlwifi-make-some-killer-wireless-ac-1550-cards-work.patch create mode 100644 queue-5.7/kbuild-fix-single-target-builds-for-external-modules.patch create mode 100644 queue-5.7/mlxsw-core-fix-wrong-sfp-eeprom-reading-for-upper-pa.patch create mode 100644 queue-5.7/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch create mode 100644 queue-5.7/mt76-mt76x02-fix-handling-mcu-timeouts-during-hw-res.patch create mode 100644 queue-5.7/net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch create mode 100644 queue-5.7/net-bcmgenet-fix-error-returns-in-bcmgenet_probe.patch create mode 100644 queue-5.7/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch create mode 100644 queue-5.7/net-dsa-microchip-call-phy_remove_link_mode-during-p.patch create mode 100644 queue-5.7/net-dsa-mv88e6xxx-fix-in-band-an-link-establishment.patch create mode 100644 queue-5.7/net-ethernet-ave-fix-error-returns-in-ave_init.patch create mode 100644 queue-5.7/net-fec-fix-hardware-time-stamping-by-external-devic.patch create mode 100644 queue-5.7/net-hns3-fix-error-handling-for-desc-filling.patch create mode 100644 queue-5.7/net-hns3-fix-for-not-calculating-tx-bd-send-size-cor.patch create mode 100644 queue-5.7/net-hns3-fix-return-value-error-when-query-mac-link-.patch create mode 100644 queue-5.7/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch create mode 100644 queue-5.7/netdevsim-fix-unbalaced-locking-in-nsim_create.patch create mode 100644 queue-5.7/netfilter-nf_tables-fix-nat-hook-table-deletion.patch create mode 100644 queue-5.7/nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch create mode 100644 queue-5.7/platform-x86-asus-wmi-allow-bat1-battery-name.patch create mode 100644 queue-5.7/platform-x86-isst-add-new-pci-device-ids.patch create mode 100644 queue-5.7/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch create mode 100644 queue-5.7/qed-suppress-false-positives-interrupt-error-message.patch create mode 100644 queue-5.7/rdma-cm-protect-access-to-remote_sidr_table.patch create mode 100644 queue-5.7/rdma-core-fix-race-in-rdma_alloc_commit_uobject.patch create mode 100644 queue-5.7/rdma-mlx5-prevent-prefetch-from-racing-with-implicit.patch create mode 100644 queue-5.7/rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch create mode 100644 queue-5.7/regmap-dev_get_regmap_match-fix-string-comparison.patch create mode 100644 queue-5.7/revert-pci-pm-assume-ports-without-dll-link-active-t.patch create mode 100644 queue-5.7/risc-v-do-not-rely-on-initrd_start-end-computed-duri.patch create mode 100644 queue-5.7/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch create mode 100644 queue-5.7/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch create mode 100644 queue-5.7/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch create mode 100644 queue-5.7/serial-exar-fix-gpio-configuration-for-sealevel-card.patch create mode 100644 queue-5.7/soc-amlogic-meson-gx-socinfo-fix-s905x3-and-s905d3-i.patch create mode 100644 queue-5.7/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch create mode 100644 queue-5.7/usb-cdns3-ep0-fix-some-endian-issues.patch create mode 100644 queue-5.7/usb-cdns3-trace-fix-some-endian-issues.patch create mode 100644 queue-5.7/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch create mode 100644 queue-5.7/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch create mode 100644 queue-5.7/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch create mode 100644 queue-5.7/vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch create mode 100644 queue-5.7/x86-boot-don-t-add-the-efi-stub-to-targets.patch create mode 100644 queue-5.7/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch diff --git a/queue-5.7/alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch b/queue-5.7/alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch new file mode 100644 index 00000000000..298882752b2 --- /dev/null +++ b/queue-5.7/alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch @@ -0,0 +1,35 @@ +From 37e165bd8dd210bdbd37f779bcb4ac09a9e8a38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:01:34 +0200 +Subject: ALSA: hda/realtek - fixup for yet another Intel reference board + +From: PeiSen Hou + +[ Upstream commit 5734e509d5d515c187f642937ef2de1e58d7715d ] + +Add headset_jack for the intel reference board support with +10ec:1230. + +Signed-off-by: PeiSen Hou +Link: https://lore.kernel.org/r/20200716090134.9811-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 65a8ffef2aff4..27dd8945d6e6d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7546,6 +7546,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), ++ SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK), + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), +-- +2.25.1 + diff --git a/queue-5.7/arm-dts-n900-remove-mmc1-card-detect-gpio.patch b/queue-5.7/arm-dts-n900-remove-mmc1-card-detect-gpio.patch new file mode 100644 index 00000000000..5e8865bc9e9 --- /dev/null +++ b/queue-5.7/arm-dts-n900-remove-mmc1-card-detect-gpio.patch @@ -0,0 +1,64 @@ +From 32fca471878fed9c5d21364b734044bea3e00f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 11:47:40 -0700 +Subject: ARM: dts: n900: remove mmc1 card detect gpio + +From: Merlijn Wajer + +[ Upstream commit ed3e98e919aaaa47e9d9f8a40c3f6f4a22577842 ] + +Instead, expose the key via the input framework, as SW_MACHINE_COVER + +The chip-detect GPIO is actually detecting if the cover is closed. +Technically it's possible to use the SD card with open cover. The +only downside is risk of battery falling out and user being able +to physically remove the card. + +The behaviour of SD card not being available when the device is +open is unexpected and creates more problems than it solves. There +is a high chance, that more people accidentally break their rootfs +by opening the case without physically removing the card. + +Reviewed-by: Sebastian Reichel +Acked-by: Tony Lindgren +Signed-off-by: Merlijn Wajer +Link: https://lore.kernel.org/r/20200612125402.18393-3-merlijn@wizzup.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-n900.dts | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 4089d97405c95..3dbcae3d60d28 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -105,6 +105,14 @@ + linux,code = ; + linux,can-disable; + }; ++ ++ machine_cover { ++ label = "Machine Cover"; ++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */ ++ linux,input-type = ; ++ linux,code = ; ++ linux,can-disable; ++ }; + }; + + isp1707: isp1707 { +@@ -819,10 +827,6 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + bus-width = <4>; +- /* For debugging, it is often good idea to remove this GPIO. +- It means you can remove back cover (to reboot by removing +- battery) and still use the MMC card. */ +- cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */ + }; + + /* most boards use vaux3, only some old versions use vmmc2 instead */ +-- +2.25.1 + diff --git a/queue-5.7/arm64-dts-clearfog-gt-8k-fix-switch-link-configurati.patch b/queue-5.7/arm64-dts-clearfog-gt-8k-fix-switch-link-configurati.patch new file mode 100644 index 00000000000..297e1f9f4fd --- /dev/null +++ b/queue-5.7/arm64-dts-clearfog-gt-8k-fix-switch-link-configurati.patch @@ -0,0 +1,53 @@ +From 2579b1fe467ca0a0d477ca2fc4f99e06a9770515 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 12:00:40 +0100 +Subject: arm64: dts: clearfog-gt-8k: fix switch link configuration + +From: Russell King + +[ Upstream commit 7c6719a1aaca51ffd7cdf3905e70aa8313f6ef26 ] + +The commit below caused a regression for clearfog-gt-8k, where the link +between the switch and the host does not come up. + +Investigation revealed two issues: +- MV88E6xxx DSA no longer allows an in-band link to come up as the link + is programmed to be forced down. Commit "net: dsa: mv88e6xxx: fix + in-band AN link establishment" addresses this. + +- The dts configured dissimilar link modes at each end of the host to + switch link; the host was configured using a fixed link (so has no + in-band status) and the switch was configured to expect in-band + status. + +With both issues fixed, the regression is resolved. + +Fixes: 34b5e6a33c1a ("net: dsa: mv88e6xxx: Configure MAC when using fixed link") +Reported-by: Martin Rowe +Signed-off-by: Russell King +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts +index b90d78a5724b2..e32a491e909f1 100644 +--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts ++++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts +@@ -454,10 +454,7 @@ + status = "okay"; + phy-mode = "2500base-x"; + phys = <&cp1_comphy5 2>; +- fixed-link { +- speed = <2500>; +- full-duplex; +- }; ++ managed = "in-band-status"; + }; + + &cp1_spi1 { +-- +2.25.1 + diff --git a/queue-5.7/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch b/queue-5.7/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch new file mode 100644 index 00000000000..f0ca7f2b61c --- /dev/null +++ b/queue-5.7/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch @@ -0,0 +1,43 @@ +From 291d6219990e9f6c526b92e5d5f27e323175f59f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2020 12:12:26 +0000 +Subject: arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP + +From: Will Deacon + +[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ] + +Rather than open-code test_tsk_thread_flag() at each callsite, simply +replace the couple of offenders with calls to test_tsk_thread_flag() +directly. + +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/debug-monitors.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 7569deb1eac17..d64a3c1e1b6ba 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -396,14 +396,14 @@ void user_rewind_single_step(struct task_struct *task) + * If single step is active for this thread, then set SPSR.SS + * to 1 to avoid returning to the active-pending state. + */ +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + set_regs_spsr_ss(task_pt_regs(task)); + } + NOKPROBE_SYMBOL(user_rewind_single_step); + + void user_fastforward_single_step(struct task_struct *task) + { +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + clear_regs_spsr_ss(task_pt_regs(task)); + } + +-- +2.25.1 + diff --git a/queue-5.7/asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch b/queue-5.7/asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch new file mode 100644 index 00000000000..98bc4a329b7 --- /dev/null +++ b/queue-5.7/asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch @@ -0,0 +1,85 @@ +From d96bacd825d6053a41d901d1ab79433514f9e6d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 12:28:16 +0100 +Subject: asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible() + +From: Will Deacon + +[ Upstream commit bd024e82e4cd95c7f1a475a55f99871936c2b2db ] + +Although mmiowb() is concerned only with serialising MMIO writes occuring +in contexts where a spinlock is held, the call to mmiowb_set_pending() +from the MMIO write accessors can occur in preemptible contexts, such +as during driver probe() functions where ordering between CPUs is not +usually a concern, assuming that the task migration path provides the +necessary ordering guarantees. + +Unfortunately, the default implementation of mmiowb_set_pending() is not +preempt-safe, as it makes use of a a per-cpu variable to track its +internal state. This has been reported to generate the following splat +on riscv: + + | BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 + | caller is regmap_mmio_write32le+0x1c/0x46 + | CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc3-hfu+ #1 + | Call Trace: + | walk_stackframe+0x0/0x7a + | dump_stack+0x6e/0x88 + | regmap_mmio_write32le+0x18/0x46 + | check_preemption_disabled+0xa4/0xaa + | regmap_mmio_write32le+0x18/0x46 + | regmap_mmio_write+0x26/0x44 + | regmap_write+0x28/0x48 + | sifive_gpio_probe+0xc0/0x1da + +Although it's possible to fix the driver in this case, other splats have +been seen from other drivers, including the infamous 8250 UART, and so +it's better to address this problem in the mmiowb core itself. + +Fix mmiowb_set_pending() by using the raw_cpu_ptr() to get at the mmiowb +state and then only updating the 'mmiowb_pending' field if we are not +preemptible (i.e. we have a non-zero nesting count). + +Cc: Arnd Bergmann +Cc: Paul Walmsley +Cc: Guo Ren +Cc: Michael Ellerman +Reported-by: Palmer Dabbelt +Reported-by: Emil Renner Berthing +Tested-by: Emil Renner Berthing +Reviewed-by: Palmer Dabbelt +Acked-by: Palmer Dabbelt +Link: https://lore.kernel.org/r/20200716112816.7356-1-will@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + include/asm-generic/mmiowb.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/include/asm-generic/mmiowb.h b/include/asm-generic/mmiowb.h +index 9439ff037b2d1..5698fca3bf560 100644 +--- a/include/asm-generic/mmiowb.h ++++ b/include/asm-generic/mmiowb.h +@@ -27,7 +27,7 @@ + #include + + DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state); +-#define __mmiowb_state() this_cpu_ptr(&__mmiowb_state) ++#define __mmiowb_state() raw_cpu_ptr(&__mmiowb_state) + #else + #define __mmiowb_state() arch_mmiowb_state() + #endif /* arch_mmiowb_state */ +@@ -35,7 +35,9 @@ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state); + static inline void mmiowb_set_pending(void) + { + struct mmiowb_state *ms = __mmiowb_state(); +- ms->mmiowb_pending = ms->nesting_count; ++ ++ if (likely(ms->nesting_count)) ++ ms->mmiowb_pending = ms->nesting_count; + } + + static inline void mmiowb_spin_lock(void) +-- +2.25.1 + diff --git a/queue-5.7/asoc-intel-bytcht_es8316-add-missed-put_device.patch b/queue-5.7/asoc-intel-bytcht_es8316-add-missed-put_device.patch new file mode 100644 index 00000000000..ccc3fbcd4e7 --- /dev/null +++ b/queue-5.7/asoc-intel-bytcht_es8316-add-missed-put_device.patch @@ -0,0 +1,42 @@ +From aa6b740846d321b0e188a98262c5dbe106a6c211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 16:09:18 +0800 +Subject: ASoC: Intel: bytcht_es8316: Add missed put_device() + +From: Jing Xiangfeng + +[ Upstream commit b3df80ab6d147d4738be242e1c91e5fdbb6b03ef ] + +snd_byt_cht_es8316_mc_probe() misses to call put_device() in an error +path. Add the missed function call to fix it. + +Fixes: ba49cf6f8e4a ("ASoC: Intel: bytcht_es8316: Add quirk for inverted jack detect") +Signed-off-by: Jing Xiangfeng +Reviewed-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200714080918.148196-1-jingxiangfeng@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index ddcd070100ef4..b3fd7de594d79 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -543,8 +543,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + + if (cnt) { + ret = device_add_properties(codec_dev, props); +- if (ret) ++ if (ret) { ++ put_device(codec_dev); + return ret; ++ } + } + + devm_acpi_dev_add_driver_gpios(codec_dev, byt_cht_es8316_gpios); +-- +2.25.1 + diff --git a/queue-5.7/ax88172a-fix-ax88172a_unbind-failures.patch b/queue-5.7/ax88172a-fix-ax88172a_unbind-failures.patch new file mode 100644 index 00000000000..3627068e8d5 --- /dev/null +++ b/queue-5.7/ax88172a-fix-ax88172a_unbind-failures.patch @@ -0,0 +1,36 @@ +From 8dd77215d3d16a4b6aa572be6f5493e7c8de55c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 09:59:31 -0400 +Subject: ax88172a: fix ax88172a_unbind() failures + +From: George Kennedy + +[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ] + +If ax88172a_unbind() fails, make sure that the return code is +less than zero so that cleanup is done properly and avoid UAF. + +Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers") +Signed-off-by: George Kennedy +Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88172a.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index 4e514f5d7c6c7..fd3a04d98dc14 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -187,6 +187,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); + if (ret < ETH_ALEN) { + netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); ++ ret = -EIO; + goto free; + } + memcpy(dev->net->dev_addr, buf, ETH_ALEN); +-- +2.25.1 + diff --git a/queue-5.7/bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch b/queue-5.7/bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch new file mode 100644 index 00000000000..c65e71f3775 --- /dev/null +++ b/queue-5.7/bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch @@ -0,0 +1,65 @@ +From 7fa7ff14b8d2d7cb31958384df6cf473520cfcf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 20:48:25 -0400 +Subject: bnxt_en: Fix completion ring sizing with TPA enabled. + +From: Michael Chan + +[ Upstream commit 27640ce68d21e556b66bc5fa022aacd26e53c947 ] + +The current completion ring sizing formula is wrong with TPA enabled. +The formula assumes that the number of TPA completions are bound by the +RX ring size, but that's not true. TPA_START completions are immediately +recycled so they are not bound by the RX ring size. We must add +bp->max_tpa to the worst case maximum RX and TPA completions. + +The completion ring can overflow because of this mistake. This will +cause hardware to disable the completion ring when this happens, +leading to RX and TX traffic to stall on that ring. This issue is +generally exposed only when the RX ring size is set very small. + +Fix the formula by adding bp->max_tpa to the number of RX completions +if TPA is enabled. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver."); +Reviewed-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 198bca9c1e2df..1656dc277af41 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -3418,7 +3418,7 @@ void bnxt_set_tpa_flags(struct bnxt *bp) + */ + void bnxt_set_ring_params(struct bnxt *bp) + { +- u32 ring_size, rx_size, rx_space; ++ u32 ring_size, rx_size, rx_space, max_rx_cmpl; + u32 agg_factor = 0, agg_ring_size = 0; + + /* 8 for CRC and VLAN */ +@@ -3474,7 +3474,15 @@ void bnxt_set_ring_params(struct bnxt *bp) + bp->tx_nr_pages = bnxt_calc_nr_ring_pages(ring_size, TX_DESC_CNT); + bp->tx_ring_mask = (bp->tx_nr_pages * TX_DESC_CNT) - 1; + +- ring_size = bp->rx_ring_size * (2 + agg_factor) + bp->tx_ring_size; ++ max_rx_cmpl = bp->rx_ring_size; ++ /* MAX TPA needs to be added because TPA_START completions are ++ * immediately recycled, so the TPA completions are not bound by ++ * the RX ring size. ++ */ ++ if (bp->flags & BNXT_FLAG_TPA) ++ max_rx_cmpl += bp->max_tpa; ++ /* RX and TPA completions are 32-byte, all others are 16-byte */ ++ ring_size = max_rx_cmpl * 2 + agg_ring_size + bp->tx_ring_size; + bp->cp_ring_size = ring_size; + + bp->cp_nr_pages = bnxt_calc_nr_ring_pages(ring_size, CP_DESC_CNT); +-- +2.25.1 + diff --git a/queue-5.7/bnxt_en-fix-race-when-modifying-pause-settings.patch b/queue-5.7/bnxt_en-fix-race-when-modifying-pause-settings.patch new file mode 100644 index 00000000000..fedb253b945 --- /dev/null +++ b/queue-5.7/bnxt_en-fix-race-when-modifying-pause-settings.patch @@ -0,0 +1,44 @@ +From ae468910e388bec6e376277f001c1ee5ebedf31a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 20:48:23 -0400 +Subject: bnxt_en: Fix race when modifying pause settings. + +From: Vasundhara Volam + +[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ] + +The driver was modified to not rely on rtnl lock to protect link +settings about 2 years ago. The pause setting was missed when +making that change. Fix it by acquiring link_lock mutex before +calling bnxt_hwrm_set_pause(). + +Fixes: e2dc9b6e38fa ("bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.") +Signed-off-by: Vasundhara Volam +Reviewed-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 360f9a95c1d50..21cc2bd127603 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1687,8 +1687,11 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (epause->tx_pause) + link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX; + +- if (netif_running(dev)) ++ if (netif_running(dev)) { ++ mutex_lock(&bp->link_lock); + rc = bnxt_hwrm_set_pause(bp); ++ mutex_unlock(&bp->link_lock); ++ } + return rc; + } + +-- +2.25.1 + diff --git a/queue-5.7/bnxt_en-init-ethtool-link-settings-after-reading-upd.patch b/queue-5.7/bnxt_en-init-ethtool-link-settings-after-reading-upd.patch new file mode 100644 index 00000000000..01831f5d0f0 --- /dev/null +++ b/queue-5.7/bnxt_en-init-ethtool-link-settings-after-reading-upd.patch @@ -0,0 +1,51 @@ +From 1720477a88a028dd2b98adf05bee4a6d05e97cb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 20:48:24 -0400 +Subject: bnxt_en: Init ethtool link settings after reading updated PHY + configuration. + +From: Vasundhara Volam + +[ Upstream commit ca0c753815fe4786b79a80abf0412eb5d52090b8 ] + +In a shared port PHY configuration, async event is received when any of the +port modifies the configuration. Ethtool link settings should be +initialised after updated PHY configuration from firmware. + +Fixes: b1613e78e98d ("bnxt_en: Add async. event logic for PHY configuration changes.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index b6fb5a1709c01..198bca9c1e2df 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10362,15 +10362,15 @@ static void bnxt_sp_task(struct work_struct *work) + &bp->sp_event)) + bnxt_hwrm_phy_qcaps(bp); + +- if (test_and_clear_bit(BNXT_LINK_CFG_CHANGE_SP_EVENT, +- &bp->sp_event)) +- bnxt_init_ethtool_link_settings(bp); +- + rc = bnxt_update_link(bp, true); +- mutex_unlock(&bp->link_lock); + if (rc) + netdev_err(bp->dev, "SP task can't update link (rc: %x)\n", + rc); ++ ++ if (test_and_clear_bit(BNXT_LINK_CFG_CHANGE_SP_EVENT, ++ &bp->sp_event)) ++ bnxt_init_ethtool_link_settings(bp); ++ mutex_unlock(&bp->link_lock); + } + if (test_and_clear_bit(BNXT_UPDATE_PHY_SP_EVENT, &bp->sp_event)) { + int rc; +-- +2.25.1 + diff --git a/queue-5.7/bonding-check-error-value-of-register_netdevice-imme.patch b/queue-5.7/bonding-check-error-value-of-register_netdevice-imme.patch new file mode 100644 index 00000000000..a33bfea986c --- /dev/null +++ b/queue-5.7/bonding-check-error-value-of-register_netdevice-imme.patch @@ -0,0 +1,90 @@ +From 72519e34fbc0cf9048aa74a5a27e01ab113bb048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 12:11:24 +0000 +Subject: bonding: check error value of register_netdevice() immediately + +From: Taehee Yoo + +[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ] + +If register_netdevice() is failed, net_device should not be used +because variables are uninitialized or freed. +So, the routine should be stopped immediately. +But, bond_create() doesn't check return value of register_netdevice() +immediately. That will result in a panic because of using uninitialized +or freed memory. + +Test commands: + modprobe netdev-notifier-error-inject + echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\ +actions/NETDEV_REGISTER/error + modprobe bonding max_bonds=3 + +Splat looks like: +[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI +[ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645 +[ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 375.039673][ T193] Workqueue: events linkwatch_event +[ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340 +[ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08 +[ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202 +[ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006 +[ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000 +[ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000 +[ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08 +[ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580 +[ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000 +[ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0 +[ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 375.073269][ T193] Call Trace: +[ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50 +[ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200 +[ 375.076244][ T193] linkwatch_event+0x21/0x30 +[ 375.077274][ T193] process_one_work+0x252/0x600 +[ 375.078379][ T193] ? process_one_work+0x600/0x600 +[ 375.079518][ T193] worker_thread+0x3c/0x380 +[ 375.080534][ T193] ? process_one_work+0x600/0x600 +[ 375.081668][ T193] kthread+0x139/0x150 +[ 375.082567][ T193] ? kthread_park+0x90/0x90 +[ 375.083567][ T193] ret_from_fork+0x22/0x30 + +Fixes: e826eafa65c6 ("bonding: Call netif_carrier_off after register_netdevice") +Signed-off-by: Taehee Yoo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2e70e43c5df5c..6b40b5ab143a7 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4953,15 +4953,19 @@ int bond_create(struct net *net, const char *name) + bond_dev->rtnl_link_ops = &bond_link_ops; + + res = register_netdevice(bond_dev); ++ if (res < 0) { ++ free_netdev(bond_dev); ++ rtnl_unlock(); ++ ++ return res; ++ } + + netif_carrier_off(bond_dev); + + bond_work_init_all(bond); + + rtnl_unlock(); +- if (res < 0) +- free_netdev(bond_dev); +- return res; ++ return 0; + } + + static int __net_init bond_net_init(struct net *net) +-- +2.25.1 + diff --git a/queue-5.7/bonding-check-return-value-of-register_netdevice-in-.patch b/queue-5.7/bonding-check-return-value-of-register_netdevice-in-.patch new file mode 100644 index 00000000000..567df4f287e --- /dev/null +++ b/queue-5.7/bonding-check-return-value-of-register_netdevice-in-.patch @@ -0,0 +1,46 @@ +From ddde99dad1266698dd8a936a7edf691de968b3b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 16:31:54 -0700 +Subject: bonding: check return value of register_netdevice() in bond_newlink() + +From: Cong Wang + +[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ] + +Very similar to commit 544f287b8495 +("bonding: check error value of register_netdevice() immediately"), +we should immediately check the return value of register_netdevice() +before doing anything else. + +Fixes: 005db31d5f5f ("bonding: set carrier off for devices created through netlink") +Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6@syzkaller.appspotmail.com +Cc: Beniamino Galvani +Cc: Taehee Yoo +Cc: Jay Vosburgh +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_netlink.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c +index b43b51646b11a..f0f9138e967f3 100644 +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -456,11 +456,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev, + return err; + + err = register_netdevice(bond_dev); +- +- netif_carrier_off(bond_dev); + if (!err) { + struct bonding *bond = netdev_priv(bond_dev); + ++ netif_carrier_off(bond_dev); + bond_work_init_all(bond); + } + +-- +2.25.1 + diff --git a/queue-5.7/crypto-chtls-fix-tls-alert-messages-corrupted-by-tls.patch b/queue-5.7/crypto-chtls-fix-tls-alert-messages-corrupted-by-tls.patch new file mode 100644 index 00000000000..8b0cde52a02 --- /dev/null +++ b/queue-5.7/crypto-chtls-fix-tls-alert-messages-corrupted-by-tls.patch @@ -0,0 +1,51 @@ +From 721247d16b72b0ab0b8fa5369e37a65c6433b2b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jul 2020 00:31:42 +0530 +Subject: crypto/chtls: fix tls alert messages corrupted by tls data + +From: Vinay Kumar Yadav + +[ Upstream commit c271042eb6a031d1333cf57422ec1d20726901ab ] + +When tls data skb is pending for Tx and tls alert comes , It +is wrongly overwrite the record type of tls data to tls alert +record type. fix the issue correcting it. + +v1->v2: +- Correct submission tree. +- Add fixes tag. + +Fixes: 6919a8264a32 ("Crypto/chtls: add/delete TLS header in driver") +Signed-off-by: Vinay Kumar Yadav +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/crypto/chelsio/chtls/chtls_io.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c +index e1401d9cc756c..2e9acae1cba3b 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_io.c ++++ b/drivers/crypto/chelsio/chtls/chtls_io.c +@@ -1052,14 +1052,15 @@ int chtls_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + &record_type); + if (err) + goto out_err; ++ ++ /* Avoid appending tls handshake, alert to tls data */ ++ if (skb) ++ tx_skb_finalize(skb); + } + + recordsz = size; + csk->tlshws.txleft = recordsz; + csk->tlshws.type = record_type; +- +- if (skb) +- ULP_SKB_CB(skb)->ulp.tls.type = record_type; + } + + if (!skb || (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_NO_APPEND) || +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch b/queue-5.7/dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch new file mode 100644 index 00000000000..008566553a0 --- /dev/null +++ b/queue-5.7/dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch @@ -0,0 +1,75 @@ +From 884912f870d501d101c464a97bf816b87285585f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 00:52:05 +0200 +Subject: dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu + +From: Angelo Dureghello + +[ Upstream commit 8678c71c17721e0f771f135967ef0cce8f69ce9a ] + +Due to recent fixes in m68k arch-specific I/O accessor macros, this +driver is not working anymore for ColdFire. Fix wrong tcd endianness +removing additional swaps, since edma_writex() functions should already +take care of any eventual swap if needed. + +Note, i could only test the change in ColdFire mcf54415 and Vybrid +vf50 / Colibri where i don't see any issue. So, every feedback and +test for all other SoCs involved is really appreciated. + +Signed-off-by: Angelo Dureghello +Reported-by: kbuild test robot +Link: https://lore.kernel.org/r/20200701225205.1674463-1-angelo.dureghello@timesys.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-edma-common.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c +index 5697c3622699b..9285884758b27 100644 +--- a/drivers/dma/fsl-edma-common.c ++++ b/drivers/dma/fsl-edma-common.c +@@ -352,26 +352,28 @@ static void fsl_edma_set_tcd_regs(struct fsl_edma_chan *fsl_chan, + /* + * TCD parameters are stored in struct fsl_edma_hw_tcd in little + * endian format. However, we need to load the TCD registers in +- * big- or little-endian obeying the eDMA engine model endian. ++ * big- or little-endian obeying the eDMA engine model endian, ++ * and this is performed from specific edma_write functions + */ + edma_writew(edma, 0, ®s->tcd[ch].csr); +- edma_writel(edma, le32_to_cpu(tcd->saddr), ®s->tcd[ch].saddr); +- edma_writel(edma, le32_to_cpu(tcd->daddr), ®s->tcd[ch].daddr); + +- edma_writew(edma, le16_to_cpu(tcd->attr), ®s->tcd[ch].attr); +- edma_writew(edma, le16_to_cpu(tcd->soff), ®s->tcd[ch].soff); ++ edma_writel(edma, (s32)tcd->saddr, ®s->tcd[ch].saddr); ++ edma_writel(edma, (s32)tcd->daddr, ®s->tcd[ch].daddr); + +- edma_writel(edma, le32_to_cpu(tcd->nbytes), ®s->tcd[ch].nbytes); +- edma_writel(edma, le32_to_cpu(tcd->slast), ®s->tcd[ch].slast); ++ edma_writew(edma, (s16)tcd->attr, ®s->tcd[ch].attr); ++ edma_writew(edma, tcd->soff, ®s->tcd[ch].soff); + +- edma_writew(edma, le16_to_cpu(tcd->citer), ®s->tcd[ch].citer); +- edma_writew(edma, le16_to_cpu(tcd->biter), ®s->tcd[ch].biter); +- edma_writew(edma, le16_to_cpu(tcd->doff), ®s->tcd[ch].doff); ++ edma_writel(edma, (s32)tcd->nbytes, ®s->tcd[ch].nbytes); ++ edma_writel(edma, (s32)tcd->slast, ®s->tcd[ch].slast); + +- edma_writel(edma, le32_to_cpu(tcd->dlast_sga), ++ edma_writew(edma, (s16)tcd->citer, ®s->tcd[ch].citer); ++ edma_writew(edma, (s16)tcd->biter, ®s->tcd[ch].biter); ++ edma_writew(edma, (s16)tcd->doff, ®s->tcd[ch].doff); ++ ++ edma_writel(edma, (s32)tcd->dlast_sga, + ®s->tcd[ch].dlast_sga); + +- edma_writew(edma, le16_to_cpu(tcd->csr), ®s->tcd[ch].csr); ++ edma_writew(edma, (s16)tcd->csr, ®s->tcd[ch].csr); + } + + static inline +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-idxd-fix-hw-descriptor-fields-for-delta-re.patch b/queue-5.7/dmaengine-idxd-fix-hw-descriptor-fields-for-delta-re.patch new file mode 100644 index 00000000000..3e9e90108fd --- /dev/null +++ b/queue-5.7/dmaengine-idxd-fix-hw-descriptor-fields-for-delta-re.patch @@ -0,0 +1,41 @@ +From 7268df0f5b04a788de8149dd0ef93b9843d31706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jun 2020 10:27:48 -0700 +Subject: dmaengine: idxd: fix hw descriptor fields for delta record + +From: Dave Jiang + +[ Upstream commit 0b8975bdc0cc5310d48d9bdd871cefebe1f94c99 ] + +Fix the hw descriptor fields for delta record in user exported idxd.h +header. Missing the "expected result mask" field. + +Reported-by: Mona Hossain +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/159120526866.65385.536565786678052944.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/uapi/linux/idxd.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/uapi/linux/idxd.h b/include/uapi/linux/idxd.h +index 1f412fbf561bb..e103c1434e4b0 100644 +--- a/include/uapi/linux/idxd.h ++++ b/include/uapi/linux/idxd.h +@@ -110,9 +110,12 @@ struct dsa_hw_desc { + uint16_t rsvd1; + union { + uint8_t expected_res; ++ /* create delta record */ + struct { + uint64_t delta_addr; + uint32_t max_delta_size; ++ uint32_t delt_rsvd; ++ uint8_t expected_res_mask; + }; + uint32_t delta_rec_size; + uint64_t dest2; +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch b/queue-5.7/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch new file mode 100644 index 00000000000..0e7ba367198 --- /dev/null +++ b/queue-5.7/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch @@ -0,0 +1,62 @@ +From bebae12929b70ade1a4f4b14561a2c267f19677d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 21:48:12 +0300 +Subject: dmaengine: ioat setting ioat timeout as module parameter + +From: Leonid Ravich + +[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ] + +DMA transaction time to completion is a function of PCI bandwidth, +transaction size and a queue depth. So hard coded value for timeouts +might be wrong for some scenarios. + +Signed-off-by: Leonid Ravich +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20200701184816.29138-1-leonid.ravich@dell.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/dma.c | 12 ++++++++++++ + drivers/dma/ioat/dma.h | 2 -- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 18c011e57592e..8e2a4d1f0be53 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -26,6 +26,18 @@ + + #include "../dmaengine.h" + ++int completion_timeout = 200; ++module_param(completion_timeout, int, 0644); ++MODULE_PARM_DESC(completion_timeout, ++ "set ioat completion timeout [msec] (default 200 [msec])"); ++int idle_timeout = 2000; ++module_param(idle_timeout, int, 0644); ++MODULE_PARM_DESC(idle_timeout, ++ "set ioat idel timeout [msec] (default 2000 [msec])"); ++ ++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) ++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) ++ + static char *chanerr_str[] = { + "DMA Transfer Source Address Error", + "DMA Transfer Destination Address Error", +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index b8e8e0b9693c7..4ac9134962f3b 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -99,8 +99,6 @@ struct ioatdma_chan { + #define IOAT_RUN 5 + #define IOAT_CHAN_ACTIVE 6 + struct timer_list timer; +- #define COMPLETION_TIMEOUT msecs_to_jiffies(100) +- #define IDLE_TIMEOUT msecs_to_jiffies(2000) + #define RESET_DELAY msecs_to_jiffies(100) + struct ioatdma_device *ioat_dma; + dma_addr_t completion_dma; +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch b/queue-5.7/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch new file mode 100644 index 00000000000..8e2b0da442d --- /dev/null +++ b/queue-5.7/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch @@ -0,0 +1,49 @@ +From 5c4c3a9dfd0042b9620f53eaf3aad87256420bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 14:46:26 +0800 +Subject: dmaengine: tegra210-adma: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Reviewed-by: Jon Hunter +Link: https://lore.kernel.org/r/20200624064626.19855-1-dinghao.liu@zju.edu.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra210-adma.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index db58d7e4f9fec..c5fa2ef74abc7 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -658,6 +658,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) + + ret = pm_runtime_get_sync(tdc2dev(tdc)); + if (ret < 0) { ++ pm_runtime_put_noidle(tdc2dev(tdc)); + free_irq(tdc->irq, tdc); + return ret; + } +@@ -869,8 +870,10 @@ static int tegra_adma_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + goto rpm_disable; ++ } + + ret = tegra_adma_init(tdma); + if (ret) +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-ti-k3-udma-add-missing-put_device-call-in-.patch b/queue-5.7/dmaengine-ti-k3-udma-add-missing-put_device-call-in-.patch new file mode 100644 index 00000000000..33a72c4ec32 --- /dev/null +++ b/queue-5.7/dmaengine-ti-k3-udma-add-missing-put_device-call-in-.patch @@ -0,0 +1,37 @@ +From b7dff726e7fb86d2c7db93c3b267ef961e793b01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 21:01:10 +0800 +Subject: dmaengine: ti: k3-udma: add missing put_device() call in + of_xudma_dev_get() + +From: Yu Kuai + +[ Upstream commit 1438cde8fe9cb709b569f5829c4c892c0f3f15b3 ] + +if of_find_device_by_node() succeed and platform_get_drvdata() failed, +of_xudma_dev_get() will return without put_device(), which will leak +the memory. + +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200618130110.582543-1-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma-private.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/ti/k3-udma-private.c b/drivers/dma/ti/k3-udma-private.c +index 0b8f3dd6b1463..77e8e67d995b3 100644 +--- a/drivers/dma/ti/k3-udma-private.c ++++ b/drivers/dma/ti/k3-udma-private.c +@@ -42,6 +42,7 @@ struct udma_dev *of_xudma_dev_get(struct device_node *np, const char *property) + ud = platform_get_drvdata(pdev); + if (!ud) { + pr_debug("UDMA has not been probed\n"); ++ put_device(&pdev->dev); + return ERR_PTR(-EPROBE_DEFER); + } + +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-ti-k3-udma-fix-cleanup-code-for-alloc_chan.patch b/queue-5.7/dmaengine-ti-k3-udma-fix-cleanup-code-for-alloc_chan.patch new file mode 100644 index 00000000000..dcd68fa3750 --- /dev/null +++ b/queue-5.7/dmaengine-ti-k3-udma-fix-cleanup-code-for-alloc_chan.patch @@ -0,0 +1,107 @@ +From cafa95e3ed188413964d3b7c4865b58feab94bfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 10:06:11 +0300 +Subject: dmaengine: ti: k3-udma: Fix cleanup code for alloc_chan_resources + +From: Peter Ujfalusi + +[ Upstream commit 5a9377cc7421b59b13c9b90b8dc0aca332a1c958 ] + +Some of the earlier errors should be sent to the error cleanup path to +make sure that the uchan struct is reset, the dma_pool (if allocated) is +released and memcpy channel pairs are released in a correct way. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200527070612.636-2-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 7cab23fe5c73f..35f54a1af29d8 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -1773,7 +1773,8 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + dev_err(ud->ddev.dev, + "Descriptor pool allocation failed\n"); + uc->use_dma_pool = false; +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_cleanup; + } + } + +@@ -1793,16 +1794,18 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + + ret = udma_get_chan_pair(uc); + if (ret) +- return ret; ++ goto err_cleanup; + + ret = udma_alloc_tx_resources(uc); +- if (ret) +- return ret; ++ if (ret) { ++ udma_put_rchan(uc); ++ goto err_cleanup; ++ } + + ret = udma_alloc_rx_resources(uc); + if (ret) { + udma_free_tx_resources(uc); +- return ret; ++ goto err_cleanup; + } + + uc->config.src_thread = ud->psil_base + uc->tchan->id; +@@ -1820,10 +1823,8 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + uc->id); + + ret = udma_alloc_tx_resources(uc); +- if (ret) { +- uc->config.remote_thread_id = -1; +- return ret; +- } ++ if (ret) ++ goto err_cleanup; + + uc->config.src_thread = ud->psil_base + uc->tchan->id; + uc->config.dst_thread = uc->config.remote_thread_id; +@@ -1840,10 +1841,8 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + uc->id); + + ret = udma_alloc_rx_resources(uc); +- if (ret) { +- uc->config.remote_thread_id = -1; +- return ret; +- } ++ if (ret) ++ goto err_cleanup; + + uc->config.src_thread = uc->config.remote_thread_id; + uc->config.dst_thread = (ud->psil_base + uc->rchan->id) | +@@ -1858,7 +1857,9 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + /* Can not happen */ + dev_err(uc->ud->dev, "%s: chan%d invalid direction (%u)\n", + __func__, uc->id, uc->config.dir); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_cleanup; ++ + } + + /* check if the channel configuration was successful */ +@@ -1936,7 +1937,7 @@ err_psi_free: + err_res_free: + udma_free_tx_resources(uc); + udma_free_rx_resources(uc); +- ++err_cleanup: + udma_reset_uchan(uc); + + if (uc->use_dma_pool) { +-- +2.25.1 + diff --git a/queue-5.7/dmaengine-ti-k3-udma-fix-the-running-channel-handlin.patch b/queue-5.7/dmaengine-ti-k3-udma-fix-the-running-channel-handlin.patch new file mode 100644 index 00000000000..4c08621ce49 --- /dev/null +++ b/queue-5.7/dmaengine-ti-k3-udma-fix-the-running-channel-handlin.patch @@ -0,0 +1,39 @@ +From 6b58cafd17b90620e5d460a153ff53c4c997a3d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 10:06:12 +0300 +Subject: dmaengine: ti: k3-udma: Fix the running channel handling in + alloc_chan_resources + +From: Peter Ujfalusi + +[ Upstream commit b5b0180c2f767e90b4a6a885a0a2abaab6e3d48d ] + +In the unlikely case when the channel is running (RT enabled) during +alloc_chan_resources then we should use udma_reset_chan() and not +udma_stop() as the later is trying to initiate a teardown on the channel, +which is not valid at this point. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200527070612.636-3-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 35f54a1af29d8..b777f1924968f 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -1868,7 +1868,7 @@ static int udma_alloc_chan_resources(struct dma_chan *chan) + + if (udma_is_chan_running(uc)) { + dev_warn(ud->dev, "chan%d: is running!\n", uc->id); +- udma_stop(uc); ++ udma_reset_chan(uc, false); + if (udma_is_chan_running(uc)) { + dev_err(ud->dev, "chan%d: won't stop!\n", uc->id); + goto err_res_free; +-- +2.25.1 + diff --git a/queue-5.7/dpaa2-eth-check-fsl_mc_get_endpoint-for-is_err_or_nu.patch b/queue-5.7/dpaa2-eth-check-fsl_mc_get_endpoint-for-is_err_or_nu.patch new file mode 100644 index 00000000000..25f97645d0e --- /dev/null +++ b/queue-5.7/dpaa2-eth-check-fsl_mc_get_endpoint-for-is_err_or_nu.patch @@ -0,0 +1,38 @@ +From f46afea868f7574bf48486b3bda903ac3706a066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 15:08:16 +0300 +Subject: dpaa2-eth: check fsl_mc_get_endpoint for IS_ERR_OR_NULL() + +From: Ioana Ciornei + +[ Upstream commit 841eb4012cef84820e5906527b31a854f42b0748 ] + +The fsl_mc_get_endpoint() function can return an error or directly a +NULL pointer in case the peer device is not under the root DPRC +container. Treat this case also, otherwise it would lead to a NULL +pointer when trying to access the peer fsl_mc_device. + +Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink") +Signed-off-by: Ioana Ciornei +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 569e06d2bab21..72fa9c4e058f7 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -3383,7 +3383,7 @@ static int dpaa2_eth_connect_mac(struct dpaa2_eth_priv *priv) + + dpni_dev = to_fsl_mc_device(priv->net_dev->dev.parent); + dpmac_dev = fsl_mc_get_endpoint(dpni_dev); +- if (IS_ERR(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) ++ if (IS_ERR_OR_NULL(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) + return 0; + + if (dpaa2_mac_is_type_fixed(dpmac_dev, priv->mc_io)) +-- +2.25.1 + diff --git a/queue-5.7/dpaa_eth-fix-one-possible-memleak-in-dpaa_eth_probe.patch b/queue-5.7/dpaa_eth-fix-one-possible-memleak-in-dpaa_eth_probe.patch new file mode 100644 index 00000000000..9d38d05bb1c --- /dev/null +++ b/queue-5.7/dpaa_eth-fix-one-possible-memleak-in-dpaa_eth_probe.patch @@ -0,0 +1,36 @@ +From 5e57a09a00f5adf8e2a9e2177a81c154dc2813e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 22:28:29 +0800 +Subject: dpaa_eth: Fix one possible memleak in dpaa_eth_probe + +From: Liu Jian + +[ Upstream commit 6790711f8ac5faabc43237c0d05d93db431a1ecc ] + +When dma_coerce_mask_and_coherent() fails, the alloced netdev need to be freed. + +Fixes: 060ad66f9795 ("dpaa_eth: change DMA device") +Signed-off-by: Liu Jian +Acked-by: Madalin Bucur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 6bfa7575af942..5f82c1f32f09b 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2938,7 +2938,7 @@ static int dpaa_eth_probe(struct platform_device *pdev) + DMA_BIT_MASK(40)); + if (err) { + netdev_err(net_dev, "dma_coerce_mask_and_coherent() failed\n"); +- return err; ++ goto free_netdev; + } + + /* If fsl_fm_max_frm is set to a higher value than the all-common 1500, +-- +2.25.1 + diff --git a/queue-5.7/drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch b/queue-5.7/drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch new file mode 100644 index 00000000000..f366d670a08 --- /dev/null +++ b/queue-5.7/drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch @@ -0,0 +1,129 @@ +From 51e808678cfb0041392bd2cbb82627954f5cd038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 17:19:25 +0800 +Subject: drivers/perf: Fix kernel panic when rmmod PMU modules during perf + sampling + +From: Qi Liu + +[ Upstream commit bdc5c744c7b6457d18a95c26769dad0e7f480a08 ] + +When users try to remove PMU modules during perf sampling, kernel panic +will happen because the pmu->read() is a NULL pointer here. + +INFO on HiSilicon hip08 platform as follow: +pc : hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu] +lr : hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu] +sp : ffff800010103e90 +x29: ffff800010103e90 x28: ffff0027db0c0e40 +x27: ffffa29a76f129d8 x26: ffffa29a77ceb000 +x25: ffffa29a773a5000 x24: ffffa29a77392000 +x23: ffffddffe5943f08 x22: ffff002784285960 +x21: ffff002784285800 x20: ffff0027d2e76c80 +x19: ffff0027842859e0 x18: ffff80003498bcc8 +x17: ffffa29a76afe910 x16: ffffa29a7583f530 +x15: 16151a1512061a1e x14: 0000000000000000 +x13: ffffa29a76f1e238 x12: 0000000000000001 +x11: 0000000000000400 x10: 00000000000009f0 +x9 : ffff8000107b3e70 x8 : ffff0027db0c1890 +x7 : ffffa29a773a7000 x6 : 00000007f5131013 +x5 : 00000007f5131013 x4 : 09f257d417c00000 +x3 : 00000002187bd7ce x2 : ffffa29a38f0f0d8 +x1 : ffffa29a38eae268 x0 : ffff0027d2e76c80 +Call trace: +hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu] +hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu] +__perf_event_read+0x1a0/0x1f8 +flush_smp_call_function_queue+0xa0/0x160 +generic_smp_call_function_single_interrupt+0x18/0x20 +handle_IPI+0x31c/0x4dc +gic_handle_irq+0x2c8/0x310 +el1_irq+0xcc/0x180 +arch_cpu_idle+0x4c/0x20c +default_idle_call+0x20/0x30 +do_idle+0x1b4/0x270 +cpu_startup_entry+0x28/0x30 +secondary_start_kernel+0x1a4/0x1fc + +To solve the above issue, current module should be registered to kernel, +so that try_module_get() can be invoked when perf sampling starts. This +adds the reference counting of module and could prevent users from removing +modules during sampling. + +Reported-by: Haifeng Wang +Signed-off-by: Qi Liu +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/1594891165-8228-1-git-send-email-liuqi115@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_smmuv3_pmu.c | 1 + + drivers/perf/fsl_imx8_ddr_perf.c | 1 + + drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 + + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 + + drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 + + 5 files changed, 5 insertions(+) + +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index 48e28ef93a702..90caba56dfbc1 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -742,6 +742,7 @@ static int smmu_pmu_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, smmu_pmu); + + smmu_pmu->pmu = (struct pmu) { ++ .module = THIS_MODULE, + .task_ctx_nr = perf_invalid_context, + .pmu_enable = smmu_pmu_enable, + .pmu_disable = smmu_pmu_disable, +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 90884d14f95fa..2aed2d96f8ae7 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -512,6 +512,7 @@ static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base, + { + *pmu = (struct ddr_pmu) { + .pmu = (struct pmu) { ++ .module = THIS_MODULE, + .capabilities = PERF_PMU_CAP_NO_EXCLUDE, + .task_ctx_nr = perf_invalid_context, + .attr_groups = attr_groups, +diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +index 453f1c6a16ca8..c65da06abb041 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +@@ -378,6 +378,7 @@ static int hisi_ddrc_pmu_probe(struct platform_device *pdev) + ddrc_pmu->sccl_id, ddrc_pmu->index_id); + ddrc_pmu->pmu = (struct pmu) { + .name = name, ++ .module = THIS_MODULE, + .task_ctx_nr = perf_invalid_context, + .event_init = hisi_uncore_pmu_event_init, + .pmu_enable = hisi_uncore_pmu_enable, +diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +index e5af9d7e6e145..ee6e6a1c390a0 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +@@ -390,6 +390,7 @@ static int hisi_hha_pmu_probe(struct platform_device *pdev) + hha_pmu->sccl_id, hha_pmu->index_id); + hha_pmu->pmu = (struct pmu) { + .name = name, ++ .module = THIS_MODULE, + .task_ctx_nr = perf_invalid_context, + .event_init = hisi_uncore_pmu_event_init, + .pmu_enable = hisi_uncore_pmu_enable, +diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +index 479de4be99eba..c8b98d3a8432a 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +@@ -380,6 +380,7 @@ static int hisi_l3c_pmu_probe(struct platform_device *pdev) + l3c_pmu->sccl_id, l3c_pmu->index_id); + l3c_pmu->pmu = (struct pmu) { + .name = name, ++ .module = THIS_MODULE, + .task_ctx_nr = perf_invalid_context, + .event_init = hisi_uncore_pmu_event_init, + .pmu_enable = hisi_uncore_pmu_enable, +-- +2.25.1 + diff --git a/queue-5.7/drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch b/queue-5.7/drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch new file mode 100644 index 00000000000..9e96beeb0e9 --- /dev/null +++ b/queue-5.7/drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch @@ -0,0 +1,197 @@ +From 5fc683b4146f4d45d76c6694399880812e51c552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 16:49:23 +0800 +Subject: drivers/perf: Prevent forced unbinding of PMU drivers + +From: Qi Liu + +[ Upstream commit f32ed8eb0e3f0d0ef4ddb854554d60ca5863a9f9 ] + +Forcefully unbinding PMU drivers during perf sampling will lead to +a kernel panic, because the perf upper-layer framework call a NULL +pointer in this situation. + +To solve this issue, "suppress_bind_attrs" should be set to true, so +that bind/unbind can be disabled via sysfs and prevent unbinding PMU +drivers during perf sampling. + +Signed-off-by: Qi Liu +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/1594975763-32966-1-git-send-email-liuqi115@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cci.c | 1 + + drivers/perf/arm-ccn.c | 1 + + drivers/perf/arm_dsu_pmu.c | 1 + + drivers/perf/arm_smmuv3_pmu.c | 1 + + drivers/perf/arm_spe_pmu.c | 1 + + drivers/perf/fsl_imx8_ddr_perf.c | 1 + + drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 + + drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 + + drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 + + drivers/perf/qcom_l2_pmu.c | 1 + + drivers/perf/qcom_l3_pmu.c | 1 + + drivers/perf/thunderx2_pmu.c | 1 + + drivers/perf/xgene_pmu.c | 1 + + 13 files changed, 13 insertions(+) + +diff --git a/drivers/perf/arm-cci.c b/drivers/perf/arm-cci.c +index 1b8e337a29cac..87c4be9dd4125 100644 +--- a/drivers/perf/arm-cci.c ++++ b/drivers/perf/arm-cci.c +@@ -1718,6 +1718,7 @@ static struct platform_driver cci_pmu_driver = { + .driver = { + .name = DRIVER_NAME, + .of_match_table = arm_cci_pmu_matches, ++ .suppress_bind_attrs = true, + }, + .probe = cci_pmu_probe, + .remove = cci_pmu_remove, +diff --git a/drivers/perf/arm-ccn.c b/drivers/perf/arm-ccn.c +index d50edef91f59b..7b7d23f257139 100644 +--- a/drivers/perf/arm-ccn.c ++++ b/drivers/perf/arm-ccn.c +@@ -1545,6 +1545,7 @@ static struct platform_driver arm_ccn_driver = { + .driver = { + .name = "arm-ccn", + .of_match_table = arm_ccn_match, ++ .suppress_bind_attrs = true, + }, + .probe = arm_ccn_probe, + .remove = arm_ccn_remove, +diff --git a/drivers/perf/arm_dsu_pmu.c b/drivers/perf/arm_dsu_pmu.c +index 70968c8c09d7f..4594e2ed13d59 100644 +--- a/drivers/perf/arm_dsu_pmu.c ++++ b/drivers/perf/arm_dsu_pmu.c +@@ -759,6 +759,7 @@ static struct platform_driver dsu_pmu_driver = { + .driver = { + .name = DRVNAME, + .of_match_table = of_match_ptr(dsu_pmu_of_match), ++ .suppress_bind_attrs = true, + }, + .probe = dsu_pmu_device_probe, + .remove = dsu_pmu_device_remove, +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index 90caba56dfbc1..4cdb35d166acc 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -860,6 +860,7 @@ static void smmu_pmu_shutdown(struct platform_device *pdev) + static struct platform_driver smmu_pmu_driver = { + .driver = { + .name = "arm-smmu-v3-pmcg", ++ .suppress_bind_attrs = true, + }, + .probe = smmu_pmu_probe, + .remove = smmu_pmu_remove, +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index b72c048525990..c5418fd3122c2 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -1228,6 +1228,7 @@ static struct platform_driver arm_spe_pmu_driver = { + .driver = { + .name = DRVNAME, + .of_match_table = of_match_ptr(arm_spe_pmu_of_match), ++ .suppress_bind_attrs = true, + }, + .probe = arm_spe_pmu_device_probe, + .remove = arm_spe_pmu_device_remove, +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 2aed2d96f8ae7..397540a4b799c 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -707,6 +707,7 @@ static struct platform_driver imx_ddr_pmu_driver = { + .driver = { + .name = "imx-ddr-pmu", + .of_match_table = imx_ddr_pmu_dt_ids, ++ .suppress_bind_attrs = true, + }, + .probe = ddr_perf_probe, + .remove = ddr_perf_remove, +diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +index c65da06abb041..3418527366408 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c +@@ -417,6 +417,7 @@ static struct platform_driver hisi_ddrc_pmu_driver = { + .driver = { + .name = "hisi_ddrc_pmu", + .acpi_match_table = ACPI_PTR(hisi_ddrc_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = hisi_ddrc_pmu_probe, + .remove = hisi_ddrc_pmu_remove, +diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +index ee6e6a1c390a0..375c4737a088a 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c +@@ -429,6 +429,7 @@ static struct platform_driver hisi_hha_pmu_driver = { + .driver = { + .name = "hisi_hha_pmu", + .acpi_match_table = ACPI_PTR(hisi_hha_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = hisi_hha_pmu_probe, + .remove = hisi_hha_pmu_remove, +diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +index c8b98d3a8432a..44e8a660c5f52 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c +@@ -419,6 +419,7 @@ static struct platform_driver hisi_l3c_pmu_driver = { + .driver = { + .name = "hisi_l3c_pmu", + .acpi_match_table = ACPI_PTR(hisi_l3c_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = hisi_l3c_pmu_probe, + .remove = hisi_l3c_pmu_remove, +diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c +index 21d6991dbe0ba..4da37f650f983 100644 +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -1028,6 +1028,7 @@ static struct platform_driver l2_cache_pmu_driver = { + .driver = { + .name = "qcom-l2cache-pmu", + .acpi_match_table = ACPI_PTR(l2_cache_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = l2_cache_pmu_probe, + .remove = l2_cache_pmu_remove, +diff --git a/drivers/perf/qcom_l3_pmu.c b/drivers/perf/qcom_l3_pmu.c +index 656e830798d9e..9ddb577c542b5 100644 +--- a/drivers/perf/qcom_l3_pmu.c ++++ b/drivers/perf/qcom_l3_pmu.c +@@ -814,6 +814,7 @@ static struct platform_driver qcom_l3_cache_pmu_driver = { + .driver = { + .name = "qcom-l3cache-pmu", + .acpi_match_table = ACPI_PTR(qcom_l3_cache_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = qcom_l3_cache_pmu_probe, + }; +diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c +index 51b31d6ff2c4c..aac9823b0c6bb 100644 +--- a/drivers/perf/thunderx2_pmu.c ++++ b/drivers/perf/thunderx2_pmu.c +@@ -1017,6 +1017,7 @@ static struct platform_driver tx2_uncore_driver = { + .driver = { + .name = "tx2-uncore-pmu", + .acpi_match_table = ACPI_PTR(tx2_uncore_acpi_match), ++ .suppress_bind_attrs = true, + }, + .probe = tx2_uncore_probe, + .remove = tx2_uncore_remove, +diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c +index 46ee6807d533a..edac28cd25ddc 100644 +--- a/drivers/perf/xgene_pmu.c ++++ b/drivers/perf/xgene_pmu.c +@@ -1975,6 +1975,7 @@ static struct platform_driver xgene_pmu_driver = { + .name = "xgene-pmu", + .of_match_table = xgene_pmu_of_match, + .acpi_match_table = ACPI_PTR(xgene_pmu_acpi_match), ++ .suppress_bind_attrs = true, + }, + }; + +-- +2.25.1 + diff --git a/queue-5.7/drm-amdgpu-fix-preemption-unit-test.patch b/queue-5.7/drm-amdgpu-fix-preemption-unit-test.patch new file mode 100644 index 00000000000..57ce3099e85 --- /dev/null +++ b/queue-5.7/drm-amdgpu-fix-preemption-unit-test.patch @@ -0,0 +1,70 @@ +From a3bae0872e2ffcca997b3410f3eea164c275301c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 12:34:52 +0800 +Subject: drm/amdgpu: fix preemption unit test + +From: Jack Xiao + +[ Upstream commit d845a2051b6b673fab4229b920ea04c7c4352b51 ] + +Remove signaled jobs from job list and ensure the +job was indeed preempted. + +Signed-off-by: Jack Xiao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index c0f9a651dc067..92b18c4760e55 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -1156,27 +1156,37 @@ static void amdgpu_ib_preempt_job_recovery(struct drm_gpu_scheduler *sched) + static void amdgpu_ib_preempt_mark_partial_job(struct amdgpu_ring *ring) + { + struct amdgpu_job *job; +- struct drm_sched_job *s_job; ++ struct drm_sched_job *s_job, *tmp; + uint32_t preempt_seq; + struct dma_fence *fence, **ptr; + struct amdgpu_fence_driver *drv = &ring->fence_drv; + struct drm_gpu_scheduler *sched = &ring->sched; ++ bool preempted = true; + + if (ring->funcs->type != AMDGPU_RING_TYPE_GFX) + return; + + preempt_seq = le32_to_cpu(*(drv->cpu_addr + 2)); +- if (preempt_seq <= atomic_read(&drv->last_seq)) +- return; ++ if (preempt_seq <= atomic_read(&drv->last_seq)) { ++ preempted = false; ++ goto no_preempt; ++ } + + preempt_seq &= drv->num_fences_mask; + ptr = &drv->fences[preempt_seq]; + fence = rcu_dereference_protected(*ptr, 1); + ++no_preempt: + spin_lock(&sched->job_list_lock); +- list_for_each_entry(s_job, &sched->ring_mirror_list, node) { ++ list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) { ++ if (dma_fence_is_signaled(&s_job->s_fence->finished)) { ++ /* remove job from ring_mirror_list */ ++ list_del_init(&s_job->node); ++ sched->ops->free_job(s_job); ++ continue; ++ } + job = to_amdgpu_job(s_job); +- if (job->fence == fence) ++ if (preempted && job->fence == fence) + /* mark the job as preempted */ + job->preemption_status |= AMDGPU_IB_PREEMPTED; + } +-- +2.25.1 + diff --git a/queue-5.7/drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch b/queue-5.7/drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch new file mode 100644 index 00000000000..0aef3aa0001 --- /dev/null +++ b/queue-5.7/drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch @@ -0,0 +1,60 @@ +From cd285fbd5dce1437ee94d90cf7c73b1d843026eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 12:18:22 +0800 +Subject: drm/amdgpu/gfx10: fix race condition for kiq +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jack Xiao + +[ Upstream commit 7d65a577bb58d4f27a3398a4c0cb0b00ab7d0511 ] + +During preemption test for gfx10, it uses kiq to trigger +gfx preemption, which would result in race condition +with flushing TLB for kiq. + +Signed-off-by: Jack Xiao +Reviewed-by: Hawking Zhang +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 0e0daf0021b60..ff94f756978d5 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4746,12 +4746,17 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring) + struct amdgpu_device *adev = ring->adev; + struct amdgpu_kiq *kiq = &adev->gfx.kiq; + struct amdgpu_ring *kiq_ring = &kiq->ring; ++ unsigned long flags; + + if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues) + return -EINVAL; + +- if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size)) ++ spin_lock_irqsave(&kiq->ring_lock, flags); ++ ++ if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size)) { ++ spin_unlock_irqrestore(&kiq->ring_lock, flags); + return -ENOMEM; ++ } + + /* assert preemption condition */ + amdgpu_ring_set_preempt_cond_exec(ring, false); +@@ -4762,6 +4767,8 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring) + ++ring->trail_seq); + amdgpu_ring_commit(kiq_ring); + ++ spin_unlock_irqrestore(&kiq->ring_lock, flags); ++ + /* poll the trailing fence */ + for (i = 0; i < adev->usec_timeout; i++) { + if (ring->trail_seq == +-- +2.25.1 + diff --git a/queue-5.7/drm-sun4i-hdmi-fix-inverted-hpd-result.patch b/queue-5.7/drm-sun4i-hdmi-fix-inverted-hpd-result.patch new file mode 100644 index 00000000000..8326a5226a1 --- /dev/null +++ b/queue-5.7/drm-sun4i-hdmi-fix-inverted-hpd-result.patch @@ -0,0 +1,40 @@ +From b1a4fdff93e337a02658aecc71fbccd2e40c2327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 09:10:30 +0800 +Subject: drm: sun4i: hdmi: Fix inverted HPD result + +From: Chen-Yu Tsai + +[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ] + +When the extra HPD polling in sun4i_hdmi was removed, the result of +HPD was accidentally inverted. + +Fix this by inverting the check. + +Fixes: bda8eaa6dee7 ("drm: sun4i: hdmi: Remove extra HPD polling") +Signed-off-by: Chen-Yu Tsai +Tested-by: Mans Rullgard +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20200711011030.21997-1-wens@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index f07e0c32b93a2..4c5072a578bf2 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -263,7 +263,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force) + unsigned long reg; + + reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG); +- if (reg & SUN4I_HDMI_HPD_HIGH) { ++ if (!(reg & SUN4I_HDMI_HPD_HIGH)) { + cec_phys_addr_invalidate(hdmi->cec_adap); + return connector_status_disconnected; + } +-- +2.25.1 + diff --git a/queue-5.7/efi-efivars-expose-rt-service-availability-via-efiva.patch b/queue-5.7/efi-efivars-expose-rt-service-availability-via-efiva.patch new file mode 100644 index 00000000000..228b216b664 --- /dev/null +++ b/queue-5.7/efi-efivars-expose-rt-service-availability-via-efiva.patch @@ -0,0 +1,173 @@ +From 87bb97ed4ab3ec4831d85a21f744b1ae67691777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 13:01:57 +0300 +Subject: efi/efivars: Expose RT service availability via efivars abstraction + +From: Ard Biesheuvel + +[ Upstream commit f88814cc2578c121e6edef686365036db72af0ed ] + +Commit + + bf67fad19e493b ("efi: Use more granular check for availability for variable services") + +introduced a check into the efivarfs, efi-pstore and other drivers that +aborts loading of the module if not all three variable runtime services +(GetVariable, SetVariable and GetNextVariable) are supported. However, this +results in efivarfs being unavailable entirely if only SetVariable support +is missing, which is only needed if you want to make any modifications. +Also, efi-pstore and the sysfs EFI variable interface could be backed by +another implementation of the 'efivars' abstraction, in which case it is +completely irrelevant which services are supported by the EFI firmware. + +So make the generic 'efivars' abstraction dependent on the availibility of +the GetVariable and GetNextVariable EFI runtime services, and add a helper +'efivar_supports_writes()' to find out whether the currently active efivars +abstraction supports writes (and wire it up to the availability of +SetVariable for the generic one). + +Then, use the efivar_supports_writes() helper to decide whether to permit +efivarfs to be mounted read-write, and whether to enable efi-pstore or the +sysfs EFI variable interface altogether. + +Fixes: bf67fad19e493b ("efi: Use more granular check for availability for variable services") +Reported-by: Heinrich Schuchardt +Acked-by: Ilias Apalodimas +Tested-by: Ilias Apalodimas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi-pstore.c | 5 +---- + drivers/firmware/efi/efi.c | 12 ++++++++---- + drivers/firmware/efi/efivars.c | 5 +---- + drivers/firmware/efi/vars.c | 6 ++++++ + fs/efivarfs/super.c | 6 +++--- + include/linux/efi.h | 1 + + 6 files changed, 20 insertions(+), 15 deletions(-) + +diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c +index c2f1d4e6630b1..feb7fe6f2da76 100644 +--- a/drivers/firmware/efi/efi-pstore.c ++++ b/drivers/firmware/efi/efi-pstore.c +@@ -356,10 +356,7 @@ static struct pstore_info efi_pstore_info = { + + static __init int efivars_pstore_init(void) + { +- if (!efi_rt_services_supported(EFI_RT_SUPPORTED_VARIABLE_SERVICES)) +- return 0; +- +- if (!efivars_kobject()) ++ if (!efivars_kobject() || !efivar_supports_writes()) + return 0; + + if (efivars_pstore_disable) +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 20a7ba47a7924..99446b3847265 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -176,11 +176,13 @@ static struct efivar_operations generic_ops; + static int generic_ops_register(void) + { + generic_ops.get_variable = efi.get_variable; +- generic_ops.set_variable = efi.set_variable; +- generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; + generic_ops.get_next_variable = efi.get_next_variable; + generic_ops.query_variable_store = efi_query_variable_store; + ++ if (efi_rt_services_supported(EFI_RT_SUPPORTED_SET_VARIABLE)) { ++ generic_ops.set_variable = efi.set_variable; ++ generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking; ++ } + return efivars_register(&generic_efivars, &generic_ops, efi_kobj); + } + +@@ -382,7 +384,8 @@ static int __init efisubsys_init(void) + return -ENOMEM; + } + +- if (efi_rt_services_supported(EFI_RT_SUPPORTED_VARIABLE_SERVICES)) { ++ if (efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE | ++ EFI_RT_SUPPORTED_GET_NEXT_VARIABLE_NAME)) { + efivar_ssdt_load(); + error = generic_ops_register(); + if (error) +@@ -416,7 +419,8 @@ static int __init efisubsys_init(void) + err_remove_group: + sysfs_remove_group(efi_kobj, &efi_subsys_attr_group); + err_unregister: +- if (efi_rt_services_supported(EFI_RT_SUPPORTED_VARIABLE_SERVICES)) ++ if (efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE | ++ EFI_RT_SUPPORTED_GET_NEXT_VARIABLE_NAME)) + generic_ops_unregister(); + err_put: + kobject_put(efi_kobj); +diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c +index 26528a46d99e9..dcea137142b3c 100644 +--- a/drivers/firmware/efi/efivars.c ++++ b/drivers/firmware/efi/efivars.c +@@ -680,11 +680,8 @@ int efivars_sysfs_init(void) + struct kobject *parent_kobj = efivars_kobject(); + int error = 0; + +- if (!efi_rt_services_supported(EFI_RT_SUPPORTED_VARIABLE_SERVICES)) +- return -ENODEV; +- + /* No efivars has been registered yet */ +- if (!parent_kobj) ++ if (!parent_kobj || !efivar_supports_writes()) + return 0; + + printk(KERN_INFO "EFI Variables Facility v%s %s\n", EFIVARS_VERSION, +diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c +index 5f2a4d162795c..973eef234b365 100644 +--- a/drivers/firmware/efi/vars.c ++++ b/drivers/firmware/efi/vars.c +@@ -1229,3 +1229,9 @@ out: + return rv; + } + EXPORT_SYMBOL_GPL(efivars_unregister); ++ ++int efivar_supports_writes(void) ++{ ++ return __efivars && __efivars->ops->set_variable; ++} ++EXPORT_SYMBOL_GPL(efivar_supports_writes); +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index 12c66f5d92dd2..28bb5689333a5 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -201,6 +201,9 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc) + sb->s_d_op = &efivarfs_d_ops; + sb->s_time_gran = 1; + ++ if (!efivar_supports_writes()) ++ sb->s_flags |= SB_RDONLY; ++ + inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true); + if (!inode) + return -ENOMEM; +@@ -252,9 +255,6 @@ static struct file_system_type efivarfs_type = { + + static __init int efivarfs_init(void) + { +- if (!efi_rt_services_supported(EFI_RT_SUPPORTED_VARIABLE_SERVICES)) +- return -ENODEV; +- + if (!efivars_kobject()) + return -ENODEV; + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 9430d01c0c3d3..650794abfa326 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -991,6 +991,7 @@ int efivars_register(struct efivars *efivars, + int efivars_unregister(struct efivars *efivars); + struct kobject *efivars_kobject(void); + ++int efivar_supports_writes(void); + int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *), + void *data, bool duplicates, struct list_head *head); + +-- +2.25.1 + diff --git a/queue-5.7/enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch b/queue-5.7/enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch new file mode 100644 index 00000000000..18b535edb49 --- /dev/null +++ b/queue-5.7/enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch @@ -0,0 +1,74 @@ +From 851f1f8ef6cf8459038a747ae7dbcb299cdb9722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 17:40:12 +0300 +Subject: enetc: Remove the mdio bus on PF probe bailout + +From: Claudiu Manoil + +[ Upstream commit 26cb7085c8984e5b71d65c374a135134ed8cabb3 ] + +For ENETC ports that register an external MDIO bus, +the bus doesn't get removed on the error bailout path +of enetc_pf_probe(). + +This issue became much more visible after recent: +commit 07095c025ac2 ("net: enetc: Use DT protocol information to set up the ports") +Before this commit, one could make probing fail on the error +path only by having register_netdev() fail, which is unlikely. +But after this commit, because it moved the enetc_of_phy_get() +call up in the probing sequence, now we can trigger an mdiobus_free() +bug just by forcing enetc_alloc_msix() to return error, i.e. with the +'pci=nomsi' kernel bootarg (since ENETC relies on MSI support to work), +as the calltrace below shows: + +kernel BUG at /home/eiz/work/enetc/net/drivers/net/phy/mdio_bus.c:648! +Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +[...] +Hardware name: LS1028A RDB Board (DT) +pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--) +pc : mdiobus_free+0x50/0x58 +lr : devm_mdiobus_free+0x14/0x20 +[...] +Call trace: + mdiobus_free+0x50/0x58 + devm_mdiobus_free+0x14/0x20 + release_nodes+0x138/0x228 + devres_release_all+0x38/0x60 + really_probe+0x1c8/0x368 + driver_probe_device+0x5c/0xc0 + device_driver_attach+0x74/0x80 + __driver_attach+0x8c/0xd8 + bus_for_each_dev+0x7c/0xd8 + driver_attach+0x24/0x30 + bus_add_driver+0x154/0x200 + driver_register+0x64/0x120 + __pci_register_driver+0x44/0x50 + enetc_pf_driver_init+0x24/0x30 + do_one_initcall+0x60/0x1c0 + kernel_init_freeable+0x1fc/0x274 + kernel_init+0x14/0x110 + ret_from_fork+0x10/0x34 + +Fixes: ebfcb23d62ab ("enetc: Add ENETC PF level external MDIO support") +Signed-off-by: Claudiu Manoil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 438648a06f2ae..041e19895adfa 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -919,6 +919,7 @@ static int enetc_pf_probe(struct pci_dev *pdev, + return 0; + + err_reg_netdev: ++ enetc_mdio_remove(pf); + enetc_of_put_phy(priv); + enetc_free_msix(priv); + err_alloc_msix: +-- +2.25.1 + diff --git a/queue-5.7/fpga-dfl-fix-bug-in-port-reset-handshake.patch b/queue-5.7/fpga-dfl-fix-bug-in-port-reset-handshake.patch new file mode 100644 index 00000000000..a724c15ad3a --- /dev/null +++ b/queue-5.7/fpga-dfl-fix-bug-in-port-reset-handshake.patch @@ -0,0 +1,40 @@ +From 59fe7a8f5ac11e7ff987c3253312f34cfa3e3bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 14:10:03 +0800 +Subject: fpga: dfl: fix bug in port reset handshake + +From: Matthew Gerlach + +[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ] + +When putting the port in reset, driver must wait for the soft reset +acknowledgment bit instead of the soft reset bit. + +Fixes: 47c1b19c160f (fpga: dfl: afu: add port ops support) +Signed-off-by: Matthew Gerlach +Signed-off-by: Xu Yilun +Acked-by: Wu Hao +Reviewed-by: Tom Rix +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/dfl-afu-main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c +index 65437b6a68424..77e257c88a1df 100644 +--- a/drivers/fpga/dfl-afu-main.c ++++ b/drivers/fpga/dfl-afu-main.c +@@ -83,7 +83,8 @@ int __afu_port_disable(struct platform_device *pdev) + * on this port and minimum soft reset pulse width has elapsed. + * Driver polls port_soft_reset_ack to determine if reset done by HW. + */ +- if (readq_poll_timeout(base + PORT_HDR_CTRL, v, v & PORT_CTRL_SFTRST, ++ if (readq_poll_timeout(base + PORT_HDR_CTRL, v, ++ v & PORT_CTRL_SFTRST_ACK, + RST_POLL_INVL, RST_POLL_TIMEOUT)) { + dev_err(&pdev->dev, "timeout, fail to reset device\n"); + return -ETIMEDOUT; +-- +2.25.1 + diff --git a/queue-5.7/fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch b/queue-5.7/fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch new file mode 100644 index 00000000000..f2d7423f113 --- /dev/null +++ b/queue-5.7/fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch @@ -0,0 +1,54 @@ +From 40d9b0a5cc703fdc0393db7739d6ae8419b23972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 14:10:02 +0800 +Subject: fpga: dfl: pci: reduce the scope of variable 'ret' + +From: Xu Yilun + +[ Upstream commit e19485dc7a0d210b428a249c0595769bd495fb71 ] + +This is to fix lkp cppcheck warnings: + + drivers/fpga/dfl-pci.c:230:6: warning: The scope of the variable 'ret' can be reduced. [variableScope] + int ret = 0; + ^ + + drivers/fpga/dfl-pci.c:230:10: warning: Variable 'ret' is assigned a value that is never used. [unreadVariable] + int ret = 0; + ^ + +Fixes: 3c2760b78f90 ("fpga: dfl: pci: fix return value of cci_pci_sriov_configure") +Reported-by: kbuild test robot +Signed-off-by: Xu Yilun +Acked-by: Wu Hao +Reviewed-by: Tom Rix +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/dfl-pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/fpga/dfl-pci.c b/drivers/fpga/dfl-pci.c +index 538755062ab7c..a78c409bf2c44 100644 +--- a/drivers/fpga/dfl-pci.c ++++ b/drivers/fpga/dfl-pci.c +@@ -227,7 +227,6 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs) + { + struct cci_drvdata *drvdata = pci_get_drvdata(pcidev); + struct dfl_fpga_cdev *cdev = drvdata->cdev; +- int ret = 0; + + if (!num_vfs) { + /* +@@ -239,6 +238,8 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs) + dfl_fpga_cdev_config_ports_pf(cdev); + + } else { ++ int ret; ++ + /* + * before enable SRIOV, put released ports into VF access mode + * first of all. +-- +2.25.1 + diff --git a/queue-5.7/geneve-fix-an-uninitialized-value-in-geneve_changeli.patch b/queue-5.7/geneve-fix-an-uninitialized-value-in-geneve_changeli.patch new file mode 100644 index 00000000000..9d5f7df7a39 --- /dev/null +++ b/queue-5.7/geneve-fix-an-uninitialized-value-in-geneve_changeli.patch @@ -0,0 +1,44 @@ +From c32dbd8a9fc14f0cd540c2fadea4e62b50192af6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 18:56:25 -0700 +Subject: geneve: fix an uninitialized value in geneve_changelink() + +From: Cong Wang + +[ Upstream commit 32818c075c54bb0cae44dd6f7ab00b01c52b8372 ] + +geneve_nl2info() sets 'df' conditionally, so we have to +initialize it by copying the value from existing geneve +device in geneve_changelink(). + +Fixes: 56c09de347e4 ("geneve: allow changing DF behavior after creation") +Reported-by: syzbot+7ebc2e088af5e4c0c9fa@syzkaller.appspotmail.com +Cc: Sabrina Dubroca +Signed-off-by: Cong Wang +Reviewed-by: Sabrina Dubroca +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 4661ef865807f..dec52b763d508 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -1615,11 +1615,11 @@ static int geneve_changelink(struct net_device *dev, struct nlattr *tb[], + struct netlink_ext_ack *extack) + { + struct geneve_dev *geneve = netdev_priv(dev); ++ enum ifla_geneve_df df = geneve->df; + struct geneve_sock *gs4, *gs6; + struct ip_tunnel_info info; + bool metadata; + bool use_udp6_rx_checksums; +- enum ifla_geneve_df df; + bool ttl_inherit; + int err; + +-- +2.25.1 + diff --git a/queue-5.7/hid-alps-support-devices-with-report-id-2.patch b/queue-5.7/hid-alps-support-devices-with-report-id-2.patch new file mode 100644 index 00000000000..89f7067c166 --- /dev/null +++ b/queue-5.7/hid-alps-support-devices-with-report-id-2.patch @@ -0,0 +1,41 @@ +From 20795cdd2344e38b074b609bdd6d87fb1e0cf720 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 05:06:10 -0400 +Subject: HID: alps: support devices with report id 2 + +From: Caiyuan Xie + +[ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ] + +Add support for devices which that have reports with id == 2 + +Signed-off-by: Caiyuan Xie +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index b2ad319a74b9a..d33f5abc8f64d 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -25,6 +25,7 @@ + + #define U1_MOUSE_REPORT_ID 0x01 /* Mouse data ReportID */ + #define U1_ABSOLUTE_REPORT_ID 0x03 /* Absolute data ReportID */ ++#define U1_ABSOLUTE_REPORT_ID_SECD 0x02 /* FW-PTP Absolute data ReportID */ + #define U1_FEATURE_REPORT_ID 0x05 /* Feature ReportID */ + #define U1_SP_ABSOLUTE_REPORT_ID 0x06 /* Feature ReportID */ + +@@ -368,6 +369,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size) + case U1_FEATURE_REPORT_ID: + break; + case U1_ABSOLUTE_REPORT_ID: ++ case U1_ABSOLUTE_REPORT_ID_SECD: + for (i = 0; i < hdata->max_fingers; i++) { + u8 *contact = &data[i * 5]; + +-- +2.25.1 + diff --git a/queue-5.7/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch b/queue-5.7/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch new file mode 100644 index 00000000000..ab1ca08322e --- /dev/null +++ b/queue-5.7/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch @@ -0,0 +1,100 @@ +From ad086eb1a02b54fdacde07fd4a20c7cfd5c1a642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 14:32:29 +0200 +Subject: HID: apple: Disable Fn-key key-re-mapping on clone keyboards + +From: Hans de Goede + +[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ] + +The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the +Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239) +of the Apple Wireless Keyboard (2009 ANSI version) . + +But its F1 - F10 keys are marked as sending F1 - F10, not the special +functions hid-apple.c maps them too; and since its descriptors do not +contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the +Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped +to key-codes which have not been set in the keybit array causing them +to not send any events at all. + +The lack of a usage code matching the Fn key in the clone is actually +useful as this allows solving this problem in a generic way. + +This commits adds a fn_found flag and it adds a input_configured +callback which checks if this flag is set once all usages have been +mapped. If it is not set, then assume this is a clone and clear the +quirks bitmap so that the hid-apple code does not add any special +handling to this keyboard. + +This fixes F1 - F6 not sending anything at all and F7 - F12 sending +the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on +similar clones. + +Cc: Joao Moreno +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index d732d1d10cafb..6909c045fece1 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -54,6 +54,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") + struct apple_sc { + unsigned long quirks; + unsigned int fn_on; ++ unsigned int fn_found; + DECLARE_BITMAP(pressed_numlock, KEY_CNT); + }; + +@@ -339,12 +340,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) + { ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ + if (usage->hid == (HID_UP_CUSTOM | 0x0003) || + usage->hid == (HID_UP_MSVENDOR | 0x0003) || + usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); ++ asc->fn_found = true; + apple_setup_input(hi->input); + return 1; + } +@@ -371,6 +375,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, + return 0; + } + ++static int apple_input_configured(struct hid_device *hdev, ++ struct hid_input *hidinput) ++{ ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ ++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { ++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); ++ asc->quirks = 0; ++ } ++ ++ return 0; ++} ++ + static int apple_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +@@ -585,6 +602,7 @@ static struct hid_driver apple_driver = { + .event = apple_event, + .input_mapping = apple_input_mapping, + .input_mapped = apple_input_mapped, ++ .input_configured = apple_input_configured, + }; + module_hid_driver(apple_driver); + +-- +2.25.1 + diff --git a/queue-5.7/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch b/queue-5.7/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch new file mode 100644 index 00000000000..3c03989b1bd --- /dev/null +++ b/queue-5.7/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch @@ -0,0 +1,41 @@ +From 8e23e2b82955ff0b08a54be67426ffc3778c1ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 22:49:11 +0200 +Subject: HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override + +From: Federico Ricchiuto + +[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ] + +The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override list. + +Signed-off-by: Federico Ricchiuto +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index ec142bc8c1daf..35f3bfc3e6f59 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Mediacom FlexBook edge 13", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Odys Winbook 13", + .matches = { +-- +2.25.1 + diff --git a/queue-5.7/hid-steam-fixes-race-in-handling-device-list.patch b/queue-5.7/hid-steam-fixes-race-in-handling-device-list.patch new file mode 100644 index 00000000000..74e02a0a41a --- /dev/null +++ b/queue-5.7/hid-steam-fixes-race-in-handling-device-list.patch @@ -0,0 +1,59 @@ +From d65fff80d77bf0c4b38254d53f186a5cbe970fbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 18:44:18 +0200 +Subject: HID: steam: fixes race in handling device list. + +From: Rodrigo Rivas Costa + +[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ] + +Using uhid and KASAN this driver crashed because it was getting +several connection events where it only expected one. Then the +device was added several times to the static device list and it got +corrupted. + +This patch checks if the device is already in the list before adding +it. + +Signed-off-by: Rodrigo Rivas Costa +Tested-by: Siarhei Vishniakou +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-steam.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c +index 6286204d4c560..a3b151b29bd71 100644 +--- a/drivers/hid/hid-steam.c ++++ b/drivers/hid/hid-steam.c +@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam) + steam_battery_register(steam); + + mutex_lock(&steam_devices_lock); +- list_add(&steam->list, &steam_devices); ++ if (list_empty(&steam->list)) ++ list_add(&steam->list, &steam_devices); + mutex_unlock(&steam_devices_lock); + } + +@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam) + hid_info(steam->hdev, "Steam Controller '%s' disconnected", + steam->serial_no); + mutex_lock(&steam_devices_lock); +- list_del(&steam->list); ++ list_del_init(&steam->list); + mutex_unlock(&steam_devices_lock); + steam->serial_no[0] = 0; + } +@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev, + mutex_init(&steam->mutex); + steam->quirks = id->driver_data; + INIT_WORK(&steam->work_connect, steam_work_connect_cb); ++ INIT_LIST_HEAD(&steam->list); + + steam->client_hdev = steam_create_client_hid(hdev); + if (IS_ERR(steam->client_hdev)) { +-- +2.25.1 + diff --git a/queue-5.7/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch b/queue-5.7/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch new file mode 100644 index 00000000000..a2f8adca631 --- /dev/null +++ b/queue-5.7/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch @@ -0,0 +1,39 @@ +From 6b10ca33d28250b9a4cb82f83be60790ee03aa13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 13:00:27 +0200 +Subject: hippi: Fix a size used in a 'pci_free_consistent()' in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ] + +The size used when calling 'pci_alloc_consistent()' and +'pci_free_consistent()' should match. + +Fix it and have it consistent with the corresponding call in 'rr_close()'. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hippi/rrunner.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 2a6ec53949666..a4b3fce69ecd9 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1242,7 +1242,7 @@ static int rr_open(struct net_device *dev) + rrpriv->info = NULL; + } + if (rrpriv->rx_ctrl) { +- pci_free_consistent(pdev, sizeof(struct ring_ctrl), ++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl), + rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); + rrpriv->rx_ctrl = NULL; + } +-- +2.25.1 + diff --git a/queue-5.7/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch b/queue-5.7/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch new file mode 100644 index 00000000000..23708b99002 --- /dev/null +++ b/queue-5.7/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch @@ -0,0 +1,71 @@ +From 9b4bea8e44c795bb7a86d9835f05eb5009ae96b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 04:06:12 +0000 +Subject: hwmon: (adm1275) Make sure we are reading enough data for different + chips + +From: Chu Lin + +[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ] + +Issue: +When PEC is enabled, binding adm1272 to the adm1275 would +fail due to PEC error. See below: +adm1275: probe of xxxx failed with error -74 + +Diagnosis: +Per the datasheet of adm1272, adm1278, adm1293 and amd1294, +PMON_CONFIG (0xd4) is 16bits wide. On the other hand, +PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not +assume everything is 8bits wide and read only 8bits from it. + +Solution: +If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word. +Else, use i2c_read_byte + +Testing: +Binding adm1272 to the driver. +The change is only tested on adm1272. + +Signed-off-by: Chu Lin +Link: https://lore.kernel.org/r/20200709040612.3977094-1-linchuyuan@google.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/adm1275.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index e25f541227dae..19317575d1c6a 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -465,6 +465,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id); + static int adm1275_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { ++ s32 (*config_read_fn)(const struct i2c_client *client, u8 reg); + u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1]; + int config, device_config; + int ret; +@@ -510,11 +511,16 @@ static int adm1275_probe(struct i2c_client *client, + "Device mismatch: Configured %s, detected %s\n", + id->name, mid->name); + +- config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG); ++ if (mid->driver_data == adm1272 || mid->driver_data == adm1278 || ++ mid->driver_data == adm1293 || mid->driver_data == adm1294) ++ config_read_fn = i2c_smbus_read_word_data; ++ else ++ config_read_fn = i2c_smbus_read_byte_data; ++ config = config_read_fn(client, ADM1275_PMON_CONFIG); + if (config < 0) + return config; + +- device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG); ++ device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG); + if (device_config < 0) + return device_config; + +-- +2.25.1 + diff --git a/queue-5.7/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch b/queue-5.7/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch new file mode 100644 index 00000000000..90bde4a19ca --- /dev/null +++ b/queue-5.7/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch @@ -0,0 +1,41 @@ +From 2025c8a05f45f269499ee7eea85ae1dba2e7e54f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 14:15:18 +0300 +Subject: hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow + +From: Evgeny Novikov + +[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ] + +aspeed_create_fan() reads a pwm_port value using of_property_read_u32(). +If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be +a buffer overflow in +aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes +the potential buffer overflow. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Link: https://lore.kernel.org/r/20200703111518.9644-1-novikov@ispras.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/aspeed-pwm-tacho.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c +index 33fb54845bf6d..3d8239fd66ed6 100644 +--- a/drivers/hwmon/aspeed-pwm-tacho.c ++++ b/drivers/hwmon/aspeed-pwm-tacho.c +@@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev, + ret = of_property_read_u32(child, "reg", &pwm_port); + if (ret) + return ret; ++ if (pwm_port >= ARRAY_SIZE(pwm_port_params)) ++ return -EINVAL; + aspeed_create_pwm_port(priv, (u8)pwm_port); + + ret = of_property_count_u8_elems(child, "cooling-levels"); +-- +2.25.1 + diff --git a/queue-5.7/hwmon-nct6775-accept-peci-calibration-as-temperature.patch b/queue-5.7/hwmon-nct6775-accept-peci-calibration-as-temperature.patch new file mode 100644 index 00000000000..702e7c66fc6 --- /dev/null +++ b/queue-5.7/hwmon-nct6775-accept-peci-calibration-as-temperature.patch @@ -0,0 +1,52 @@ +From 988eae3805f461d8f9ca6f5239830e86c111b111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 14:31:11 -0700 +Subject: hwmon: (nct6775) Accept PECI Calibration as temperature source for + NCT6798D + +From: Guenter Roeck + +[ Upstream commit 8a03746c8baf82e1616f05a1a716d34378dcf780 ] + +Stefan Dietrich reports invalid temperature source messages on Asus Formula +XII Z490. + +nct6775 nct6775.656: Invalid temperature source 28 at index 0, + source register 0x100, temp register 0x73 + +Debugging suggests that temperature source 28 reports the CPU temperature. +Let's assume that temperature sources 28 and 29 reflect "PECI Agent {0,1} +Calibration", similar to other chips of the series. + +Reported-by: Stefan Dietrich +Cc: Stefan Dietrich +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index 7efa6bfef0609..ba9b96973e808 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -786,13 +786,13 @@ static const char *const nct6798_temp_label[] = { + "Agent1 Dimm1", + "BYTE_TEMP0", + "BYTE_TEMP1", +- "", +- "", ++ "PECI Agent 0 Calibration", /* undocumented */ ++ "PECI Agent 1 Calibration", /* undocumented */ + "", + "Virtual_TEMP" + }; + +-#define NCT6798_TEMP_MASK 0x8fff0ffe ++#define NCT6798_TEMP_MASK 0xbfff0ffe + #define NCT6798_VIRT_TEMP_MASK 0x80000c00 + + /* NCT6102D/NCT6106D specific data */ +-- +2.25.1 + diff --git a/queue-5.7/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch b/queue-5.7/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch new file mode 100644 index 00000000000..15ca33ba6a1 --- /dev/null +++ b/queue-5.7/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch @@ -0,0 +1,43 @@ +From f68ac61168224d0d656103cf044a3492c41a09ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 13:13:38 +0100 +Subject: hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() + +From: Cristian Marussi + +[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ] + +SMATCH detected a potential buffer overflow in the manipulation of +hwmon_attributes array inside the scmi_hwmon_probe function: + +drivers/hwmon/scmi-hwmon.c:226 + scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9 + +Fix it by statically declaring the size of the array as the maximum +possible as defined by hwmon_max define. + +Signed-off-by: Cristian Marussi +Reviewed-by: Sudeep Holla +Link: https://lore.kernel.org/r/20200715121338.GA18761@e119603-lin.cambridge.arm.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/scmi-hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c +index 286d3cfda7de8..d421e691318b3 100644 +--- a/drivers/hwmon/scmi-hwmon.c ++++ b/drivers/hwmon/scmi-hwmon.c +@@ -147,7 +147,7 @@ static enum hwmon_sensor_types scmi_types[] = { + [ENERGY] = hwmon_energy, + }; + +-static u32 hwmon_attributes[] = { ++static u32 hwmon_attributes[hwmon_max] = { + [hwmon_chip] = HWMON_C_REGISTER_TZ, + [hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL, + [hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL, +-- +2.25.1 + diff --git a/queue-5.7/i2c-i2c-qcom-geni-fix-dma-transfer-race.patch b/queue-5.7/i2c-i2c-qcom-geni-fix-dma-transfer-race.patch new file mode 100644 index 00000000000..e0e1da8740d --- /dev/null +++ b/queue-5.7/i2c-i2c-qcom-geni-fix-dma-transfer-race.patch @@ -0,0 +1,93 @@ +From de46b122d95405df952d10d9c9a2dd4883f46122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 15:00:21 -0700 +Subject: i2c: i2c-qcom-geni: Fix DMA transfer race + +From: Douglas Anderson + +[ Upstream commit 02b9aec59243c6240fc42884acc958602146ddf6 ] + +When I have KASAN enabled on my kernel and I start stressing the +touchscreen my system tends to hang. The touchscreen is one of the +only things that does a lot of big i2c transfers and ends up hitting +the DMA paths in the geni i2c driver. It appears that KASAN adds +enough delay in my system to tickle a race condition in the DMA setup +code. + +When the system hangs, I found that it was running the geni_i2c_irq() +over and over again. It had these: + +m_stat = 0x04000080 +rx_st = 0x30000011 +dm_tx_st = 0x00000000 +dm_rx_st = 0x00000000 +dma = 0x00000001 + +Notably we're in DMA mode but are getting M_RX_IRQ_EN and +M_RX_FIFO_WATERMARK_EN over and over again. + +Putting some traces in geni_i2c_rx_one_msg() showed that when we +failed we were getting to the start of geni_i2c_rx_one_msg() but were +never executing geni_se_rx_dma_prep(). + +I believe that the problem here is that we are starting the geni +command before we run geni_se_rx_dma_prep(). If a transfer makes it +far enough before we do that then we get into the state I have +observed. Let's change the order, which seems to work fine. + +Although problems were seen on the RX path, code inspection suggests +that the TX should be changed too. Change it as well. + +Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") +Signed-off-by: Douglas Anderson +Tested-by: Sai Prakash Ranjan +Reviewed-by: Akash Asthana +Reviewed-by: Stephen Boyd +Reviewed-by: Mukesh Kumar Savaliya +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-qcom-geni.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index 18d1e4fd4cf34..7f130829bf018 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -367,7 +367,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + geni_se_select_mode(se, GENI_SE_FIFO); + + writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN); +- geni_se_setup_m_cmd(se, I2C_READ, m_param); + + if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) { + geni_se_select_mode(se, GENI_SE_FIFO); +@@ -375,6 +374,8 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + dma_buf = NULL; + } + ++ geni_se_setup_m_cmd(se, I2C_READ, m_param); ++ + time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); + if (!time_left) + geni_i2c_abort_xfer(gi2c); +@@ -408,7 +409,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + geni_se_select_mode(se, GENI_SE_FIFO); + + writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN); +- geni_se_setup_m_cmd(se, I2C_WRITE, m_param); + + if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) { + geni_se_select_mode(se, GENI_SE_FIFO); +@@ -416,6 +416,8 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + dma_buf = NULL; + } + ++ geni_se_setup_m_cmd(se, I2C_WRITE, m_param); ++ + if (!dma_buf) /* Get FIFO IRQ */ + writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG); + +-- +2.25.1 + diff --git a/queue-5.7/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch b/queue-5.7/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch new file mode 100644 index 00000000000..3f65157a8a2 --- /dev/null +++ b/queue-5.7/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch @@ -0,0 +1,48 @@ +From 6954f01fb19dca13e651d01a52a00b13095a9436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jul 2020 15:38:29 +0200 +Subject: i2c: rcar: always clear ICSAR to avoid side effects + +From: Wolfram Sang + +[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ] + +On R-Car Gen2, we get a timeout when reading from the address set in +ICSAR, even though the slave interface is disabled. Clearing it fixes +this situation. Note that Gen3 is not affected. + +To reproduce: bind and undbind an I2C slave on some bus, run +'i2cdetect' on that bus. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 3b5397aa4ca60..50dd98803ca0c 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -868,6 +868,7 @@ static int rcar_unreg_slave(struct i2c_client *slave) + /* disable irqs and ensure none is running before clearing ptr */ + rcar_i2c_write(priv, ICSIER, 0); + rcar_i2c_write(priv, ICSCR, 0); ++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + + synchronize_irq(priv->irq); + priv->slave = NULL; +@@ -971,6 +972,8 @@ static int rcar_i2c_probe(struct platform_device *pdev) + if (ret < 0) + goto out_pm_put; + ++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ ++ + if (priv->devtype == I2C_RCAR_GEN3) { + priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); + if (!IS_ERR(priv->rstc)) { +-- +2.25.1 + diff --git a/queue-5.7/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch b/queue-5.7/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch new file mode 100644 index 00000000000..13b5e4037bd --- /dev/null +++ b/queue-5.7/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch @@ -0,0 +1,46 @@ +From 280bcffcc2e7a5769d93c8fb2b5d685ba293a658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 17:01:21 +0800 +Subject: ieee802154: fix one possible memleak in adf7242_probe + +From: Liu Jian + +[ Upstream commit 66673f96f0f968b991dc38be06102246919c663c ] + +When probe fail, we should destroy the workqueue. + +Fixes: 2795e8c25161 ("net: ieee802154: fix a potential NULL pointer dereference") +Signed-off-by: Liu Jian +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20200717090121.2143-1-liujian56@huawei.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/adf7242.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index 5a37514e42347..8dbccec6ac866 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -1262,7 +1262,7 @@ static int adf7242_probe(struct spi_device *spi) + WQ_MEM_RECLAIM); + if (unlikely(!lp->wqueue)) { + ret = -ENOMEM; +- goto err_hw_init; ++ goto err_alloc_wq; + } + + ret = adf7242_hw_init(lp); +@@ -1294,6 +1294,8 @@ static int adf7242_probe(struct spi_device *spi) + return ret; + + err_hw_init: ++ destroy_workqueue(lp->wqueue); ++err_alloc_wq: + mutex_destroy(&lp->bmux); + ieee802154_free_hw(lp->hw); + +-- +2.25.1 + diff --git a/queue-5.7/input-add-sw_machine_cover.patch b/queue-5.7/input-add-sw_machine_cover.patch new file mode 100644 index 00000000000..9734ae7f54a --- /dev/null +++ b/queue-5.7/input-add-sw_machine_cover.patch @@ -0,0 +1,54 @@ +From 8d8d23c44ad6d82edb52bb390980c20eeb1a9847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 11:47:04 -0700 +Subject: Input: add `SW_MACHINE_COVER` + +From: Merlijn Wajer + +[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ] + +This event code represents the state of a removable cover of a device. +Value 0 means that the cover is open or removed, value 1 means that the +cover is closed. + +Reviewed-by: Sebastian Reichel +Acked-by: Tony Lindgren +Signed-off-by: Merlijn Wajer +Link: https://lore.kernel.org/r/20200612125402.18393-2-merlijn@wizzup.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + include/linux/mod_devicetable.h | 2 +- + include/uapi/linux/input-event-codes.h | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 0754b8d71262b..8a84f11bf1246 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -318,7 +318,7 @@ struct pcmcia_device_id { + #define INPUT_DEVICE_ID_LED_MAX 0x0f + #define INPUT_DEVICE_ID_SND_MAX 0x07 + #define INPUT_DEVICE_ID_FF_MAX 0x7f +-#define INPUT_DEVICE_ID_SW_MAX 0x0f ++#define INPUT_DEVICE_ID_SW_MAX 0x10 + #define INPUT_DEVICE_ID_PROP_MAX 0x1f + + #define INPUT_DEVICE_ID_MATCH_BUS 1 +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index b6a835d378263..0c2e27d28e0ac 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -888,7 +888,8 @@ + #define SW_LINEIN_INSERT 0x0d /* set = inserted */ + #define SW_MUTE_DEVICE 0x0e /* set = device disabled */ + #define SW_PEN_INSERTED 0x0f /* set = pen inserted */ +-#define SW_MAX 0x0f ++#define SW_MACHINE_COVER 0x10 /* set = cover closed */ ++#define SW_MAX 0x10 + #define SW_CNT (SW_MAX+1) + + /* +-- +2.25.1 + diff --git a/queue-5.7/input-elan_i2c-only-increment-wakeup-count-on-touch.patch b/queue-5.7/input-elan_i2c-only-increment-wakeup-count-on-touch.patch new file mode 100644 index 00000000000..74ba27c297f --- /dev/null +++ b/queue-5.7/input-elan_i2c-only-increment-wakeup-count-on-touch.patch @@ -0,0 +1,73 @@ +From f9911abb5fc7b76f087e7210d3a33b36848c1e96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 17:39:41 -0700 +Subject: Input: elan_i2c - only increment wakeup count on touch + +From: Derek Basehore + +[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ] + +This moves the wakeup increment for elan devices to the touch report. +This prevents the drivers from incorrectly reporting a wakeup when the +resume callback resets then device, which causes an interrupt to +occur. + +Signed-off-by: Derek Basehore +Link: https://lore.kernel.org/r/20200706235046.1984283-1-dbasehore@chromium.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c_core.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index 8719da5403834..196e8505dd8d7 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -951,6 +951,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet) + u8 hover_info = packet[ETP_HOVER_INFO_OFFSET]; + bool contact_valid, hover_event; + ++ pm_wakeup_event(&data->client->dev, 0); ++ + hover_event = hover_info & 0x40; + for (i = 0; i < ETP_MAX_FINGERS; i++) { + contact_valid = tp_info & (1U << (3 + i)); +@@ -974,6 +976,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report) + u8 *packet = &report[ETP_REPORT_ID_OFFSET + 1]; + int x, y; + ++ pm_wakeup_event(&data->client->dev, 0); ++ + if (!data->tp_input) { + dev_warn_once(&data->client->dev, + "received a trackpoint report while no trackpoint device has been created. Please report upstream.\n"); +@@ -998,7 +1002,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report) + static irqreturn_t elan_isr(int irq, void *dev_id) + { + struct elan_tp_data *data = dev_id; +- struct device *dev = &data->client->dev; + int error; + u8 report[ETP_MAX_REPORT_LEN]; + +@@ -1016,8 +1019,6 @@ static irqreturn_t elan_isr(int irq, void *dev_id) + if (error) + goto out; + +- pm_wakeup_event(dev, 0); +- + switch (report[ETP_REPORT_ID_OFFSET]) { + case ETP_REPORT_ID: + elan_report_absolute(data, report); +@@ -1026,7 +1027,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id) + elan_report_trackpoint(data, report); + break; + default: +- dev_err(dev, "invalid report id data (%x)\n", ++ dev_err(&data->client->dev, "invalid report id data (%x)\n", + report[ETP_REPORT_ID_OFFSET]); + } + +-- +2.25.1 + diff --git a/queue-5.7/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch b/queue-5.7/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch new file mode 100644 index 00000000000..ea94955773f --- /dev/null +++ b/queue-5.7/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch @@ -0,0 +1,36 @@ +From 15750daf8ec23309034f003460828343d10ff092 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 15:27:43 -0700 +Subject: Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen + +From: Ilya Katsnelson + +[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ] + +Tested on my own laptop, touchpad feels slightly more responsive with +this on, though it might just be placebo. + +Signed-off-by: Ilya Katsnelson +Reviewed-by: Lyude Paul +Link: https://lore.kernel.org/r/20200703143457.132373-1-me@0upti.me +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 758dae8d65006..4b81b2d0fe067 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN0093", /* T480 */ + "LEN0096", /* X280 */ + "LEN0097", /* X280 -> ALPS trackpoint */ ++ "LEN0099", /* X1 Extreme 1st */ + "LEN009b", /* T580 */ + "LEN200f", /* T450s */ + "LEN2044", /* L470 */ +-- +2.25.1 + diff --git a/queue-5.7/iommu-qcom-use-domain-rather-than-dev-as-tlb-cookie.patch b/queue-5.7/iommu-qcom-use-domain-rather-than-dev-as-tlb-cookie.patch new file mode 100644 index 00000000000..c21d85baa54 --- /dev/null +++ b/queue-5.7/iommu-qcom-use-domain-rather-than-dev-as-tlb-cookie.patch @@ -0,0 +1,139 @@ +From 5cb96959db26bf18208df7fbb7af362eb5a26bbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 08:52:17 -0700 +Subject: iommu/qcom: Use domain rather than dev as tlb cookie + +From: Rob Clark + +[ Upstream commit 1014a2f8d76b05e0f228dd097ac1a249c5934232 ] + +The device may be torn down, but the domain should still be valid. Lets +use that as the tlb flush ops cookie. + +Fixes a problem reported in [1] + +[1] https://lkml.org/lkml/2020/7/20/104 + +Reported-by: Naresh Kamboju +Signed-off-by: Rob Clark +Tested-by: Naresh Kamboju +Fixes: 09b5dfff9ad6 ("iommu/qcom: Use accessor functions for iommu private data") +Link: https://lore.kernel.org/r/20200720155217.274994-1-robdclark@gmail.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/qcom_iommu.c | 37 +++++++++++++++++-------------------- + 1 file changed, 17 insertions(+), 20 deletions(-) + +diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c +index 5b3b270972f80..c6277d7398f30 100644 +--- a/drivers/iommu/qcom_iommu.c ++++ b/drivers/iommu/qcom_iommu.c +@@ -65,6 +65,7 @@ struct qcom_iommu_domain { + struct mutex init_mutex; /* Protects iommu pointer */ + struct iommu_domain domain; + struct qcom_iommu_dev *iommu; ++ struct iommu_fwspec *fwspec; + }; + + static struct qcom_iommu_domain *to_qcom_iommu_domain(struct iommu_domain *dom) +@@ -84,9 +85,9 @@ static struct qcom_iommu_dev * to_iommu(struct device *dev) + return dev_iommu_priv_get(dev); + } + +-static struct qcom_iommu_ctx * to_ctx(struct device *dev, unsigned asid) ++static struct qcom_iommu_ctx * to_ctx(struct qcom_iommu_domain *d, unsigned asid) + { +- struct qcom_iommu_dev *qcom_iommu = to_iommu(dev); ++ struct qcom_iommu_dev *qcom_iommu = d->iommu; + if (!qcom_iommu) + return NULL; + return qcom_iommu->ctxs[asid - 1]; +@@ -118,14 +119,12 @@ iommu_readq(struct qcom_iommu_ctx *ctx, unsigned reg) + + static void qcom_iommu_tlb_sync(void *cookie) + { +- struct iommu_fwspec *fwspec; +- struct device *dev = cookie; ++ struct qcom_iommu_domain *qcom_domain = cookie; ++ struct iommu_fwspec *fwspec = qcom_domain->fwspec; + unsigned i; + +- fwspec = dev_iommu_fwspec_get(dev); +- + for (i = 0; i < fwspec->num_ids; i++) { +- struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]); ++ struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]); + unsigned int val, ret; + + iommu_writel(ctx, ARM_SMMU_CB_TLBSYNC, 0); +@@ -139,14 +138,12 @@ static void qcom_iommu_tlb_sync(void *cookie) + + static void qcom_iommu_tlb_inv_context(void *cookie) + { +- struct device *dev = cookie; +- struct iommu_fwspec *fwspec; ++ struct qcom_iommu_domain *qcom_domain = cookie; ++ struct iommu_fwspec *fwspec = qcom_domain->fwspec; + unsigned i; + +- fwspec = dev_iommu_fwspec_get(dev); +- + for (i = 0; i < fwspec->num_ids; i++) { +- struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]); ++ struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]); + iommu_writel(ctx, ARM_SMMU_CB_S1_TLBIASID, ctx->asid); + } + +@@ -156,16 +153,14 @@ static void qcom_iommu_tlb_inv_context(void *cookie) + static void qcom_iommu_tlb_inv_range_nosync(unsigned long iova, size_t size, + size_t granule, bool leaf, void *cookie) + { +- struct device *dev = cookie; +- struct iommu_fwspec *fwspec; ++ struct qcom_iommu_domain *qcom_domain = cookie; ++ struct iommu_fwspec *fwspec = qcom_domain->fwspec; + unsigned i, reg; + + reg = leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA; + +- fwspec = dev_iommu_fwspec_get(dev); +- + for (i = 0; i < fwspec->num_ids; i++) { +- struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]); ++ struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]); + size_t s = size; + + iova = (iova >> 12) << 12; +@@ -256,7 +251,9 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain, + }; + + qcom_domain->iommu = qcom_iommu; +- pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, dev); ++ qcom_domain->fwspec = fwspec; ++ ++ pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, qcom_domain); + if (!pgtbl_ops) { + dev_err(qcom_iommu->dev, "failed to allocate pagetable ops\n"); + ret = -ENOMEM; +@@ -269,7 +266,7 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain, + domain->geometry.force_aperture = true; + + for (i = 0; i < fwspec->num_ids; i++) { +- struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]); ++ struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]); + + if (!ctx->secure_init) { + ret = qcom_scm_restore_sec_cfg(qcom_iommu->sec_id, ctx->asid); +@@ -419,7 +416,7 @@ static void qcom_iommu_detach_dev(struct iommu_domain *domain, struct device *de + + pm_runtime_get_sync(qcom_iommu->dev); + for (i = 0; i < fwspec->num_ids; i++) { +- struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]); ++ struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]); + + /* Disable the context bank: */ + iommu_writel(ctx, ARM_SMMU_CB_SCTLR, 0); +-- +2.25.1 + diff --git a/queue-5.7/ionic-fix-up-filter-locks-and-debug-msgs.patch b/queue-5.7/ionic-fix-up-filter-locks-and-debug-msgs.patch new file mode 100644 index 00000000000..102e27baa86 --- /dev/null +++ b/queue-5.7/ionic-fix-up-filter-locks-and-debug-msgs.patch @@ -0,0 +1,123 @@ +From 876e80d7a7fedae01ad92b05eadf3404766bede7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 16:00:14 -0700 +Subject: ionic: fix up filter locks and debug msgs + +From: Shannon Nelson + +[ Upstream commit cbec2153a9a68d011454960ba84887e46e40b37d ] + +Add in a couple of forgotten spinlocks and fix up some of +the debug messages around filter management. + +Fixes: c1e329ebec8d ("ionic: Add management of rx filters") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++---------- + .../ethernet/pensando/ionic/ionic_rx_filter.c | 5 +++++ + 2 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 7fea60fc3e089..48aa502e4bd3d 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -849,8 +849,7 @@ static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr) + if (f) + return 0; + +- netdev_dbg(lif->netdev, "rx_filter add ADDR %pM (id %d)\n", addr, +- ctx.comp.rx_filter_add.filter_id); ++ netdev_dbg(lif->netdev, "rx_filter add ADDR %pM\n", addr); + + memcpy(ctx.cmd.rx_filter_add.mac.addr, addr, ETH_ALEN); + err = ionic_adminq_post_wait(lif, &ctx); +@@ -879,6 +878,9 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr) + return -ENOENT; + } + ++ netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n", ++ addr, f->filter_id); ++ + ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id); + ionic_rx_filter_free(lif, f); + spin_unlock_bh(&lif->rx_filters.lock); +@@ -887,9 +889,6 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr) + if (err && err != -EEXIST) + return err; + +- netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n", addr, +- ctx.cmd.rx_filter_del.filter_id); +- + return 0; + } + +@@ -1341,13 +1340,11 @@ static int ionic_vlan_rx_add_vid(struct net_device *netdev, __be16 proto, + }; + int err; + ++ netdev_dbg(netdev, "rx_filter add VLAN %d\n", vid); + err = ionic_adminq_post_wait(lif, &ctx); + if (err) + return err; + +- netdev_dbg(netdev, "rx_filter add VLAN %d (id %d)\n", vid, +- ctx.comp.rx_filter_add.filter_id); +- + return ionic_rx_filter_save(lif, 0, IONIC_RXQ_INDEX_ANY, 0, &ctx); + } + +@@ -1372,8 +1369,8 @@ static int ionic_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, + return -ENOENT; + } + +- netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n", vid, +- le32_to_cpu(ctx.cmd.rx_filter_del.filter_id)); ++ netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n", ++ vid, f->filter_id); + + ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id); + ionic_rx_filter_free(lif, f); +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c +index 80eeb7696e014..fb9d828812bd2 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c +@@ -69,10 +69,12 @@ int ionic_rx_filters_init(struct ionic_lif *lif) + + spin_lock_init(&lif->rx_filters.lock); + ++ spin_lock_bh(&lif->rx_filters.lock); + for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) { + INIT_HLIST_HEAD(&lif->rx_filters.by_hash[i]); + INIT_HLIST_HEAD(&lif->rx_filters.by_id[i]); + } ++ spin_unlock_bh(&lif->rx_filters.lock); + + return 0; + } +@@ -84,11 +86,13 @@ void ionic_rx_filters_deinit(struct ionic_lif *lif) + struct hlist_node *tmp; + unsigned int i; + ++ spin_lock_bh(&lif->rx_filters.lock); + for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) { + head = &lif->rx_filters.by_id[i]; + hlist_for_each_entry_safe(f, tmp, head, by_id) + ionic_rx_filter_free(lif, f); + } ++ spin_unlock_bh(&lif->rx_filters.lock); + } + + int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index, +@@ -124,6 +128,7 @@ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index, + f->filter_id = le32_to_cpu(ctx->comp.rx_filter_add.filter_id); + f->rxq_index = rxq_index; + memcpy(&f->cmd, ac, sizeof(f->cmd)); ++ netdev_dbg(lif->netdev, "rx_filter add filter_id %d\n", f->filter_id); + + INIT_HLIST_NODE(&f->by_hash); + INIT_HLIST_NODE(&f->by_id); +-- +2.25.1 + diff --git a/queue-5.7/ionic-keep-rss-hash-after-fw-update.patch b/queue-5.7/ionic-keep-rss-hash-after-fw-update.patch new file mode 100644 index 00000000000..e5c15e60bbc --- /dev/null +++ b/queue-5.7/ionic-keep-rss-hash-after-fw-update.patch @@ -0,0 +1,41 @@ +From beedfee5daf82c74bd746e2212cb5d7f46f9d04d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 16:00:16 -0700 +Subject: ionic: keep rss hash after fw update + +From: Shannon Nelson + +[ Upstream commit bdff46665ee655600d0fe2a0e5f62ec7853d3b22 ] + +Make sure the RSS hash key is kept across a fw update by not +de-initing it when an update is happening. + +Fixes: c672412f6172 ("ionic: remove lifs on fw reset") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 48aa502e4bd3d..08ab6dafc66c5 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -2227,11 +2227,10 @@ static void ionic_lif_deinit(struct ionic_lif *lif) + cancel_work_sync(&lif->deferred.work); + cancel_work_sync(&lif->tx_timeout_work); + ionic_rx_filters_deinit(lif); ++ if (lif->netdev->features & NETIF_F_RXHASH) ++ ionic_lif_rss_deinit(lif); + } + +- if (lif->netdev->features & NETIF_F_RXHASH) +- ionic_lif_rss_deinit(lif); +- + napi_disable(&lif->adminqcq->napi); + ionic_lif_qcq_deinit(lif, lif->notifyqcq); + ionic_lif_qcq_deinit(lif, lif->adminqcq); +-- +2.25.1 + diff --git a/queue-5.7/ionic-update-filter-id-after-replay.patch b/queue-5.7/ionic-update-filter-id-after-replay.patch new file mode 100644 index 00000000000..aebe8774caf --- /dev/null +++ b/queue-5.7/ionic-update-filter-id-after-replay.patch @@ -0,0 +1,77 @@ +From 4069c18f3cf6f30d15a902e81048965bb1058db3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 16:00:15 -0700 +Subject: ionic: update filter id after replay + +From: Shannon Nelson + +[ Upstream commit cc4428c4de8c31f12e4690d0409e0432fe05702f ] + +When we replay the rx filters after a fw-upgrade we get new +filter_id values from the FW, which we need to save and update +in our local filter list. This allows us to delete the filters +with the correct filter_id when we're done. + +Fixes: 7e4d47596b68 ("ionic: replay filters after fw upgrade") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/pensando/ionic/ionic_rx_filter.c | 24 +++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c +index fb9d828812bd2..cd0076fc3044e 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c +@@ -21,13 +21,16 @@ void ionic_rx_filter_free(struct ionic_lif *lif, struct ionic_rx_filter *f) + void ionic_rx_filter_replay(struct ionic_lif *lif) + { + struct ionic_rx_filter_add_cmd *ac; ++ struct hlist_head new_id_list; + struct ionic_admin_ctx ctx; + struct ionic_rx_filter *f; + struct hlist_head *head; + struct hlist_node *tmp; ++ unsigned int key; + unsigned int i; + int err; + ++ INIT_HLIST_HEAD(&new_id_list); + ac = &ctx.cmd.rx_filter_add; + + for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) { +@@ -58,9 +61,30 @@ void ionic_rx_filter_replay(struct ionic_lif *lif) + ac->mac.addr); + break; + } ++ spin_lock_bh(&lif->rx_filters.lock); ++ ionic_rx_filter_free(lif, f); ++ spin_unlock_bh(&lif->rx_filters.lock); ++ ++ continue; + } ++ ++ /* remove from old id list, save new id in tmp list */ ++ spin_lock_bh(&lif->rx_filters.lock); ++ hlist_del(&f->by_id); ++ spin_unlock_bh(&lif->rx_filters.lock); ++ f->filter_id = le32_to_cpu(ctx.comp.rx_filter_add.filter_id); ++ hlist_add_head(&f->by_id, &new_id_list); + } + } ++ ++ /* rebuild the by_id hash lists with the new filter ids */ ++ spin_lock_bh(&lif->rx_filters.lock); ++ hlist_for_each_entry_safe(f, tmp, &new_id_list, by_id) { ++ key = f->filter_id & IONIC_RX_FILTER_HLISTS_MASK; ++ head = &lif->rx_filters.by_id[key]; ++ hlist_add_head(&f->by_id, head); ++ } ++ spin_unlock_bh(&lif->rx_filters.lock); + } + + int ionic_rx_filters_init(struct ionic_lif *lif) +-- +2.25.1 + diff --git a/queue-5.7/ionic-use-mutex-to-protect-queue-operations.patch b/queue-5.7/ionic-use-mutex-to-protect-queue-operations.patch new file mode 100644 index 00000000000..f20d404d105 --- /dev/null +++ b/queue-5.7/ionic-use-mutex-to-protect-queue-operations.patch @@ -0,0 +1,177 @@ +From 228c1b28f4f581efc619ba08d6ebae57591920cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 16:00:17 -0700 +Subject: ionic: use mutex to protect queue operations + +From: Shannon Nelson + +[ Upstream commit 0925e9db4dc86daf666d9a3d53c7db14ac6d5d00 ] + +The ionic_wait_on_bit_lock() was a open-coded mutex knock-off +used only for protecting the queue reset operations, and there +was no reason not to use the real thing. We can use the lock +more correctly and to better protect the queue stop and start +operations from cross threading. We can also remove a useless +and expensive bit operation from the Rx path. + +This fixes a case found where the link_status_check from a link +flap could run into an MTU change and cause a crash. + +Fixes: beead698b173 ("ionic: Add the basic NDO callbacks for netdev support") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/pensando/ionic/ionic_lif.c | 28 +++++++++++-------- + .../net/ethernet/pensando/ionic/ionic_lif.h | 8 +----- + .../net/ethernet/pensando/ionic/ionic_txrx.c | 6 ---- + 3 files changed, 17 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 08ab6dafc66c5..2c3e9ef22129c 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -85,8 +85,7 @@ static void ionic_link_status_check(struct ionic_lif *lif) + u16 link_status; + bool link_up; + +- if (!test_bit(IONIC_LIF_F_LINK_CHECK_REQUESTED, lif->state) || +- test_bit(IONIC_LIF_F_QUEUE_RESET, lif->state)) ++ if (!test_bit(IONIC_LIF_F_LINK_CHECK_REQUESTED, lif->state)) + return; + + if (lif->ionic->is_mgmt_nic) +@@ -106,16 +105,22 @@ static void ionic_link_status_check(struct ionic_lif *lif) + netif_carrier_on(netdev); + } + +- if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) ++ if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) { ++ mutex_lock(&lif->queue_lock); + ionic_start_queues(lif); ++ mutex_unlock(&lif->queue_lock); ++ } + } else { + if (netif_carrier_ok(netdev)) { + netdev_info(netdev, "Link down\n"); + netif_carrier_off(netdev); + } + +- if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) ++ if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) { ++ mutex_lock(&lif->queue_lock); + ionic_stop_queues(lif); ++ mutex_unlock(&lif->queue_lock); ++ } + } + + clear_bit(IONIC_LIF_F_LINK_CHECK_REQUESTED, lif->state); +@@ -1948,16 +1953,13 @@ int ionic_reset_queues(struct ionic_lif *lif, ionic_reset_cb cb, void *arg) + bool running; + int err = 0; + +- err = ionic_wait_for_bit(lif, IONIC_LIF_F_QUEUE_RESET); +- if (err) +- return err; +- ++ mutex_lock(&lif->queue_lock); + running = netif_running(lif->netdev); + if (running) { + netif_device_detach(lif->netdev); + err = ionic_stop(lif->netdev); + if (err) +- goto reset_out; ++ return err; + } + + if (cb) +@@ -1967,9 +1969,7 @@ int ionic_reset_queues(struct ionic_lif *lif, ionic_reset_cb cb, void *arg) + err = ionic_open(lif->netdev); + netif_device_attach(lif->netdev); + } +- +-reset_out: +- clear_bit(IONIC_LIF_F_QUEUE_RESET, lif->state); ++ mutex_unlock(&lif->queue_lock); + + return err; + } +@@ -2108,7 +2108,9 @@ static void ionic_lif_handle_fw_down(struct ionic_lif *lif) + + if (test_bit(IONIC_LIF_F_UP, lif->state)) { + dev_info(ionic->dev, "Surprise FW stop, stopping queues\n"); ++ mutex_lock(&lif->queue_lock); + ionic_stop_queues(lif); ++ mutex_unlock(&lif->queue_lock); + } + + if (netif_running(lif->netdev)) { +@@ -2235,6 +2237,7 @@ static void ionic_lif_deinit(struct ionic_lif *lif) + ionic_lif_qcq_deinit(lif, lif->notifyqcq); + ionic_lif_qcq_deinit(lif, lif->adminqcq); + ++ mutex_destroy(&lif->queue_lock); + ionic_lif_reset(lif); + } + +@@ -2410,6 +2413,7 @@ static int ionic_lif_init(struct ionic_lif *lif) + return err; + + lif->hw_index = le16_to_cpu(comp.hw_index); ++ mutex_init(&lif->queue_lock); + + /* now that we have the hw_index we can figure out our doorbell page */ + lif->dbid_count = le32_to_cpu(lif->ionic->ident.dev.ndbpgs_per_lif); +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +index 2c65cf6300dbd..90992614f136e 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h +@@ -126,7 +126,6 @@ enum ionic_lif_state_flags { + IONIC_LIF_F_SW_DEBUG_STATS, + IONIC_LIF_F_UP, + IONIC_LIF_F_LINK_CHECK_REQUESTED, +- IONIC_LIF_F_QUEUE_RESET, + IONIC_LIF_F_FW_RESET, + + /* leave this as last */ +@@ -145,6 +144,7 @@ struct ionic_lif { + unsigned int hw_index; + unsigned int kern_pid; + u64 __iomem *kern_dbpage; ++ struct mutex queue_lock; /* lock for queue structures */ + spinlock_t adminq_lock; /* lock for AdminQ operations */ + struct ionic_qcq *adminqcq; + struct ionic_qcq *notifyqcq; +@@ -191,12 +191,6 @@ struct ionic_lif { + #define lif_to_txq(lif, i) (&lif_to_txqcq((lif), i)->q) + #define lif_to_rxq(lif, i) (&lif_to_txqcq((lif), i)->q) + +-/* return 0 if successfully set the bit, else non-zero */ +-static inline int ionic_wait_for_bit(struct ionic_lif *lif, int bitname) +-{ +- return wait_on_bit_lock(lif->state, bitname, TASK_INTERRUPTIBLE); +-} +- + static inline u32 ionic_coal_usec_to_hw(struct ionic *ionic, u32 usecs) + { + u32 mult = le32_to_cpu(ionic->ident.dev.intr_coal_mult); +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index d233b6e77b1ee..ce8e246cda07d 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -157,12 +157,6 @@ static void ionic_rx_clean(struct ionic_queue *q, struct ionic_desc_info *desc_i + return; + } + +- /* no packet processing while resetting */ +- if (unlikely(test_bit(IONIC_LIF_F_QUEUE_RESET, q->lif->state))) { +- stats->dropped++; +- return; +- } +- + stats->pkts++; + stats->bytes += le16_to_cpu(comp->len); + +-- +2.25.1 + diff --git a/queue-5.7/ionic-use-offset-for-ethtool-regs-data.patch b/queue-5.7/ionic-use-offset-for-ethtool-regs-data.patch new file mode 100644 index 00000000000..4881d431e4e --- /dev/null +++ b/queue-5.7/ionic-use-offset-for-ethtool-regs-data.patch @@ -0,0 +1,48 @@ +From 30391754945b43968fecf1446dee381f52efb13c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 16:00:13 -0700 +Subject: ionic: use offset for ethtool regs data + +From: Shannon Nelson + +[ Upstream commit f85ae16f924f92a370b81b4e77862c1c59882fce ] + +Use an offset to write the second half of the regs data into the +second half of the buffer instead of overwriting the first half. + +Fixes: 4d03e00a2140 ("ionic: Add initial ethtool support") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index 22430fa911e2c..63d78519cbc6f 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -102,15 +102,18 @@ static void ionic_get_regs(struct net_device *netdev, struct ethtool_regs *regs, + void *p) + { + struct ionic_lif *lif = netdev_priv(netdev); ++ unsigned int offset; + unsigned int size; + + regs->version = IONIC_DEV_CMD_REG_VERSION; + ++ offset = 0; + size = IONIC_DEV_INFO_REG_COUNT * sizeof(u32); +- memcpy_fromio(p, lif->ionic->idev.dev_info_regs->words, size); ++ memcpy_fromio(p + offset, lif->ionic->idev.dev_info_regs->words, size); + ++ offset += size; + size = IONIC_DEV_CMD_REG_COUNT * sizeof(u32); +- memcpy_fromio(p, lif->ionic->idev.dev_cmd_regs->words, size); ++ memcpy_fromio(p + offset, lif->ionic->idev.dev_cmd_regs->words, size); + } + + static int ionic_get_link_ksettings(struct net_device *netdev, +-- +2.25.1 + diff --git a/queue-5.7/ipvs-fix-the-connection-sync-failed-in-some-cases.patch b/queue-5.7/ipvs-fix-the-connection-sync-failed-in-some-cases.patch new file mode 100644 index 00000000000..62d409714c9 --- /dev/null +++ b/queue-5.7/ipvs-fix-the-connection-sync-failed-in-some-cases.patch @@ -0,0 +1,64 @@ +From f3766b28ef06660f4c218c95c03491984805083e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 16:12:08 +0800 +Subject: ipvs: fix the connection sync failed in some cases + +From: guodeqing + +[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ] + +The sync_thread_backup only checks sk_receive_queue is empty or not, +there is a situation which cannot sync the connection entries when +sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf, +the sync packets are dropped in __udp_enqueue_schedule_skb, this is +because the packets in reader_queue is not read, so the rmem is +not reclaimed. + +Here I add the check of whether the reader_queue of the udp sock is +empty or not to solve this problem. + +Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception") +Reported-by: zhouxudong +Signed-off-by: guodeqing +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index 605e0f68f8bd3..2b8abbfe018cf 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data) + { + struct ip_vs_sync_thread_data *tinfo = data; + struct netns_ipvs *ipvs = tinfo->ipvs; ++ struct sock *sk = tinfo->sock->sk; ++ struct udp_sock *up = udp_sk(sk); + int len; + + pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, " +@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data) + ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id); + + while (!kthread_should_stop()) { +- wait_event_interruptible(*sk_sleep(tinfo->sock->sk), +- !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue) +- || kthread_should_stop()); ++ wait_event_interruptible(*sk_sleep(sk), ++ !skb_queue_empty_lockless(&sk->sk_receive_queue) || ++ !skb_queue_empty_lockless(&up->reader_queue) || ++ kthread_should_stop()); + + /* do we have data now? */ +- while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) { ++ while (!skb_queue_empty_lockless(&sk->sk_receive_queue) || ++ !skb_queue_empty_lockless(&up->reader_queue)) { + len = ip_vs_receive(tinfo->sock, tinfo->buf, + ipvs->bcfg.sync_maxlen); + if (len <= 0) { +-- +2.25.1 + diff --git a/queue-5.7/iwlwifi-make-some-killer-wireless-ac-1550-cards-work.patch b/queue-5.7/iwlwifi-make-some-killer-wireless-ac-1550-cards-work.patch new file mode 100644 index 00000000000..9a611f29d65 --- /dev/null +++ b/queue-5.7/iwlwifi-make-some-killer-wireless-ac-1550-cards-work.patch @@ -0,0 +1,41 @@ +From d5ab91fd6fd3767e42ececb6ff7b710759b7ce93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 11:19:11 +0200 +Subject: iwlwifi: Make some Killer Wireless-AC 1550 cards work again + +From: Alessio Bonfiglio + +[ Upstream commit b5ba46b81c2fef00bcf110777fb6d51befa4a23e ] + +Fix the regression introduced by commit c8685937d07f ("iwlwifi: move +pu devices to new table") by adding the ids and the configurations of +two missing Killer 1550 cards in order to configure and let them work +correctly again (following the new table convention). +Resolve bug 208141 ("Wireless ac 9560 not working kernel 5.7.2", +https://bugzilla.kernel.org/show_bug.cgi?id=208141). + +Fixes: c8685937d07f ("iwlwifi: move pu devices to new table") +Signed-off-by: Alessio Bonfiglio +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200714091911.4442-1-alessio.bonfiglio@mail.polimi.it +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 29971c25dba44..9ea3e56346722 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -577,6 +577,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_DEV_INFO(0x30DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), + IWL_DEV_INFO(0x31DC, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name), + IWL_DEV_INFO(0x31DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), ++ IWL_DEV_INFO(0xA370, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name), ++ IWL_DEV_INFO(0xA370, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), + + IWL_DEV_INFO(0x271C, 0x0214, iwl9260_2ac_cfg, iwl9260_1_name), + +-- +2.25.1 + diff --git a/queue-5.7/kbuild-fix-single-target-builds-for-external-modules.patch b/queue-5.7/kbuild-fix-single-target-builds-for-external-modules.patch new file mode 100644 index 00000000000..2c6a4d67f7c --- /dev/null +++ b/queue-5.7/kbuild-fix-single-target-builds-for-external-modules.patch @@ -0,0 +1,40 @@ +From f7977545b42be3ea4f88495e606235634aa9562b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 01:35:08 +0900 +Subject: kbuild: fix single target builds for external modules +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masahiro Yamada + +[ Upstream commit 20b1be59528295e5c2a8812059b8560753dd8e68 ] + +Commit f566e1fbadb6 ("kbuild: make multiple directory targets work") +broke single target builds for external modules. Fix this. + +Fixes: f566e1fbadb6 ("kbuild: make multiple directory targets work") +Reported-by: Bjørn Mork +Signed-off-by: Masahiro Yamada +Tested-by: Bjørn Mork +Signed-off-by: Sasha Levin +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index e622e084e7e26..74056e09f0a30 100644 +--- a/Makefile ++++ b/Makefile +@@ -1730,7 +1730,7 @@ PHONY += descend $(build-dirs) + descend: $(build-dirs) + $(build-dirs): prepare + $(Q)$(MAKE) $(build)=$@ \ +- single-build=$(if $(filter-out $@/, $(filter $@/%, $(single-no-ko))),1) \ ++ single-build=$(if $(filter-out $@/, $(filter $@/%, $(KBUILD_SINGLE_TARGETS))),1) \ + need-builtin=1 need-modorder=1 + + clean-dirs := $(addprefix _clean_, $(clean-dirs)) +-- +2.25.1 + diff --git a/queue-5.7/mlxsw-core-fix-wrong-sfp-eeprom-reading-for-upper-pa.patch b/queue-5.7/mlxsw-core-fix-wrong-sfp-eeprom-reading-for-upper-pa.patch new file mode 100644 index 00000000000..a0bf0b45cb8 --- /dev/null +++ b/queue-5.7/mlxsw-core-fix-wrong-sfp-eeprom-reading-for-upper-pa.patch @@ -0,0 +1,131 @@ +From 817c2d65915b466f141a12e981128de6a392459f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 22:01:43 +0300 +Subject: mlxsw: core: Fix wrong SFP EEPROM reading for upper pages 1-3 + +From: Vadim Pasternak + +[ Upstream commit 9b8737788af6c76ef93e3161ee2cdc4ddcc034ca ] + +Fix wrong reading of upper pages for SFP EEPROM. According to "Memory +Organization" figure in SFF-8472 spec: When reading upper pages 1, 2 and +3 the offset should be set relative to zero and I2C high address 0x51 +[1010001X (A2h)] is to be used. + +Fixes: a45bfb5a5070 ("mlxsw: core: Extend QSFP EEPROM size for ethtool") +Signed-off-by: Vadim Pasternak +Reviewed-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/core_env.c | 48 ++++++++++++------- + 1 file changed, 32 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_env.c b/drivers/net/ethernet/mellanox/mlxsw/core_env.c +index 08215fed193d3..a7d86df7123ff 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c +@@ -45,7 +45,7 @@ static int mlxsw_env_validate_cable_ident(struct mlxsw_core *core, int id, + static int + mlxsw_env_query_module_eeprom(struct mlxsw_core *mlxsw_core, int module, + u16 offset, u16 size, void *data, +- unsigned int *p_read_size) ++ bool qsfp, unsigned int *p_read_size) + { + char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE]; + char mcia_pl[MLXSW_REG_MCIA_LEN]; +@@ -54,6 +54,10 @@ mlxsw_env_query_module_eeprom(struct mlxsw_core *mlxsw_core, int module, + int status; + int err; + ++ /* MCIA register accepts buffer size <= 48. Page of size 128 should be ++ * read by chunks of size 48, 48, 32. Align the size of the last chunk ++ * to avoid reading after the end of the page. ++ */ + size = min_t(u16, size, MLXSW_REG_MCIA_EEPROM_SIZE); + + if (offset < MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH && +@@ -63,18 +67,25 @@ mlxsw_env_query_module_eeprom(struct mlxsw_core *mlxsw_core, int module, + + i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_LOW; + if (offset >= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) { +- page = MLXSW_REG_MCIA_PAGE_GET(offset); +- offset -= MLXSW_REG_MCIA_EEPROM_UP_PAGE_LENGTH * page; +- /* When reading upper pages 1, 2 and 3 the offset starts at +- * 128. Please refer to "QSFP+ Memory Map" figure in SFF-8436 +- * specification for graphical depiction. +- * MCIA register accepts buffer size <= 48. Page of size 128 +- * should be read by chunks of size 48, 48, 32. Align the size +- * of the last chunk to avoid reading after the end of the +- * page. +- */ +- if (offset + size > MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) +- size = MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH - offset; ++ if (qsfp) { ++ /* When reading upper pages 1, 2 and 3 the offset ++ * starts at 128. Please refer to "QSFP+ Memory Map" ++ * figure in SFF-8436 specification for graphical ++ * depiction. ++ */ ++ page = MLXSW_REG_MCIA_PAGE_GET(offset); ++ offset -= MLXSW_REG_MCIA_EEPROM_UP_PAGE_LENGTH * page; ++ if (offset + size > MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) ++ size = MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH - offset; ++ } else { ++ /* When reading upper pages 1, 2 and 3 the offset ++ * starts at 0 and I2C high address is used. Please refer ++ * refer to "Memory Organization" figure in SFF-8472 ++ * specification for graphical depiction. ++ */ ++ i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_HIGH; ++ offset -= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH; ++ } + } + + mlxsw_reg_mcia_pack(mcia_pl, module, 0, page, offset, size, i2c_addr); +@@ -166,7 +177,7 @@ int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module, + int err; + + err = mlxsw_env_query_module_eeprom(mlxsw_core, module, 0, offset, +- module_info, &read_size); ++ module_info, false, &read_size); + if (err) + return err; + +@@ -197,7 +208,7 @@ int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module, + /* Verify if transceiver provides diagnostic monitoring page */ + err = mlxsw_env_query_module_eeprom(mlxsw_core, module, + SFP_DIAGMON, 1, &diag_mon, +- &read_size); ++ false, &read_size); + if (err) + return err; + +@@ -225,17 +236,22 @@ int mlxsw_env_get_module_eeprom(struct net_device *netdev, + int offset = ee->offset; + unsigned int read_size; + int i = 0; ++ bool qsfp; + int err; + + if (!ee->len) + return -EINVAL; + + memset(data, 0, ee->len); ++ /* Validate module identifier value. */ ++ err = mlxsw_env_validate_cable_ident(mlxsw_core, module, &qsfp); ++ if (err) ++ return err; + + while (i < ee->len) { + err = mlxsw_env_query_module_eeprom(mlxsw_core, module, offset, + ee->len - i, data + i, +- &read_size); ++ qsfp, &read_size); + if (err) { + netdev_err(netdev, "Eeprom query failed\n"); + return err; +-- +2.25.1 + diff --git a/queue-5.7/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch b/queue-5.7/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch new file mode 100644 index 00000000000..c69b54771e0 --- /dev/null +++ b/queue-5.7/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch @@ -0,0 +1,45 @@ +From c672dde779c9e8139bb6642307355c27d8d2312f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 22:31:49 +0800 +Subject: mlxsw: destroy workqueue when trap_register in mlxsw_emad_init + +From: Liu Jian + +[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ] + +When mlxsw_core_trap_register fails in mlxsw_emad_init, +destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq. + +Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock") +Signed-off-by: Liu Jian +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c +index e9ccd333f61dd..d6d6fe64887b3 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -710,7 +710,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) + err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); + if (err) +- return err; ++ goto err_trap_register; + + err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core); + if (err) +@@ -722,6 +722,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) + err_emad_trap_set: + mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); ++err_trap_register: + destroy_workqueue(mlxsw_core->emad_wq); + return err; + } +-- +2.25.1 + diff --git a/queue-5.7/mt76-mt76x02-fix-handling-mcu-timeouts-during-hw-res.patch b/queue-5.7/mt76-mt76x02-fix-handling-mcu-timeouts-during-hw-res.patch new file mode 100644 index 00000000000..6e497518a83 --- /dev/null +++ b/queue-5.7/mt76-mt76x02-fix-handling-mcu-timeouts-during-hw-res.patch @@ -0,0 +1,216 @@ +From e795a55edb4b6fcc232396efadd28393a7193a0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Feb 2020 16:08:58 +0100 +Subject: mt76: mt76x02: fix handling MCU timeouts during hw restart + +From: Felix Fietkau + +[ Upstream commit fd6c2dfa49b762ffe773a835ba62fa692df4c1b0 ] + +If a MCU timeout occurs before a hw restart completes, another hw restart +is scheduled, and the station state gets corrupted. +To speed up dealing with that, do not issue any MCU commands after the first +timeout, and defer handling timeouts until the reset has completed. +Also ignore errors in MCU commands during start/config to avoid making user +space fail on this condition. If it happens, another restart is scheduled +quickly, and that usually recovers the hardware properly. + +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76.h | 1 + + .../net/wireless/mediatek/mt76/mt76x0/pci.c | 2 ++ + drivers/net/wireless/mediatek/mt76/mt76x02.h | 2 ++ + .../net/wireless/mediatek/mt76/mt76x02_mcu.c | 3 +++ + .../net/wireless/mediatek/mt76/mt76x02_mmio.c | 16 ++++++++++++++++ + .../wireless/mediatek/mt76/mt76x2/pci_init.c | 1 + + .../wireless/mediatek/mt76/mt76x2/pci_main.c | 19 ++++++------------- + 7 files changed, 31 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h +index 37641ad14d498..652dd05af16b0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76.h +@@ -275,6 +275,7 @@ enum { + MT76_STATE_RUNNING, + MT76_STATE_MCU_RUNNING, + MT76_SCANNING, ++ MT76_RESTART, + MT76_RESET, + MT76_MCU_RESET, + MT76_REMOVED, +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c +index 0b520ae08d018..57091d41eb851 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c +@@ -29,6 +29,7 @@ static void mt76x0e_stop_hw(struct mt76x02_dev *dev) + { + cancel_delayed_work_sync(&dev->cal_work); + cancel_delayed_work_sync(&dev->mt76.mac_work); ++ clear_bit(MT76_RESTART, &dev->mphy.state); + + if (!mt76_poll(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_TX_DMA_BUSY, + 0, 1000)) +@@ -83,6 +84,7 @@ static const struct ieee80211_ops mt76x0e_ops = { + .set_coverage_class = mt76x02_set_coverage_class, + .set_rts_threshold = mt76x02_set_rts_threshold, + .get_antenna = mt76_get_antenna, ++ .reconfig_complete = mt76x02_reconfig_complete, + }; + + static int mt76x0e_register_device(struct mt76x02_dev *dev) +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h +index 830532b85b58b..6ea210bd3f070 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h +@@ -187,6 +187,8 @@ void mt76x02_sta_ps(struct mt76_dev *dev, struct ieee80211_sta *sta, bool ps); + void mt76x02_bss_info_changed(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + struct ieee80211_bss_conf *info, u32 changed); ++void mt76x02_reconfig_complete(struct ieee80211_hw *hw, ++ enum ieee80211_reconfig_type reconfig_type); + + struct beacon_bc_data { + struct mt76x02_dev *dev; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mcu.c +index 5664749ad6c1a..8247611d9b18b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mcu.c +@@ -20,6 +20,9 @@ int mt76x02_mcu_msg_send(struct mt76_dev *mdev, int cmd, const void *data, + int ret; + u8 seq; + ++ if (mt76_is_mmio(&dev->mt76) && dev->mcu_timeout) ++ return -EIO; ++ + skb = mt76x02_mcu_msg_alloc(data, len); + if (!skb) + return -ENOMEM; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +index 7dcc5d342e9f5..7e389dbccfeb8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c +@@ -520,6 +520,7 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev) + } + + if (restart) { ++ set_bit(MT76_RESTART, &dev->mphy.state); + mt76x02_mcu_function_select(dev, Q_SELECT, 1); + ieee80211_restart_hw(dev->mt76.hw); + } else { +@@ -528,8 +529,23 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev) + } + } + ++void mt76x02_reconfig_complete(struct ieee80211_hw *hw, ++ enum ieee80211_reconfig_type reconfig_type) ++{ ++ struct mt76x02_dev *dev = hw->priv; ++ ++ if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART) ++ return; ++ ++ clear_bit(MT76_RESTART, &dev->mphy.state); ++} ++EXPORT_SYMBOL_GPL(mt76x02_reconfig_complete); ++ + static void mt76x02_check_tx_hang(struct mt76x02_dev *dev) + { ++ if (test_bit(MT76_RESTART, &dev->mphy.state)) ++ return; ++ + if (mt76x02_tx_hang(dev)) { + if (++dev->tx_hang_check >= MT_TX_HANG_TH) + goto restart; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c +index c69579e5f6479..f27774f574382 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c +@@ -256,6 +256,7 @@ void mt76x2_stop_hardware(struct mt76x02_dev *dev) + cancel_delayed_work_sync(&dev->cal_work); + cancel_delayed_work_sync(&dev->mt76.mac_work); + cancel_delayed_work_sync(&dev->wdt_work); ++ clear_bit(MT76_RESTART, &dev->mphy.state); + mt76x02_mcu_set_radio_state(dev, false); + mt76x2_mac_stop(dev, false); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c +index 105e5b99b3f9b..a74599f7f729f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c +@@ -10,12 +10,9 @@ static int + mt76x2_start(struct ieee80211_hw *hw) + { + struct mt76x02_dev *dev = hw->priv; +- int ret; + + mt76x02_mac_start(dev); +- ret = mt76x2_phy_start(dev); +- if (ret) +- return ret; ++ mt76x2_phy_start(dev); + + ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mt76.mac_work, + MT_MAC_WORK_INTERVAL); +@@ -35,11 +32,9 @@ mt76x2_stop(struct ieee80211_hw *hw) + mt76x2_stop_hardware(dev); + } + +-static int ++static void + mt76x2_set_channel(struct mt76x02_dev *dev, struct cfg80211_chan_def *chandef) + { +- int ret; +- + cancel_delayed_work_sync(&dev->cal_work); + tasklet_disable(&dev->mt76.pre_tbtt_tasklet); + tasklet_disable(&dev->dfs_pd.dfs_tasklet); +@@ -50,7 +45,7 @@ mt76x2_set_channel(struct mt76x02_dev *dev, struct cfg80211_chan_def *chandef) + mt76_set_channel(&dev->mphy); + + mt76x2_mac_stop(dev, true); +- ret = mt76x2_phy_set_channel(dev, chandef); ++ mt76x2_phy_set_channel(dev, chandef); + + mt76x02_mac_cc_reset(dev); + mt76x02_dfs_init_params(dev); +@@ -64,15 +59,12 @@ mt76x2_set_channel(struct mt76x02_dev *dev, struct cfg80211_chan_def *chandef) + tasklet_enable(&dev->mt76.pre_tbtt_tasklet); + + mt76_txq_schedule_all(&dev->mphy); +- +- return ret; + } + + static int + mt76x2_config(struct ieee80211_hw *hw, u32 changed) + { + struct mt76x02_dev *dev = hw->priv; +- int ret = 0; + + mutex_lock(&dev->mt76.mutex); + +@@ -101,11 +93,11 @@ mt76x2_config(struct ieee80211_hw *hw, u32 changed) + + if (changed & IEEE80211_CONF_CHANGE_CHANNEL) { + ieee80211_stop_queues(hw); +- ret = mt76x2_set_channel(dev, &hw->conf.chandef); ++ mt76x2_set_channel(dev, &hw->conf.chandef); + ieee80211_wake_queues(hw); + } + +- return ret; ++ return 0; + } + + static void +@@ -162,5 +154,6 @@ const struct ieee80211_ops mt76x2_ops = { + .set_antenna = mt76x2_set_antenna, + .get_antenna = mt76_get_antenna, + .set_rts_threshold = mt76x02_set_rts_threshold, ++ .reconfig_complete = mt76x02_reconfig_complete, + }; + +-- +2.25.1 + diff --git a/queue-5.7/net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch b/queue-5.7/net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch new file mode 100644 index 00000000000..00d065c94e7 --- /dev/null +++ b/queue-5.7/net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch @@ -0,0 +1,38 @@ +From e556c456a4f3ff2cb7523ad1fecc42075e094f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 21:46:14 -0400 +Subject: net: ag71xx: add missed clk_disable_unprepare in error path of probe + +From: Huang Guobin + +[ Upstream commit befc113c56a76ae7be3986034a0e476d3385e265 ] + +The ag71xx_mdio_probe() forgets to call clk_disable_unprepare() when +of_reset_control_get_exclusive() failed. Add the missed call to fix it. + +Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") +Reported-by: Hulk Robot +Signed-off-by: Huang Guobin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/ag71xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index 02b7705393ca7..37a1cf63d9f7b 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -556,7 +556,8 @@ static int ag71xx_mdio_probe(struct ag71xx *ag) + ag->mdio_reset = of_reset_control_get_exclusive(np, "mdio"); + if (IS_ERR(ag->mdio_reset)) { + netif_err(ag, probe, ndev, "Failed to get reset mdio.\n"); +- return PTR_ERR(ag->mdio_reset); ++ err = PTR_ERR(ag->mdio_reset); ++ goto mdio_err_put_clk; + } + + mii_bus->name = "ag71xx_mdio"; +-- +2.25.1 + diff --git a/queue-5.7/net-bcmgenet-fix-error-returns-in-bcmgenet_probe.patch b/queue-5.7/net-bcmgenet-fix-error-returns-in-bcmgenet_probe.patch new file mode 100644 index 00000000000..a5c657ec33c --- /dev/null +++ b/queue-5.7/net-bcmgenet-fix-error-returns-in-bcmgenet_probe.patch @@ -0,0 +1,40 @@ +From 18d702d89bf7af016f6fd690501456f6ccdad2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 15:18:43 +0800 +Subject: net: bcmgenet: fix error returns in bcmgenet_probe() + +From: Zhang Changzhong + +[ Upstream commit 24a63fe6d45d6527db5ab87bcd1da6921f10e89e ] + +The driver forgets to call clk_disable_unprepare() in error path after +a success calling for clk_prepare_enable(). + +Fix to goto err_clk_disable if clk_prepare_enable() is successful. + +Fixes: 99d55638d4b0 ("net: bcmgenet: enable NETIF_F_HIGHDMA flag") +Signed-off-by: Zhang Changzhong +Acked-by: Doug Berger +Acked-by: Florian fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index dde1c23c8e399..7b95bb77ad3bb 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3522,7 +3522,7 @@ static int bcmgenet_probe(struct platform_device *pdev) + if (err) + err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); + if (err) +- goto err; ++ goto err_clk_disable; + + /* Mii wait queue */ + init_waitqueue_head(&priv->wq); +-- +2.25.1 + diff --git a/queue-5.7/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch b/queue-5.7/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch new file mode 100644 index 00000000000..f084368c3d2 --- /dev/null +++ b/queue-5.7/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch @@ -0,0 +1,66 @@ +From e1435ff403ef0737c6a4ba7f1c4f969126b4d96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 19:10:00 +0300 +Subject: net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual + configuration + +From: Sergey Organov + +[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ] + +From Documentation/networking/timestamping.txt: + + A driver which supports hardware time stamping shall update the + struct with the actual, possibly more permissive configuration. + +Do update the struct passed when we upscale the requested time +stamping mode. + +Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") +Signed-off-by: Sergey Organov +Acked-by: Richard Cochran +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83640.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index ecbd5e0d685cf..acb0aae607558 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -1260,6 +1260,7 @@ static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V1; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: +@@ -1267,6 +1268,7 @@ static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L2_SYNC: +@@ -1274,6 +1276,7 @@ static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_SYNC: +@@ -1281,6 +1284,7 @@ static int dp83640_hwtstamp(struct mii_timestamper *mii_ts, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; + break; + default: + return -ERANGE; +-- +2.25.1 + diff --git a/queue-5.7/net-dsa-microchip-call-phy_remove_link_mode-during-p.patch b/queue-5.7/net-dsa-microchip-call-phy_remove_link_mode-during-p.patch new file mode 100644 index 00000000000..d275b07b003 --- /dev/null +++ b/queue-5.7/net-dsa-microchip-call-phy_remove_link_mode-during-p.patch @@ -0,0 +1,135 @@ +From 6231fdeadc6b3034f01edc9fba331e5dddece180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 13:07:39 +0200 +Subject: net: dsa: microchip: call phy_remove_link_mode during probe + +From: Helmut Grohne + +[ Upstream commit 3506b2f42dff66ea6814c3dfa1988bafb79e6f88 ] + +When doing "ip link set dev ... up" for a ksz9477 backed link, +ksz9477_phy_setup is called and it calls phy_remove_link_mode to remove +1000baseT HDX. During phy_remove_link_mode, phy_advertise_supported is +called. Doing so reverts any previous change to advertised link modes +e.g. using a udevd .link file. + +phy_remove_link_mode is not meant to be used while opening a link and +should be called during phy probe when the link is not yet available to +userspace. + +Therefore move the phy_remove_link_mode calls into +ksz9477_switch_register. It indirectly calls dsa_register_switch, which +creates the relevant struct phy_devices and we update the link modes +right after that. At that time dev->features is already initialized by +ksz9477_switch_detect. + +Remove phy_setup from ksz_dev_ops as no users remain. + +Link: https://lore.kernel.org/netdev/20200715192722.GD1256692@lunn.ch/ +Fixes: 42fc6a4c613019 ("net: dsa: microchip: prepare PHY for proper advertisement") +Signed-off-by: Helmut Grohne +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 42 ++++++++++++++------------ + drivers/net/dsa/microchip/ksz_common.c | 2 -- + drivers/net/dsa/microchip/ksz_common.h | 2 -- + 3 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 65701e65b6c2c..95a406e2e3731 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -977,23 +977,6 @@ static void ksz9477_port_mirror_del(struct dsa_switch *ds, int port, + PORT_MIRROR_SNIFFER, false); + } + +-static void ksz9477_phy_setup(struct ksz_device *dev, int port, +- struct phy_device *phy) +-{ +- /* Only apply to port with PHY. */ +- if (port >= dev->phy_port_cnt) +- return; +- +- /* The MAC actually cannot run in 1000 half-duplex mode. */ +- phy_remove_link_mode(phy, +- ETHTOOL_LINK_MODE_1000baseT_Half_BIT); +- +- /* PHY does not support gigabit. */ +- if (!(dev->features & GBIT_SUPPORT)) +- phy_remove_link_mode(phy, +- ETHTOOL_LINK_MODE_1000baseT_Full_BIT); +-} +- + static bool ksz9477_get_gbit(struct ksz_device *dev, u8 data) + { + bool gbit; +@@ -1606,7 +1589,6 @@ static const struct ksz_dev_ops ksz9477_dev_ops = { + .get_port_addr = ksz9477_get_port_addr, + .cfg_port_member = ksz9477_cfg_port_member, + .flush_dyn_mac_table = ksz9477_flush_dyn_mac_table, +- .phy_setup = ksz9477_phy_setup, + .port_setup = ksz9477_port_setup, + .r_mib_cnt = ksz9477_r_mib_cnt, + .r_mib_pkt = ksz9477_r_mib_pkt, +@@ -1620,7 +1602,29 @@ static const struct ksz_dev_ops ksz9477_dev_ops = { + + int ksz9477_switch_register(struct ksz_device *dev) + { +- return ksz_switch_register(dev, &ksz9477_dev_ops); ++ int ret, i; ++ struct phy_device *phydev; ++ ++ ret = ksz_switch_register(dev, &ksz9477_dev_ops); ++ if (ret) ++ return ret; ++ ++ for (i = 0; i < dev->phy_port_cnt; ++i) { ++ if (!dsa_is_user_port(dev->ds, i)) ++ continue; ++ ++ phydev = dsa_to_port(dev->ds, i)->slave->phydev; ++ ++ /* The MAC actually cannot run in 1000 half-duplex mode. */ ++ phy_remove_link_mode(phydev, ++ ETHTOOL_LINK_MODE_1000baseT_Half_BIT); ++ ++ /* PHY does not support gigabit. */ ++ if (!(dev->features & GBIT_SUPPORT)) ++ phy_remove_link_mode(phydev, ++ ETHTOOL_LINK_MODE_1000baseT_Full_BIT); ++ } ++ return ret; + } + EXPORT_SYMBOL(ksz9477_switch_register); + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index fd1d6676ae4fd..7b6c0dce75360 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -358,8 +358,6 @@ int ksz_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy) + + /* setup slave port */ + dev->dev_ops->port_setup(dev, port, false); +- if (dev->dev_ops->phy_setup) +- dev->dev_ops->phy_setup(dev, port, phy); + + /* port_stp_state_set() will be called after to enable the port so + * there is no need to do anything. +diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h +index f2c9bb68fd330..7d11dd32ec0d1 100644 +--- a/drivers/net/dsa/microchip/ksz_common.h ++++ b/drivers/net/dsa/microchip/ksz_common.h +@@ -119,8 +119,6 @@ struct ksz_dev_ops { + u32 (*get_port_addr)(int port, int offset); + void (*cfg_port_member)(struct ksz_device *dev, int port, u8 member); + void (*flush_dyn_mac_table)(struct ksz_device *dev, int port); +- void (*phy_setup)(struct ksz_device *dev, int port, +- struct phy_device *phy); + void (*port_cleanup)(struct ksz_device *dev, int port); + void (*port_setup)(struct ksz_device *dev, int port, bool cpu_port); + void (*r_phy)(struct ksz_device *dev, u16 phy, u16 reg, u16 *val); +-- +2.25.1 + diff --git a/queue-5.7/net-dsa-mv88e6xxx-fix-in-band-an-link-establishment.patch b/queue-5.7/net-dsa-mv88e6xxx-fix-in-band-an-link-establishment.patch new file mode 100644 index 00000000000..3fa045234da --- /dev/null +++ b/queue-5.7/net-dsa-mv88e6xxx-fix-in-band-an-link-establishment.patch @@ -0,0 +1,96 @@ +From 09656c1b86898cc7d78f55cb3354da21d143783d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 12:00:35 +0100 +Subject: net: dsa: mv88e6xxx: fix in-band AN link establishment + +From: Russell King + +[ Upstream commit fad58190c0ffd72c394722928cd3e919b6e18357 ] + +If in-band negotiation or fixed-link modes are specified for a DSA +port, the DSA code will force the link down during initialisation. For +fixed-link mode, this is fine, as phylink will manage the link state. +However, for in-band mode, phylink expects the PCS to detect link, +which will not happen if the link is forced down. + +There is a related issue that in in-band mode, the link could come up +while we are making configuration changes, so we should force the link +down prior to reconfiguring the interface mode. + +This patch addresses both issues. + +Fixes: 3be98b2d5fbc ("net: dsa: Down cpu/dsa ports phylink will control") +Signed-off-by: Russell King +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 22 +++++++++++++++++++--- + drivers/net/dsa/mv88e6xxx/chip.h | 1 + + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 2b4a723c83065..e065be419a03d 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -664,8 +664,11 @@ static void mv88e6xxx_mac_config(struct dsa_switch *ds, int port, + const struct phylink_link_state *state) + { + struct mv88e6xxx_chip *chip = ds->priv; ++ struct mv88e6xxx_port *p; + int err; + ++ p = &chip->ports[port]; ++ + /* FIXME: is this the correct test? If we're in fixed mode on an + * internal port, why should we process this any different from + * PHY mode? On the other hand, the port may be automedia between +@@ -675,10 +678,14 @@ static void mv88e6xxx_mac_config(struct dsa_switch *ds, int port, + return; + + mv88e6xxx_reg_lock(chip); +- /* FIXME: should we force the link down here - but if we do, how +- * do we restore the link force/unforce state? The driver layering +- * gets in the way. ++ /* In inband mode, the link may come up at any time while the link ++ * is not forced down. Force the link down while we reconfigure the ++ * interface mode. + */ ++ if (mode == MLO_AN_INBAND && p->interface != state->interface && ++ chip->info->ops->port_set_link) ++ chip->info->ops->port_set_link(chip, port, LINK_FORCED_DOWN); ++ + err = mv88e6xxx_port_config_interface(chip, port, state->interface); + if (err && err != -EOPNOTSUPP) + goto err_unlock; +@@ -691,6 +698,15 @@ static void mv88e6xxx_mac_config(struct dsa_switch *ds, int port, + if (err > 0) + err = 0; + ++ /* Undo the forced down state above after completing configuration ++ * irrespective of its state on entry, which allows the link to come up. ++ */ ++ if (mode == MLO_AN_INBAND && p->interface != state->interface && ++ chip->info->ops->port_set_link) ++ chip->info->ops->port_set_link(chip, port, LINK_UNFORCED); ++ ++ p->interface = state->interface; ++ + err_unlock: + mv88e6xxx_reg_unlock(chip); + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h +index e5430cf2ad711..6476524e8239d 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.h ++++ b/drivers/net/dsa/mv88e6xxx/chip.h +@@ -232,6 +232,7 @@ struct mv88e6xxx_port { + u64 atu_full_violation; + u64 vtu_member_violation; + u64 vtu_miss_violation; ++ phy_interface_t interface; + u8 cmode; + bool mirror_ingress; + bool mirror_egress; +-- +2.25.1 + diff --git a/queue-5.7/net-ethernet-ave-fix-error-returns-in-ave_init.patch b/queue-5.7/net-ethernet-ave-fix-error-returns-in-ave_init.patch new file mode 100644 index 00000000000..0c9f35e147d --- /dev/null +++ b/queue-5.7/net-ethernet-ave-fix-error-returns-in-ave_init.patch @@ -0,0 +1,39 @@ +From 3c67351b228ab3bfb8f84ff93b643b2115f5fdae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 10:50:49 +0800 +Subject: net: ethernet: ave: Fix error returns in ave_init + +From: Wang Hai + +[ Upstream commit 1264d7fa3a64d8bea7aebb77253f917947ffda25 ] + +When regmap_update_bits failed in ave_init(), calls of the functions +reset_control_assert() and clk_disable_unprepare() were missed. +Add goto out_reset_assert to do this. + +Fixes: 57878f2f4697 ("net: ethernet: ave: add support for phy-mode setting of system controller") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Reviewed-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/socionext/sni_ave.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c +index 67ddf782d98a5..897c895629d03 100644 +--- a/drivers/net/ethernet/socionext/sni_ave.c ++++ b/drivers/net/ethernet/socionext/sni_ave.c +@@ -1191,7 +1191,7 @@ static int ave_init(struct net_device *ndev) + ret = regmap_update_bits(priv->regmap, SG_ETPINMODE, + priv->pinmode_mask, priv->pinmode_val); + if (ret) +- return ret; ++ goto out_reset_assert; + + ave_global_reset(ndev); + +-- +2.25.1 + diff --git a/queue-5.7/net-fec-fix-hardware-time-stamping-by-external-devic.patch b/queue-5.7/net-fec-fix-hardware-time-stamping-by-external-devic.patch new file mode 100644 index 00000000000..633721de95c --- /dev/null +++ b/queue-5.7/net-fec-fix-hardware-time-stamping-by-external-devic.patch @@ -0,0 +1,110 @@ +From ea050d0449313fa9b6daff9f515b746d0d96215d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 19:28:02 +0300 +Subject: net: fec: fix hardware time stamping by external devices + +From: Sergey Organov + +[ Upstream commit 340746398b67e3ce5019698748ebaa7adf048114 ] + +Fix support for external PTP-aware devices such as DSA or PTP PHY: + +Make sure we never time stamp tx packets when hardware time stamping +is disabled. + +Check for PTP PHY being in use and then pass ioctls related to time +stamping of Ethernet packets to the PTP PHY rather than handle them +ourselves. In addition, disable our own hardware time stamping in this +case. + +Fixes: 6605b730c061 ("FEC: Add time stamping code and a PTP hardware clock") +Signed-off-by: Sergey Organov +Acked-by: Richard Cochran +Acked-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec.h | 1 + + drivers/net/ethernet/freescale/fec_main.c | 23 +++++++++++++++++------ + drivers/net/ethernet/freescale/fec_ptp.c | 12 ++++++++++++ + 3 files changed, 30 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h +index e74dd1f86bbae..828eb8ce6631c 100644 +--- a/drivers/net/ethernet/freescale/fec.h ++++ b/drivers/net/ethernet/freescale/fec.h +@@ -597,6 +597,7 @@ struct fec_enet_private { + void fec_ptp_init(struct platform_device *pdev, int irq_idx); + void fec_ptp_stop(struct platform_device *pdev); + void fec_ptp_start_cyclecounter(struct net_device *ndev); ++void fec_ptp_disable_hwts(struct net_device *ndev); + int fec_ptp_set(struct net_device *ndev, struct ifreq *ifr); + int fec_ptp_get(struct net_device *ndev, struct ifreq *ifr); + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index dc6f8763a5d40..bf73bc9bf35b9 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1302,8 +1302,13 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id) + ndev->stats.tx_bytes += skb->len; + } + +- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS) && +- fep->bufdesc_ex) { ++ /* NOTE: SKBTX_IN_PROGRESS being set does not imply it's we who ++ * are to time stamp the packet, so we still need to check time ++ * stamping enabled flag. ++ */ ++ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS && ++ fep->hwts_tx_en) && ++ fep->bufdesc_ex) { + struct skb_shared_hwtstamps shhwtstamps; + struct bufdesc_ex *ebdp = (struct bufdesc_ex *)bdp; + +@@ -2731,10 +2736,16 @@ static int fec_enet_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd) + return -ENODEV; + + if (fep->bufdesc_ex) { +- if (cmd == SIOCSHWTSTAMP) +- return fec_ptp_set(ndev, rq); +- if (cmd == SIOCGHWTSTAMP) +- return fec_ptp_get(ndev, rq); ++ bool use_fec_hwts = !phy_has_hwtstamp(phydev); ++ ++ if (cmd == SIOCSHWTSTAMP) { ++ if (use_fec_hwts) ++ return fec_ptp_set(ndev, rq); ++ fec_ptp_disable_hwts(ndev); ++ } else if (cmd == SIOCGHWTSTAMP) { ++ if (use_fec_hwts) ++ return fec_ptp_get(ndev, rq); ++ } + } + + return phy_mii_ioctl(phydev, rq, cmd); +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 945643c026155..f8a592c96beb0 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -452,6 +452,18 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp, + return -EOPNOTSUPP; + } + ++/** ++ * fec_ptp_disable_hwts - disable hardware time stamping ++ * @ndev: pointer to net_device ++ */ ++void fec_ptp_disable_hwts(struct net_device *ndev) ++{ ++ struct fec_enet_private *fep = netdev_priv(ndev); ++ ++ fep->hwts_tx_en = 0; ++ fep->hwts_rx_en = 0; ++} ++ + int fec_ptp_set(struct net_device *ndev, struct ifreq *ifr) + { + struct fec_enet_private *fep = netdev_priv(ndev); +-- +2.25.1 + diff --git a/queue-5.7/net-hns3-fix-error-handling-for-desc-filling.patch b/queue-5.7/net-hns3-fix-error-handling-for-desc-filling.patch new file mode 100644 index 00000000000..5db2696e91f --- /dev/null +++ b/queue-5.7/net-hns3-fix-error-handling-for-desc-filling.patch @@ -0,0 +1,79 @@ +From e128f6521dc2f14c8233516ab4919329445915cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 19:03:53 +0800 +Subject: net: hns3: fix error handling for desc filling + +From: Yunsheng Lin + +[ Upstream commit 8ceca59fb3ed48a693171bd571c4fcbd555b7f1f ] + +The content of the TX desc is automatically cleared by the HW +when the HW has sent out the packet to the wire. When desc filling +fails in hns3_nic_net_xmit(), it will call hns3_clear_desc() to do +the error handling, which miss zeroing of the TX desc and the +checking if a unmapping is needed. + +So add the zeroing and checking in hns3_clear_desc() to avoid the +above problem. Also add DESC_TYPE_UNKNOWN to indicate the info in +desc_cb is not valid, because hns3_nic_reclaim_desc() may treat +the desc_cb->type of zero as packet and add to the sent pkt +statistics accordingly. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index 5587605d6deb2..cc45662f77f04 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -77,6 +77,7 @@ + ((ring)->p = ((ring)->p - 1 + (ring)->desc_num) % (ring)->desc_num) + + enum hns_desc_type { ++ DESC_TYPE_UNKNOWN, + DESC_TYPE_SKB, + DESC_TYPE_FRAGLIST_SKB, + DESC_TYPE_PAGE, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 5dab84aa3afd5..df1cb0441183c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1351,6 +1351,10 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig) + unsigned int i; + + for (i = 0; i < ring->desc_num; i++) { ++ struct hns3_desc *desc = &ring->desc[ring->next_to_use]; ++ ++ memset(desc, 0, sizeof(*desc)); ++ + /* check if this is where we started */ + if (ring->next_to_use == next_to_use_orig) + break; +@@ -1358,6 +1362,9 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig) + /* rollback one */ + ring_ptr_move_bw(ring, next_to_use); + ++ if (!ring->desc_cb[ring->next_to_use].dma) ++ continue; ++ + /* unmap the descriptor dma address */ + if (ring->desc_cb[ring->next_to_use].type == DESC_TYPE_SKB || + ring->desc_cb[ring->next_to_use].type == +@@ -1374,6 +1381,7 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig) + + ring->desc_cb[ring->next_to_use].length = 0; + ring->desc_cb[ring->next_to_use].dma = 0; ++ ring->desc_cb[ring->next_to_use].type = DESC_TYPE_UNKNOWN; + } + } + +-- +2.25.1 + diff --git a/queue-5.7/net-hns3-fix-for-not-calculating-tx-bd-send-size-cor.patch b/queue-5.7/net-hns3-fix-for-not-calculating-tx-bd-send-size-cor.patch new file mode 100644 index 00000000000..25bc47518f6 --- /dev/null +++ b/queue-5.7/net-hns3-fix-for-not-calculating-tx-bd-send-size-cor.patch @@ -0,0 +1,61 @@ +From f813ab18bd980bcc21a4f4c93926be18072aed58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 19:03:52 +0800 +Subject: net: hns3: fix for not calculating TX BD send size correctly + +From: Yunsheng Lin + +[ Upstream commit 48ae74c9d89f827b39b5c07a1f02fc13637a3cd6 ] + +With GRO and fraglist support, the SKB can be aggregated to +a total size of 65535, and when that SKB is forwarded through +a bridge, the size of the SKB may be pushed to exceed the size +of 65535 when br_dev_queue_push_xmit() is called. + +The max send size of BD supported by the HW is 65535, when a SKB +with a headlen of over 65535 is sent to the driver, the driver +needs to use multi BD to send the linear data, and the send size +of the last BD is calculated incorrectly by the driver who is +using '&' operation, which causes a TX error. + +Use '%' operation to fix this problem. + +Fixes: 3fe13ed95dd3 ("net: hns3: avoid mult + div op in critical data path") +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 -- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 3003eecd5263b..5dab84aa3afd5 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1140,7 +1140,7 @@ static int hns3_fill_desc(struct hns3_enet_ring *ring, void *priv, + } + + frag_buf_num = hns3_tx_bd_count(size); +- sizeoflast = size & HNS3_TX_LAST_SIZE_M; ++ sizeoflast = size % HNS3_MAX_BD_SIZE; + sizeoflast = sizeoflast ? sizeoflast : HNS3_MAX_BD_SIZE; + + /* When frag size is bigger than hardware limit, split this frag */ +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +index abefd7a179f7b..e6b29a35cdb24 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -186,8 +186,6 @@ enum hns3_nic_state { + #define HNS3_TXD_MSS_S 0 + #define HNS3_TXD_MSS_M (0x3fff << HNS3_TXD_MSS_S) + +-#define HNS3_TX_LAST_SIZE_M 0xffff +- + #define HNS3_VECTOR_TX_IRQ BIT_ULL(0) + #define HNS3_VECTOR_RX_IRQ BIT_ULL(1) + +-- +2.25.1 + diff --git a/queue-5.7/net-hns3-fix-return-value-error-when-query-mac-link-.patch b/queue-5.7/net-hns3-fix-return-value-error-when-query-mac-link-.patch new file mode 100644 index 00000000000..fff45cf18b6 --- /dev/null +++ b/queue-5.7/net-hns3-fix-return-value-error-when-query-mac-link-.patch @@ -0,0 +1,154 @@ +From a130205646a66d368afc3ea1b55f622b44360edb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 19:03:54 +0800 +Subject: net: hns3: fix return value error when query MAC link status fail + +From: Jian Shen + +[ Upstream commit fac24df7b9a6d9363abdff0e351ade041dd16daa ] + +Currently, PF queries the MAC link status per second by calling +function hclge_get_mac_link_status(). It return the error code +when failed to send cmdq command to firmware. It's incorrect, +because this return value is used as the MAC link status, which +0 means link down, and none-zero means link up. So fixes it. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Jian Shen +Signed-off-by: Huazhong tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_main.c | 49 +++++++++---------- + .../hisilicon/hns3/hns3pf/hclge_main.h | 3 ++ + 2 files changed, 25 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 4de268a879582..b66b93f320b42 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2680,11 +2680,10 @@ void hclge_task_schedule(struct hclge_dev *hdev, unsigned long delay_time) + delay_time); + } + +-static int hclge_get_mac_link_status(struct hclge_dev *hdev) ++static int hclge_get_mac_link_status(struct hclge_dev *hdev, int *link_status) + { + struct hclge_link_status_cmd *req; + struct hclge_desc desc; +- int link_status; + int ret; + + hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_QUERY_LINK_STATUS, true); +@@ -2696,33 +2695,25 @@ static int hclge_get_mac_link_status(struct hclge_dev *hdev) + } + + req = (struct hclge_link_status_cmd *)desc.data; +- link_status = req->status & HCLGE_LINK_STATUS_UP_M; ++ *link_status = (req->status & HCLGE_LINK_STATUS_UP_M) > 0 ? ++ HCLGE_LINK_STATUS_UP : HCLGE_LINK_STATUS_DOWN; + +- return !!link_status; ++ return 0; + } + +-static int hclge_get_mac_phy_link(struct hclge_dev *hdev) ++static int hclge_get_mac_phy_link(struct hclge_dev *hdev, int *link_status) + { +- unsigned int mac_state; +- int link_stat; ++ struct phy_device *phydev = hdev->hw.mac.phydev; ++ ++ *link_status = HCLGE_LINK_STATUS_DOWN; + + if (test_bit(HCLGE_STATE_DOWN, &hdev->state)) + return 0; + +- mac_state = hclge_get_mac_link_status(hdev); +- +- if (hdev->hw.mac.phydev) { +- if (hdev->hw.mac.phydev->state == PHY_RUNNING) +- link_stat = mac_state & +- hdev->hw.mac.phydev->link; +- else +- link_stat = 0; +- +- } else { +- link_stat = mac_state; +- } ++ if (phydev && (phydev->state != PHY_RUNNING || !phydev->link)) ++ return 0; + +- return !!link_stat; ++ return hclge_get_mac_link_status(hdev, link_status); + } + + static void hclge_update_link_status(struct hclge_dev *hdev) +@@ -2732,6 +2723,7 @@ static void hclge_update_link_status(struct hclge_dev *hdev) + struct hnae3_handle *rhandle; + struct hnae3_handle *handle; + int state; ++ int ret; + int i; + + if (!client) +@@ -2740,7 +2732,12 @@ static void hclge_update_link_status(struct hclge_dev *hdev) + if (test_and_set_bit(HCLGE_STATE_LINK_UPDATING, &hdev->state)) + return; + +- state = hclge_get_mac_phy_link(hdev); ++ ret = hclge_get_mac_phy_link(hdev, &state); ++ if (ret) { ++ clear_bit(HCLGE_STATE_LINK_UPDATING, &hdev->state); ++ return; ++ } ++ + if (state != hdev->hw.mac.link) { + for (i = 0; i < hdev->num_vmdq_vport + 1; i++) { + handle = &hdev->vport[i].nic; +@@ -6435,14 +6432,15 @@ static int hclge_mac_link_status_wait(struct hclge_dev *hdev, int link_ret) + { + #define HCLGE_MAC_LINK_STATUS_NUM 100 + ++ int link_status; + int i = 0; + int ret; + + do { +- ret = hclge_get_mac_link_status(hdev); +- if (ret < 0) ++ ret = hclge_get_mac_link_status(hdev, &link_status); ++ if (ret) + return ret; +- else if (ret == link_ret) ++ if (link_status == link_ret) + return 0; + + msleep(HCLGE_LINK_STATUS_MS); +@@ -6453,9 +6451,6 @@ static int hclge_mac_link_status_wait(struct hclge_dev *hdev, int link_ret) + static int hclge_mac_phy_link_status_wait(struct hclge_dev *hdev, bool en, + bool is_phy) + { +-#define HCLGE_LINK_STATUS_DOWN 0 +-#define HCLGE_LINK_STATUS_UP 1 +- + int link_ret; + + link_ret = en ? HCLGE_LINK_STATUS_UP : HCLGE_LINK_STATUS_DOWN; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +index 71df23d5f1b4d..8784168f8f6f7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -316,6 +316,9 @@ enum hclge_link_fail_code { + HCLGE_LF_XSFP_ABSENT, + }; + ++#define HCLGE_LINK_STATUS_DOWN 0 ++#define HCLGE_LINK_STATUS_UP 1 ++ + #define HCLGE_PG_NUM 4 + #define HCLGE_SCH_MODE_SP 0 + #define HCLGE_SCH_MODE_DWRR 1 +-- +2.25.1 + diff --git a/queue-5.7/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch b/queue-5.7/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch new file mode 100644 index 00000000000..4562abf2838 --- /dev/null +++ b/queue-5.7/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch @@ -0,0 +1,47 @@ +From f0998a022b11f47ecd23b5c932c1fd96000f11e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:50:38 +0800 +Subject: net: smc91x: Fix possible memory leak in smc_drv_probe() + +From: Wang Hai + +[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ] + +If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev) +should be called to free the ndev created earlier. Otherwise, a memleak +will occur. + +Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc91x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 90410f9d3b1aa..1c4fea9c3ec4c 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -2274,7 +2274,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, + "power", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Optional reset GPIO configured? Minimum 100 ns reset needed +@@ -2283,7 +2283,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, + "reset", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Need to wait for optional EEPROM to load, max 750 us according +-- +2.25.1 + diff --git a/queue-5.7/netdevsim-fix-unbalaced-locking-in-nsim_create.patch b/queue-5.7/netdevsim-fix-unbalaced-locking-in-nsim_create.patch new file mode 100644 index 00000000000..3a63bb18f7e --- /dev/null +++ b/queue-5.7/netdevsim-fix-unbalaced-locking-in-nsim_create.patch @@ -0,0 +1,49 @@ +From d527c92085d3e973ad20f20e6ed5ec25cfce363e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 14:51:50 +0000 +Subject: netdevsim: fix unbalaced locking in nsim_create() + +From: Taehee Yoo + +[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ] + +In the nsim_create(), rtnl_lock() is called before nsim_bpf_init(). +If nsim_bpf_init() is failed, rtnl_unlock() should be called, +but it isn't called. +So, unbalanced locking would occur. + +Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe") +Signed-off-by: Taehee Yoo +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c +index 2908e0a0d6e19..23950e7a0f81e 100644 +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -302,7 +302,7 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port) + rtnl_lock(); + err = nsim_bpf_init(ns); + if (err) +- goto err_free_netdev; ++ goto err_rtnl_unlock; + + nsim_ipsec_init(ns); + +@@ -316,8 +316,8 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port) + err_ipsec_teardown: + nsim_ipsec_teardown(ns); + nsim_bpf_uninit(ns); ++err_rtnl_unlock: + rtnl_unlock(); +-err_free_netdev: + free_netdev(dev); + return ERR_PTR(err); + } +-- +2.25.1 + diff --git a/queue-5.7/netfilter-nf_tables-fix-nat-hook-table-deletion.patch b/queue-5.7/netfilter-nf_tables-fix-nat-hook-table-deletion.patch new file mode 100644 index 00000000000..73180281f49 --- /dev/null +++ b/queue-5.7/netfilter-nf_tables-fix-nat-hook-table-deletion.patch @@ -0,0 +1,156 @@ +From 37df5a2719b50ef1e06e2c27f58ab1613dc8302e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 18:51:39 +0200 +Subject: netfilter: nf_tables: fix nat hook table deletion + +From: Florian Westphal + +[ Upstream commit 1e9451cbda456a170518b2bfd643e2cb980880bf ] + +sybot came up with following transaction: + add table ip syz0 + add chain ip syz0 syz2 { type nat hook prerouting priority 0; policy accept; } + add table ip syz0 { flags dormant; } + delete chain ip syz0 syz2 + delete table ip syz0 + +which yields: +hook not found, pf 2 num 0 +WARNING: CPU: 0 PID: 6775 at net/netfilter/core.c:413 __nf_unregister_net_hook+0x3e6/0x4a0 net/netfilter/core.c:413 +[..] + nft_unregister_basechain_hooks net/netfilter/nf_tables_api.c:206 [inline] + nft_table_disable net/netfilter/nf_tables_api.c:835 [inline] + nf_tables_table_disable net/netfilter/nf_tables_api.c:868 [inline] + nf_tables_commit+0x32d3/0x4d70 net/netfilter/nf_tables_api.c:7550 + nfnetlink_rcv_batch net/netfilter/nfnetlink.c:486 [inline] + nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:544 [inline] + nfnetlink_rcv+0x14a5/0x1e50 net/netfilter/nfnetlink.c:562 + netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] + +Problem is that when I added ability to override base hook registration +to make nat basechains register with the nat core instead of netfilter +core, I forgot to update nft_table_disable() to use that instead of +the 'raw' hook register interface. + +In syzbot transaction, the basechain is of 'nat' type. Its registered +with the nat core. The switch to 'dormant mode' attempts to delete from +netfilter core instead. + +After updating nft_table_disable/enable to use the correct helper, +nft_(un)register_basechain_hooks can be folded into the only remaining +caller. + +Because nft_trans_table_enable() won't do anything when the DORMANT flag +is set, remove the flag first, then re-add it in case re-enablement +fails, else this patch breaks sequence: + +add table ip x { flags dormant; } +/* add base chains */ +add table ip x + +The last 'add' will remove the dormant flags, but won't have any other +effect -- base chains are not registered. +Then, next 'set dormant flag' will create another 'hook not found' +splat. + +Reported-by: syzbot+2570f2c036e3da5db176@syzkaller.appspotmail.com +Fixes: 4e25ceb80b58 ("netfilter: nf_tables: allow chain type to override hook register") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 41 ++++++++++++----------------------- + 1 file changed, 14 insertions(+), 27 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 9780bd93b7e49..e1d678af8749b 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -188,24 +188,6 @@ static void nft_netdev_unregister_hooks(struct net *net, + nf_unregister_net_hook(net, &hook->ops); + } + +-static int nft_register_basechain_hooks(struct net *net, int family, +- struct nft_base_chain *basechain) +-{ +- if (family == NFPROTO_NETDEV) +- return nft_netdev_register_hooks(net, &basechain->hook_list); +- +- return nf_register_net_hook(net, &basechain->ops); +-} +- +-static void nft_unregister_basechain_hooks(struct net *net, int family, +- struct nft_base_chain *basechain) +-{ +- if (family == NFPROTO_NETDEV) +- nft_netdev_unregister_hooks(net, &basechain->hook_list); +- else +- nf_unregister_net_hook(net, &basechain->ops); +-} +- + static int nf_tables_register_hook(struct net *net, + const struct nft_table *table, + struct nft_chain *chain) +@@ -223,7 +205,10 @@ static int nf_tables_register_hook(struct net *net, + if (basechain->type->ops_register) + return basechain->type->ops_register(net, ops); + +- return nft_register_basechain_hooks(net, table->family, basechain); ++ if (table->family == NFPROTO_NETDEV) ++ return nft_netdev_register_hooks(net, &basechain->hook_list); ++ ++ return nf_register_net_hook(net, &basechain->ops); + } + + static void nf_tables_unregister_hook(struct net *net, +@@ -242,7 +227,10 @@ static void nf_tables_unregister_hook(struct net *net, + if (basechain->type->ops_unregister) + return basechain->type->ops_unregister(net, ops); + +- nft_unregister_basechain_hooks(net, table->family, basechain); ++ if (table->family == NFPROTO_NETDEV) ++ nft_netdev_unregister_hooks(net, &basechain->hook_list); ++ else ++ nf_unregister_net_hook(net, &basechain->ops); + } + + static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) +@@ -832,8 +820,7 @@ static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) + if (cnt && i++ == cnt) + break; + +- nft_unregister_basechain_hooks(net, table->family, +- nft_base_chain(chain)); ++ nf_tables_unregister_hook(net, table, chain); + } + } + +@@ -848,8 +835,7 @@ static int nf_tables_table_enable(struct net *net, struct nft_table *table) + if (!nft_is_base_chain(chain)) + continue; + +- err = nft_register_basechain_hooks(net, table->family, +- nft_base_chain(chain)); ++ err = nf_tables_register_hook(net, table, chain); + if (err < 0) + goto err_register_hooks; + +@@ -894,11 +880,12 @@ static int nf_tables_updtable(struct nft_ctx *ctx) + nft_trans_table_enable(trans) = false; + } else if (!(flags & NFT_TABLE_F_DORMANT) && + ctx->table->flags & NFT_TABLE_F_DORMANT) { ++ ctx->table->flags &= ~NFT_TABLE_F_DORMANT; + ret = nf_tables_table_enable(ctx->net, ctx->table); +- if (ret >= 0) { +- ctx->table->flags &= ~NFT_TABLE_F_DORMANT; ++ if (ret >= 0) + nft_trans_table_enable(trans) = true; +- } ++ else ++ ctx->table->flags |= NFT_TABLE_F_DORMANT; + } + if (ret < 0) + goto err; +-- +2.25.1 + diff --git a/queue-5.7/nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch b/queue-5.7/nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch new file mode 100644 index 00000000000..62367e36dee --- /dev/null +++ b/queue-5.7/nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch @@ -0,0 +1,85 @@ +From 8245a2706a9bd2ae1fce83eaadc587433409fc7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 13:31:36 -0400 +Subject: nfsd4: fix NULL dereference in nfsd/clients display code + +From: J. Bruce Fields + +[ Upstream commit 9affa435817711861d774f5626c393c80f16d044 ] + +We hold the cl_lock here, and that's enough to keep stateid's from going +away, but it's not enough to prevent the files they point to from going +away. Take fi_lock and a reference and check for NULL, as we do in +other code. + +Reported-by: NeilBrown +Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens") +Reviewed-by: NeilBrown +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index bdfae3ba39539..0a201bb074b0e 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -509,6 +509,17 @@ find_any_file(struct nfs4_file *f) + return ret; + } + ++static struct nfsd_file *find_deleg_file(struct nfs4_file *f) ++{ ++ struct nfsd_file *ret = NULL; ++ ++ spin_lock(&f->fi_lock); ++ if (f->fi_deleg_file) ++ ret = nfsd_file_get(f->fi_deleg_file); ++ spin_unlock(&f->fi_lock); ++ return ret; ++} ++ + static atomic_long_t num_delegations; + unsigned long max_delegations; + +@@ -2436,6 +2447,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st) + oo = ols->st_stateowner; + nf = st->sc_file; + file = find_any_file(nf); ++ if (!file) ++ return 0; + + seq_printf(s, "- 0x%16phN: { type: open, ", &st->sc_stateid); + +@@ -2469,6 +2482,8 @@ static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st) + oo = ols->st_stateowner; + nf = st->sc_file; + file = find_any_file(nf); ++ if (!file) ++ return 0; + + seq_printf(s, "- 0x%16phN: { type: lock, ", &st->sc_stateid); + +@@ -2497,7 +2512,9 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st) + + ds = delegstateid(st); + nf = st->sc_file; +- file = nf->fi_deleg_file; ++ file = find_deleg_file(nf); ++ if (!file) ++ return 0; + + seq_printf(s, "- 0x%16phN: { type: deleg, ", &st->sc_stateid); + +@@ -2509,6 +2526,7 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st) + + nfs4_show_superblock(s, file); + seq_printf(s, " }\n"); ++ nfsd_file_put(file); + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.7/platform-x86-asus-wmi-allow-bat1-battery-name.patch b/queue-5.7/platform-x86-asus-wmi-allow-bat1-battery-name.patch new file mode 100644 index 00000000000..b1b3f624e4e --- /dev/null +++ b/queue-5.7/platform-x86-asus-wmi-allow-bat1-battery-name.patch @@ -0,0 +1,34 @@ +From 6e398e4c5891b9aab97eacd934f882a35c6436d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 20:56:01 +0300 +Subject: platform/x86: asus-wmi: allow BAT1 battery name + +From: Vasiliy Kupriakov + +[ Upstream commit 9a33e375d98ece5ea40c576eabd3257acb90c509 ] + +The battery on my laptop ASUS TUF Gaming FX706II is named BAT1. +This patch allows battery extension to load. + +Signed-off-by: Vasiliy Kupriakov +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index cd212ee210e2d..537b824a1ae25 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -432,6 +432,7 @@ static int asus_wmi_battery_add(struct power_supply *battery) + * battery is named BATT. + */ + if (strcmp(battery->desc->name, "BAT0") != 0 && ++ strcmp(battery->desc->name, "BAT1") != 0 && + strcmp(battery->desc->name, "BATT") != 0) + return -ENODEV; + +-- +2.25.1 + diff --git a/queue-5.7/platform-x86-isst-add-new-pci-device-ids.patch b/queue-5.7/platform-x86-isst-add-new-pci-device-ids.patch new file mode 100644 index 00000000000..5bbad401bfb --- /dev/null +++ b/queue-5.7/platform-x86-isst-add-new-pci-device-ids.patch @@ -0,0 +1,62 @@ +From bd301cd49ab939fc2349617d12eb7252ff580b3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 10:51:38 -0700 +Subject: platform/x86: ISST: Add new PCI device ids + +From: Srinivas Pandruvada + +[ Upstream commit e1eea3f839f41368d7cb4eb2d872d5b288677e94 ] + +Added new PCI device ids for supporting mailbox and MMIO interface for +Sapphire Rapids. + +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_speed_select_if/isst_if_common.h | 3 +++ + drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c | 1 + + drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c | 1 + + 3 files changed, 5 insertions(+) + +diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h +index 1409a5bb55820..4f6f7f0761fc1 100644 +--- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h ++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h +@@ -13,6 +13,9 @@ + #define INTEL_RAPL_PRIO_DEVID_0 0x3451 + #define INTEL_CFG_MBOX_DEVID_0 0x3459 + ++#define INTEL_RAPL_PRIO_DEVID_1 0x3251 ++#define INTEL_CFG_MBOX_DEVID_1 0x3259 ++ + /* + * Validate maximum commands in a single request. + * This is enough to handle command to every core in one ioctl, or all +diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +index de4169d0796bd..9a055fd54053f 100644 +--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c ++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +@@ -148,6 +148,7 @@ static long isst_if_mbox_proc_cmd(u8 *cmd_ptr, int *write_only, int resume) + + static const struct pci_device_id isst_if_mbox_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_0)}, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_1)}, + { 0 }, + }; + MODULE_DEVICE_TABLE(pci, isst_if_mbox_ids); +diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c +index 3584859fcc421..aa17fd7817f8f 100644 +--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c ++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c +@@ -72,6 +72,7 @@ static long isst_if_mmio_rd_wr(u8 *cmd_ptr, int *write_only, int resume) + + static const struct pci_device_id isst_if_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_0)}, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_1)}, + { 0 }, + }; + MODULE_DEVICE_TABLE(pci, isst_if_ids); +-- +2.25.1 + diff --git a/queue-5.7/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch b/queue-5.7/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch new file mode 100644 index 00000000000..06f97d7d443 --- /dev/null +++ b/queue-5.7/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch @@ -0,0 +1,61 @@ +From f66b38656d48ef8e573f58356de56cfe8645bd23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 17:41:42 +0300 +Subject: qed: suppress "don't support RoCE & iWARP" flooding on HW init + +From: Alexander Lobakin + +[ Upstream commit 1ea999039fe7c7953da2fbb7ca7c3ef00064d328 ] + +Change the verbosity of the "don't support RoCE & iWARP simultaneously" +warning to debug level to stop flooding on driver/hardware initialization: + +[ 4.783230] qede 01:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth0] +[ 4.810020] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 4.861186] qede 01:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth1] +[ 4.893311] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.181713] qede a1:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth2] +[ 5.224740] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.276449] qede a1:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth3] +[ 5.318671] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.369548] qede a1:00.02: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth4] +[ 5.411645] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only + +Fixes: e0a8f9de16fc ("qed: Add iWARP enablement support") +Signed-off-by: Alexander Lobakin +Signed-off-by: Igor Russkikh +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index aeed8939f410a..3bbcff5f26214 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -1987,8 +1987,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn, + num_srqs = min_t(u32, QED_RDMA_MAX_SRQS, p_params->num_srqs); + + if (p_hwfn->mcp_info->func_info.protocol == QED_PCI_ETH_RDMA) { +- DP_NOTICE(p_hwfn, +- "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n"); ++ DP_VERBOSE(p_hwfn, QED_MSG_SP, ++ "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n"); + p_hwfn->hw_info.personality = QED_PCI_ETH_ROCE; + } + +-- +2.25.1 + diff --git a/queue-5.7/qed-suppress-false-positives-interrupt-error-message.patch b/queue-5.7/qed-suppress-false-positives-interrupt-error-message.patch new file mode 100644 index 00000000000..b98a9b71482 --- /dev/null +++ b/queue-5.7/qed-suppress-false-positives-interrupt-error-message.patch @@ -0,0 +1,148 @@ +From 5c258770cf6e17081b1c010433fd872eaa873381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 17:41:43 +0300 +Subject: qed: suppress false-positives interrupt error messages on HW init + +From: Alexander Lobakin + +[ Upstream commit eb61c2d69903e977ffa2b80b1da9d1f758cf228d ] + +It was found that qed_pglueb_rbc_attn_handler() can produce a lot of +false-positive error detections on driver load/reload (especially after +crashes/recoveries) and spam the kernel log: + +[ 4.958275] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d00ff0 +[ 2079.146764] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0 +[ 2116.374631] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0 +[ 2135.250564] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0 +[...] + +Reduce the logging level of two false-positive prone error messages from +notice to verbose on initialization (only) to not mix it with real error +attentions while debugging. + +Fixes: 666db4862f2d ("qed: Revise load sequence to avoid PCI errors") +Signed-off-by: Alexander Lobakin +Signed-off-by: Igor Russkikh +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- + drivers/net/ethernet/qlogic/qed/qed_int.c | 50 +++++++++++++---------- + drivers/net/ethernet/qlogic/qed/qed_int.h | 4 +- + 3 files changed, 32 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 58913fe4f3457..0629dd4e18d97 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -3096,7 +3096,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params) + } + + /* Log and clear previous pglue_b errors if such exist */ +- qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt); ++ qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt, true); + + /* Enable the PF's internal FID_enable in the PXP */ + rc = qed_pglueb_set_pfid_enable(p_hwfn, p_hwfn->p_main_ptt, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index 9f5113639eaf0..8d106063e9275 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -256,9 +256,10 @@ out: + #define PGLUE_ATTENTION_ZLR_VALID (1 << 25) + #define PGLUE_ATTENTION_ILT_VALID (1 << 23) + +-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt) ++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ bool hw_init) + { ++ char msg[256]; + u32 tmp; + + tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS2); +@@ -272,22 +273,23 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, + details = qed_rd(p_hwfn, p_ptt, + PGLUE_B_REG_TX_ERR_WR_DETAILS); + +- DP_NOTICE(p_hwfn, +- "Illegal write by chip to [%08x:%08x] blocked.\n" +- "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n" +- "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]\n", +- addr_hi, addr_lo, details, +- (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID), +- (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID), +- GET_FIELD(details, +- PGLUE_ATTENTION_DETAILS_VF_VALID) ? 1 : 0, +- tmp, +- GET_FIELD(tmp, +- PGLUE_ATTENTION_DETAILS2_WAS_ERR) ? 1 : 0, +- GET_FIELD(tmp, +- PGLUE_ATTENTION_DETAILS2_BME) ? 1 : 0, +- GET_FIELD(tmp, +- PGLUE_ATTENTION_DETAILS2_FID_EN) ? 1 : 0); ++ snprintf(msg, sizeof(msg), ++ "Illegal write by chip to [%08x:%08x] blocked.\n" ++ "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n" ++ "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]", ++ addr_hi, addr_lo, details, ++ (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID), ++ (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID), ++ !!GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VF_VALID), ++ tmp, ++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_WAS_ERR), ++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_BME), ++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_FID_EN)); ++ ++ if (hw_init) ++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg); ++ else ++ DP_NOTICE(p_hwfn, "%s\n", msg); + } + + tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_RD_DETAILS2); +@@ -320,8 +322,14 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, + } + + tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS_ICPL); +- if (tmp & PGLUE_ATTENTION_ICPL_VALID) +- DP_NOTICE(p_hwfn, "ICPL error - %08x\n", tmp); ++ if (tmp & PGLUE_ATTENTION_ICPL_VALID) { ++ snprintf(msg, sizeof(msg), "ICPL error - %08x", tmp); ++ ++ if (hw_init) ++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg); ++ else ++ DP_NOTICE(p_hwfn, "%s\n", msg); ++ } + + tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_MASTER_ZLR_ERR_DETAILS); + if (tmp & PGLUE_ATTENTION_ZLR_VALID) { +@@ -360,7 +368,7 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, + + static int qed_pglueb_rbc_attn_cb(struct qed_hwfn *p_hwfn) + { +- return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt); ++ return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt, false); + } + + #define QED_DORQ_ATTENTION_REASON_MASK (0xfffff) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h +index 9ad568d93ae65..defb0d1bc45a2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.h +@@ -431,7 +431,7 @@ int qed_int_set_timer_res(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, + + #define QED_MAPPING_MEMORY_SIZE(dev) (NUM_OF_SBS(dev)) + +-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt); ++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ bool hw_init); + + #endif +-- +2.25.1 + diff --git a/queue-5.7/rdma-cm-protect-access-to-remote_sidr_table.patch b/queue-5.7/rdma-cm-protect-access-to-remote_sidr_table.patch new file mode 100644 index 00000000000..df7067ab9b5 --- /dev/null +++ b/queue-5.7/rdma-cm-protect-access-to-remote_sidr_table.patch @@ -0,0 +1,83 @@ +From 28c5826a1d02daf35497d08cecd561c4a8758533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 13:55:19 +0300 +Subject: RDMA/cm: Protect access to remote_sidr_table + +From: Maor Gottlieb + +[ Upstream commit 87c4c774cbef5c68b3df96827c2fb07f1aa80152 ] + +cm.lock must be held while accessing remote_sidr_table. This fixes the +below NULL pointer dereference. + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 0 P4D 0 + Oops: 0002 [#1] SMP PTI + CPU: 2 PID: 7288 Comm: udaddy Not tainted 5.7.0_for_upstream_perf_2020_06_09_15_14_20_38 #1 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + RIP: 0010:rb_erase+0x10d/0x360 + Code: 00 00 00 48 89 c1 48 89 d0 48 8b 50 08 48 39 ca 74 48 f6 02 01 75 af 48 8b 7a 10 48 89 c1 48 83 c9 01 48 89 78 08 48 89 42 10 <48> 89 0f 48 8b 08 48 89 0a 48 83 e1 fc 48 89 10 0f 84 b1 00 00 00 + RSP: 0018:ffffc90000f77c30 EFLAGS: 00010086 + RAX: ffff8883df27d458 RBX: ffff8883df27da58 RCX: ffff8883df27d459 + RDX: ffff8883d183fa58 RSI: ffffffffa01e8d00 RDI: 0000000000000000 + RBP: ffff8883d62ac800 R08: 0000000000000000 R09: 00000000000000ce + R10: 000000000000000a R11: 0000000000000000 R12: ffff8883df27da00 + R13: ffffc90000f77c98 R14: 0000000000000130 R15: 0000000000000000 + FS: 00007f009f877740(0000) GS:ffff8883f1a00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 00000003d467e003 CR4: 0000000000160ee0 + Call Trace: + cm_send_sidr_rep_locked+0x15a/0x1a0 [ib_cm] + ib_send_cm_sidr_rep+0x2b/0x50 [ib_cm] + cma_send_sidr_rep+0x8b/0xe0 [rdma_cm] + __rdma_accept+0x21d/0x2b0 [rdma_cm] + ? ucma_get_ctx+0x2b/0xe0 [rdma_ucm] + ? _copy_from_user+0x30/0x60 + ucma_accept+0x13e/0x1e0 [rdma_ucm] + ucma_write+0xb4/0x130 [rdma_ucm] + vfs_write+0xad/0x1a0 + ksys_write+0x9d/0xb0 + do_syscall_64+0x48/0x130 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f009ef60924 + Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 80 00 00 00 00 8b 05 2a ef 2c 00 48 63 ff 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 f3 c3 66 90 55 53 48 89 d5 48 89 f3 48 83 + RSP: 002b:00007fff843edf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 000055743042e1d0 RCX: 00007f009ef60924 + RDX: 0000000000000130 RSI: 00007fff843edf40 RDI: 0000000000000003 + RBP: 00007fff843ee0e0 R08: 0000000000000000 R09: 0000557430433090 + R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 + R13: 00007fff843edf40 R14: 000000000000038c R15: 00000000ffffff00 + CR2: 0000000000000000 + +Fixes: 6a8824a74bc9 ("RDMA/cm: Allow ib_send_cm_sidr_rep() to be done under lock") +Link: https://lore.kernel.org/r/20200716105519.1424266-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 1c2bf18cda9f6..83b66757c7ae2 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3723,10 +3723,12 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + return ret; + } + cm_id_priv->id.state = IB_CM_IDLE; ++ spin_lock_irq(&cm.lock); + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { + rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); + RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); + } ++ spin_unlock_irq(&cm.lock); + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.7/rdma-core-fix-race-in-rdma_alloc_commit_uobject.patch b/queue-5.7/rdma-core-fix-race-in-rdma_alloc_commit_uobject.patch new file mode 100644 index 00000000000..e1143931c21 --- /dev/null +++ b/queue-5.7/rdma-core-fix-race-in-rdma_alloc_commit_uobject.patch @@ -0,0 +1,87 @@ +From efda6c3a4ad4bb68f22471adc9802099504d2e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 13:20:59 +0300 +Subject: RDMA/core: Fix race in rdma_alloc_commit_uobject() + +From: Leon Romanovsky + +[ Upstream commit 0d1fd39bb27e479fb1de3dd4b4c247c7c9a1fabf ] + +The FD should not be installed until all of the setup is completed as the +fd_install() transfers ownership of the kref to the FD table. A thread can +race a close() and trigger concurrent rdma_alloc_commit_uobject() and +uverbs_uobject_fd_release() which, at least, triggers a safety WARN_ON: + + WARNING: CPU: 4 PID: 6913 at drivers/infiniband/core/rdma_core.c:768 uverbs_uobject_fd_release+0x202/0x230 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 4 PID: 6913 Comm: syz-executor.3 Not tainted 5.7.0-rc2 #22 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + [..] + RIP: 0010:uverbs_uobject_fd_release+0x202/0x230 + Code: fe 4c 89 e7 e8 af 23 fe ff e9 2a ff ff ff e8 c5 fa 61 fe be 03 00 00 00 4c 89 e7 e8 68 eb f5 fe e9 13 ff ff ff e8 ae fa 61 fe <0f> 0b eb ac e8 e5 aa 3c fe e8 50 2b 86 fe e9 6a fe ff ff e8 46 2b + RSP: 0018:ffffc90008117d88 EFLAGS: 00010293 + RAX: ffff88810e146580 RBX: 1ffff92001022fb1 RCX: ffffffff82d5b902 + RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88811951b040 + RBP: ffff88811951b000 R08: ffffed10232a3609 R09: ffffed10232a3609 + R10: ffff88811951b043 R11: 0000000000000001 R12: ffff888100a7c600 + R13: ffff888100a7c650 R14: ffffc90008117da8 R15: ffffffff82d5b700 + ? __uverbs_cleanup_ufile+0x270/0x270 + ? uverbs_uobject_fd_release+0x202/0x230 + ? uverbs_uobject_fd_release+0x202/0x230 + ? __uverbs_cleanup_ufile+0x270/0x270 + ? locks_remove_file+0x282/0x3d0 + ? security_file_free+0xaa/0xd0 + __fput+0x2be/0x770 + task_work_run+0x10e/0x1b0 + exit_to_usermode_loop+0x145/0x170 + do_syscall_64+0x2d0/0x390 + ? prepare_exit_to_usermode+0x17a/0x230 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x414da7 + Code: 00 00 0f 05 48 3d 00 f0 ff ff 77 3f f3 c3 0f 1f 44 00 00 53 89 fb 48 83 ec 10 e8 f4 fb ff ff 89 df 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2b 89 d7 89 44 24 0c e8 36 fc ff ff 8b 44 24 + RSP: 002b:00007fff39d379d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 + RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000414da7 + RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003 + RBP: 00007fff39d37a3c R08: 0000000400000000 R09: 0000000400000000 + R10: 00007fff39d37910 R11: 0000000000000293 R12: 0000000000000001 + R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000003 + +Reorder so that fd_install() is the last thing done in +rdma_alloc_commit_uobject(). + +Fixes: aba94548c9e4 ("IB/uverbs: Move the FD uobj type struct file allocation to alloc_commit") +Link: https://lore.kernel.org/r/20200716102059.1420681-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/rdma_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 75bcbc625616e..3ab84fcbaadec 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -638,9 +638,6 @@ void rdma_alloc_commit_uobject(struct ib_uobject *uobj, + { + struct ib_uverbs_file *ufile = attrs->ufile; + +- /* alloc_commit consumes the uobj kref */ +- uobj->uapi_object->type_class->alloc_commit(uobj); +- + /* kref is held so long as the uobj is on the uobj list. */ + uverbs_uobject_get(uobj); + spin_lock_irq(&ufile->uobjects_lock); +@@ -650,6 +647,9 @@ void rdma_alloc_commit_uobject(struct ib_uobject *uobj, + /* matches atomic_set(-1) in alloc_uobj */ + atomic_set(&uobj->usecnt, 0); + ++ /* alloc_commit consumes the uobj kref */ ++ uobj->uapi_object->type_class->alloc_commit(uobj); ++ + /* Matches the down_read in rdma_alloc_begin_uobject */ + up_read(&ufile->hw_destroy_rwsem); + } +-- +2.25.1 + diff --git a/queue-5.7/rdma-mlx5-prevent-prefetch-from-racing-with-implicit.patch b/queue-5.7/rdma-mlx5-prevent-prefetch-from-racing-with-implicit.patch new file mode 100644 index 00000000000..3b445668139 --- /dev/null +++ b/queue-5.7/rdma-mlx5-prevent-prefetch-from-racing-with-implicit.patch @@ -0,0 +1,92 @@ +From eeeb7ae5ecef693f292faaa73968cf9707f6d90a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 09:54:35 +0300 +Subject: RDMA/mlx5: Prevent prefetch from racing with implicit destruction + +From: Jason Gunthorpe + +[ Upstream commit a862192e9227ad46e0447fd0a03869ba1b30d16f ] + +Prefetch work in mlx5_ib_prefetch_mr_work can be queued and able to run +concurrently with destruction of the implicit MR. The num_deferred_work +was intended to serialize this, but there is a race: + + CPU0 CPU1 + + mlx5_ib_free_implicit_mr() + xa_erase(odp_mkeys) + synchronize_srcu() + __xa_erase(implicit_children) + mlx5_ib_prefetch_mr_work() + pagefault_mr() + pagefault_implicit_mr() + implicit_get_child_mr() + xa_cmpxchg() + atomic_dec_and_test(num_deferred_mr) + wait_event(imr->q_deferred_work) + ib_umem_odp_release(odp_imr) + kfree(odp_imr) + +At this point in mlx5_ib_free_implicit_mr() the implicit_children list is +supposed to be empty forever so that destroy_unused_implicit_child_mr() +and related are not and will not be running. + +Since it is not empty the destroy_unused_implicit_child_mr() flow ends up +touching deallocated memory as mlx5_ib_free_implicit_mr() already tore down the +imr parent. + +The solution is to flush out the prefetch wq by driving num_deferred_work +to zero after creation of new prefetch work is blocked. + +Fixes: 5256edcb98a1 ("RDMA/mlx5: Rework implicit ODP destroy") +Link: https://lore.kernel.org/r/20200719065435.130722-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/odp.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 3de7606d4a1a7..bdeb6500a9191 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -601,6 +601,23 @@ void mlx5_ib_free_implicit_mr(struct mlx5_ib_mr *imr) + */ + synchronize_srcu(&dev->odp_srcu); + ++ /* ++ * All work on the prefetch list must be completed, xa_erase() prevented ++ * new work from being created. ++ */ ++ wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work)); ++ ++ /* ++ * At this point it is forbidden for any other thread to enter ++ * pagefault_mr() on this imr. It is already forbidden to call ++ * pagefault_mr() on an implicit child. Due to this additions to ++ * implicit_children are prevented. ++ */ ++ ++ /* ++ * Block destroy_unused_implicit_child_mr() from incrementing ++ * num_deferred_work. ++ */ + xa_lock(&imr->implicit_children); + xa_for_each (&imr->implicit_children, idx, mtt) { + __xa_erase(&imr->implicit_children, idx); +@@ -609,9 +626,8 @@ void mlx5_ib_free_implicit_mr(struct mlx5_ib_mr *imr) + xa_unlock(&imr->implicit_children); + + /* +- * num_deferred_work can only be incremented inside the odp_srcu, or +- * under xa_lock while the child is in the xarray. Thus at this point +- * it is only decreasing, and all work holding it is now on the wq. ++ * Wait for any concurrent destroy_unused_implicit_child_mr() to ++ * complete. + */ + wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work)); + +-- +2.25.1 + diff --git a/queue-5.7/rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch b/queue-5.7/rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch new file mode 100644 index 00000000000..5a6aae9f597 --- /dev/null +++ b/queue-5.7/rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch @@ -0,0 +1,115 @@ +From c2330696ae4be966ae060cbdfe6ee6cea0db8b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jul 2020 13:26:41 +0300 +Subject: RDMA/mlx5: Use xa_lock_irq when access to SRQ table + +From: Maor Gottlieb + +[ Upstream commit c3d6057e07a5d15be7c69ea545b3f91877808c96 ] + +SRQ table is accessed both from interrupt and process context, +therefore we must use xa_lock_irq. + + inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. + kworker/u17:9/8573 takes: + ffff8883e3503d30 (&xa->xa_lock#13){?...}-{2:2}, at: mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib] + {IN-HARDIRQ-W} state was registered at: + lock_acquire+0xb9/0x3a0 + _raw_spin_lock+0x25/0x30 + srq_event_notifier+0x2b/0xc0 [mlx5_ib] + notifier_call_chain+0x45/0x70 + __atomic_notifier_call_chain+0x69/0x100 + forward_event+0x36/0xc0 [mlx5_core] + notifier_call_chain+0x45/0x70 + __atomic_notifier_call_chain+0x69/0x100 + mlx5_eq_async_int+0xc5/0x160 [mlx5_core] + notifier_call_chain+0x45/0x70 + __atomic_notifier_call_chain+0x69/0x100 + mlx5_irq_int_handler+0x19/0x30 [mlx5_core] + __handle_irq_event_percpu+0x43/0x2a0 + handle_irq_event_percpu+0x30/0x70 + handle_irq_event+0x34/0x60 + handle_edge_irq+0x7c/0x1b0 + do_IRQ+0x60/0x110 + ret_from_intr+0x0/0x2a + default_idle+0x34/0x160 + do_idle+0x1ec/0x220 + cpu_startup_entry+0x19/0x20 + start_secondary+0x153/0x1a0 + secondary_startup_64+0xa4/0xb0 + irq event stamp: 20907 + hardirqs last enabled at (20907): _raw_spin_unlock_irq+0x24/0x30 + hardirqs last disabled at (20906): _raw_spin_lock_irq+0xf/0x40 + softirqs last enabled at (20746): __do_softirq+0x2c9/0x436 + softirqs last disabled at (20681): irq_exit+0xb3/0xc0 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&xa->xa_lock#13); + + lock(&xa->xa_lock#13); + + *** DEADLOCK *** + + 2 locks held by kworker/u17:9/8573: + #0: ffff888295218d38 ((wq_completion)mlx5_ib_page_fault){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0 + #1: ffff888401647e78 ((work_completion)(&pfault->work)){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0 + + stack backtrace: + CPU: 0 PID: 8573 Comm: kworker/u17:9 Tainted: GO 5.7.0_for_upstream_min_debug_2020_06_14_11_31_46_41 #1 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] + Call Trace: + dump_stack+0x71/0x9b + mark_lock+0x4f2/0x590 + ? print_shortest_lock_dependencies+0x200/0x200 + __lock_acquire+0xa00/0x1eb0 + lock_acquire+0xb9/0x3a0 + ? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib] + _raw_spin_lock+0x25/0x30 + ? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib] + mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib] + mlx5_ib_eqe_pf_action+0x257/0xa30 [mlx5_ib] + ? process_one_work+0x209/0x5f0 + process_one_work+0x27b/0x5f0 + ? __schedule+0x280/0x7e0 + worker_thread+0x2d/0x3c0 + ? process_one_work+0x5f0/0x5f0 + kthread+0x111/0x130 + ? kthread_park+0x90/0x90 + ret_from_fork+0x24/0x30 + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Link: https://lore.kernel.org/r/20200712102641.15210-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/srq_cmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/mlx5/srq_cmd.c +index 8fc3630a9d4c3..0224231a2e6f8 100644 +--- a/drivers/infiniband/hw/mlx5/srq_cmd.c ++++ b/drivers/infiniband/hw/mlx5/srq_cmd.c +@@ -83,11 +83,11 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn) + struct mlx5_srq_table *table = &dev->srq_table; + struct mlx5_core_srq *srq; + +- xa_lock(&table->array); ++ xa_lock_irq(&table->array); + srq = xa_load(&table->array, srqn); + if (srq) + refcount_inc(&srq->common.refcount); +- xa_unlock(&table->array); ++ xa_unlock_irq(&table->array); + + return srq; + } +-- +2.25.1 + diff --git a/queue-5.7/regmap-dev_get_regmap_match-fix-string-comparison.patch b/queue-5.7/regmap-dev_get_regmap_match-fix-string-comparison.patch new file mode 100644 index 00000000000..7c779261f22 --- /dev/null +++ b/queue-5.7/regmap-dev_get_regmap_match-fix-string-comparison.patch @@ -0,0 +1,43 @@ +From 740fc00f4c10922c78901ebbb201407398322d41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 12:33:15 +0200 +Subject: regmap: dev_get_regmap_match(): fix string comparison + +From: Marc Kleine-Budde + +[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ] + +This function is used by dev_get_regmap() to retrieve a regmap for the +specified device. If the device has more than one regmap, the name parameter +can be used to specify one. + +The code here uses a pointer comparison to check for equal strings. This +however will probably always fail, as the regmap->name is allocated via +kstrdup_const() from the regmap's config->name. + +Fix this by using strcmp() instead. + +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 320d23de02c29..927ebde1607be 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1363,7 +1363,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) + + /* If the user didn't specify a name match any */ + if (data) +- return (*r)->name == data; ++ return !strcmp((*r)->name, data); + else + return 1; + } +-- +2.25.1 + diff --git a/queue-5.7/revert-pci-pm-assume-ports-without-dll-link-active-t.patch b/queue-5.7/revert-pci-pm-assume-ports-without-dll-link-active-t.patch new file mode 100644 index 00000000000..9fc11ac4eeb --- /dev/null +++ b/queue-5.7/revert-pci-pm-assume-ports-without-dll-link-active-t.patch @@ -0,0 +1,101 @@ +From b6e4f84a1f399fdeb0bb49b819db2911c11d2ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 17:21:28 -0500 +Subject: Revert "PCI/PM: Assume ports without DLL Link Active train links in + 100 ms" + +From: Bjorn Helgaas + +[ Upstream commit d08c30d7a0d1826f771f16cde32bd86e48401791 ] + +This reverts commit ec411e02b7a2e785a4ed9ed283207cd14f48699d. + +Patrick reported that this commit broke hybrid graphics on a ThinkPad X1 +Extreme 2nd with Intel UHD Graphics 630 and NVIDIA GeForce GTX 1650 Mobile: + + nouveau 0000:01:00.0: fifo: PBDMA0: 01000000 [] ch 0 [00ff992000 DRM] subc 0 mthd 0008 data 00000000 + +Karol reported that this commit broke Nouveau firmware loading on a Lenovo +P1G2 with Intel UHD Graphics 630 and NVIDIA TU117GLM [Quadro T1000 Mobile]: + + nouveau 0000:01:00.0: acr: AHESASC binary failed + +In both cases, reverting ec411e02b7a2 solved the problem. Unfortunately, +this revert will reintroduce the "Thunderbolt bridges take long time to +resume from D3cold" problem: +https://bugzilla.kernel.org/show_bug.cgi?id=206837 + +Link: https://lore.kernel.org/r/CAErSpo5sTeK_my1dEhWp7aHD0xOp87+oHYWkTjbL7ALgDbXo-Q@mail.gmail.com +Link: https://lore.kernel.org/r/CACO55tsAEa5GXw5oeJPG=mcn+qxNvspXreJYWDJGZBy5v82JDA@mail.gmail.com +Link: https://bugzilla.kernel.org/show_bug.cgi?id=208597 +Reported-by: Patrick Volkerding +Reported-by: Karol Herbst +Fixes: ec411e02b7a2 ("PCI/PM: Assume ports without DLL Link Active train links in 100 ms") +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 30 +++++++++--------------------- + 1 file changed, 9 insertions(+), 21 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index d4758518a97bd..a4efc7e0061f5 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4662,8 +4662,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe) + * pcie_wait_for_link_delay - Wait until link is active or inactive + * @pdev: Bridge device + * @active: waiting for active or inactive? +- * @delay: Delay to wait after link has become active (in ms). Specify %0 +- * for no delay. ++ * @delay: Delay to wait after link has become active (in ms) + * + * Use this to wait till link becomes active or inactive. + */ +@@ -4704,7 +4703,7 @@ static bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active, + msleep(10); + timeout -= 10; + } +- if (active && ret && delay) ++ if (active && ret) + msleep(delay); + else if (ret != active) + pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n", +@@ -4825,28 +4824,17 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + if (!pcie_downstream_port(dev)) + return; + +- /* +- * Per PCIe r5.0, sec 6.6.1, for downstream ports that support +- * speeds > 5 GT/s, we must wait for link training to complete +- * before the mandatory delay. +- * +- * We can only tell when link training completes via DLL Link +- * Active, which is required for downstream ports that support +- * speeds > 5 GT/s (sec 7.5.3.6). Unfortunately some common +- * devices do not implement Link Active reporting even when it's +- * required, so we'll check for that directly instead of checking +- * the supported link speed. We assume devices without Link Active +- * reporting can train in 100 ms regardless of speed. +- */ +- if (dev->link_active_reporting) { +- pci_dbg(dev, "waiting for link to train\n"); +- if (!pcie_wait_for_link_delay(dev, true, 0)) { ++ if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) { ++ pci_dbg(dev, "waiting %d ms for downstream link\n", delay); ++ msleep(delay); ++ } else { ++ pci_dbg(dev, "waiting %d ms for downstream link, after activation\n", ++ delay); ++ if (!pcie_wait_for_link_delay(dev, true, delay)) { + /* Did not train, no need to wait any further */ + return; + } + } +- pci_dbg(child, "waiting %d ms to become accessible\n", delay); +- msleep(delay); + + if (!pci_device_is_present(child)) { + pci_dbg(child, "waiting additional %d ms to become accessible\n", delay); +-- +2.25.1 + diff --git a/queue-5.7/risc-v-do-not-rely-on-initrd_start-end-computed-duri.patch b/queue-5.7/risc-v-do-not-rely-on-initrd_start-end-computed-duri.patch new file mode 100644 index 00000000000..abc499ab6ee --- /dev/null +++ b/queue-5.7/risc-v-do-not-rely-on-initrd_start-end-computed-duri.patch @@ -0,0 +1,99 @@ +From fc6aa91a34c309f8ac9923dbfcfb6e98d800b76f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 16:30:08 -0700 +Subject: RISC-V: Do not rely on initrd_start/end computed during early dt + parsing + +From: Atish Patra + +[ Upstream commit 4400231c8acc7e513204c8470c6d796ba47dc169 ] + +Currently, initrd_start/end are computed during early_init_dt_scan +but used during arch_setup. We will get the following panic if initrd is used +and CONFIG_DEBUG_VIRTUAL is turned on. + +[ 0.000000] ------------[ cut here ]------------ +[ 0.000000] kernel BUG at arch/riscv/mm/physaddr.c:33! +[ 0.000000] Kernel BUG [#1] +[ 0.000000] Modules linked in: +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.8.0-rc4-00015-ged0b226fed02 #886 +[ 0.000000] epc: ffffffe0002058d2 ra : ffffffe0000053f0 sp : ffffffe001001f40 +[ 0.000000] gp : ffffffe00106e250 tp : ffffffe001009d40 t0 : ffffffe00107ee28 +[ 0.000000] t1 : 0000000000000000 t2 : ffffffe000a2e880 s0 : ffffffe001001f50 +[ 0.000000] s1 : ffffffe0001383e8 a0 : ffffffe00c087e00 a1 : 0000000080200000 +[ 0.000000] a2 : 00000000010bf000 a3 : ffffffe00106f3c8 a4 : ffffffe0010bf000 +[ 0.000000] a5 : ffffffe000000000 a6 : 0000000000000006 a7 : 0000000000000001 +[ 0.000000] s2 : ffffffe00106f068 s3 : ffffffe00106f070 s4 : 0000000080200000 +[ 0.000000] s5 : 0000000082200000 s6 : 0000000000000000 s7 : 0000000000000000 +[ 0.000000] s8 : 0000000080011010 s9 : 0000000080012700 s10: 0000000000000000 +[ 0.000000] s11: 0000000000000000 t3 : 000000000001fe30 t4 : 000000000001fe30 +[ 0.000000] t5 : 0000000000000000 t6 : ffffffe00107c471 +[ 0.000000] status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003 +[ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x22/0x46 with crng_init=0 + +To avoid the error, initrd_start/end can be computed from phys_initrd_start/size +in setup itself. It also improves the initrd placement by aligning the start +and size with the page size. + +Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") +Signed-off-by: Atish Patra +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index fdc772f57edc3..81493cee0a167 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -94,19 +94,40 @@ void __init mem_init(void) + #ifdef CONFIG_BLK_DEV_INITRD + static void __init setup_initrd(void) + { ++ phys_addr_t start; + unsigned long size; + +- if (initrd_start >= initrd_end) { +- pr_info("initrd not found or empty"); ++ /* Ignore the virtul address computed during device tree parsing */ ++ initrd_start = initrd_end = 0; ++ ++ if (!phys_initrd_size) ++ return; ++ /* ++ * Round the memory region to page boundaries as per free_initrd_mem() ++ * This allows us to detect whether the pages overlapping the initrd ++ * are in use, but more importantly, reserves the entire set of pages ++ * as we don't want these pages allocated for other purposes. ++ */ ++ start = round_down(phys_initrd_start, PAGE_SIZE); ++ size = phys_initrd_size + (phys_initrd_start - start); ++ size = round_up(size, PAGE_SIZE); ++ ++ if (!memblock_is_region_memory(start, size)) { ++ pr_err("INITRD: 0x%08llx+0x%08lx is not a memory region", ++ (u64)start, size); + goto disable; + } +- if (__pa_symbol(initrd_end) > PFN_PHYS(max_low_pfn)) { +- pr_err("initrd extends beyond end of memory"); ++ ++ if (memblock_is_region_reserved(start, size)) { ++ pr_err("INITRD: 0x%08llx+0x%08lx overlaps in-use memory region\n", ++ (u64)start, size); + goto disable; + } + +- size = initrd_end - initrd_start; +- memblock_reserve(__pa_symbol(initrd_start), size); ++ memblock_reserve(start, size); ++ /* Now convert initrd to virtual addresses */ ++ initrd_start = (unsigned long)__va(phys_initrd_start); ++ initrd_end = initrd_start + phys_initrd_size; + initrd_below_start_ok = 1; + + pr_info("Initial ramdisk at: 0x%p (%lu bytes)\n", +-- +2.25.1 + diff --git a/queue-5.7/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch b/queue-5.7/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch new file mode 100644 index 00000000000..0e68939a4e7 --- /dev/null +++ b/queue-5.7/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch @@ -0,0 +1,45 @@ +From c343ecd030f8ce2a8d1f083768e45a899f1de9cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:57:26 -0700 +Subject: RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw + +From: Palmer Dabbelt + +[ Upstream commit 38b7c2a3ffb1fce8358ddc6006cfe5c038ff9963 ] + +While digging through the recent mmiowb preemption issue it came up that +we aren't actually preventing IO from crossing a scheduling boundary. +While it's a bit ugly to overload smp_mb__after_spinlock() with this +behavior, it's what PowerPC is doing so there's some precedent. + +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/barrier.h | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h +index 3f1737f301ccb..d0e24aaa2aa06 100644 +--- a/arch/riscv/include/asm/barrier.h ++++ b/arch/riscv/include/asm/barrier.h +@@ -58,8 +58,16 @@ do { \ + * The AQ/RL pair provides a RCpc critical section, but there's not really any + * way we can take advantage of that here because the ordering is only enforced + * on that one lock. Thus, we're just doing a full fence. ++ * ++ * Since we allow writeX to be called from preemptive regions we need at least ++ * an "o" in the predecessor set to ensure device writes are visible before the ++ * task is marked as available for scheduling on a new hart. While I don't see ++ * any concrete reason we need a full IO fence, it seems safer to just upgrade ++ * this in order to avoid any IO crossing a scheduling boundary. In both ++ * instances the scheduler pairs this with an mb(), so nothing is necessary on ++ * the new hart. + */ +-#define smp_mb__after_spinlock() RISCV_FENCE(rw,rw) ++#define smp_mb__after_spinlock() RISCV_FENCE(iorw,iorw) + + #include + +-- +2.25.1 + diff --git a/queue-5.7/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch b/queue-5.7/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch new file mode 100644 index 00000000000..bfbcfe12c7f --- /dev/null +++ b/queue-5.7/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch @@ -0,0 +1,49 @@ +From 117de6ba0c195b62e72f3c621750ffb8f9f29c21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 21:15:43 -0700 +Subject: scripts/decode_stacktrace: strip basepath from all paths + +From: Pi-Hsun Shih + +[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ] + +Currently the basepath is removed only from the beginning of the string. +When the symbol is inlined and there's multiple line outputs of +addr2line, only the first line would have basepath removed. + +Change to remove the basepath prefix from all lines. + +Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex") +Co-developed-by: Shik Chen +Signed-off-by: Pi-Hsun Shih +Signed-off-by: Shik Chen +Signed-off-by: Andrew Morton +Reviewed-by: Stephen Boyd +Cc: Sasha Levin +Cc: Nicolas Boichat +Cc: Jiri Slaby +Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 13e5fbafdf2f7..fe7076fdac8a3 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -84,8 +84,8 @@ parse_symbol() { + return + fi + +- # Strip out the base of the path +- code=${code#$basepath/} ++ # Strip out the base of the path on each line ++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") + + # In the case of inlines, move everything to same line + code=${code//$'\n'/' '} +-- +2.25.1 + diff --git a/queue-5.7/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch b/queue-5.7/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch new file mode 100644 index 00000000000..fdeec97f1f9 --- /dev/null +++ b/queue-5.7/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch @@ -0,0 +1,51 @@ +From 25494ada621678c7051e18f42d020757e9be373e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 21:15:52 -0700 +Subject: scripts/gdb: fix lx-symbols 'gdb.error' while loading modules + +From: Stefano Garzarella + +[ Upstream commit 7359608a271ce81803de148befefd309baf88c76 ] + +Commit ed66f991bb19 ("module: Refactor section attr into bin attribute") +removed the 'name' field from 'struct module_sect_attr' triggering the +following error when invoking lx-symbols: + + (gdb) lx-symbols + loading vmlinux + scanning for modules in linux/build + loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko + Python Exception There is no member named name.: + Error occurred in Python: There is no member named name. + +This patch fixes the issue taking the module name from the 'struct +attribute'. + +Fixes: ed66f991bb19 ("module: Refactor section attr into bin attribute") +Signed-off-by: Stefano Garzarella +Signed-off-by: Andrew Morton +Reviewed-by: Jan Kiszka +Reviewed-by: Kieran Bingham +Link: http://lkml.kernel.org/r/20200722102239.313231-1-sgarzare@redhat.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/symbols.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index be984aa29b759..1be9763cf8bb2 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -96,7 +96,7 @@ lx-symbols command.""" + return "" + attrs = sect_attrs['attrs'] + section_name_to_address = { +- attrs[n]['name'].string(): attrs[n]['address'] ++ attrs[n]['battr']['attr']['name'].string(): attrs[n]['address'] + for n in range(int(sect_attrs['nsections']))} + args = [] + for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", +-- +2.25.1 + diff --git a/queue-5.7/serial-exar-fix-gpio-configuration-for-sealevel-card.patch b/queue-5.7/serial-exar-fix-gpio-configuration-for-sealevel-card.patch new file mode 100644 index 00000000000..1dff2014cce --- /dev/null +++ b/queue-5.7/serial-exar-fix-gpio-configuration-for-sealevel-card.patch @@ -0,0 +1,58 @@ +From 8bd58101d61fe0348682ba7c80210387147872a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 16:11:24 -0400 +Subject: serial: exar: Fix GPIO configuration for Sealevel cards based on + XR17V35X + +From: Matthew Howell + +[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ] + +Sealevel XR17V35X based devices are inoperable on kernel versions +4.11 and above due to a change in the GPIO preconfiguration introduced in +commit +7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel +cards to the value (0x00) used prior to commit 7dea8165f1d + +With GPIOs preconfigured as per commit 7dea8165f1d all ports on +Sealevel XR17V35X based devices become stuck in high impedance +mode, regardless of dip-switch or software configuration. This +causes the device to become effectively unusable. This patch (in +various forms) has been distributed to our customers and no issues +related to it have been reported. + +Fixes: 7dea8165f1d6 ("serial: exar: Preconfigure xr17v35x MPIOs as output") +Signed-off-by: Matthew Howell +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 59449b6500cd6..9b5da1d43332f 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -326,7 +326,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p) + * devices will export them as GPIOs, so we pre-configure them safely + * as inputs. + */ +- u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00; ++ ++ u8 dir = 0x00; ++ ++ if ((pcidev->vendor == PCI_VENDOR_ID_EXAR) && ++ (pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) { ++ // Configure GPIO as inputs for Commtech adapters ++ dir = 0xff; ++ } else { ++ // Configure GPIO as outputs for SeaLevel adapters ++ dir = 0x00; ++ } + + writeb(0x00, p + UART_EXAR_MPIOINT_7_0); + writeb(0x00, p + UART_EXAR_MPIOLVL_7_0); +-- +2.25.1 + diff --git a/queue-5.7/series b/queue-5.7/series index 5330d63bece..4774ec212a4 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -38,3 +38,101 @@ s390-cpum_cf-perf-change-dflt_ccerror-counter-name.patch btrfs-fix-double-free-on-ulist-after-backref-resolution-failure.patch btrfs-fix-mount-failure-caused-by-race-with-umount.patch btrfs-fix-page-leaks-after-failure-to-lock-page-for-delalloc.patch +mt76-mt76x02-fix-handling-mcu-timeouts-during-hw-res.patch +efi-efivars-expose-rt-service-availability-via-efiva.patch +bnxt_en-fix-race-when-modifying-pause-settings.patch +bnxt_en-init-ethtool-link-settings-after-reading-upd.patch +bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch +fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch +fpga-dfl-fix-bug-in-port-reset-handshake.patch +hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch +netfilter-nf_tables-fix-nat-hook-table-deletion.patch +dpaa2-eth-check-fsl_mc_get_endpoint-for-is_err_or_nu.patch +vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch +ax88172a-fix-ax88172a_unbind-failures.patch +rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch +rdma-core-fix-race-in-rdma_alloc_commit_uobject.patch +rdma-cm-protect-access-to-remote_sidr_table.patch +net-fec-fix-hardware-time-stamping-by-external-devic.patch +asoc-intel-bytcht_es8316-add-missed-put_device.patch +net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch +ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch +drm-sun4i-hdmi-fix-inverted-hpd-result.patch +net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch +mlxsw-core-fix-wrong-sfp-eeprom-reading-for-upper-pa.patch +net-dsa-mv88e6xxx-fix-in-band-an-link-establishment.patch +arm64-dts-clearfog-gt-8k-fix-switch-link-configurati.patch +bonding-check-error-value-of-register_netdevice-imme.patch +iwlwifi-make-some-killer-wireless-ac-1550-cards-work.patch +net-bcmgenet-fix-error-returns-in-bcmgenet_probe.patch +dpaa_eth-fix-one-possible-memleak-in-dpaa_eth_probe.patch +mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch +ionic-use-offset-for-ethtool-regs-data.patch +ionic-fix-up-filter-locks-and-debug-msgs.patch +ionic-update-filter-id-after-replay.patch +ionic-keep-rss-hash-after-fw-update.patch +ionic-use-mutex-to-protect-queue-operations.patch +crypto-chtls-fix-tls-alert-messages-corrupted-by-tls.patch +net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch +rdma-mlx5-prevent-prefetch-from-racing-with-implicit.patch +net-hns3-fix-for-not-calculating-tx-bd-send-size-cor.patch +net-hns3-fix-error-handling-for-desc-filling.patch +net-hns3-fix-return-value-error-when-query-mac-link-.patch +net-dsa-microchip-call-phy_remove_link_mode-during-p.patch +netdevsim-fix-unbalaced-locking-in-nsim_create.patch +qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch +qed-suppress-false-positives-interrupt-error-message.patch +ipvs-fix-the-connection-sync-failed-in-some-cases.patch +net-ethernet-ave-fix-error-returns-in-ave_init.patch +iommu-qcom-use-domain-rather-than-dev-as-tlb-cookie.patch +revert-pci-pm-assume-ports-without-dll-link-active-t.patch +nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch +enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch +i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch +i2c-i2c-qcom-geni-fix-dma-transfer-race.patch +bonding-check-return-value-of-register_netdevice-in-.patch +geneve-fix-an-uninitialized-value-in-geneve_changeli.patch +serial-exar-fix-gpio-configuration-for-sealevel-card.patch +scripts-decode_stacktrace-strip-basepath-from-all-pa.patch +scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch +risc-v-do-not-rely-on-initrd_start-end-computed-duri.patch +kbuild-fix-single-target-builds-for-external-modules.patch +hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch +hid-alps-support-devices-with-report-id-2.patch +dmaengine-ti-k3-udma-fix-cleanup-code-for-alloc_chan.patch +dmaengine-ti-k3-udma-fix-the-running-channel-handlin.patch +hid-steam-fixes-race-in-handling-device-list.patch +dmaengine-ti-k3-udma-add-missing-put_device-call-in-.patch +dmaengine-idxd-fix-hw-descriptor-fields-for-delta-re.patch +hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch +dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch +soc-amlogic-meson-gx-socinfo-fix-s905x3-and-s905d3-i.patch +input-add-sw_machine_cover.patch +arm-dts-n900-remove-mmc1-card-detect-gpio.patch +spi-mediatek-use-correct-spi_cfg2_reg-macro.patch +regmap-dev_get_regmap_match-fix-string-comparison.patch +hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch +dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch +dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch +input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch +input-elan_i2c-only-increment-wakeup-count-on-touch.patch +usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch +usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch +usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch +usb-cdns3-ep0-fix-some-endian-issues.patch +usb-cdns3-trace-fix-some-endian-issues.patch +hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch +drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch +drm-amdgpu-fix-preemption-unit-test.patch +hwmon-nct6775-accept-peci-calibration-as-temperature.patch +platform-x86-isst-add-new-pci-device-ids.patch +platform-x86-asus-wmi-allow-bat1-battery-name.patch +hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch +alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch +drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch +arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch +x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch +asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch +drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch +risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch +x86-boot-don-t-add-the-efi-stub-to-targets.patch diff --git a/queue-5.7/soc-amlogic-meson-gx-socinfo-fix-s905x3-and-s905d3-i.patch b/queue-5.7/soc-amlogic-meson-gx-socinfo-fix-s905x3-and-s905d3-i.patch new file mode 100644 index 00000000000..1224739519e --- /dev/null +++ b/queue-5.7/soc-amlogic-meson-gx-socinfo-fix-s905x3-and-s905d3-i.patch @@ -0,0 +1,53 @@ +From b7e7dda8a5f672216290fd561e77d214459a6f39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 08:13:18 +0000 +Subject: soc: amlogic: meson-gx-socinfo: Fix S905X3 and S905D3 ID's + +From: Christian Hewitt + +[ Upstream commit d16d0481e6bab5a916450e4ef0e1c958b550880c ] + +Correct the SoC revision and package bits/mask values for S905D3/X3 to detect +a wider range of observed SoC IDs, and tweak sort order for A311D/S922X. + +S905X3 05 0000 0101 (SEI610 initial devices) +S905X3 10 0001 0000 (ODROID-C4 and recent Android boxes) +S905X3 50 0101 0000 (SEI610 later revisions) +S905D3 04 0000 0100 (VIM3L devices in kernelci) +S905D3 b0 1011 0000 (VIM3L initial production) + +Fixes commit c9cc9bec36d0 ("soc: amlogic: meson-gx-socinfo: Add SM1 and S905X3 IDs") + +Suggested-by: Neil Armstrong +Signed-off-by: Christian Hewitt +Signed-off-by: Kevin Hilman +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20200609081318.28023-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/soc/amlogic/meson-gx-socinfo.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c +index 01fc0d20a70db..6f54bd832c8b8 100644 +--- a/drivers/soc/amlogic/meson-gx-socinfo.c ++++ b/drivers/soc/amlogic/meson-gx-socinfo.c +@@ -66,10 +66,12 @@ static const struct meson_gx_package_id { + { "A113D", 0x25, 0x22, 0xff }, + { "S905D2", 0x28, 0x10, 0xf0 }, + { "S905X2", 0x28, 0x40, 0xf0 }, +- { "S922X", 0x29, 0x40, 0xf0 }, + { "A311D", 0x29, 0x10, 0xf0 }, +- { "S905X3", 0x2b, 0x5, 0xf }, +- { "S905D3", 0x2b, 0xb0, 0xf0 }, ++ { "S922X", 0x29, 0x40, 0xf0 }, ++ { "S905D3", 0x2b, 0x4, 0xf5 }, ++ { "S905X3", 0x2b, 0x5, 0xf5 }, ++ { "S905X3", 0x2b, 0x10, 0x3f }, ++ { "S905D3", 0x2b, 0x30, 0x3f }, + { "A113L", 0x2c, 0x0, 0xf8 }, + }; + +-- +2.25.1 + diff --git a/queue-5.7/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch b/queue-5.7/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch new file mode 100644 index 00000000000..2f358347c7c --- /dev/null +++ b/queue-5.7/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch @@ -0,0 +1,76 @@ +From 5c0c05a55adf8f3d67e546f9d37320fecc8994e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 17:00:20 +0800 +Subject: spi: mediatek: use correct SPI_CFG2_REG MACRO + +From: leilk.liu + +[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ] + +this patch use correct SPI_CFG2_REG offset. + +Signed-off-by: leilk.liu +Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk.liu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt65xx.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index 6783e12c40c22..a556795caeef4 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -36,7 +36,6 @@ + #define SPI_CFG0_SCK_LOW_OFFSET 8 + #define SPI_CFG0_CS_HOLD_OFFSET 16 + #define SPI_CFG0_CS_SETUP_OFFSET 24 +-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16 + #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0 + #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16 + +@@ -48,6 +47,8 @@ + #define SPI_CFG1_CS_IDLE_MASK 0xff + #define SPI_CFG1_PACKET_LOOP_MASK 0xff00 + #define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000 ++#define SPI_CFG2_SCK_HIGH_OFFSET 0 ++#define SPI_CFG2_SCK_LOW_OFFSET 16 + + #define SPI_CMD_ACT BIT(0) + #define SPI_CMD_RESUME BIT(1) +@@ -283,7 +284,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable) + static void mtk_spi_prepare_transfer(struct spi_master *master, + struct spi_transfer *xfer) + { +- u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0; ++ u32 spi_clk_hz, div, sck_time, cs_time, reg_val; + struct mtk_spi *mdata = spi_master_get_devdata(master); + + spi_clk_hz = clk_get_rate(mdata->spi_clk); +@@ -296,18 +297,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master, + cs_time = sck_time * 2; + + if (mdata->dev_comp->enhance_timing) { ++ reg_val = (((sck_time - 1) & 0xffff) ++ << SPI_CFG2_SCK_HIGH_OFFSET); + reg_val |= (((sck_time - 1) & 0xffff) +- << SPI_CFG0_SCK_HIGH_OFFSET); +- reg_val |= (((sck_time - 1) & 0xffff) +- << SPI_ADJUST_CFG0_SCK_LOW_OFFSET); ++ << SPI_CFG2_SCK_LOW_OFFSET); + writel(reg_val, mdata->base + SPI_CFG2_REG); +- reg_val |= (((cs_time - 1) & 0xffff) ++ reg_val = (((cs_time - 1) & 0xffff) + << SPI_ADJUST_CFG0_CS_HOLD_OFFSET); + reg_val |= (((cs_time - 1) & 0xffff) + << SPI_ADJUST_CFG0_CS_SETUP_OFFSET); + writel(reg_val, mdata->base + SPI_CFG0_REG); + } else { +- reg_val |= (((sck_time - 1) & 0xff) ++ reg_val = (((sck_time - 1) & 0xff) + << SPI_CFG0_SCK_HIGH_OFFSET); + reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET); + reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET); +-- +2.25.1 + diff --git a/queue-5.7/usb-cdns3-ep0-fix-some-endian-issues.patch b/queue-5.7/usb-cdns3-ep0-fix-some-endian-issues.patch new file mode 100644 index 00000000000..c667ccfc1f1 --- /dev/null +++ b/queue-5.7/usb-cdns3-ep0-fix-some-endian-issues.patch @@ -0,0 +1,99 @@ +From 55f2fd5843e1bf1834b2ddaec90d9185c80ed05b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jun 2020 14:53:54 +0800 +Subject: usb: cdns3: ep0: fix some endian issues + +From: Peter Chen + +[ Upstream commit 9f81d45c79271def8a9b90447b04b9c6323291f9 ] + +It is found by sparse. + +Reported-by: kbuild test robot +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/ep0.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/usb/cdns3/ep0.c b/drivers/usb/cdns3/ep0.c +index da4c5eb03d7ee..666cebd9c5f29 100644 +--- a/drivers/usb/cdns3/ep0.c ++++ b/drivers/usb/cdns3/ep0.c +@@ -37,18 +37,18 @@ static void cdns3_ep0_run_transfer(struct cdns3_device *priv_dev, + struct cdns3_usb_regs __iomem *regs = priv_dev->regs; + struct cdns3_endpoint *priv_ep = priv_dev->eps[0]; + +- priv_ep->trb_pool[0].buffer = TRB_BUFFER(dma_addr); +- priv_ep->trb_pool[0].length = TRB_LEN(length); ++ priv_ep->trb_pool[0].buffer = cpu_to_le32(TRB_BUFFER(dma_addr)); ++ priv_ep->trb_pool[0].length = cpu_to_le32(TRB_LEN(length)); + + if (zlp) { +- priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_TYPE(TRB_NORMAL); +- priv_ep->trb_pool[1].buffer = TRB_BUFFER(dma_addr); +- priv_ep->trb_pool[1].length = TRB_LEN(0); +- priv_ep->trb_pool[1].control = TRB_CYCLE | TRB_IOC | +- TRB_TYPE(TRB_NORMAL); ++ priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_TYPE(TRB_NORMAL)); ++ priv_ep->trb_pool[1].buffer = cpu_to_le32(TRB_BUFFER(dma_addr)); ++ priv_ep->trb_pool[1].length = cpu_to_le32(TRB_LEN(0)); ++ priv_ep->trb_pool[1].control = cpu_to_le32(TRB_CYCLE | TRB_IOC | ++ TRB_TYPE(TRB_NORMAL)); + } else { +- priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_IOC | +- TRB_TYPE(TRB_NORMAL); ++ priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_IOC | ++ TRB_TYPE(TRB_NORMAL)); + priv_ep->trb_pool[1].control = 0; + } + +@@ -264,11 +264,11 @@ static int cdns3_req_ep0_get_status(struct cdns3_device *priv_dev, + case USB_RECIP_INTERFACE: + return cdns3_ep0_delegate_req(priv_dev, ctrl); + case USB_RECIP_ENDPOINT: +- index = cdns3_ep_addr_to_index(ctrl->wIndex); ++ index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex)); + priv_ep = priv_dev->eps[index]; + + /* check if endpoint is stalled or stall is pending */ +- cdns3_select_ep(priv_dev, ctrl->wIndex); ++ cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex)); + if (EP_STS_STALL(readl(&priv_dev->regs->ep_sts)) || + (priv_ep->flags & EP_STALL_PENDING)) + usb_status = BIT(USB_ENDPOINT_HALT); +@@ -388,10 +388,10 @@ static int cdns3_ep0_feature_handle_endpoint(struct cdns3_device *priv_dev, + if (!(ctrl->wIndex & ~USB_DIR_IN)) + return 0; + +- index = cdns3_ep_addr_to_index(ctrl->wIndex); ++ index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex)); + priv_ep = priv_dev->eps[index]; + +- cdns3_select_ep(priv_dev, ctrl->wIndex); ++ cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex)); + + if (set) + __cdns3_gadget_ep_set_halt(priv_ep); +@@ -452,7 +452,7 @@ static int cdns3_req_ep0_set_sel(struct cdns3_device *priv_dev, + if (priv_dev->gadget.state < USB_STATE_ADDRESS) + return -EINVAL; + +- if (ctrl_req->wLength != 6) { ++ if (le16_to_cpu(ctrl_req->wLength) != 6) { + dev_err(priv_dev->dev, "Set SEL should be 6 bytes, got %d\n", + ctrl_req->wLength); + return -EINVAL; +@@ -476,7 +476,7 @@ static int cdns3_req_ep0_set_isoch_delay(struct cdns3_device *priv_dev, + if (ctrl_req->wIndex || ctrl_req->wLength) + return -EINVAL; + +- priv_dev->isoch_delay = ctrl_req->wValue; ++ priv_dev->isoch_delay = le16_to_cpu(ctrl_req->wValue); + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.7/usb-cdns3-trace-fix-some-endian-issues.patch b/queue-5.7/usb-cdns3-trace-fix-some-endian-issues.patch new file mode 100644 index 00000000000..16aec123995 --- /dev/null +++ b/queue-5.7/usb-cdns3-trace-fix-some-endian-issues.patch @@ -0,0 +1,39 @@ +From 43b9aa92a50104d4f0d4db6a47d447cfc444ee0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jun 2020 14:53:55 +0800 +Subject: usb: cdns3: trace: fix some endian issues + +From: Peter Chen + +[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ] + +It is found by sparse. + +Reported-by: kbuild test robot +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/cdns3/trace.h b/drivers/usb/cdns3/trace.h +index 755c565822575..0a2a3269bfac6 100644 +--- a/drivers/usb/cdns3/trace.h ++++ b/drivers/usb/cdns3/trace.h +@@ -404,9 +404,9 @@ DECLARE_EVENT_CLASS(cdns3_log_trb, + TP_fast_assign( + __assign_str(name, priv_ep->name); + __entry->trb = trb; +- __entry->buffer = trb->buffer; +- __entry->length = trb->length; +- __entry->control = trb->control; ++ __entry->buffer = le32_to_cpu(trb->buffer); ++ __entry->length = le32_to_cpu(trb->length); ++ __entry->control = le32_to_cpu(trb->control); + __entry->type = usb_endpoint_type(priv_ep->endpoint.desc); + __entry->last_stream_id = priv_ep->last_stream_id; + ), +-- +2.25.1 + diff --git a/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch b/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch new file mode 100644 index 00000000000..aafe1e83ba9 --- /dev/null +++ b/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch @@ -0,0 +1,44 @@ +From 85a80c751302bffbe7580a55526dd24b5e72704a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 15:24:59 +0300 +Subject: usb: dwc3: pci: add support for the Intel Jasper Lake + +From: Heikki Krogerus + +[ Upstream commit e25d1e8532c3d84f075deca1580a7d61e0f43ce6 ] + +This patch adds the necessary PCI ID for Intel Jasper Lake +devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 47b7e83d90626..139474c3e77b1 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -39,6 +39,7 @@ + #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee ++#define PCI_DEVICE_ID_INTEL_JSP 0x4dee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -362,6 +363,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.25.1 + diff --git a/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch b/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch new file mode 100644 index 00000000000..33e1c7bdc54 --- /dev/null +++ b/queue-5.7/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch @@ -0,0 +1,43 @@ +From 3b80114eb8174b2da92a675ac19d9b4557ab30f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 10:34:32 +0300 +Subject: usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant + +From: Heikki Krogerus + +[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ] + +This patch adds the necessary PCI ID for TGP-H devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 96c05b121fac8..47b7e83d90626 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -38,6 +38,7 @@ + #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee + #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee ++#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -358,6 +359,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.25.1 + diff --git a/queue-5.7/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch b/queue-5.7/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch new file mode 100644 index 00000000000..b58a6d857a8 --- /dev/null +++ b/queue-5.7/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch @@ -0,0 +1,45 @@ +From 067f9316291acfe210867cef3afaba7de2e79c0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 16:17:47 +0300 +Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in + gr_ep_init() + +From: Evgeny Novikov + +[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ] + +gr_ep_init() does not assign the allocated request anywhere if allocation +of memory for the buffer fails. This is a memory leak fixed by the given +patch. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c +index aaf975c809bf9..ecf874dee9962 100644 +--- a/drivers/usb/gadget/udc/gr_udc.c ++++ b/drivers/usb/gadget/udc/gr_udc.c +@@ -1981,9 +1981,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) + + if (num == 0) { + _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); ++ if (!_req) ++ return -ENOMEM; ++ + buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); +- if (!_req || !buf) { +- /* possible _req freed by gr_probe via gr_remove */ ++ if (!buf) { ++ gr_free_request(&ep->ep, _req); + return -ENOMEM; + } + +-- +2.25.1 + diff --git a/queue-5.7/vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch b/queue-5.7/vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch new file mode 100644 index 00000000000..95e046f4b6a --- /dev/null +++ b/queue-5.7/vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch @@ -0,0 +1,61 @@ +From 03adcc0d21f0f8e83150fb8b57b7861bbb5d324d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 14:12:43 +0200 +Subject: vsock/virtio: annotate 'the_virtio_vsock' RCU pointer + +From: Stefano Garzarella + +[ Upstream commit f961134a612c793d5901a93d85a29337c74af978 ] + +Commit 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free +on the_virtio_vsock") starts to use RCU to protect 'the_virtio_vsock' +pointer, but we forgot to annotate it. + +This patch adds the annotation to fix the following sparse errors: + + net/vmw_vsock/virtio_transport.c:73:17: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock * + net/vmw_vsock/virtio_transport.c:171:17: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock * + net/vmw_vsock/virtio_transport.c:207:17: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock * + net/vmw_vsock/virtio_transport.c:561:13: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock * + net/vmw_vsock/virtio_transport.c:612:9: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock * + net/vmw_vsock/virtio_transport.c:631:9: error: incompatible types in comparison expression (different address spaces): + net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock [noderef] __rcu * + net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock * + +Fixes: 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock") +Reported-by: Michael S. Tsirkin +Signed-off-by: Stefano Garzarella +Reviewed-by: Stefan Hajnoczi +Acked-by: Michael S. Tsirkin +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/virtio_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c +index dfbaf6bd8b1c7..2700a63ab095e 100644 +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -22,7 +22,7 @@ + #include + + static struct workqueue_struct *virtio_vsock_workqueue; +-static struct virtio_vsock *the_virtio_vsock; ++static struct virtio_vsock __rcu *the_virtio_vsock; + static DEFINE_MUTEX(the_virtio_vsock_mutex); /* protects the_virtio_vsock */ + + struct virtio_vsock { +-- +2.25.1 + diff --git a/queue-5.7/x86-boot-don-t-add-the-efi-stub-to-targets.patch b/queue-5.7/x86-boot-don-t-add-the-efi-stub-to-targets.patch new file mode 100644 index 00000000000..c023baf822e --- /dev/null +++ b/queue-5.7/x86-boot-don-t-add-the-efi-stub-to-targets.patch @@ -0,0 +1,60 @@ +From 8dce07b4b4a214f6f238ac9eb2424040df8f1bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 23:26:31 -0400 +Subject: x86/boot: Don't add the EFI stub to targets + +From: Arvind Sankar + +[ Upstream commit da05b143a308bd6a7a444401f9732678ae63fc70 ] + +vmlinux-objs-y is added to targets, which currently means that the EFI +stub gets added to the targets as well. It shouldn't be added since it +is built elsewhere. + +This confuses Makefile.build which interprets the EFI stub as a target + $(obj)/$(objtree)/drivers/firmware/efi/libstub/lib.a +and will create drivers/firmware/efi/libstub/ underneath +arch/x86/boot/compressed, to hold this supposed target, if building +out-of-tree. [0] + +Fix this by pulling the stub out of vmlinux-objs-y into efi-obj-y. + +[0] See scripts/Makefile.build near the end: + # Create directories for object files if they do not exist + +Signed-off-by: Arvind Sankar +Signed-off-by: Thomas Gleixner +Reviewed-by: Masahiro Yamada +Acked-by: Ard Biesheuvel +Link: https://lkml.kernel.org/r/20200715032631.1562882-1-nivedita@alum.mit.edu +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index 5f7c262bcc99a..20aac99683156 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -88,8 +88,8 @@ endif + + vmlinux-objs-$(CONFIG_ACPI) += $(obj)/acpi.o + +-vmlinux-objs-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a + vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o ++efi-obj-$(CONFIG_EFI_STUB) = $(objtree)/drivers/firmware/efi/libstub/lib.a + + # The compressed kernel is built with -fPIC/-fPIE so that a boot loader + # can place it anywhere in memory and it will still run. However, since +@@ -113,7 +113,7 @@ endef + quiet_cmd_check-and-link-vmlinux = LD $@ + cmd_check-and-link-vmlinux = $(cmd_check_data_rel); $(cmd_ld) + +-$(obj)/vmlinux: $(vmlinux-objs-y) FORCE ++$(obj)/vmlinux: $(vmlinux-objs-y) $(efi-obj-y) FORCE + $(call if_changed,check-and-link-vmlinux) + + OBJCOPYFLAGS_vmlinux.bin := -R .comment -S +-- +2.25.1 + diff --git a/queue-5.7/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch b/queue-5.7/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch new file mode 100644 index 00000000000..2649a20b650 --- /dev/null +++ b/queue-5.7/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch @@ -0,0 +1,43 @@ +From 02e6bbc4154e117f934891599521d8e6e33fb19d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 15:53:46 +0200 +Subject: x86: math-emu: Fix up 'cmp' insn for clang ias + +From: Arnd Bergmann + +[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ] + +The clang integrated assembler requires the 'cmp' instruction to +have a length prefix here: + +arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl') + cmp $0xffffffff,-24(%ebp) + ^ + +Make this a 32-bit comparison, which it was clearly meant to be. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Gleixner +Reviewed-by: Nick Desaulniers +Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de +Signed-off-by: Sasha Levin +--- + arch/x86/math-emu/wm_sqrt.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S +index 3b2b58164ec18..40526dd85137b 100644 +--- a/arch/x86/math-emu/wm_sqrt.S ++++ b/arch/x86/math-emu/wm_sqrt.S +@@ -209,7 +209,7 @@ sqrt_stage_2_finish: + + #ifdef PARANOID + /* It should be possible to get here only if the arg is ffff....ffff */ +- cmp $0xffffffff,FPU_fsqrt_arg_1 ++ cmpl $0xffffffff,FPU_fsqrt_arg_1 + jnz sqrt_stage_2_error + #endif /* PARANOID */ + +-- +2.25.1 + -- 2.47.3