From a99dd305eed77e4ed34faae9e5483ce40144503a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Dec 2020 09:54:23 +0100 Subject: [PATCH] 5.10-stable patches added patches: acpi-nfit-fix-input-validation-of-bus-family.patch acpi-pnp-compare-the-string-length-in-the-matching_id.patch alsa-core-memalloc-add-page-alignment-for-iram.patch alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch alsa-hda-ca0132-change-input-source-enum-strings.patch alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch alsa-hda-realtek-add-quirk-for-msi-gp73.patch alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch alsa-hda-realtek-supported-dell-fixed-type-headset.patch alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch binder-add-flag-to-clear-buffer-on-txn-complete.patch cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch documentation-seqlock-s-locktype-lockname-g.patch dyndbg-fix-use-before-null-check.patch edac-amd64-fix-pci-component-registration.patch edac-i10nm-use-readl-to-access-mmio-registers.patch input-cyapa_gen6-fix-out-of-bounds-stack-access.patch m68k-fix-warning-splat-in-pmac_zilog-driver.patch media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch media-ipu3-cio2-remove-traces-of-returned-buffers.patch media-ipu3-cio2-return-actual-subdev-format.patch media-ipu3-cio2-serialise-access-to-pad-format.patch media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch s390-dasd-fix-hanging-device-offline-processing.patch s390-dasd-fix-list-corruption-of-lcu-list.patch s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch s390-dasd-prevent-inconsistent-lcu-device-data.patch s390-idle-add-missing-mt_cycles-calculation.patch s390-idle-fix-accounting-with-machine-checks.patch s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch usb-serial-keyspan_pda-fix-stalled-writes.patch usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch usb-serial-keyspan_pda-fix-write-deadlock.patch usb-serial-keyspan_pda-fix-write-unthrottling.patch usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch usb-serial-mos7720-fix-parallel-port-state-restore.patch z3fold-simplify-freeing-slots.patch z3fold-stricter-locking-and-more-careful-reclaim.patch --- ...t-fix-input-validation-of-bus-family.patch | 52 +++ ...the-string-length-in-the-matching_id.patch | 48 +++ ...memalloc-add-page-alignment-for-iram.patch | 35 ++ ...he-acer-veriton-n4640g-n6640g-n2510g.patch | 45 +++ ...132-change-input-source-enum-strings.patch | 35 ++ ...a0132-fix-ae-5-rear-headphone-pincfg.patch | 37 ++ ...ressions-on-clear-and-reconfig-sysfs.patch | 54 +++ ...a-hda-realtek-add-quirk-for-msi-gp73.patch | 32 ++ ...or-more-lenovo-alc285-headset-button.patch | 34 ++ ...ltek-apply-jack-fixup-for-quanta-nl3.patch | 40 ++ ...dset-mic-of-asus-q524uqk-with-alc255.patch | 33 ++ ...adset-mic-of-asus-x430un-with-alc256.patch | 33 ++ ...k-volume-adjustable-on-a-yoga-laptop.patch | 62 ++++ ...lineout-on-acer-travelmate-p648-p658.patch | 79 ++++ ...ek-supported-dell-fixed-type-headset.patch | 32 ++ ...a-pcm-oss-fix-a-few-more-ubsan-fixes.patch | 66 ++++ ...ias-entry-for-asus-prime-trx40-pro-s.patch | 35 ++ ...ive-dsd-reproduction-on-fiio-devices.patch | 33 ++ ...-check-if-firmware-doesn-t-give-back.patch | 37 ++ ...enoir-fix-the-pci-probe-pci-revision.patch | 53 +++ ...-avoid-the-acp-mic-probe-broken-bios.patch | 99 +++++ ...ions-of-playback-and-capture-streams.patch | 49 +++ ...flag-to-clear-buffer-on-txn-complete.patch | 146 ++++++++ ...recent-guaranteed-performance-values.patch | 99 +++++ ...n-hotplug-work-and-later-cpu-offline.patch | 126 +++++++ ...-around-cortex-a57-a72-silion-errata.patch | 80 ++++ ...naligned-accesses-in-ecdh_set_secret.patch | 47 +++ ...tation-seqlock-s-locktype-lockname-g.patch | 74 ++++ .../dyndbg-fix-use-before-null-check.patch | 43 +++ ...amd64-fix-pci-component-registration.patch | 114 ++++++ ...m-use-readl-to-access-mmio-registers.patch | 61 +++ ..._gen6-fix-out-of-bounds-stack-access.patch | 44 +++ ...x-warning-splat-in-pmac_zilog-driver.patch | 137 +++++++ ...eld-on-subdev-format-v4l2_field_none.patch | 35 ++ ...o2-remove-traces-of-returned-buffers.patch | 35 ++ ...pu3-cio2-return-actual-subdev-format.patch | 62 ++++ ...-cio2-serialise-access-to-pad-format.patch | 95 +++++ ...mbus-format-in-setting-subdev-format.patch | 74 ++++ ...-leak-spi-master-in-probe-error-path.patch | 69 ++++ ...-ir-is-handled-when-it-is-continuous.patch | 42 +++ ...nt-for-cycle_activity.stalls_mem_any.patch | 41 +++ ...rtm_abort_event-encoding-on-ice-lake.patch | 39 ++ ...ix-the-return-type-of-get_lbr_cycles.patch | 39 ++ ...i-pci-drop-acpi_pm_set_bridge_wakeup.patch | 186 ++++++++++ ...-while-counting-events-in-user-space.patch | 46 +++ ...rminate-to-terminate-resources-walks.patch | 39 ++ ...ix-hanging-device-offline-processing.patch | 58 +++ ...dasd-fix-list-corruption-of-lcu-list.patch | 53 +++ ...st-corruption-of-pavgroup-group-list.patch | 55 +++ ...prevent-inconsistent-lcu-device-data.patch | 52 +++ ...le-add-missing-mt_cycles-calculation.patch | 87 +++++ ...e-fix-accounting-with-machine-checks.patch | 73 ++++ ...08-subcode-when-loading-crash-kernel.patch | 65 ++++ ...tial-cpu-reset-also-for-smt-siblings.patch | 55 +++ queue-5.10/series | 65 ++++ ...4-fix-ai-end-of-conversion-detection.patch | 50 +++ ...cceleport-fix-write-wakeup-deadlocks.patch | 156 ++++++++ ...da-fix-dropped-unthrottle-interrupts.patch | 45 +++ ...erial-keyspan_pda-fix-stalled-writes.patch | 35 ++ ...pda-fix-tx-unthrottle-use-after-free.patch | 41 +++ ...erial-keyspan_pda-fix-write-deadlock.patch | 52 +++ ...l-keyspan_pda-fix-write-unthrottling.patch | 104 ++++++ ..._pda-fix-write-wakeup-use-after-free.patch | 81 ++++ ...7720-fix-parallel-port-state-restore.patch | 34 ++ .../z3fold-simplify-freeing-slots.patch | 183 +++++++++ ...ter-locking-and-more-careful-reclaim.patch | 347 ++++++++++++++++++ 66 files changed, 4487 insertions(+) create mode 100644 queue-5.10/acpi-nfit-fix-input-validation-of-bus-family.patch create mode 100644 queue-5.10/acpi-pnp-compare-the-string-length-in-the-matching_id.patch create mode 100644 queue-5.10/alsa-core-memalloc-add-page-alignment-for-iram.patch create mode 100644 queue-5.10/alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch create mode 100644 queue-5.10/alsa-hda-ca0132-change-input-source-enum-strings.patch create mode 100644 queue-5.10/alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch create mode 100644 queue-5.10/alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch create mode 100644 queue-5.10/alsa-hda-realtek-add-quirk-for-msi-gp73.patch create mode 100644 queue-5.10/alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch create mode 100644 queue-5.10/alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch create mode 100644 queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch create mode 100644 queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch create mode 100644 queue-5.10/alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch create mode 100644 queue-5.10/alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch create mode 100644 queue-5.10/alsa-hda-realtek-supported-dell-fixed-type-headset.patch create mode 100644 queue-5.10/alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch create mode 100644 queue-5.10/alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch create mode 100644 queue-5.10/alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch create mode 100644 queue-5.10/alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch create mode 100644 queue-5.10/asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch create mode 100644 queue-5.10/asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch create mode 100644 queue-5.10/asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch create mode 100644 queue-5.10/binder-add-flag-to-clear-buffer-on-txn-complete.patch create mode 100644 queue-5.10/cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch create mode 100644 queue-5.10/cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch create mode 100644 queue-5.10/crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch create mode 100644 queue-5.10/crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch create mode 100644 queue-5.10/documentation-seqlock-s-locktype-lockname-g.patch create mode 100644 queue-5.10/dyndbg-fix-use-before-null-check.patch create mode 100644 queue-5.10/edac-amd64-fix-pci-component-registration.patch create mode 100644 queue-5.10/edac-i10nm-use-readl-to-access-mmio-registers.patch create mode 100644 queue-5.10/input-cyapa_gen6-fix-out-of-bounds-stack-access.patch create mode 100644 queue-5.10/m68k-fix-warning-splat-in-pmac_zilog-driver.patch create mode 100644 queue-5.10/media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch create mode 100644 queue-5.10/media-ipu3-cio2-remove-traces-of-returned-buffers.patch create mode 100644 queue-5.10/media-ipu3-cio2-return-actual-subdev-format.patch create mode 100644 queue-5.10/media-ipu3-cio2-serialise-access-to-pad-format.patch create mode 100644 queue-5.10/media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch create mode 100644 queue-5.10/media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch create mode 100644 queue-5.10/media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch create mode 100644 queue-5.10/perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch create mode 100644 queue-5.10/perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch create mode 100644 queue-5.10/perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch create mode 100644 queue-5.10/pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch create mode 100644 queue-5.10/powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch create mode 100644 queue-5.10/revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch create mode 100644 queue-5.10/s390-dasd-fix-hanging-device-offline-processing.patch create mode 100644 queue-5.10/s390-dasd-fix-list-corruption-of-lcu-list.patch create mode 100644 queue-5.10/s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch create mode 100644 queue-5.10/s390-dasd-prevent-inconsistent-lcu-device-data.patch create mode 100644 queue-5.10/s390-idle-add-missing-mt_cycles-calculation.patch create mode 100644 queue-5.10/s390-idle-fix-accounting-with-machine-checks.patch create mode 100644 queue-5.10/s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch create mode 100644 queue-5.10/s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch create mode 100644 queue-5.10/staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch create mode 100644 queue-5.10/usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-stalled-writes.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-write-deadlock.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-write-unthrottling.patch create mode 100644 queue-5.10/usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch create mode 100644 queue-5.10/usb-serial-mos7720-fix-parallel-port-state-restore.patch create mode 100644 queue-5.10/z3fold-simplify-freeing-slots.patch create mode 100644 queue-5.10/z3fold-stricter-locking-and-more-careful-reclaim.patch diff --git a/queue-5.10/acpi-nfit-fix-input-validation-of-bus-family.patch b/queue-5.10/acpi-nfit-fix-input-validation-of-bus-family.patch new file mode 100644 index 00000000000..d2e8d0b8c0e --- /dev/null +++ b/queue-5.10/acpi-nfit-fix-input-validation-of-bus-family.patch @@ -0,0 +1,52 @@ +From 9a7e3d7f056831a6193d6d737fb7a26dfdceb04b Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Mon, 23 Nov 2020 17:43:53 -0800 +Subject: ACPI: NFIT: Fix input validation of bus-family + +From: Dan Williams + +commit 9a7e3d7f056831a6193d6d737fb7a26dfdceb04b upstream. + +Dan reports that smatch thinks userspace can craft an out-of-bound bus +family number. However, nd_cmd_clear_to_send() blocks all non-zero +values of bus-family since only the kernel can initiate these commands. +However, in the speculation path, family is a user controlled array +index value so mask it for speculation safety. Also, since the +nd_cmd_clear_to_send() safety is non-obvious and possibly may change in +the future include input validation as if userspace could get past the +nd_cmd_clear_to_send() gatekeeper. + +Link: http://lore.kernel.org/r/20201111113000.GA1237157@mwanda +Reported-by: Dan Carpenter +Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands") +Cc: +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/nfit/core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -478,8 +479,11 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + cmd_mask = nd_desc->cmd_mask; + if (cmd == ND_CMD_CALL && call_pkg->nd_family) { + family = call_pkg->nd_family; +- if (!test_bit(family, &nd_desc->bus_family_mask)) ++ if (family > NVDIMM_BUS_FAMILY_MAX || ++ !test_bit(family, &nd_desc->bus_family_mask)) + return -EINVAL; ++ family = array_index_nospec(family, ++ NVDIMM_BUS_FAMILY_MAX + 1); + dsm_mask = acpi_desc->family_dsm_mask[family]; + guid = to_nfit_bus_uuid(family); + } else { diff --git a/queue-5.10/acpi-pnp-compare-the-string-length-in-the-matching_id.patch b/queue-5.10/acpi-pnp-compare-the-string-length-in-the-matching_id.patch new file mode 100644 index 00000000000..2b897cf5527 --- /dev/null +++ b/queue-5.10/acpi-pnp-compare-the-string-length-in-the-matching_id.patch @@ -0,0 +1,48 @@ +From b08221c40febcbda9309dd70c61cf1b0ebb0e351 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 11 Dec 2020 10:18:14 +0800 +Subject: ACPI: PNP: compare the string length in the matching_id() + +From: Hui Wang + +commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream. + +Recently we met a touchscreen problem on some Thinkpad machines, the +touchscreen driver (i2c-hid) is not loaded and the touchscreen can't +work. + +An i2c ACPI device with the name WACF2200 is defined in the BIOS, with +the current rule in matching_id(), this device will be regarded as +a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and +this PNP device is attached to the acpi device as the 1st +physical_node, this will make the i2c bus match fail when i2c bus +calls acpi_companion_match() to match the acpi_id_table in the i2c-hid +driver. + +WACF2200 is an i2c device instead of a PNP device, after adding the +string length comparing, the matching_id() will return false when +matching WACF2200 and WACFXXX, and it is reasonable to compare the +string length when matching two IDs. + +Suggested-by: Rafael J. Wysocki +Signed-off-by: Hui Wang +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_pnp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/acpi/acpi_pnp.c ++++ b/drivers/acpi/acpi_pnp.c +@@ -319,6 +319,9 @@ static bool matching_id(const char *idst + { + int i; + ++ if (strlen(idstr) != strlen(list_id)) ++ return false; ++ + if (memcmp(idstr, list_id, 3)) + return false; + diff --git a/queue-5.10/alsa-core-memalloc-add-page-alignment-for-iram.patch b/queue-5.10/alsa-core-memalloc-add-page-alignment-for-iram.patch new file mode 100644 index 00000000000..ddefc9255a0 --- /dev/null +++ b/queue-5.10/alsa-core-memalloc-add-page-alignment-for-iram.patch @@ -0,0 +1,35 @@ +From 74c64efa1557fef731b59eb813f115436d18078e Mon Sep 17 00:00:00 2001 +From: Robin Gong +Date: Fri, 18 Dec 2020 00:15:47 +0800 +Subject: ALSA: core: memalloc: add page alignment for iram + +From: Robin Gong + +commit 74c64efa1557fef731b59eb813f115436d18078e upstream. + +Since mmap for userspace is based on page alignment, add page alignment +for iram alloc from pool, otherwise, some good data located in the same +page of dmab->area maybe touched wrongly by userspace like pulseaudio. + +Signed-off-by: Robin Gong +Cc: +Link: https://lore.kernel.org/r/1608221747-3474-1-git-send-email-yibin.gong@nxp.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/memalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/memalloc.c ++++ b/sound/core/memalloc.c +@@ -77,7 +77,8 @@ static void snd_malloc_dev_iram(struct s + /* Assign the pool into private_data field */ + dmab->private_data = pool; + +- dmab->area = gen_pool_dma_alloc(pool, size, &dmab->addr); ++ dmab->area = gen_pool_dma_alloc_align(pool, size, &dmab->addr, ++ PAGE_SIZE); + } + + /** diff --git a/queue-5.10/alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch b/queue-5.10/alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch new file mode 100644 index 00000000000..7b29b7e702b --- /dev/null +++ b/queue-5.10/alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch @@ -0,0 +1,45 @@ +From 13be30f156fda725b168ac89fc91f78651575307 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Tue, 22 Dec 2020 23:04:59 +0800 +Subject: ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G + +From: Chris Chiu + +commit 13be30f156fda725b168ac89fc91f78651575307 upstream. + +This Acer Veriton N4640G/N6640G/N2510G desktops have 2 headphone +jacks(front and rear), and a separate Mic In jack. + +The rear headphone jack is actually a line out jack but always silent +while playing audio. The front 'Mic In' also fails the jack sensing. +Apply the ALC269_FIXUP_LIFEBOOK to have all audio jacks to work as +expected. + +Signed-off-by: Chris Chiu +Signed-off-by: Jian-Hong Pan +Cc: +Link: https://lore.kernel.org/r/20201222150459.9545-2-chiu@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7805,11 +7805,14 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), ++ SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", ALC269VC_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1166, "Acer Veriton N4640G", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x1025, 0x1167, "Acer Veriton N6640G", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), + SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE), diff --git a/queue-5.10/alsa-hda-ca0132-change-input-source-enum-strings.patch b/queue-5.10/alsa-hda-ca0132-change-input-source-enum-strings.patch new file mode 100644 index 00000000000..e813e58343d --- /dev/null +++ b/queue-5.10/alsa-hda-ca0132-change-input-source-enum-strings.patch @@ -0,0 +1,35 @@ +From 7079f785b50055a32b72eddcb7d9ba5688db24d0 Mon Sep 17 00:00:00 2001 +From: Connor McAdams +Date: Thu, 10 Dec 2020 12:35:49 -0500 +Subject: ALSA: hda/ca0132 - Change Input Source enum strings. + +From: Connor McAdams + +commit 7079f785b50055a32b72eddcb7d9ba5688db24d0 upstream. + +Change the Input Source enumerated control's strings to make it play +nice with pulseaudio. + +Fixes: 7cb9d94c05de9 ("ALSA: hda/ca0132: add alt_select_in/out for R3Di + SBZ") +Cc: +Signed-off-by: Connor McAdams +Link: https://lore.kernel.org/r/20201208195223.424753-2-conmanx360@gmail.com +Link: https://lore.kernel.org/r/20201210173550.2968-2-conmanx360@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_ca0132.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -95,7 +95,7 @@ enum { + }; + + /* Strings for Input Source Enum Control */ +-static const char *const in_src_str[3] = {"Rear Mic", "Line", "Front Mic" }; ++static const char *const in_src_str[3] = { "Microphone", "Line In", "Front Microphone" }; + #define IN_SRC_NUM_OF_INPUTS 3 + enum { + REAR_MIC, diff --git a/queue-5.10/alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch b/queue-5.10/alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch new file mode 100644 index 00000000000..8edb2704d3b --- /dev/null +++ b/queue-5.10/alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch @@ -0,0 +1,37 @@ +From c697ba85a94b8f65bf90dec5ef9af5c39c3e73b2 Mon Sep 17 00:00:00 2001 +From: Connor McAdams +Date: Thu, 10 Dec 2020 12:35:48 -0500 +Subject: ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg. + +From: Connor McAdams + +commit c697ba85a94b8f65bf90dec5ef9af5c39c3e73b2 upstream. + +The Windows driver sets the pincfg for the AE-5's rear-headphone to +report as a microphone. This causes issues with Pulseaudio mistakenly +believing there is no headphone plugged in. In Linux, we should instead +set it to be a headphone. + +Fixes: a6b0961b39896 ("ALSA: hda/ca0132 - fix AE-5 pincfg") +Cc: +Signed-off-by: Connor McAdams +Link: https://lore.kernel.org/r/20201208195223.424753-1-conmanx360@gmail.com +Link: https://lore.kernel.org/r/20201210173550.2968-1-conmanx360@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_ca0132.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1223,7 +1223,7 @@ static const struct hda_pintbl ae5_pincf + { 0x0e, 0x01c510f0 }, /* SPDIF In */ + { 0x0f, 0x01017114 }, /* Port A -- Rear L/R. */ + { 0x10, 0x01017012 }, /* Port D -- Center/LFE or FP Hp */ +- { 0x11, 0x01a170ff }, /* Port B -- LineMicIn2 / Rear Headphone */ ++ { 0x11, 0x012170ff }, /* Port B -- LineMicIn2 / Rear Headphone */ + { 0x12, 0x01a170f0 }, /* Port C -- LineIn1 */ + { 0x13, 0x908700f0 }, /* What U Hear In*/ + { 0x18, 0x50d000f0 }, /* N/A */ diff --git a/queue-5.10/alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch b/queue-5.10/alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch new file mode 100644 index 00000000000..b7b2de4e463 --- /dev/null +++ b/queue-5.10/alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch @@ -0,0 +1,54 @@ +From 2506318e382c4c7daa77bdc48f80a0ee82804588 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 9 Dec 2020 16:01:19 +0100 +Subject: ALSA: hda: Fix regressions on clear and reconfig sysfs + +From: Takashi Iwai + +commit 2506318e382c4c7daa77bdc48f80a0ee82804588 upstream. + +It seems that the HD-audio clear and reconfig sysfs don't work any +longer after the recent driver core change. There are multiple issues +around that: the linked list corruption and the dead device handling. +The former issue is fixed by another patch for the driver core itself, +while the latter patch needs to be addressed in HD-audio side. + +This patch corresponds to the latter, it recovers those broken +functions by replacing the device detach and attach actions with the +standard core API functions, which are almost equivalent with unbind +and bind actions. + +Fixes: 654888327e9f ("driver core: Avoid binding drivers to dead devices") +Cc: +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209207 +Link: https://lore.kernel.org/r/20201209150119.7705-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_codec.c | 2 +- + sound/pci/hda/hda_sysfs.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -1803,7 +1803,7 @@ int snd_hda_codec_reset(struct hda_codec + return -EBUSY; + + /* OK, let it free */ +- snd_hdac_device_unregister(&codec->core); ++ device_release_driver(hda_codec_dev(codec)); + + /* allow device access again */ + snd_hda_unlock_devices(bus); +--- a/sound/pci/hda/hda_sysfs.c ++++ b/sound/pci/hda/hda_sysfs.c +@@ -139,7 +139,7 @@ static int reconfig_codec(struct hda_cod + "The codec is being used, can't reconfigure.\n"); + goto error; + } +- err = snd_hda_codec_configure(codec); ++ err = device_reprobe(hda_codec_dev(codec)); + if (err < 0) + goto error; + err = snd_card_register(codec->card); diff --git a/queue-5.10/alsa-hda-realtek-add-quirk-for-msi-gp73.patch b/queue-5.10/alsa-hda-realtek-add-quirk-for-msi-gp73.patch new file mode 100644 index 00000000000..eb6d8d1166a --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-quirk-for-msi-gp73.patch @@ -0,0 +1,32 @@ +From 09926202e939fd699650ac0fc0baa5757e069390 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 20 Dec 2020 09:09:43 +0100 +Subject: ALSA: hda/realtek: Add quirk for MSI-GP73 + +From: Takashi Iwai + +commit 09926202e939fd699650ac0fc0baa5757e069390 upstream. + +MSI-GP73 (with SSID 1462:1229) requires yet again +ALC1220_FIXUP_CLEVO_P950 quirk like other MSI models. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210793 +Cc: +Link: https://lore.kernel.org/r/20201220080943.24839-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2516,6 +2516,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950), ++ SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950), diff --git a/queue-5.10/alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch b/queue-5.10/alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch new file mode 100644 index 00000000000..e93eba04c35 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch @@ -0,0 +1,34 @@ +From 607184cb1635eaee239fe3fb9648a8b82a5232d7 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Fri, 11 Dec 2020 14:17:09 +0800 +Subject: ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button + +From: Kailang Yang + +commit 607184cb1635eaee239fe3fb9648a8b82a5232d7 upstream. + +Add supported for more Lenovo ALC285 Headset Button. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/bb1f1da1526d460885aa4257be81eb94@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8577,6 +8577,10 @@ static const struct snd_hda_pin_quirk al + {0x12, 0x90a60130}, + {0x19, 0x03a11020}, + {0x21, 0x0321101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, ++ {0x14, 0x90170110}, ++ {0x19, 0x04a11040}, ++ {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + {0x12, 0x90a60130}, + {0x14, 0x90170110}, diff --git a/queue-5.10/alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch b/queue-5.10/alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch new file mode 100644 index 00000000000..7611a21e09c --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch @@ -0,0 +1,40 @@ +From 6ca653e3f73a1af0f30dbf9c2c79d2897074989f Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Tue, 22 Dec 2020 23:04:58 +0800 +Subject: ALSA: hda/realtek: Apply jack fixup for Quanta NL3 + +From: Chris Chiu + +commit 6ca653e3f73a1af0f30dbf9c2c79d2897074989f upstream. + +The Quanta NL3 laptop has both a headphone output jack and a headset +jack, on the right edge of the chassis. + +The pin information suggests that both of these are at the Front. +The PulseAudio is confused to differentiate them so one of the jack +can neither get the jack sense working nor the audio output. + +The ALC269_FIXUP_LIFEBOOK chained with ALC269_FIXUP_QUANTA_MUTE can +help to differentiate 2 jacks and get the 'Auto-Mute Mode' working +correctly. + +Signed-off-by: Chris Chiu +Cc: +Link: https://lore.kernel.org/r/20201222150459.9545-1-chiu@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8021,6 +8021,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), diff --git a/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch b/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch new file mode 100644 index 00000000000..1debc88503f --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch @@ -0,0 +1,33 @@ +From 7e413528474d5895e3e315c019fb0c43522eb6d9 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 9 Dec 2020 12:57:30 +0800 +Subject: ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 + +From: Chris Chiu + +commit 7e413528474d5895e3e315c019fb0c43522eb6d9 upstream. + +The ASUS laptop Q524UQK with ALC255 codec can't detect the headset +microphone until ALC255_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied. + +Signed-off-by: Chris Chiu +Signed-off-by: Jian-Hong Pan +Cc: +Link: https://lore.kernel.org/r/20201209045730.9972-1-chiu@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7979,6 +7979,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), diff --git a/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch b/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch new file mode 100644 index 00000000000..45116508cdf --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch @@ -0,0 +1,33 @@ +From 5cfca59604e423f720297e30a9dc493eea623493 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Mon, 7 Dec 2020 15:27:55 +0800 +Subject: ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 + +From: Chris Chiu + +commit 5cfca59604e423f720297e30a9dc493eea623493 upstream. + +The ASUS laptop X430UN with ALC256 can't detect the headset microphone +until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied. + +Signed-off-by: Chris Chiu +Signed-off-by: Jian-Hong Pan +Cc: +Link: https://lore.kernel.org/r/20201207072755.16210-1-chiu@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7958,6 +7958,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC), diff --git a/queue-5.10/alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch b/queue-5.10/alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch new file mode 100644 index 00000000000..d5a635696fa --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch @@ -0,0 +1,62 @@ +From c72b9bfe0f914639cc475585f45722a3eb57a56d Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Sat, 5 Dec 2020 13:11:30 +0800 +Subject: ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop + +From: Hui Wang + +commit c72b9bfe0f914639cc475585f45722a3eb57a56d upstream. + +This change could fix 2 issues on this machine: + - the bass speaker's output volume can't be adjusted, that is because + the bass speaker is routed to the DAC (Nid 0x6) which has no volume + control. + - after plugging a headset with vol+, vol- and pause buttons on it, + press those buttons, nothing happens, this means those buttons + don't work at all. This machine has alc287 codec, need to add the + codec id to the disable/enable_headset_jack_key(), then the headset + button could work. + +The quirk of ALC285_FIXUP_THINKPAD_HEADSET_JACK could fix both of these +2 issues. + +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20201205051130.8122-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3104,6 +3104,7 @@ static void alc_disable_headset_jack_key + case 0x10ec0215: + case 0x10ec0225: + case 0x10ec0285: ++ case 0x10ec0287: + case 0x10ec0295: + case 0x10ec0289: + case 0x10ec0299: +@@ -3130,6 +3131,7 @@ static void alc_enable_headset_jack_key( + case 0x10ec0215: + case 0x10ec0225: + case 0x10ec0285: ++ case 0x10ec0287: + case 0x10ec0295: + case 0x10ec0289: + case 0x10ec0299: +@@ -8578,6 +8580,11 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170110}, + {0x19, 0x04a11040}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0287, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_HEADSET_JACK, ++ {0x14, 0x90170110}, ++ {0x17, 0x90170111}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE, + {0x12, 0x90a60130}, + {0x17, 0x90170110}, diff --git a/queue-5.10/alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch b/queue-5.10/alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch new file mode 100644 index 00000000000..1c93b2ff350 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch @@ -0,0 +1,79 @@ +From 34cdf405aa5de827b8bef79a6c82c39120b3729b Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 16 Dec 2020 20:52:00 +0800 +Subject: ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 + +From: Chris Chiu + +commit 34cdf405aa5de827b8bef79a6c82c39120b3729b upstream. + +Acer TravelMate laptops P648/P658 series with codec ALC282 only have +one physical jack for headset but there's a confusing lineout pin on +NID 0x1b reported. Audio applications hence misunderstand that there +are a speaker and a lineout, and take the lineout as the default audio +output. + +Add a new quirk to remove the useless lineout and enable the pin 0x18 +for jack sensing and headset microphone. + +Signed-off-by: Chris Chiu +Signed-off-by: Jian-Hong Pan +Cc: +Link: https://lore.kernel.org/r/20201216125200.27053-1-chiu@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6369,6 +6369,7 @@ enum { + ALC287_FIXUP_HP_GPIO_LED, + ALC256_FIXUP_HP_HEADSET_MIC, + ALC236_FIXUP_DELL_AIO_HEADSET_MIC, ++ ALC282_FIXUP_ACER_DISABLE_LINEOUT, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7792,6 +7793,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC282_FIXUP_ACER_DISABLE_LINEOUT] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1b, 0x411111f0 }, ++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { }, ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -8569,6 +8580,22 @@ static const struct snd_hda_pin_quirk al + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, ++ ALC282_STANDARD_PINS, ++ {0x12, 0x90a609c0}, ++ {0x18, 0x03a11830}, ++ {0x19, 0x04a19831}, ++ {0x1a, 0x0481303f}, ++ {0x1b, 0x04211020}, ++ {0x21, 0x0321101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, ++ ALC282_STANDARD_PINS, ++ {0x12, 0x90a60940}, ++ {0x18, 0x03a11830}, ++ {0x19, 0x04a19831}, ++ {0x1a, 0x0481303f}, ++ {0x1b, 0x04211020}, ++ {0x21, 0x0321101f}), + SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC282_STANDARD_PINS, + {0x12, 0x90a60130}, diff --git a/queue-5.10/alsa-hda-realtek-supported-dell-fixed-type-headset.patch b/queue-5.10/alsa-hda-realtek-supported-dell-fixed-type-headset.patch new file mode 100644 index 00000000000..72f9e48077f --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-supported-dell-fixed-type-headset.patch @@ -0,0 +1,32 @@ +From 150927c3674d7db4dd51a7269e01423c8c78e53b Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 17 Dec 2020 16:52:44 +0800 +Subject: ALSA: hda/realtek - Supported Dell fixed type headset + +From: Kailang Yang + +commit 150927c3674d7db4dd51a7269e01423c8c78e53b upstream. + +This platform only supported iphone type headset. +It can't support Dell headset mode. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/b97e971978034bc9b772a08ec91265e8@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7885,6 +7885,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x09bf, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0a2e, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0a30, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1028, 0x0a58, "Dell Precision 3650 Tower", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-5.10/alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch b/queue-5.10/alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch new file mode 100644 index 00000000000..44fb26b1e86 --- /dev/null +++ b/queue-5.10/alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch @@ -0,0 +1,66 @@ +From 11cb881bf075cea41092a20236ba708b18e1dbb2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Dec 2020 17:17:30 +0100 +Subject: ALSA: pcm: oss: Fix a few more UBSAN fixes + +From: Takashi Iwai + +commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream. + +There are a few places that call round{up|down}_pow_of_two() with the +value zero, and this causes undefined behavior warnings. Avoid +calling those macros if such a nonsense value is passed; it's a minor +optimization as well, as we handle it as either an error or a value to +be skipped, instead. + +Reported-by: syzbot+33ef0b6639a8d2d42b4c@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20201218161730.26596-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/pcm_oss.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -693,6 +693,8 @@ static int snd_pcm_oss_period_size(struc + + oss_buffer_size = snd_pcm_plug_client_size(substream, + snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size; ++ if (!oss_buffer_size) ++ return -EINVAL; + oss_buffer_size = rounddown_pow_of_two(oss_buffer_size); + if (atomic_read(&substream->mmap_count)) { + if (oss_buffer_size > runtime->oss.mmap_bytes) +@@ -728,17 +730,21 @@ static int snd_pcm_oss_period_size(struc + + min_period_size = snd_pcm_plug_client_size(substream, + snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL)); +- min_period_size *= oss_frame_size; +- min_period_size = roundup_pow_of_two(min_period_size); +- if (oss_period_size < min_period_size) +- oss_period_size = min_period_size; ++ if (min_period_size) { ++ min_period_size *= oss_frame_size; ++ min_period_size = roundup_pow_of_two(min_period_size); ++ if (oss_period_size < min_period_size) ++ oss_period_size = min_period_size; ++ } + + max_period_size = snd_pcm_plug_client_size(substream, + snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL)); +- max_period_size *= oss_frame_size; +- max_period_size = rounddown_pow_of_two(max_period_size); +- if (oss_period_size > max_period_size) +- oss_period_size = max_period_size; ++ if (max_period_size) { ++ max_period_size *= oss_frame_size; ++ max_period_size = rounddown_pow_of_two(max_period_size); ++ if (oss_period_size > max_period_size) ++ oss_period_size = max_period_size; ++ } + + oss_periods = oss_buffer_size / oss_period_size; + diff --git a/queue-5.10/alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch b/queue-5.10/alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch new file mode 100644 index 00000000000..0dd7b543596 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch @@ -0,0 +1,35 @@ +From 525d9c57d0eeeb660d9b25e5b2d1c95975e3ba95 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 21 Dec 2020 09:01:59 +0100 +Subject: ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S + +From: Takashi Iwai + +commit 525d9c57d0eeeb660d9b25e5b2d1c95975e3ba95 upstream. + +ASUS PRIME TRX40 PRO-S mobo with 0b05:1918 needs the same quirk alias +for another ASUS mobo (0b05:1917) for the proper mixer mapping, etc. +Add the corresponding entry. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210783 +Cc: +Link: https://lore.kernel.org/r/20201221080159.24468-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -382,6 +382,9 @@ static const struct usb_audio_device_nam + /* ASUS ROG Strix */ + PROFILE_NAME(0x0b05, 0x1917, + "Realtek", "ALC1220-VB-DT", "Realtek-ALC1220-VB-Desktop"), ++ /* ASUS PRIME TRX40 PRO-S */ ++ PROFILE_NAME(0x0b05, 0x1918, ++ "Realtek", "ALC1220-VB-DT", "Realtek-ALC1220-VB-Desktop"), + + /* Dell WD15 Dock */ + PROFILE_NAME(0x0bda, 0x4014, "Dell", "WD15 Dock", "Dell-WD15-Dock"), diff --git a/queue-5.10/alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch b/queue-5.10/alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch new file mode 100644 index 00000000000..3109a6cfb0b --- /dev/null +++ b/queue-5.10/alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch @@ -0,0 +1,33 @@ +From 725124d10d00b2f56bb5bd08b431cc74ab3b3ace Mon Sep 17 00:00:00 2001 +From: Amadej Kastelic +Date: Tue, 15 Dec 2020 19:09:05 +0100 +Subject: ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices + +From: Amadej Kastelic + +commit 725124d10d00b2f56bb5bd08b431cc74ab3b3ace upstream. + +Add VID to support native DSD reproduction on FiiO devices. + +Tested-by: Amadej Kastelic +Signed-off-by: Emilio Moretti +Signed-off-by: Amadej Kastelic +Cc: +Link: https://lore.kernel.org/r/X9j7wdXSr4XyK7Bd@ryzen.localdomain +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1799,6 +1799,7 @@ u64 snd_usb_interface_dsd_format_quirks( + case 0x25ce: /* Mytek devices */ + case 0x278b: /* Rotel? */ + case 0x292b: /* Gustard/Ess based devices */ ++ case 0x2972: /* FiiO devices */ + case 0x2ab6: /* T+A devices */ + case 0x3353: /* Khadas devices */ + case 0x3842: /* EVGA */ diff --git a/queue-5.10/alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch b/queue-5.10/alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch new file mode 100644 index 00000000000..f90b5512d93 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch @@ -0,0 +1,37 @@ +From 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 18 Dec 2020 15:58:58 +0100 +Subject: ALSA: usb-audio: Disable sample read check if firmware doesn't give back + +From: Takashi Iwai + +commit 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d upstream. + +Some buggy firmware don't give the current sample rate but leaves +zero. Handle this case more gracefully without warning but just skip +the current rate verification from the next time. + +Cc: +Link: https://lore.kernel.org/r/20201218145858.2357-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/clock.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -531,6 +531,12 @@ static int set_sample_rate_v1(struct snd + } + + crate = data[0] | (data[1] << 8) | (data[2] << 16); ++ if (!crate) { ++ dev_info(&dev->dev, "failed to read current rate; disabling the check\n"); ++ chip->sample_rate_read_error = 3; /* three strikes, see above */ ++ return 0; ++ } ++ + if (crate != rate) { + dev_warn(&dev->dev, "current rate %d is different from the runtime rate %d\n", crate, rate); + // runtime->rate = crate; diff --git a/queue-5.10/asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch b/queue-5.10/asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch new file mode 100644 index 00000000000..a45325d11ab --- /dev/null +++ b/queue-5.10/asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch @@ -0,0 +1,53 @@ +From 55d8e6a85bce21f748c42eedea63681219f70523 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Tue, 8 Dec 2020 19:12:33 +0100 +Subject: ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision) + +From: Jaroslav Kysela + +commit 55d8e6a85bce21f748c42eedea63681219f70523 upstream. + +The Raven and Renoir ACP can be distinguished by the PCI revision. +Let's do the check very early, otherwise the wrong probe code +can be run. + +Link: https://lore.kernel.org/alsa-devel/2e4587f8-f602-cf23-4845-fd27a32b1cfc@amd.com/ +Cc: +Cc: Vijendar Mukunda +Cc: Mark Brown +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20201208181233.2745726-1-perex@perex.cz +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/amd/raven/pci-acp3x.c | 4 ++++ + sound/soc/amd/renoir/rn-pci-acp3x.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/sound/soc/amd/raven/pci-acp3x.c ++++ b/sound/soc/amd/raven/pci-acp3x.c +@@ -118,6 +118,10 @@ static int snd_acp3x_probe(struct pci_de + int ret, i; + u32 addr, val; + ++ /* Raven device detection */ ++ if (pci->revision != 0x00) ++ return -ENODEV; ++ + if (pci_enable_device(pci)) { + dev_err(&pci->dev, "pci_enable_device failed\n"); + return -ENODEV; +--- a/sound/soc/amd/renoir/rn-pci-acp3x.c ++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c +@@ -188,6 +188,10 @@ static int snd_rn_acp_probe(struct pci_d + int ret, index; + u32 addr; + ++ /* Renoir device check */ ++ if (pci->revision != 0x01) ++ return -ENODEV; ++ + if (pci_enable_device(pci)) { + dev_err(&pci->dev, "pci_enable_device failed\n"); + return -ENODEV; diff --git a/queue-5.10/asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch b/queue-5.10/asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch new file mode 100644 index 00000000000..f326ec15af7 --- /dev/null +++ b/queue-5.10/asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch @@ -0,0 +1,99 @@ +From 718c406e1ffaca4eac987b957bbb36ce1090797a Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Tue, 8 Dec 2020 18:12:00 +0100 +Subject: ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS) + +From: Jaroslav Kysela + +commit 718c406e1ffaca4eac987b957bbb36ce1090797a upstream. + +Users reported that some Lenovo AMD platforms do not have ACP microphone, +but the BIOS advertises it via ACPI. + +This patch create a simple DMI table, where those machines with the broken +BIOS can be added. The DMI description for Lenovo IdeaPad 5 and +IdeaPad Flex 5 devices are added there. + +Also describe the dmic_acpi_check kernel module parameter in a more +understandable way. + +Cc: +Cc: Vijendar Mukunda +Cc: Mark Brown +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20201208171200.2737620-1-perex@perex.cz +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/amd/renoir/rn-pci-acp3x.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +--- a/sound/soc/amd/renoir/rn-pci-acp3x.c ++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c +@@ -6,6 +6,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -20,14 +21,13 @@ module_param(acp_power_gating, int, 0644 + MODULE_PARM_DESC(acp_power_gating, "Enable acp power gating"); + + /** +- * dmic_acpi_check = -1 - Checks ACPI method to know DMIC hardware status runtime +- * = 0 - Skips the DMIC device creation and returns probe failure +- * = 1 - Assumes that platform has DMIC support and skips ACPI +- * method check ++ * dmic_acpi_check = -1 - Use ACPI/DMI method to detect the DMIC hardware presence at runtime ++ * = 0 - Skip the DMIC device creation and return probe failure ++ * = 1 - Force DMIC support + */ + static int dmic_acpi_check = ACP_DMIC_AUTO; + module_param(dmic_acpi_check, bint, 0644); +-MODULE_PARM_DESC(dmic_acpi_check, "checks Dmic hardware runtime"); ++MODULE_PARM_DESC(dmic_acpi_check, "Digital microphone presence (-1=auto, 0=none, 1=force)"); + + struct acp_dev_data { + void __iomem *acp_base; +@@ -163,6 +163,17 @@ static int rn_acp_deinit(void __iomem *a + return 0; + } + ++static const struct dmi_system_id rn_acp_quirk_table[] = { ++ { ++ /* Lenovo IdeaPad Flex 5 14ARE05, IdeaPad 5 15ARE05 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"), ++ } ++ }, ++ {} ++}; ++ + static int snd_rn_acp_probe(struct pci_dev *pci, + const struct pci_device_id *pci_id) + { +@@ -172,6 +183,7 @@ static int snd_rn_acp_probe(struct pci_d + acpi_handle handle; + acpi_integer dmic_status; + #endif ++ const struct dmi_system_id *dmi_id; + unsigned int irqflags; + int ret, index; + u32 addr; +@@ -232,6 +244,12 @@ static int snd_rn_acp_probe(struct pci_d + goto de_init; + } + #endif ++ dmi_id = dmi_first_match(rn_acp_quirk_table); ++ if (dmi_id && !dmi_id->driver_data) { ++ dev_info(&pci->dev, "ACPI settings override using DMI (ACP mic is not present)"); ++ ret = -ENODEV; ++ goto de_init; ++ } + } + + adata->res = devm_kzalloc(&pci->dev, diff --git a/queue-5.10/asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch b/queue-5.10/asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch new file mode 100644 index 00000000000..7b63fb2203f --- /dev/null +++ b/queue-5.10/asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch @@ -0,0 +1,49 @@ +From 0d024a8bec084205fdd9fa17479ba91f45f85db3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 8 Dec 2020 14:51:54 +0100 +Subject: ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams + +From: Takashi Iwai + +commit 0d024a8bec084205fdd9fa17479ba91f45f85db3 upstream. + +The cx2072x codec driver defines multiple DAIs with the same stream +name "Playback" and "Capture". Although the current code works more +or less as is as the secondary streams are never used, it still leads +the error message like: + debugfs: File 'Playback' in directory 'dapm' already present! + debugfs: File 'Capture' in directory 'dapm' already present! + +Fix it by renaming the secondary streams to unique names. + +Fixes: a497a4363706 ("ASoC: Add support for Conexant CX2072X CODEC") +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20201208135154.9188-1-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/cx2072x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/cx2072x.c ++++ b/sound/soc/codecs/cx2072x.c +@@ -1579,7 +1579,7 @@ static struct snd_soc_dai_driver soc_cod + .id = CX2072X_DAI_DSP, + .probe = cx2072x_dsp_dai_probe, + .playback = { +- .stream_name = "Playback", ++ .stream_name = "DSP Playback", + .channels_min = 2, + .channels_max = 2, + .rates = CX2072X_RATES_DSP, +@@ -1591,7 +1591,7 @@ static struct snd_soc_dai_driver soc_cod + .name = "cx2072x-aec", + .id = 3, + .capture = { +- .stream_name = "Capture", ++ .stream_name = "AEC Capture", + .channels_min = 2, + .channels_max = 2, + .rates = CX2072X_RATES_DSP, diff --git a/queue-5.10/binder-add-flag-to-clear-buffer-on-txn-complete.patch b/queue-5.10/binder-add-flag-to-clear-buffer-on-txn-complete.patch new file mode 100644 index 00000000000..965bd840733 --- /dev/null +++ b/queue-5.10/binder-add-flag-to-clear-buffer-on-txn-complete.patch @@ -0,0 +1,146 @@ +From 0f966cba95c78029f491b433ea95ff38f414a761 Mon Sep 17 00:00:00 2001 +From: Todd Kjos +Date: Fri, 20 Nov 2020 15:37:43 -0800 +Subject: binder: add flag to clear buffer on txn complete + +From: Todd Kjos + +commit 0f966cba95c78029f491b433ea95ff38f414a761 upstream. + +Add a per-transaction flag to indicate that the buffer +must be cleared when the transaction is complete to +prevent copies of sensitive data from being preserved +in memory. + +Signed-off-by: Todd Kjos +Link: https://lore.kernel.org/r/20201120233743.3617529-1-tkjos@google.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 48 ++++++++++++++++++++++++++++++++++++ + drivers/android/binder_alloc.h | 4 ++- + include/uapi/linux/android/binder.h | 1 + 4 files changed, 53 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -3146,6 +3146,7 @@ static void binder_transaction(struct bi + t->buffer->debug_id = t->debug_id; + t->buffer->transaction = t; + t->buffer->target_node = target_node; ++ t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF); + trace_binder_transaction_alloc_buf(t->buffer); + + if (binder_alloc_copy_user_to_buffer( +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -696,6 +696,8 @@ static void binder_free_buf_locked(struc + binder_insert_free_buffer(alloc, buffer); + } + ++static void binder_alloc_clear_buf(struct binder_alloc *alloc, ++ struct binder_buffer *buffer); + /** + * binder_alloc_free_buf() - free a binder buffer + * @alloc: binder_alloc for this proc +@@ -706,6 +708,18 @@ static void binder_free_buf_locked(struc + void binder_alloc_free_buf(struct binder_alloc *alloc, + struct binder_buffer *buffer) + { ++ /* ++ * We could eliminate the call to binder_alloc_clear_buf() ++ * from binder_alloc_deferred_release() by moving this to ++ * binder_alloc_free_buf_locked(). However, that could ++ * increase contention for the alloc mutex if clear_on_free ++ * is used frequently for large buffers. The mutex is not ++ * needed for correctness here. ++ */ ++ if (buffer->clear_on_free) { ++ binder_alloc_clear_buf(alloc, buffer); ++ buffer->clear_on_free = false; ++ } + mutex_lock(&alloc->mutex); + binder_free_buf_locked(alloc, buffer); + mutex_unlock(&alloc->mutex); +@@ -802,6 +816,10 @@ void binder_alloc_deferred_release(struc + /* Transaction should already have been freed */ + BUG_ON(buffer->transaction); + ++ if (buffer->clear_on_free) { ++ binder_alloc_clear_buf(alloc, buffer); ++ buffer->clear_on_free = false; ++ } + binder_free_buf_locked(alloc, buffer); + buffers++; + } +@@ -1136,6 +1154,36 @@ static struct page *binder_alloc_get_pag + } + + /** ++ * binder_alloc_clear_buf() - zero out buffer ++ * @alloc: binder_alloc for this proc ++ * @buffer: binder buffer to be cleared ++ * ++ * memset the given buffer to 0 ++ */ ++static void binder_alloc_clear_buf(struct binder_alloc *alloc, ++ struct binder_buffer *buffer) ++{ ++ size_t bytes = binder_alloc_buffer_size(alloc, buffer); ++ binder_size_t buffer_offset = 0; ++ ++ while (bytes) { ++ unsigned long size; ++ struct page *page; ++ pgoff_t pgoff; ++ void *kptr; ++ ++ page = binder_alloc_get_page(alloc, buffer, ++ buffer_offset, &pgoff); ++ size = min_t(size_t, bytes, PAGE_SIZE - pgoff); ++ kptr = kmap(page) + pgoff; ++ memset(kptr, 0, size); ++ kunmap(page); ++ bytes -= size; ++ buffer_offset += size; ++ } ++} ++ ++/** + * binder_alloc_copy_user_to_buffer() - copy src user to tgt user + * @alloc: binder_alloc for this proc + * @buffer: binder buffer to be accessed +--- a/drivers/android/binder_alloc.h ++++ b/drivers/android/binder_alloc.h +@@ -23,6 +23,7 @@ struct binder_transaction; + * @entry: entry alloc->buffers + * @rb_node: node for allocated_buffers/free_buffers rb trees + * @free: %true if buffer is free ++ * @clear_on_free: %true if buffer must be zeroed after use + * @allow_user_free: %true if user is allowed to free buffer + * @async_transaction: %true if buffer is in use for an async txn + * @debug_id: unique ID for debugging +@@ -41,9 +42,10 @@ struct binder_buffer { + struct rb_node rb_node; /* free entry by size or allocated entry */ + /* by address */ + unsigned free:1; ++ unsigned clear_on_free:1; + unsigned allow_user_free:1; + unsigned async_transaction:1; +- unsigned debug_id:29; ++ unsigned debug_id:28; + + struct binder_transaction *transaction; + +--- a/include/uapi/linux/android/binder.h ++++ b/include/uapi/linux/android/binder.h +@@ -248,6 +248,7 @@ enum transaction_flags { + TF_ROOT_OBJECT = 0x04, /* contents are the component's root object */ + TF_STATUS_CODE = 0x08, /* contents are a 32-bit status code */ + TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */ ++ TF_CLEAR_BUF = 0x20, /* clear buffer on txn complete */ + }; + + struct binder_transaction_data { diff --git a/queue-5.10/cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch b/queue-5.10/cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch new file mode 100644 index 00000000000..905891d531f --- /dev/null +++ b/queue-5.10/cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch @@ -0,0 +1,99 @@ +From e40ad84c26b4deeee46666492ec66b9a534b8e59 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 17 Dec 2020 20:17:49 +0100 +Subject: cpufreq: intel_pstate: Use most recent guaranteed performance values + +From: Rafael J. Wysocki + +commit e40ad84c26b4deeee46666492ec66b9a534b8e59 upstream. + +When turbo has been disabled by the BIOS, but HWP_CAP.GUARANTEED is +changed later, user space may want to take advantage of this increased +guaranteed performance. + +HWP_CAP.GUARANTEED is not a static value. It can be adjusted by an +out-of-band agent or during an Intel Speed Select performance level +change. The HWP_CAP.MAX is still the maximum achievable performance +with turbo disabled by the BIOS, so HWP_CAP.GUARANTEED can still +change as long as it remains less than or equal to HWP_CAP.MAX. + +When HWP_CAP.GUARANTEED is changed, the sysfs base_frequency +attribute shows the most recent guaranteed frequency value. This +attribute can be used by user space software to update the scaling +min/max limits of the CPU. + +Currently, the ->setpolicy() callback already uses the latest +HWP_CAP values when setting HWP_REQ, but the ->verify() callback will +restrict the user settings to the to old guaranteed performance value +which prevents user space from making use of the extra CPU capacity +theoretically available to it after increasing HWP_CAP.GUARANTEED. + +To address this, read HWP_CAP in intel_pstate_verify_cpu_policy() +to obtain the maximum P-state that can be used and use that to +confine the policy max limit instead of using the cached and +possibly stale pstate.max_freq value for this purpose. + +For consistency, update intel_pstate_update_perf_limits() to use the +maximum available P-state returned by intel_pstate_get_hwp_max() to +compute the maximum frequency instead of using the return value of +intel_pstate_get_max_freq() which, again, may be stale. + +This issue is a side-effect of fixing the scaling frequency limits in +commit eacc9c5a927e ("cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() +for turbo disabled") which corrected the setting of the reduced scaling +frequency values, but caused stale HWP_CAP.GUARANTEED to be used in +the case at hand. + +Fixes: eacc9c5a927e ("cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled") +Reported-by: Srinivas Pandruvada +Tested-by: Srinivas Pandruvada +Cc: 5.8+ # 5.8+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -2207,9 +2207,9 @@ static void intel_pstate_update_perf_lim + unsigned int policy_min, + unsigned int policy_max) + { +- int max_freq = intel_pstate_get_max_freq(cpu); + int32_t max_policy_perf, min_policy_perf; + int max_state, turbo_max; ++ int max_freq; + + /* + * HWP needs some special consideration, because on BDX the +@@ -2223,6 +2223,7 @@ static void intel_pstate_update_perf_lim + cpu->pstate.max_pstate : cpu->pstate.turbo_pstate; + turbo_max = cpu->pstate.turbo_pstate; + } ++ max_freq = max_state * cpu->pstate.scaling; + + max_policy_perf = max_state * policy_max / max_freq; + if (policy_max == policy_min) { +@@ -2325,9 +2326,18 @@ static void intel_pstate_adjust_policy_m + static void intel_pstate_verify_cpu_policy(struct cpudata *cpu, + struct cpufreq_policy_data *policy) + { ++ int max_freq; ++ + update_turbo_state(); +- cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq, +- intel_pstate_get_max_freq(cpu)); ++ if (hwp_active) { ++ int max_state, turbo_max; ++ ++ intel_pstate_get_hwp_max(cpu->cpu, &turbo_max, &max_state); ++ max_freq = max_state * cpu->pstate.scaling; ++ } else { ++ max_freq = intel_pstate_get_max_freq(cpu); ++ } ++ cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq, max_freq); + + intel_pstate_adjust_policy_max(cpu, policy); + } diff --git a/queue-5.10/cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch b/queue-5.10/cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch new file mode 100644 index 00000000000..14baaac5710 --- /dev/null +++ b/queue-5.10/cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch @@ -0,0 +1,126 @@ +From 406100f3da08066c00105165db8520bbc7694a36 Mon Sep 17 00:00:00 2001 +From: Daniel Jordan +Date: Thu, 12 Nov 2020 12:17:11 -0500 +Subject: cpuset: fix race between hotplug work and later CPU offline + +From: Daniel Jordan + +commit 406100f3da08066c00105165db8520bbc7694a36 upstream. + +One of our machines keeled over trying to rebuild the scheduler domains. +Mainline produces the same splat: + + BUG: unable to handle page fault for address: 0000607f820054db + CPU: 2 PID: 149 Comm: kworker/1:1 Not tainted 5.10.0-rc1-master+ #6 + Workqueue: events cpuset_hotplug_workfn + RIP: build_sched_domains + Call Trace: + partition_sched_domains_locked + rebuild_sched_domains_locked + cpuset_hotplug_workfn + +It happens with cgroup2 and exclusive cpusets only. This reproducer +triggers it on an 8-cpu vm and works most effectively with no +preexisting child cgroups: + + cd $UNIFIED_ROOT + mkdir cg1 + echo 4-7 > cg1/cpuset.cpus + echo root > cg1/cpuset.cpus.partition + + # with smt/control reading 'on', + echo off > /sys/devices/system/cpu/smt/control + +RIP maps to + + sd->shared = *per_cpu_ptr(sdd->sds, sd_id); + +from sd_init(). sd_id is calculated earlier in the same function: + + cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu)); + sd_id = cpumask_first(sched_domain_span(sd)); + +tl->mask(cpu), which reads cpu_sibling_map on x86, returns an empty mask +and so cpumask_first() returns >= nr_cpu_ids, which leads to the bogus +value from per_cpu_ptr() above. + +The problem is a race between cpuset_hotplug_workfn() and a later +offline of CPU N. cpuset_hotplug_workfn() updates the effective masks +when N is still online, the offline clears N from cpu_sibling_map, and +then the worker uses the stale effective masks that still have N to +generate the scheduling domains, leading the worker to read +N's empty cpu_sibling_map in sd_init(). + +rebuild_sched_domains_locked() prevented the race during the cgroup2 +cpuset series up until the Fixes commit changed its check. Make the +check more robust so that it can detect an offline CPU in any exclusive +cpuset's effective mask, not just the top one. + +Fixes: 0ccea8feb980 ("cpuset: Make generate_sched_domains() work with partition") +Signed-off-by: Daniel Jordan +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Tejun Heo +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20201112171711.639541-1-daniel.m.jordan@oracle.com +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup/cpuset.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -983,25 +983,48 @@ partition_and_rebuild_sched_domains(int + */ + static void rebuild_sched_domains_locked(void) + { ++ struct cgroup_subsys_state *pos_css; + struct sched_domain_attr *attr; + cpumask_var_t *doms; ++ struct cpuset *cs; + int ndoms; + + lockdep_assert_cpus_held(); + percpu_rwsem_assert_held(&cpuset_rwsem); + + /* +- * We have raced with CPU hotplug. Don't do anything to avoid ++ * If we have raced with CPU hotplug, return early to avoid + * passing doms with offlined cpu to partition_sched_domains(). +- * Anyways, hotplug work item will rebuild sched domains. ++ * Anyways, cpuset_hotplug_workfn() will rebuild sched domains. ++ * ++ * With no CPUs in any subpartitions, top_cpuset's effective CPUs ++ * should be the same as the active CPUs, so checking only top_cpuset ++ * is enough to detect racing CPU offlines. + */ + if (!top_cpuset.nr_subparts_cpus && + !cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask)) + return; + +- if (top_cpuset.nr_subparts_cpus && +- !cpumask_subset(top_cpuset.effective_cpus, cpu_active_mask)) +- return; ++ /* ++ * With subpartition CPUs, however, the effective CPUs of a partition ++ * root should be only a subset of the active CPUs. Since a CPU in any ++ * partition root could be offlined, all must be checked. ++ */ ++ if (top_cpuset.nr_subparts_cpus) { ++ rcu_read_lock(); ++ cpuset_for_each_descendant_pre(cs, pos_css, &top_cpuset) { ++ if (!is_partition_root(cs)) { ++ pos_css = css_rightmost_descendant(pos_css); ++ continue; ++ } ++ if (!cpumask_subset(cs->effective_cpus, ++ cpu_active_mask)) { ++ rcu_read_unlock(); ++ return; ++ } ++ } ++ rcu_read_unlock(); ++ } + + /* Generate domain masks and attrs */ + ndoms = generate_sched_domains(&doms, &attr); diff --git a/queue-5.10/crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch b/queue-5.10/crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch new file mode 100644 index 00000000000..4ed6be951e1 --- /dev/null +++ b/queue-5.10/crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch @@ -0,0 +1,80 @@ +From f3456b9fd269c6d0c973b136c5449d46b2510f4b Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 26 Nov 2020 08:49:07 +0100 +Subject: crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata + +From: Ard Biesheuvel + +commit f3456b9fd269c6d0c973b136c5449d46b2510f4b upstream. + +ARM Cortex-A57 and Cortex-A72 cores running in 32-bit mode are affected +by silicon errata #1742098 and #1655431, respectively, where the second +instruction of a AES instruction pair may execute twice if an interrupt +is taken right after the first instruction consumes an input register of +which a single 32-bit lane has been updated the last time it was modified. + +This is not such a rare occurrence as it may seem: in counter mode, only +the least significant 32-bit word is incremented in the absence of a +carry, which makes our counter mode implementation susceptible to these +errata. + +So let's shuffle the counter assignments around a bit so that the most +recent updates when the AES instruction pair executes are 128-bit wide. + +[0] ARM-EPM-049219 v23 Cortex-A57 MPCore Software Developers Errata Notice +[1] ARM-EPM-012079 v11.0 Cortex-A72 MPCore Software Developers Errata Notice + +Cc: # v5.4+ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/crypto/aes-ce-core.S | 32 ++++++++++++++++++++++---------- + 1 file changed, 22 insertions(+), 10 deletions(-) + +--- a/arch/arm/crypto/aes-ce-core.S ++++ b/arch/arm/crypto/aes-ce-core.S +@@ -386,20 +386,32 @@ ENTRY(ce_aes_ctr_encrypt) + .Lctrloop4x: + subs r4, r4, #4 + bmi .Lctr1x +- add r6, r6, #1 ++ ++ /* ++ * NOTE: the sequence below has been carefully tweaked to avoid ++ * a silicon erratum that exists in Cortex-A57 (#1742098) and ++ * Cortex-A72 (#1655431) cores, where AESE/AESMC instruction pairs ++ * may produce an incorrect result if they take their input from a ++ * register of which a single 32-bit lane has been updated the last ++ * time it was modified. To work around this, the lanes of registers ++ * q0-q3 below are not manipulated individually, and the different ++ * counter values are prepared by successive manipulations of q7. ++ */ ++ add ip, r6, #1 + vmov q0, q7 ++ rev ip, ip ++ add lr, r6, #2 ++ vmov s31, ip @ set lane 3 of q1 via q7 ++ add ip, r6, #3 ++ rev lr, lr + vmov q1, q7 +- rev ip, r6 +- add r6, r6, #1 ++ vmov s31, lr @ set lane 3 of q2 via q7 ++ rev ip, ip + vmov q2, q7 +- vmov s7, ip +- rev ip, r6 +- add r6, r6, #1 ++ vmov s31, ip @ set lane 3 of q3 via q7 ++ add r6, r6, #4 + vmov q3, q7 +- vmov s11, ip +- rev ip, r6 +- add r6, r6, #1 +- vmov s15, ip ++ + vld1.8 {q4-q5}, [r1]! + vld1.8 {q6}, [r1]! + vld1.8 {q15}, [r1]! diff --git a/queue-5.10/crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch b/queue-5.10/crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch new file mode 100644 index 00000000000..c7bf08b16d0 --- /dev/null +++ b/queue-5.10/crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch @@ -0,0 +1,47 @@ +From 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 24 Nov 2020 11:47:19 +0100 +Subject: crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() + +From: Ard Biesheuvel + +commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream. + +ecdh_set_secret() casts a void* pointer to a const u64* in order to +feed it into ecc_is_key_valid(). This is not generally permitted by +the C standard, and leads to actual misalignment faults on ARMv6 +cores. In some cases, these are fixed up in software, but this still +leads to performance hits that are entirely avoidable. + +So let's copy the key into the ctx buffer first, which we will do +anyway in the common case, and which guarantees correct alignment. + +Cc: +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/ecdh.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/crypto/ecdh.c ++++ b/crypto/ecdh.c +@@ -53,12 +53,13 @@ static int ecdh_set_secret(struct crypto + return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, + ctx->private_key); + +- if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits, +- (const u64 *)params.key, params.key_size) < 0) +- return -EINVAL; +- + memcpy(ctx->private_key, params.key, params.key_size); + ++ if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits, ++ ctx->private_key, params.key_size) < 0) { ++ memzero_explicit(ctx->private_key, params.key_size); ++ return -EINVAL; ++ } + return 0; + } + diff --git a/queue-5.10/documentation-seqlock-s-locktype-lockname-g.patch b/queue-5.10/documentation-seqlock-s-locktype-lockname-g.patch new file mode 100644 index 00000000000..3f39c0909ab --- /dev/null +++ b/queue-5.10/documentation-seqlock-s-locktype-lockname-g.patch @@ -0,0 +1,74 @@ +From cf48647243cc28d15280600292db5777592606c5 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Sun, 6 Dec 2020 17:21:41 +0100 +Subject: Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g + +From: Ahmed S. Darwish + +commit cf48647243cc28d15280600292db5777592606c5 upstream. + +Sequence counters with an associated write serialization lock are called +seqcount_LOCKNAME_t. Fix the documentation accordingly. + +While at it, remove a paragraph that inappropriately discussed a +seqlock.h implementation detail. + +Fixes: 6dd699b13d53 ("seqlock: seqcount_LOCKNAME_t: Standardize naming convention") +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20201206162143.14387-2-a.darwish@linutronix.de +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/locking/seqlock.rst | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/Documentation/locking/seqlock.rst ++++ b/Documentation/locking/seqlock.rst +@@ -89,7 +89,7 @@ Read path:: + + .. _seqcount_locktype_t: + +-Sequence counters with associated locks (``seqcount_LOCKTYPE_t``) ++Sequence counters with associated locks (``seqcount_LOCKNAME_t``) + ----------------------------------------------------------------- + + As discussed at :ref:`seqcount_t`, sequence count write side critical +@@ -115,27 +115,26 @@ The following sequence counters with ass + - ``seqcount_mutex_t`` + - ``seqcount_ww_mutex_t`` + +-The plain seqcount read and write APIs branch out to the specific +-seqcount_LOCKTYPE_t implementation at compile-time. This avoids kernel +-API explosion per each new seqcount LOCKTYPE. ++The sequence counter read and write APIs can take either a plain ++seqcount_t or any of the seqcount_LOCKNAME_t variants above. + +-Initialization (replace "LOCKTYPE" with one of the supported locks):: ++Initialization (replace "LOCKNAME" with one of the supported locks):: + + /* dynamic */ +- seqcount_LOCKTYPE_t foo_seqcount; +- seqcount_LOCKTYPE_init(&foo_seqcount, &lock); ++ seqcount_LOCKNAME_t foo_seqcount; ++ seqcount_LOCKNAME_init(&foo_seqcount, &lock); + + /* static */ +- static seqcount_LOCKTYPE_t foo_seqcount = +- SEQCNT_LOCKTYPE_ZERO(foo_seqcount, &lock); ++ static seqcount_LOCKNAME_t foo_seqcount = ++ SEQCNT_LOCKNAME_ZERO(foo_seqcount, &lock); + + /* C99 struct init */ + struct { +- .seq = SEQCNT_LOCKTYPE_ZERO(foo.seq, &lock), ++ .seq = SEQCNT_LOCKNAME_ZERO(foo.seq, &lock), + } foo; + + Write path: same as in :ref:`seqcount_t`, while running from a context +-with the associated LOCKTYPE lock acquired. ++with the associated write serialization lock acquired. + + Read path: same as in :ref:`seqcount_t`. + diff --git a/queue-5.10/dyndbg-fix-use-before-null-check.patch b/queue-5.10/dyndbg-fix-use-before-null-check.patch new file mode 100644 index 00000000000..800652fa875 --- /dev/null +++ b/queue-5.10/dyndbg-fix-use-before-null-check.patch @@ -0,0 +1,43 @@ +From 3577afb0052fca65e67efdfc8e0859bb7bac87a6 Mon Sep 17 00:00:00 2001 +From: Jim Cromie +Date: Wed, 9 Dec 2020 11:36:25 -0700 +Subject: dyndbg: fix use before null check + +From: Jim Cromie + +commit 3577afb0052fca65e67efdfc8e0859bb7bac87a6 upstream. + +In commit a2d375eda771 ("dyndbg: refine export, rename to +dynamic_debug_exec_queries()"), a string is copied before checking it +isn't NULL. Fix this, report a usage/interface error, and return the +proper error code. + +Fixes: a2d375eda771 ("dyndbg: refine export, rename to dynamic_debug_exec_queries()") +Cc: stable@vger.kernel.org +Signed-off-by: Jim Cromie +Link: https://lore.kernel.org/r/20201209183625.2432329-1-jim.cromie@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + lib/dynamic_debug.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -561,9 +561,14 @@ static int ddebug_exec_queries(char *que + int dynamic_debug_exec_queries(const char *query, const char *modname) + { + int rc; +- char *qry = kstrndup(query, PAGE_SIZE, GFP_KERNEL); ++ char *qry; /* writable copy of query */ + +- if (!query) ++ if (!query) { ++ pr_err("non-null query/command string expected\n"); ++ return -EINVAL; ++ } ++ qry = kstrndup(query, PAGE_SIZE, GFP_KERNEL); ++ if (!qry) + return -ENOMEM; + + rc = ddebug_exec_queries(qry, modname); diff --git a/queue-5.10/edac-amd64-fix-pci-component-registration.patch b/queue-5.10/edac-amd64-fix-pci-component-registration.patch new file mode 100644 index 00000000000..df8985559a1 --- /dev/null +++ b/queue-5.10/edac-amd64-fix-pci-component-registration.patch @@ -0,0 +1,114 @@ +From 706657b1febf446a9ba37dc51b89f46604f57ee9 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Sun, 22 Nov 2020 15:57:21 +0100 +Subject: EDAC/amd64: Fix PCI component registration + +From: Borislav Petkov + +commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream. + +In order to setup its PCI component, the driver needs any node private +instance in order to get a reference to the PCI device and hand that +into edac_pci_create_generic_ctl(). For convenience, it uses the 0th +memory controller descriptor under the assumption that if any, the 0th +will be always present. + +However, this assumption goes wrong when the 0th node doesn't have +memory and the driver doesn't initialize an instance for it: + + EDAC amd64: F17h detected (node 0). + ... + EDAC amd64: Node 0: No DIMMs detected. + +But looking up node instances is not really needed - all one needs is +the pointer to the proper device which gets discovered during instance +init. + +So stash that pointer into a variable and use it when setting up the +EDAC PCI component. + +Clear that variable when the driver needs to unwind due to some +instances failing init to avoid any registration imbalance. + +Cc: +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20201122150815.13808-1-bp@alien8.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/amd64_edac.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -18,6 +18,9 @@ static struct amd64_family_type *fam_typ + /* Per-node stuff */ + static struct ecc_settings **ecc_stngs; + ++/* Device for the PCI component */ ++static struct device *pci_ctl_dev; ++ + /* + * Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing + * bandwidth to a valid bit pattern. The 'set' operation finds the 'matching- +@@ -2683,6 +2686,9 @@ reserve_mc_sibling_devs(struct amd64_pvt + return -ENODEV; + } + ++ if (!pci_ctl_dev) ++ pci_ctl_dev = &pvt->F0->dev; ++ + edac_dbg(1, "F0: %s\n", pci_name(pvt->F0)); + edac_dbg(1, "F3: %s\n", pci_name(pvt->F3)); + edac_dbg(1, "F6: %s\n", pci_name(pvt->F6)); +@@ -2707,6 +2713,9 @@ reserve_mc_sibling_devs(struct amd64_pvt + return -ENODEV; + } + ++ if (!pci_ctl_dev) ++ pci_ctl_dev = &pvt->F2->dev; ++ + edac_dbg(1, "F1: %s\n", pci_name(pvt->F1)); + edac_dbg(1, "F2: %s\n", pci_name(pvt->F2)); + edac_dbg(1, "F3: %s\n", pci_name(pvt->F3)); +@@ -3623,21 +3632,10 @@ static void remove_one_instance(unsigned + + static void setup_pci_device(void) + { +- struct mem_ctl_info *mci; +- struct amd64_pvt *pvt; +- + if (pci_ctl) + return; + +- mci = edac_mc_find(0); +- if (!mci) +- return; +- +- pvt = mci->pvt_info; +- if (pvt->umc) +- pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR); +- else +- pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR); ++ pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR); + if (!pci_ctl) { + pr_warn("%s(): Unable to create PCI control\n", __func__); + pr_warn("%s(): PCI error report via EDAC not set\n", __func__); +@@ -3716,6 +3714,8 @@ static int __init amd64_edac_init(void) + return 0; + + err_pci: ++ pci_ctl_dev = NULL; ++ + msrs_free(msrs); + msrs = NULL; + +@@ -3745,6 +3745,8 @@ static void __exit amd64_edac_exit(void) + kfree(ecc_stngs); + ecc_stngs = NULL; + ++ pci_ctl_dev = NULL; ++ + msrs_free(msrs); + msrs = NULL; + } diff --git a/queue-5.10/edac-i10nm-use-readl-to-access-mmio-registers.patch b/queue-5.10/edac-i10nm-use-readl-to-access-mmio-registers.patch new file mode 100644 index 00000000000..47bc9a7ee3b --- /dev/null +++ b/queue-5.10/edac-i10nm-use-readl-to-access-mmio-registers.patch @@ -0,0 +1,61 @@ +From 83ff51c4e3fecf6b8587ce4d46f6eac59f5d7c5a Mon Sep 17 00:00:00 2001 +From: Qiuxu Zhuo +Date: Tue, 17 Nov 2020 20:49:51 +0800 +Subject: EDAC/i10nm: Use readl() to access MMIO registers + +From: Qiuxu Zhuo + +commit 83ff51c4e3fecf6b8587ce4d46f6eac59f5d7c5a upstream. + +Instead of raw access, use readl() to access MMIO registers of +memory controller to avoid possible compiler re-ordering. + +Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors") +Cc: +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/i10nm_base.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -6,6 +6,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -19,14 +20,16 @@ + #define i10nm_printk(level, fmt, arg...) \ + edac_printk(level, "i10nm", fmt, ##arg) + +-#define I10NM_GET_SCK_BAR(d, reg) \ ++#define I10NM_GET_SCK_BAR(d, reg) \ + pci_read_config_dword((d)->uracu, 0xd0, &(reg)) + #define I10NM_GET_IMC_BAR(d, i, reg) \ + pci_read_config_dword((d)->uracu, 0xd8 + (i) * 4, &(reg)) + #define I10NM_GET_DIMMMTR(m, i, j) \ +- (*(u32 *)((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4)) ++ readl((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4) + #define I10NM_GET_MCDDRTCFG(m, i, j) \ +- (*(u32 *)((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4)) ++ readl((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4) ++#define I10NM_GET_MCMTR(m, i) \ ++ readl((m)->mbase + 0x20ef8 + (i) * 0x4000) + + #define I10NM_GET_SCK_MMIO_BASE(reg) (GET_BITFIELD(reg, 0, 28) << 23) + #define I10NM_GET_IMC_MMIO_OFFSET(reg) (GET_BITFIELD(reg, 0, 10) << 12) +@@ -148,7 +151,7 @@ static bool i10nm_check_ecc(struct skx_i + { + u32 mcmtr; + +- mcmtr = *(u32 *)(imc->mbase + 0x20ef8 + chan * 0x4000); ++ mcmtr = I10NM_GET_MCMTR(imc, chan); + edac_dbg(1, "ch%d mcmtr reg %x\n", chan, mcmtr); + + return !!GET_BITFIELD(mcmtr, 2, 2); diff --git a/queue-5.10/input-cyapa_gen6-fix-out-of-bounds-stack-access.patch b/queue-5.10/input-cyapa_gen6-fix-out-of-bounds-stack-access.patch new file mode 100644 index 00000000000..f1d4ef6e8f6 --- /dev/null +++ b/queue-5.10/input-cyapa_gen6-fix-out-of-bounds-stack-access.patch @@ -0,0 +1,44 @@ +From f051ae4f6c732c231046945b36234e977f8467c6 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 14 Dec 2020 13:37:46 -0800 +Subject: Input: cyapa_gen6 - fix out-of-bounds stack access + +From: Arnd Bergmann + +commit f051ae4f6c732c231046945b36234e977f8467c6 upstream. + +gcc -Warray-bounds warns about a serious bug in +cyapa_pip_retrieve_data_structure: + +drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop': +include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds] + 40 | *((__le16 *)p) = cpu_to_le16(val); +drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd' + 569 | } __packed cmd; + | ^~~ + +Apparently the '-2' was added to the pointer instead of the value, +writing garbage into the stack next to this variable. + +Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/cyapa_gen6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/mouse/cyapa_gen6.c ++++ b/drivers/input/mouse/cyapa_gen6.c +@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_struc + + memset(&cmd, 0, sizeof(cmd)); + put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr); +- put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2); ++ put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length); + cmd.head.report_id = PIP_APP_CMD_REPORT_ID; + cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE; + put_unaligned_le16(read_offset, &cmd.read_offset); diff --git a/queue-5.10/m68k-fix-warning-splat-in-pmac_zilog-driver.patch b/queue-5.10/m68k-fix-warning-splat-in-pmac_zilog-driver.patch new file mode 100644 index 00000000000..6f177bbae18 --- /dev/null +++ b/queue-5.10/m68k-fix-warning-splat-in-pmac_zilog-driver.patch @@ -0,0 +1,137 @@ +From a7b5458ce73b235be027cf2658c39b19b7e58cf2 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Sun, 22 Nov 2020 10:28:17 +1100 +Subject: m68k: Fix WARNING splat in pmac_zilog driver + +From: Finn Thain + +commit a7b5458ce73b235be027cf2658c39b19b7e58cf2 upstream. + +Don't add platform resources that won't be used. This avoids a +recently-added warning from the driver core, that can show up on a +multi-platform kernel when !MACH_IS_MAC. + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at drivers/base/platform.c:224 platform_get_irq_optional+0x8e/0xce +0 is an invalid IRQ number +Modules linked in: +CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-multi #1 +Stack from 004b3f04: + 004b3f04 00462c2f 00462c2f 004b3f20 0002e128 004754db 004b6ad4 004b3f4c + 0002e19c 004754f7 000000e0 00285ba0 00000009 00000000 004b3f44 ffffffff + 004754db 004b3f64 004b3f74 00285ba0 004754f7 000000e0 00000009 004754db + 004fdf0c 005269e2 004fdf0c 00000000 004b3f88 00285cae 004b6964 00000000 + 004fdf0c 004b3fac 0051cc68 004b6964 00000000 004b6964 00000200 00000000 + 0051cc3e 0023c18a 004b3fc0 0051cd8a 004fdf0c 00000002 0052b43c 004b3fc8 +Call Trace: [<0002e128>] __warn+0xa6/0xd6 + [<0002e19c>] warn_slowpath_fmt+0x44/0x76 + [<00285ba0>] platform_get_irq_optional+0x8e/0xce + [<00285ba0>] platform_get_irq_optional+0x8e/0xce + [<00285cae>] platform_get_irq+0x12/0x4c + [<0051cc68>] pmz_init_port+0x2a/0xa6 + [<0051cc3e>] pmz_init_port+0x0/0xa6 + [<0023c18a>] strlen+0x0/0x22 + [<0051cd8a>] pmz_probe+0x34/0x88 + [<0051cde6>] pmz_console_init+0x8/0x28 + [<00511776>] console_init+0x1e/0x28 + [<0005a3bc>] printk+0x0/0x16 + [<0050a8a6>] start_kernel+0x368/0x4ce + [<005094f8>] _sinittext+0x4f8/0xc48 +random: get_random_bytes called from print_oops_end_marker+0x56/0x80 with crng_init=0 +---[ end trace 392d8e82eed68d6c ]--- + +Commit a85a6c86c25b ("driver core: platform: Clarify that IRQ 0 is invalid"), +which introduced the WARNING, suggests that testing for irq == 0 is +undesirable. Instead of that comparison, just test for resource existence. + +Cc: Michael Ellerman +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Cc: Joshua Thompson +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: stable@vger.kernel.org # v5.8+ +Reported-by: Laurent Vivier +Signed-off-by: Finn Thain +Link: https://lore.kernel.org/r/0c0fe1e4f11ccec202d4df09ea7d9d98155d101a.1606001297.git.fthain@telegraphics.com.au +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + arch/m68k/mac/config.c | 17 +++++++++-------- + drivers/tty/serial/pmac_zilog.c | 14 +++++++++----- + 2 files changed, 18 insertions(+), 13 deletions(-) + +--- a/arch/m68k/mac/config.c ++++ b/arch/m68k/mac/config.c +@@ -777,16 +777,12 @@ static struct resource scc_b_rsrcs[] = { + struct platform_device scc_a_pdev = { + .name = "scc", + .id = 0, +- .num_resources = ARRAY_SIZE(scc_a_rsrcs), +- .resource = scc_a_rsrcs, + }; + EXPORT_SYMBOL(scc_a_pdev); + + struct platform_device scc_b_pdev = { + .name = "scc", + .id = 1, +- .num_resources = ARRAY_SIZE(scc_b_rsrcs), +- .resource = scc_b_rsrcs, + }; + EXPORT_SYMBOL(scc_b_pdev); + +@@ -813,10 +809,15 @@ static void __init mac_identify(void) + + /* Set up serial port resources for the console initcall. */ + +- scc_a_rsrcs[0].start = (resource_size_t) mac_bi_data.sccbase + 2; +- scc_a_rsrcs[0].end = scc_a_rsrcs[0].start; +- scc_b_rsrcs[0].start = (resource_size_t) mac_bi_data.sccbase; +- scc_b_rsrcs[0].end = scc_b_rsrcs[0].start; ++ scc_a_rsrcs[0].start = (resource_size_t)mac_bi_data.sccbase + 2; ++ scc_a_rsrcs[0].end = scc_a_rsrcs[0].start; ++ scc_a_pdev.num_resources = ARRAY_SIZE(scc_a_rsrcs); ++ scc_a_pdev.resource = scc_a_rsrcs; ++ ++ scc_b_rsrcs[0].start = (resource_size_t)mac_bi_data.sccbase; ++ scc_b_rsrcs[0].end = scc_b_rsrcs[0].start; ++ scc_b_pdev.num_resources = ARRAY_SIZE(scc_b_rsrcs); ++ scc_b_pdev.resource = scc_b_rsrcs; + + switch (macintosh_config->scc_type) { + case MAC_SCC_PSC: +--- a/drivers/tty/serial/pmac_zilog.c ++++ b/drivers/tty/serial/pmac_zilog.c +@@ -1693,22 +1693,26 @@ static int __init pmz_probe(void) + + #else + ++/* On PCI PowerMacs, pmz_probe() does an explicit search of the OpenFirmware ++ * tree to obtain the device_nodes needed to start the console before the ++ * macio driver. On Macs without OpenFirmware, global platform_devices take ++ * the place of those device_nodes. ++ */ + extern struct platform_device scc_a_pdev, scc_b_pdev; + + static int __init pmz_init_port(struct uart_pmac_port *uap) + { +- struct resource *r_ports; +- int irq; ++ struct resource *r_ports, *r_irq; + + r_ports = platform_get_resource(uap->pdev, IORESOURCE_MEM, 0); +- irq = platform_get_irq(uap->pdev, 0); +- if (!r_ports || irq <= 0) ++ r_irq = platform_get_resource(uap->pdev, IORESOURCE_IRQ, 0); ++ if (!r_ports || !r_irq) + return -ENODEV; + + uap->port.mapbase = r_ports->start; + uap->port.membase = (unsigned char __iomem *) r_ports->start; + uap->port.iotype = UPIO_MEM; +- uap->port.irq = irq; ++ uap->port.irq = r_irq->start; + uap->port.uartclk = ZS_CLOCK; + uap->port.fifosize = 1; + uap->port.ops = &pmz_pops; diff --git a/queue-5.10/media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch b/queue-5.10/media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch new file mode 100644 index 00000000000..0db8ece08cf --- /dev/null +++ b/queue-5.10/media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch @@ -0,0 +1,35 @@ +From 219a8b9c04e54872f9a4d566633fb42f08bcbe2a Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Fri, 9 Oct 2020 15:56:05 +0200 +Subject: media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE + +From: Sakari Ailus + +commit 219a8b9c04e54872f9a4d566633fb42f08bcbe2a upstream. + +The ipu3-cio2 doesn't make use of the field and this is reflected in V4L2 +buffers as well as the try format. Do this in active format, too. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Reviewed-by: Andy Shevchenko +Reviewed-by: Laurent Pinchart +Cc: stable@vger.kernel.org # v4.16 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1286,6 +1286,7 @@ static int cio2_subdev_set_fmt(struct v4 + fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH); + fmt->format.height = min_t(u32, fmt->format.height, + CIO2_IMAGE_MAX_LENGTH); ++ fmt->format.field = V4L2_FIELD_NONE; + + mutex_lock(&q->subdev_lock); + *mbus = fmt->format; diff --git a/queue-5.10/media-ipu3-cio2-remove-traces-of-returned-buffers.patch b/queue-5.10/media-ipu3-cio2-remove-traces-of-returned-buffers.patch new file mode 100644 index 00000000000..894fda5ab92 --- /dev/null +++ b/queue-5.10/media-ipu3-cio2-remove-traces-of-returned-buffers.patch @@ -0,0 +1,35 @@ +From 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Mon, 12 Oct 2020 17:25:28 +0200 +Subject: media: ipu3-cio2: Remove traces of returned buffers + +From: Sakari Ailus + +commit 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 upstream. + +If starting a video buffer queue fails, the buffers are returned to +videobuf2. Remove the reference to the buffer from the driver's queue as +well. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Cc: stable@vger.kernel.org # v4.16 and up +Reviewed-by: Andy Shevchenko +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -791,6 +791,7 @@ static void cio2_vb2_return_all_buffers( + atomic_dec(&q->bufs_queued); + vb2_buffer_done(&q->bufs[i]->vbb.vb2_buf, + state); ++ q->bufs[i] = NULL; + } + } + } diff --git a/queue-5.10/media-ipu3-cio2-return-actual-subdev-format.patch b/queue-5.10/media-ipu3-cio2-return-actual-subdev-format.patch new file mode 100644 index 00000000000..027899397fe --- /dev/null +++ b/queue-5.10/media-ipu3-cio2-return-actual-subdev-format.patch @@ -0,0 +1,62 @@ +From 8160e86702e0807bd36d40f82648f9f9820b9d5a Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 8 Oct 2020 21:06:28 +0200 +Subject: media: ipu3-cio2: Return actual subdev format + +From: Sakari Ailus + +commit 8160e86702e0807bd36d40f82648f9f9820b9d5a upstream. + +Return actual subdev format on ipu3-cio2 subdev pads. The earlier +implementation was based on an infinite recursion that exhausted the +stack. + +Reported-by: Tsuchiya Yuto +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Bingbu Cao +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v4.16 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 24 +++--------------------- + 1 file changed, 3 insertions(+), 21 deletions(-) + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1233,29 +1233,11 @@ static int cio2_subdev_get_fmt(struct v4 + struct v4l2_subdev_format *fmt) + { + struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); +- struct v4l2_subdev_format format; +- int ret; + +- if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { ++ if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) + fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad); +- return 0; +- } +- +- if (fmt->pad == CIO2_PAD_SINK) { +- format.which = V4L2_SUBDEV_FORMAT_ACTIVE; +- ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, +- &format); +- +- if (ret) +- return ret; +- /* update colorspace etc */ +- q->subdev_fmt.colorspace = format.format.colorspace; +- q->subdev_fmt.ycbcr_enc = format.format.ycbcr_enc; +- q->subdev_fmt.quantization = format.format.quantization; +- q->subdev_fmt.xfer_func = format.format.xfer_func; +- } +- +- fmt->format = q->subdev_fmt; ++ else ++ fmt->format = q->subdev_fmt; + + return 0; + } diff --git a/queue-5.10/media-ipu3-cio2-serialise-access-to-pad-format.patch b/queue-5.10/media-ipu3-cio2-serialise-access-to-pad-format.patch new file mode 100644 index 00000000000..6a47cb5f33f --- /dev/null +++ b/queue-5.10/media-ipu3-cio2-serialise-access-to-pad-format.patch @@ -0,0 +1,95 @@ +From 55a6c6b2be3d6670bf5772364d8208bd8dc17da4 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 8 Oct 2020 21:29:38 +0200 +Subject: media: ipu3-cio2: Serialise access to pad format + +From: Sakari Ailus + +commit 55a6c6b2be3d6670bf5772364d8208bd8dc17da4 upstream. + +Pad format can be accessed from user space. Serialise access to it. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Reviewed-by: Bingbu Cao +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v4.16 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 11 +++++++++++ + drivers/media/pci/intel/ipu3/ipu3-cio2.h | 1 + + 2 files changed, 12 insertions(+) + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1234,11 +1234,15 @@ static int cio2_subdev_get_fmt(struct v4 + { + struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); + ++ mutex_lock(&q->subdev_lock); ++ + if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) + fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad); + else + fmt->format = q->subdev_fmt; + ++ mutex_unlock(&q->subdev_lock); ++ + return 0; + } + +@@ -1262,6 +1266,8 @@ static int cio2_subdev_set_fmt(struct v4 + if (fmt->pad == CIO2_PAD_SOURCE) + return cio2_subdev_get_fmt(sd, cfg, fmt); + ++ mutex_lock(&q->subdev_lock); ++ + if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { + *v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format; + } else { +@@ -1272,6 +1278,8 @@ static int cio2_subdev_set_fmt(struct v4 + fmt->format = q->subdev_fmt; + } + ++ mutex_unlock(&q->subdev_lock); ++ + return 0; + } + +@@ -1530,6 +1538,7 @@ static int cio2_queue_init(struct cio2_d + + /* Initialize miscellaneous variables */ + mutex_init(&q->lock); ++ mutex_init(&q->subdev_lock); + + /* Initialize formats to default values */ + fmt = &q->subdev_fmt; +@@ -1646,6 +1655,7 @@ fail_vdev_media_entity: + fail_subdev_media_entity: + cio2_fbpt_exit(q, &cio2->pci_dev->dev); + fail_fbpt: ++ mutex_destroy(&q->subdev_lock); + mutex_destroy(&q->lock); + + return r; +@@ -1658,6 +1668,7 @@ static void cio2_queue_exit(struct cio2_ + v4l2_device_unregister_subdev(&q->subdev); + media_entity_cleanup(&q->subdev.entity); + cio2_fbpt_exit(q, &cio2->pci_dev->dev); ++ mutex_destroy(&q->subdev_lock); + mutex_destroy(&q->lock); + } + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.h ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.h +@@ -335,6 +335,7 @@ struct cio2_queue { + + /* Subdev, /dev/v4l-subdevX */ + struct v4l2_subdev subdev; ++ struct mutex subdev_lock; /* Serialise acces to subdev_fmt field */ + struct media_pad subdev_pads[CIO2_PADS]; + struct v4l2_mbus_framefmt subdev_fmt; + atomic_t frame_sequence; diff --git a/queue-5.10/media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch b/queue-5.10/media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch new file mode 100644 index 00000000000..3f822b11fc7 --- /dev/null +++ b/queue-5.10/media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch @@ -0,0 +1,74 @@ +From a86cf9b29e8b12811cf53c4970eefe0c1d290476 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 8 Oct 2020 21:33:26 +0200 +Subject: media: ipu3-cio2: Validate mbus format in setting subdev format + +From: Sakari Ailus + +commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream. + +Validate media bus code, width and height when setting the subdev format. + +This effectively reworks how setting subdev format is implemented in the +driver. + +Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Signed-off-by: Sakari Ailus +Reviewed-by: Andy Shevchenko +Reviewed-by: Laurent Pinchart +Cc: stable@vger.kernel.org # v4.16 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 29 ++++++++++++++++++++--------- + 1 file changed, 20 insertions(+), 9 deletions(-) + +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1258,6 +1258,9 @@ static int cio2_subdev_set_fmt(struct v4 + struct v4l2_subdev_format *fmt) + { + struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev); ++ struct v4l2_mbus_framefmt *mbus; ++ u32 mbus_code = fmt->format.code; ++ unsigned int i; + + /* + * Only allow setting sink pad format; +@@ -1266,18 +1269,26 @@ static int cio2_subdev_set_fmt(struct v4 + if (fmt->pad == CIO2_PAD_SOURCE) + return cio2_subdev_get_fmt(sd, cfg, fmt); + +- mutex_lock(&q->subdev_lock); ++ if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) ++ mbus = v4l2_subdev_get_try_format(sd, cfg, fmt->pad); ++ else ++ mbus = &q->subdev_fmt; ++ ++ fmt->format.code = formats[0].mbus_code; + +- if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { +- *v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format; +- } else { +- /* It's the sink, allow changing frame size */ +- q->subdev_fmt.width = fmt->format.width; +- q->subdev_fmt.height = fmt->format.height; +- q->subdev_fmt.code = fmt->format.code; +- fmt->format = q->subdev_fmt; ++ for (i = 0; i < ARRAY_SIZE(formats); i++) { ++ if (formats[i].mbus_code == fmt->format.code) { ++ fmt->format.code = mbus_code; ++ break; ++ } + } + ++ fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH); ++ fmt->format.height = min_t(u32, fmt->format.height, ++ CIO2_IMAGE_MAX_LENGTH); ++ ++ mutex_lock(&q->subdev_lock); ++ *mbus = fmt->format; + mutex_unlock(&q->subdev_lock); + + return 0; diff --git a/queue-5.10/media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch b/queue-5.10/media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch new file mode 100644 index 00000000000..57489d9f80f --- /dev/null +++ b/queue-5.10/media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch @@ -0,0 +1,69 @@ +From e297ddf296de35037fa97f4302782def196d350a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 7 Dec 2020 09:17:12 +0100 +Subject: media: netup_unidvb: Don't leak SPI master in probe error path + +From: Lukas Wunner + +commit e297ddf296de35037fa97f4302782def196d350a upstream. + +If the call to spi_register_master() fails on probe of the NetUP +Universal DVB driver, the spi_master struct is erroneously not freed. + +Likewise, if spi_new_device() fails, the spi_controller struct is +not unregistered. Plug the leaks. + +While at it, fix an ordering issue in netup_spi_release() wherein +spi_unregister_master() is called after fiddling with the IRQ control +register. The correct order is to call spi_unregister_master() *before* +this teardown step because bus accesses may still be ongoing until that +function returns. + +Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") +Signed-off-by: Lukas Wunner +Reviewed-by: Mauro Carvalho Chehab +Cc: # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation +Cc: # v4.3+ +Cc: Kozlov Sergey +Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c +@@ -175,7 +175,7 @@ int netup_spi_init(struct netup_unidvb_d + struct spi_master *master; + struct netup_spi *nspi; + +- master = spi_alloc_master(&ndev->pci_dev->dev, ++ master = devm_spi_alloc_master(&ndev->pci_dev->dev, + sizeof(struct netup_spi)); + if (!master) { + dev_err(&ndev->pci_dev->dev, +@@ -208,6 +208,7 @@ int netup_spi_init(struct netup_unidvb_d + ndev->pci_slot, + ndev->pci_func); + if (!spi_new_device(master, &netup_spi_board)) { ++ spi_unregister_master(master); + ndev->spi = NULL; + dev_err(&ndev->pci_dev->dev, + "%s(): unable to create SPI device\n", __func__); +@@ -226,13 +227,13 @@ void netup_spi_release(struct netup_unid + if (!spi) + return; + ++ spi_unregister_master(spi->master); + spin_lock_irqsave(&spi->lock, flags); + reg = readw(&spi->regs->control_stat); + writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat); + reg = readw(&spi->regs->control_stat); + writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat); + spin_unlock_irqrestore(&spi->lock, flags); +- spi_unregister_master(spi->master); + ndev->spi = NULL; + } + diff --git a/queue-5.10/media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch b/queue-5.10/media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch new file mode 100644 index 00000000000..019055ea61b --- /dev/null +++ b/queue-5.10/media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch @@ -0,0 +1,42 @@ +From 3f56df4c8ffeb120ed41906d3aae71799b7e726a Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Mon, 9 Nov 2020 23:16:52 +0100 +Subject: media: sunxi-cir: ensure IR is handled when it is continuous + +From: Sean Young + +commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream. + +If a user holds a button down on a remote, then no ir idle interrupt will +be generated until the user releases the button, depending on how quickly +the remote repeats. No IR is processed until that point, which means that +holding down a button may not do anything. + +This also resolves an issue on a Cubieboard 1 where the IR receiver is +picking up ambient infrared as IR and spews out endless +"rc rc0: IR event FIFO is full!" messages unless you choose to live in +the dark. + +Cc: stable@vger.kernel.org +Tested-by: Hans Verkuil +Acked-by: Maxime Ripard +Reported-by: Hans Verkuil +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/sunxi-cir.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/rc/sunxi-cir.c ++++ b/drivers/media/rc/sunxi-cir.c +@@ -137,6 +137,8 @@ static irqreturn_t sunxi_ir_irq(int irqn + } else if (status & REG_RXSTA_RPE) { + ir_raw_event_set_idle(ir->rc, true); + ir_raw_event_handle(ir->rc); ++ } else { ++ ir_raw_event_handle(ir->rc); + } + + spin_unlock(&ir->ir_lock); diff --git a/queue-5.10/perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch b/queue-5.10/perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch new file mode 100644 index 00000000000..4cb628ec368 --- /dev/null +++ b/queue-5.10/perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch @@ -0,0 +1,41 @@ +From 306e3e91edf1c6739a55312edd110d298ff498dd Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Mon, 19 Oct 2020 09:45:29 -0700 +Subject: perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY + +From: Kan Liang + +commit 306e3e91edf1c6739a55312edd110d298ff498dd upstream. + +The event CYCLE_ACTIVITY.STALLS_MEM_ANY (0x14a3) should be available on +all 8 GP counters on ICL, but it's only scheduled on the first four +counters due to the current ICL constraint table. + +Add a line for the CYCLE_ACTIVITY.STALLS_MEM_ANY event in the ICL +constraint table. +Correct the comments for the CYCLE_ACTIVITY.CYCLES_MEM_ANY event. + +Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") +Reported-by: Andi Kleen +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20201019164529.32154-1-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -257,7 +257,8 @@ static struct event_constraint intel_icl + INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x54, 0xf), + INTEL_EVENT_CONSTRAINT_RANGE(0x60, 0x8b, 0xf), + INTEL_UEVENT_CONSTRAINT(0x04a3, 0xff), /* CYCLE_ACTIVITY.STALLS_TOTAL */ +- INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff), /* CYCLE_ACTIVITY.STALLS_MEM_ANY */ ++ INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff), /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */ ++ INTEL_UEVENT_CONSTRAINT(0x14a3, 0xff), /* CYCLE_ACTIVITY.STALLS_MEM_ANY */ + INTEL_EVENT_CONSTRAINT(0xa3, 0xf), /* CYCLE_ACTIVITY.* */ + INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf), + INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf), diff --git a/queue-5.10/perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch b/queue-5.10/perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch new file mode 100644 index 00000000000..e89b3ffe922 --- /dev/null +++ b/queue-5.10/perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch @@ -0,0 +1,39 @@ +From 46b72e1bf4fc571da0c29c6fb3e5b2a2107a4c26 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Wed, 25 Nov 2020 13:37:19 -0800 +Subject: perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake + +From: Kan Liang + +commit 46b72e1bf4fc571da0c29c6fb3e5b2a2107a4c26 upstream. + +According to the event list from icelake_core_v1.09.json, the encoding +of the RTM_RETIRED.ABORTED event on Ice Lake should be, + "EventCode": "0xc9", + "UMask": "0x04", + "EventName": "RTM_RETIRED.ABORTED", + +Correct the wrong encoding. + +Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20201125213720.15692-1-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -5465,7 +5465,7 @@ __init int intel_pmu_init(void) + mem_attr = icl_events_attrs; + td_attr = icl_td_events_attrs; + tsx_attr = icl_tsx_events_attrs; +- x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xca, .umask=0x02); ++ x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xc9, .umask=0x04); + x86_pmu.lbr_pt_coexist = true; + intel_pmu_pebs_data_source_skl(pmem); + x86_pmu.update_topdown_event = icl_update_topdown_event; diff --git a/queue-5.10/perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch b/queue-5.10/perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch new file mode 100644 index 00000000000..255be28d89f --- /dev/null +++ b/queue-5.10/perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch @@ -0,0 +1,39 @@ +From f8129cd958b395575e5543ce25a8434874b04d3a Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Wed, 25 Nov 2020 13:37:20 -0800 +Subject: perf/x86/intel/lbr: Fix the return type of get_lbr_cycles() + +From: Kan Liang + +commit f8129cd958b395575e5543ce25a8434874b04d3a upstream. + +The cycle count of a timed LBR is always 1 in perf record -D. + +The cycle count is stored in the first 16 bits of the IA32_LBR_x_INFO +register, but the get_lbr_cycles() return Boolean type. + +Use u16 to replace the Boolean type. + +Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR") +Reported-by: Stephane Eranian +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20201125213720.15692-2-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/lbr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/lbr.c ++++ b/arch/x86/events/intel/lbr.c +@@ -919,7 +919,7 @@ static __always_inline bool get_lbr_pred + return !(info & LBR_INFO_MISPRED); + } + +-static __always_inline bool get_lbr_cycles(u64 info) ++static __always_inline u16 get_lbr_cycles(u64 info) + { + if (static_cpu_has(X86_FEATURE_ARCH_LBR) && + !(x86_pmu.lbr_timed_lbr && info & LBR_INFO_CYC_CNT_VALID)) diff --git a/queue-5.10/pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch b/queue-5.10/pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch new file mode 100644 index 00000000000..ed575edba9a --- /dev/null +++ b/queue-5.10/pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch @@ -0,0 +1,186 @@ +From 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 24 Nov 2020 20:44:00 +0100 +Subject: PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() + +From: Rafael J. Wysocki + +commit 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 upstream. + +The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to +be reference counted for wakeup enabling, because they may be enabled +to signal wakeup on behalf of their subordinate devices and that +may happen for multiple times in a row, whereas for the other devices +it only makes sense to enable wakeup signaling once. + +However, this becomes problematic if the bridge itself is suspended, +because it is treated as a "regular" device in that case and the +reference counting doesn't work. + +For instance, suppose that there are two devices below a bridge and +they both can signal wakeup. Every time one of them is suspended, +wakeup signaling is enabled for the bridge, so when they both have +been suspended, the bridge's wakeup reference counter value is 2. + +Say that the bridge is suspended subsequently and acpi_pci_wakeup() +is called for it. Because the bridge can signal wakeup, that +function will invoke acpi_pm_set_device_wakeup() to configure it +and __acpi_pm_set_device_wakeup() will be called with the last +argument equal to 1. This causes __acpi_device_wakeup_enable() +invoked by it to omit the reference counting, because the reference +counter of the target device (the bridge) is 2 at that time. + +Now say that the bridge resumes and one of the device below it +resumes too, so the bridge's reference counter becomes 0 and +wakeup signaling is disabled for it, but there is still the other +suspended device which may need the bridge to signal wakeup on its +behalf and that is not going to work. + +To address this scenario, use wakeup enable reference counting for +all devices, not just for bridges, so drop the last argument from +__acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(), +which causes acpi_pm_set_device_wakeup() and +acpi_pm_set_bridge_wakeup() to become identical, so drop the latter +and use the former instead of it everywhere. + +Fixes: 1ba51a7c1496 ("ACPI / PCI / PM: Rework acpi_pci_propagate_wakeup()") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Acked-by: Bjorn Helgaas +Cc: 4.14+ # 4.14+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 41 ++++++++++++----------------------------- + drivers/pci/pci-acpi.c | 4 ++-- + include/acpi/acpi_bus.h | 5 ----- + 3 files changed, 14 insertions(+), 36 deletions(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -749,7 +749,7 @@ static void acpi_pm_notify_work_func(str + static DEFINE_MUTEX(acpi_wakeup_lock); + + static int __acpi_device_wakeup_enable(struct acpi_device *adev, +- u32 target_state, int max_count) ++ u32 target_state) + { + struct acpi_device_wakeup *wakeup = &adev->wakeup; + acpi_status status; +@@ -757,9 +757,10 @@ static int __acpi_device_wakeup_enable(s + + mutex_lock(&acpi_wakeup_lock); + +- if (wakeup->enable_count >= max_count) ++ if (wakeup->enable_count >= INT_MAX) { ++ acpi_handle_info(adev->handle, "Wakeup enable count out of bounds!\n"); + goto out; +- ++ } + if (wakeup->enable_count > 0) + goto inc; + +@@ -799,7 +800,7 @@ out: + */ + static int acpi_device_wakeup_enable(struct acpi_device *adev, u32 target_state) + { +- return __acpi_device_wakeup_enable(adev, target_state, 1); ++ return __acpi_device_wakeup_enable(adev, target_state); + } + + /** +@@ -829,8 +830,12 @@ out: + mutex_unlock(&acpi_wakeup_lock); + } + +-static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable, +- int max_count) ++/** ++ * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device. ++ * @dev: Device to enable/disable to generate wakeup events. ++ * @enable: Whether to enable or disable the wakeup functionality. ++ */ ++int acpi_pm_set_device_wakeup(struct device *dev, bool enable) + { + struct acpi_device *adev; + int error; +@@ -850,37 +855,15 @@ static int __acpi_pm_set_device_wakeup(s + return 0; + } + +- error = __acpi_device_wakeup_enable(adev, acpi_target_system_state(), +- max_count); ++ error = __acpi_device_wakeup_enable(adev, acpi_target_system_state()); + if (!error) + dev_dbg(dev, "Wakeup enabled by ACPI\n"); + + return error; + } +- +-/** +- * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device. +- * @dev: Device to enable/disable to generate wakeup events. +- * @enable: Whether to enable or disable the wakeup functionality. +- */ +-int acpi_pm_set_device_wakeup(struct device *dev, bool enable) +-{ +- return __acpi_pm_set_device_wakeup(dev, enable, 1); +-} + EXPORT_SYMBOL_GPL(acpi_pm_set_device_wakeup); + + /** +- * acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge. +- * @dev: Bridge device to enable/disable to generate wakeup events. +- * @enable: Whether to enable or disable the wakeup functionality. +- */ +-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable) +-{ +- return __acpi_pm_set_device_wakeup(dev, enable, INT_MAX); +-} +-EXPORT_SYMBOL_GPL(acpi_pm_set_bridge_wakeup); +- +-/** + * acpi_dev_pm_low_power - Put ACPI device into a low-power state. + * @dev: Device to put into a low-power state. + * @adev: ACPI device node corresponding to @dev. +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -1060,7 +1060,7 @@ static int acpi_pci_propagate_wakeup(str + { + while (bus->parent) { + if (acpi_pm_device_can_wakeup(&bus->self->dev)) +- return acpi_pm_set_bridge_wakeup(&bus->self->dev, enable); ++ return acpi_pm_set_device_wakeup(&bus->self->dev, enable); + + bus = bus->parent; + } +@@ -1068,7 +1068,7 @@ static int acpi_pci_propagate_wakeup(str + /* We have reached the root bus. */ + if (bus->bridge) { + if (acpi_pm_device_can_wakeup(bus->bridge)) +- return acpi_pm_set_bridge_wakeup(bus->bridge, enable); ++ return acpi_pm_set_device_wakeup(bus->bridge, enable); + } + return 0; + } +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -620,7 +620,6 @@ acpi_status acpi_remove_pm_notifier(stru + bool acpi_pm_device_can_wakeup(struct device *dev); + int acpi_pm_device_sleep_state(struct device *, int *, int); + int acpi_pm_set_device_wakeup(struct device *dev, bool enable); +-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable); + #else + static inline void acpi_pm_wakeup_event(struct device *dev) + { +@@ -651,10 +650,6 @@ static inline int acpi_pm_set_device_wak + { + return -ENODEV; + } +-static inline int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable) +-{ +- return -ENODEV; +-} + #endif + + #ifdef CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT diff --git a/queue-5.10/powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch b/queue-5.10/powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch new file mode 100644 index 00000000000..f6b8020407a --- /dev/null +++ b/queue-5.10/powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch @@ -0,0 +1,46 @@ +From aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 Mon Sep 17 00:00:00 2001 +From: Athira Rajeev +Date: Wed, 25 Nov 2020 02:26:55 -0500 +Subject: powerpc/perf: Exclude kernel samples while counting events in user space. + +From: Athira Rajeev + +commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream. + +Perf event attritube supports exclude_kernel flag to avoid +sampling/profiling in supervisor state (kernel). Based on this event +attr flag, Monitor Mode Control Register bit is set to freeze on +supervisor state. But sometimes (due to hardware limitation), Sampled +Instruction Address Register (SIAR) locks on to kernel address even +when freeze on supervisor is set. Patch here adds a check to drop +those samples. + +Cc: stable@vger.kernel.org +Signed-off-by: Athira Rajeev +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1606289215-1433-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/perf/core-book3s.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2125,6 +2125,16 @@ static void record_and_restart(struct pe + perf_event_update_userpage(event); + + /* ++ * Due to hardware limitation, sometimes SIAR could sample a kernel ++ * address even when freeze on supervisor state (kernel) is set in ++ * MMCR2. Check attr.exclude_kernel and address to drop the sample in ++ * these cases. ++ */ ++ if (event->attr.exclude_kernel && record) ++ if (is_kernel_addr(mfspr(SPRN_SIAR))) ++ record = 0; ++ ++ /* + * Finally record data if requested. + */ + if (record) { diff --git a/queue-5.10/revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch b/queue-5.10/revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch new file mode 100644 index 00000000000..3b564dbb13c --- /dev/null +++ b/queue-5.10/revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch @@ -0,0 +1,39 @@ +From 12fc4dad94dfac25599f31257aac181c691ca96f Mon Sep 17 00:00:00 2001 +From: Daniel Scally +Date: Sat, 5 Dec 2020 17:04:03 +0000 +Subject: Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" + +From: Daniel Scally + +commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream. + +This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef. + +Switching this function to AE_CTRL_TERMINATE broke the documented +behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in +fact, terminate the resource walk because acpi_walk_resource_buffer() +ignores it (specifically converting it to AE_OK), referring to that +value as "an OK termination by the user function". This means that +acpi_dev_get_resources() does not abort processing when the preproc +function returns a negative value. + +Signed-off-by: Daniel Scally +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -541,7 +541,7 @@ static acpi_status acpi_dev_process_reso + ret = c->preproc(ares, c->preproc_data); + if (ret < 0) { + c->error = ret; +- return AE_CTRL_TERMINATE; ++ return AE_ABORT_METHOD; + } else if (ret > 0) { + return AE_OK; + } diff --git a/queue-5.10/s390-dasd-fix-hanging-device-offline-processing.patch b/queue-5.10/s390-dasd-fix-hanging-device-offline-processing.patch new file mode 100644 index 00000000000..bdf94d6c7bc --- /dev/null +++ b/queue-5.10/s390-dasd-fix-hanging-device-offline-processing.patch @@ -0,0 +1,58 @@ +From 658a337a606f48b7ebe451591f7681d383fa115e Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 17 Dec 2020 16:59:04 +0100 +Subject: s390/dasd: fix hanging device offline processing + +From: Stefan Haberland + +commit 658a337a606f48b7ebe451591f7681d383fa115e upstream. + +For an LCU update a read unit address configuration IO is required. +This is started using sleep_on(), which has early exit paths in case the +device is not usable for IO. For example when it is in offline processing. + +In those cases the LCU update should fail and not be retried. +Therefore lcu_update_work checks if EOPNOTSUPP is returned or not. + +Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") +accidentally removed the EOPNOTSUPP return code from +read_unit_address_configuration(), which in turn might lead to an endless +loop of the LCU update in offline processing. + +Fix by returning EOPNOTSUPP again if the device is not able to perform the +request. + +Fixes: 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") +Cc: stable@vger.kernel.org #5.3 +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_alias.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -462,11 +462,19 @@ static int read_unit_address_configurati + spin_unlock_irqrestore(&lcu->lock, flags); + + rc = dasd_sleep_on(cqr); +- if (rc && !suborder_not_supported(cqr)) { ++ if (!rc) ++ goto out; ++ ++ if (suborder_not_supported(cqr)) { ++ /* suborder not supported or device unusable for IO */ ++ rc = -EOPNOTSUPP; ++ } else { ++ /* IO failed but should be retried */ + spin_lock_irqsave(&lcu->lock, flags); + lcu->flags |= NEED_UAC_UPDATE; + spin_unlock_irqrestore(&lcu->lock, flags); + } ++out: + dasd_sfree_request(cqr, cqr->memdev); + return rc; + } diff --git a/queue-5.10/s390-dasd-fix-list-corruption-of-lcu-list.patch b/queue-5.10/s390-dasd-fix-list-corruption-of-lcu-list.patch new file mode 100644 index 00000000000..02530318ed8 --- /dev/null +++ b/queue-5.10/s390-dasd-fix-list-corruption-of-lcu-list.patch @@ -0,0 +1,53 @@ +From 53a7f655834c7c335bf683f248208d4fbe4b47bc Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 17 Dec 2020 16:59:07 +0100 +Subject: s390/dasd: fix list corruption of lcu list + +From: Stefan Haberland + +commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream. + +In dasd_alias_disconnect_device_from_lcu the device is removed from any +list on the LCU. Afterwards the LCU is removed from the lcu list if it +does not contain devices any longer. + +The lcu->lock protects the lcu from parallel updates. But to cancel all +workers and wait for completion the lcu->lock has to be unlocked. + +If two devices are removed in parallel and both are removed from the LCU +the first device that takes the lcu->lock again will delete the LCU because +it is already empty but the second device also tries to free the LCU which +leads to a list corruption of the lcu list. + +Fix by removing the device right before the lcu is checked without +unlocking the lcu->lock in between. + +Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") +Cc: stable@vger.kernel.org +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_alias.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_l + return; + device->discipline->get_uid(device, &uid); + spin_lock_irqsave(&lcu->lock, flags); +- list_del_init(&device->alias_list); + /* make sure that the workers don't use this device */ + if (device == lcu->suc_data.device) { + spin_unlock_irqrestore(&lcu->lock, flags); +@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_l + + spin_lock_irqsave(&aliastree.lock, flags); + spin_lock(&lcu->lock); ++ list_del_init(&device->alias_list); + if (list_empty(&lcu->grouplist) && + list_empty(&lcu->active_devices) && + list_empty(&lcu->inactive_devices)) { diff --git a/queue-5.10/s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch b/queue-5.10/s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch new file mode 100644 index 00000000000..5174796010a --- /dev/null +++ b/queue-5.10/s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch @@ -0,0 +1,55 @@ +From 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 17 Dec 2020 16:59:06 +0100 +Subject: s390/dasd: fix list corruption of pavgroup group list + +From: Stefan Haberland + +commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream. + +dasd_alias_add_device() moves devices to the active_devices list in case +of a scheduled LCU update regardless if they have previously been in a +pavgroup or not. + +Example: device A and B are in the same pavgroup. + +Device A has already been in a pavgroup and the private->pavgroup pointer +is set and points to a valid pavgroup. While going through dasd_add_device +it is moved from the pavgroup to the active_devices list. + +In parallel device B might be removed from the same pavgroup in +remove_device_from_lcu() which in turn checks if the group is empty +and deletes it accordingly because device A has already been removed from +there. + +When now device A enters remove_device_from_lcu() it is tried to remove it +from the pavgroup again because the pavgroup pointer is still set and again +the empty group will be cleaned up which leads to a list corruption. + +Fix by setting private->pavgroup to NULL in dasd_add_device. + +If the device has been the last device on the pavgroup an empty pavgroup +remains but this will be cleaned up by the scheduled lcu_update which +iterates over all existing pavgroups. + +Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") +Cc: stable@vger.kernel.org +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_alias.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -642,6 +642,7 @@ int dasd_alias_add_device(struct dasd_de + } + if (lcu->flags & UPDATE_PENDING) { + list_move(&device->alias_list, &lcu->active_devices); ++ private->pavgroup = NULL; + _schedule_lcu_update(lcu, device); + } + spin_unlock_irqrestore(&lcu->lock, flags); diff --git a/queue-5.10/s390-dasd-prevent-inconsistent-lcu-device-data.patch b/queue-5.10/s390-dasd-prevent-inconsistent-lcu-device-data.patch new file mode 100644 index 00000000000..74a15a2fc1f --- /dev/null +++ b/queue-5.10/s390-dasd-prevent-inconsistent-lcu-device-data.patch @@ -0,0 +1,52 @@ +From a29ea01653493b94ea12bb2b89d1564a265081b6 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 17 Dec 2020 16:59:05 +0100 +Subject: s390/dasd: prevent inconsistent LCU device data + +From: Stefan Haberland + +commit a29ea01653493b94ea12bb2b89d1564a265081b6 upstream. + +Prevent _lcu_update from adding a device to a pavgroup if the LCU still +requires an update. The data is not reliable any longer and in parallel +devices might have been moved on the lists already. +This might lead to list corruptions or invalid PAV grouping. +Only add devices to a pavgroup if the LCU is up to date. Additional steps +are taken by the scheduled lcu update. + +Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") +Cc: stable@vger.kernel.org +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_alias.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -511,6 +511,14 @@ static int _lcu_update(struct dasd_devic + return rc; + + spin_lock_irqsave(&lcu->lock, flags); ++ /* ++ * there is another update needed skip the remaining handling ++ * the data might already be outdated ++ * but especially do not add the device to an LCU with pending ++ * update ++ */ ++ if (lcu->flags & NEED_UAC_UPDATE) ++ goto out; + lcu->pav = NO_PAV; + for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) { + switch (lcu->uac->unit[i].ua_type) { +@@ -529,6 +537,7 @@ static int _lcu_update(struct dasd_devic + alias_list) { + _add_device_to_lcu(lcu, device, refdev); + } ++out: + spin_unlock_irqrestore(&lcu->lock, flags); + return 0; + } diff --git a/queue-5.10/s390-idle-add-missing-mt_cycles-calculation.patch b/queue-5.10/s390-idle-add-missing-mt_cycles-calculation.patch new file mode 100644 index 00000000000..b713342027c --- /dev/null +++ b/queue-5.10/s390-idle-add-missing-mt_cycles-calculation.patch @@ -0,0 +1,87 @@ +From e259b3fafa7de362b04ecd86e7fa9a9e9273e5fb Mon Sep 17 00:00:00 2001 +From: Sven Schnelle +Date: Thu, 3 Dec 2020 22:03:32 +0100 +Subject: s390/idle: add missing mt_cycles calculation + +From: Sven Schnelle + +commit e259b3fafa7de362b04ecd86e7fa9a9e9273e5fb upstream. + +During removal of the critical section cleanup the calculation +of mt_cycles during idle was removed. This causes invalid +accounting on systems with SMT enabled. + +Fixes: 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S") +Cc: # 5.8 +Reviewed-by: Heiko Carstens +Signed-off-by: Sven Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/entry.S | 34 +++++++++++++++++++++++++--------- + 1 file changed, 25 insertions(+), 9 deletions(-) + +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -112,7 +112,7 @@ _LPP_OFFSET = __LC_LPP + + .macro SWITCH_ASYNC savearea,timer + tmhh %r8,0x0001 # interrupting from user ? +- jnz 2f ++ jnz 4f + #if IS_ENABLED(CONFIG_KVM) + lgr %r14,%r9 + larl %r13,.Lsie_gmap +@@ -125,9 +125,25 @@ _LPP_OFFSET = __LC_LPP + #endif + 0: larl %r13,.Lpsw_idle_exit + cgr %r13,%r9 +- jne 1f ++ jne 3f + +- mvc __CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK ++ larl %r1,smp_cpu_mtid ++ llgf %r1,0(%r1) ++ ltgr %r1,%r1 ++ jz 2f # no SMT, skip mt_cycles calculation ++ .insn rsy,0xeb0000000017,%r1,5,__SF_EMPTY+80(%r15) ++ larl %r3,mt_cycles ++ ag %r3,__LC_PERCPU_OFFSET ++ la %r4,__SF_EMPTY+16(%r15) ++1: lg %r0,0(%r3) ++ slg %r0,0(%r4) ++ alg %r0,64(%r4) ++ stg %r0,0(%r3) ++ la %r3,8(%r3) ++ la %r4,8(%r4) ++ brct %r1,1b ++ ++2: mvc __CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK + mvc __TIMER_IDLE_EXIT(8,%r2), __LC_ASYNC_ENTER_TIMER + # account system time going idle + ni __LC_CPU_FLAGS+7,255-_CIF_ENABLED_WAIT +@@ -146,17 +162,17 @@ _LPP_OFFSET = __LC_LPP + mvc __LC_LAST_UPDATE_TIMER(8),__TIMER_IDLE_EXIT(%r2) + + nihh %r8,0xfcfd # clear wait state and irq bits +-1: lg %r14,__LC_ASYNC_STACK # are we already on the target stack? ++3: lg %r14,__LC_ASYNC_STACK # are we already on the target stack? + slgr %r14,%r15 + srag %r14,%r14,STACK_SHIFT +- jnz 3f ++ jnz 5f + CHECK_STACK \savearea + aghi %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE) +- j 4f +-2: UPDATE_VTIME %r14,%r15,\timer ++ j 6f ++4: UPDATE_VTIME %r14,%r15,\timer + BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP +-3: lg %r15,__LC_ASYNC_STACK # load async stack +-4: la %r11,STACK_FRAME_OVERHEAD(%r15) ++5: lg %r15,__LC_ASYNC_STACK # load async stack ++6: la %r11,STACK_FRAME_OVERHEAD(%r15) + .endm + + .macro UPDATE_VTIME w1,w2,enter_timer diff --git a/queue-5.10/s390-idle-fix-accounting-with-machine-checks.patch b/queue-5.10/s390-idle-fix-accounting-with-machine-checks.patch new file mode 100644 index 00000000000..1080f1deebf --- /dev/null +++ b/queue-5.10/s390-idle-fix-accounting-with-machine-checks.patch @@ -0,0 +1,73 @@ +From 454efcf82ea17d7efeb86ebaa20775a21ec87d27 Mon Sep 17 00:00:00 2001 +From: Sven Schnelle +Date: Sun, 6 Dec 2020 10:47:47 +0100 +Subject: s390/idle: fix accounting with machine checks + +From: Sven Schnelle + +commit 454efcf82ea17d7efeb86ebaa20775a21ec87d27 upstream. + +When a machine check interrupt is triggered during idle, the code +is using the async timer/clock for idle time calculation. It should use +the machine check enter timer/clock which is passed to the macro. + +Fixes: 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S") +Cc: # 5.8 +Reviewed-by: Heiko Carstens +Signed-off-by: Sven Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/entry.S | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -110,7 +110,7 @@ _LPP_OFFSET = __LC_LPP + #endif + .endm + +- .macro SWITCH_ASYNC savearea,timer ++ .macro SWITCH_ASYNC savearea,timer,clock + tmhh %r8,0x0001 # interrupting from user ? + jnz 4f + #if IS_ENABLED(CONFIG_KVM) +@@ -143,8 +143,8 @@ _LPP_OFFSET = __LC_LPP + la %r4,8(%r4) + brct %r1,1b + +-2: mvc __CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK +- mvc __TIMER_IDLE_EXIT(8,%r2), __LC_ASYNC_ENTER_TIMER ++2: mvc __CLOCK_IDLE_EXIT(8,%r2), \clock ++ mvc __TIMER_IDLE_EXIT(8,%r2), \timer + # account system time going idle + ni __LC_CPU_FLAGS+7,255-_CIF_ENABLED_WAIT + +@@ -761,7 +761,7 @@ ENTRY(io_int_handler) + stmg %r8,%r15,__LC_SAVE_AREA_ASYNC + lg %r12,__LC_CURRENT + lmg %r8,%r9,__LC_IO_OLD_PSW +- SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER ++ SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER,__LC_INT_CLOCK + stmg %r0,%r7,__PT_R0(%r11) + # clear user controlled registers to prevent speculative use + xgr %r0,%r0 +@@ -961,7 +961,7 @@ ENTRY(ext_int_handler) + stmg %r8,%r15,__LC_SAVE_AREA_ASYNC + lg %r12,__LC_CURRENT + lmg %r8,%r9,__LC_EXT_OLD_PSW +- SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER ++ SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER,__LC_INT_CLOCK + stmg %r0,%r7,__PT_R0(%r11) + # clear user controlled registers to prevent speculative use + xgr %r0,%r0 +@@ -1183,7 +1183,7 @@ ENTRY(mcck_int_handler) + TSTMSK __LC_MCCK_CODE,MCCK_CODE_PSW_IA_VALID + jno .Lmcck_panic + 4: ssm __LC_PGM_NEW_PSW # turn dat on, keep irqs off +- SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+64,__LC_MCCK_ENTER_TIMER ++ SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+64,__LC_MCCK_ENTER_TIMER,__LC_MCCK_CLOCK + .Lmcck_skip: + lghi %r14,__LC_GPREGS_SAVE_AREA+64 + stmg %r0,%r7,__PT_R0(%r11) diff --git a/queue-5.10/s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch b/queue-5.10/s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch new file mode 100644 index 00000000000..5cdf56108ed --- /dev/null +++ b/queue-5.10/s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch @@ -0,0 +1,65 @@ +From 613775d62ec60202f98d2c5f520e6e9ba6dd4ac4 Mon Sep 17 00:00:00 2001 +From: Philipp Rudo +Date: Thu, 26 Nov 2020 18:31:08 +0100 +Subject: s390/kexec_file: fix diag308 subcode when loading crash kernel + +From: Philipp Rudo + +commit 613775d62ec60202f98d2c5f520e6e9ba6dd4ac4 upstream. + +diag308 subcode 0 performes a clear reset which inlcudes the reset of +all registers in the system. While this is the preferred behavior when +loading a normal kernel via kexec it prevents the crash kernel to store +the register values in the dump. To prevent this use subcode 1 when +loading a crash kernel instead. + +Fixes: ee337f5469fd ("s390/kexec_file: Add crash support to image loader") +Cc: # 4.17 +Signed-off-by: Philipp Rudo +Reported-by: Xiaoying Yan +Tested-by: Lianbo Jiang +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/purgatory/head.S | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/s390/purgatory/head.S ++++ b/arch/s390/purgatory/head.S +@@ -62,14 +62,15 @@ + jh 10b + .endm + +-.macro START_NEXT_KERNEL base ++.macro START_NEXT_KERNEL base subcode + lg %r4,kernel_entry-\base(%r13) + lg %r5,load_psw_mask-\base(%r13) + ogr %r4,%r5 + stg %r4,0(%r0) + + xgr %r0,%r0 +- diag %r0,%r0,0x308 ++ lghi %r1,\subcode ++ diag %r0,%r1,0x308 + .endm + + .text +@@ -123,7 +124,7 @@ ENTRY(purgatory_start) + je .start_crash_kernel + + /* start normal kernel */ +- START_NEXT_KERNEL .base_crash ++ START_NEXT_KERNEL .base_crash 0 + + .return_old_kernel: + lmg %r6,%r15,gprregs-.base_crash(%r13) +@@ -227,7 +228,7 @@ ENTRY(purgatory_start) + MEMCPY %r9,%r10,%r11 + + /* start crash kernel */ +- START_NEXT_KERNEL .base_dst ++ START_NEXT_KERNEL .base_dst 1 + + + load_psw_mask: diff --git a/queue-5.10/s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch b/queue-5.10/s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch new file mode 100644 index 00000000000..b9d07a26512 --- /dev/null +++ b/queue-5.10/s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch @@ -0,0 +1,55 @@ +From b5e438ebd7e808d1d2435159ac4742e01a94b8da Mon Sep 17 00:00:00 2001 +From: Sven Schnelle +Date: Tue, 8 Dec 2020 07:35:21 +0100 +Subject: s390/smp: perform initial CPU reset also for SMT siblings + +From: Sven Schnelle + +commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream. + +Not resetting the SMT siblings might leave them in unpredictable +state. One of the observed problems was that the CPU timer wasn't +reset and therefore large system time values where accounted during +CPU bringup. + +Cc: # 4.0 +Fixes: 10ad34bc76dfb ("s390: add SMT support") +Reviewed-by: Heiko Carstens +Signed-off-by: Sven Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/smp.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -896,24 +896,12 @@ static void __no_sanitize_address smp_st + /* Upping and downing of CPUs */ + int __cpu_up(unsigned int cpu, struct task_struct *tidle) + { +- struct pcpu *pcpu; +- int base, i, rc; ++ struct pcpu *pcpu = pcpu_devices + cpu; ++ int rc; + +- pcpu = pcpu_devices + cpu; + if (pcpu->state != CPU_STATE_CONFIGURED) + return -EIO; +- base = smp_get_base_cpu(cpu); +- for (i = 0; i <= smp_cpu_mtid; i++) { +- if (base + i < nr_cpu_ids) +- if (cpu_online(base + i)) +- break; +- } +- /* +- * If this is the first CPU of the core to get online +- * do an initial CPU reset. +- */ +- if (i > smp_cpu_mtid && +- pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) != ++ if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) != + SIGP_CC_ORDER_CODE_ACCEPTED) + return -EIO; + diff --git a/queue-5.10/series b/queue-5.10/series index b1a446ed318..2c3fb8d9e11 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -519,3 +519,68 @@ io_uring-hold-uring_lock-while-completing-failed-polled-io-in-io_wq_submit_work. io_uring-fix-ignoring-xa_store-errors.patch io_uring-fix-double-io_uring-free.patch io_uring-make-ctx-cancel-on-exit-targeted-to-actual-ctx.patch +media-sunxi-cir-ensure-ir-is-handled-when-it-is-continuous.patch +media-netup_unidvb-don-t-leak-spi-master-in-probe-error-path.patch +media-ipu3-cio2-remove-traces-of-returned-buffers.patch +media-ipu3-cio2-return-actual-subdev-format.patch +media-ipu3-cio2-serialise-access-to-pad-format.patch +media-ipu3-cio2-validate-mbus-format-in-setting-subdev-format.patch +media-ipu3-cio2-make-the-field-on-subdev-format-v4l2_field_none.patch +input-cyapa_gen6-fix-out-of-bounds-stack-access.patch +alsa-hda-ca0132-change-input-source-enum-strings.patch +acpi-nfit-fix-input-validation-of-bus-family.patch +pm-acpi-pci-drop-acpi_pm_set_bridge_wakeup.patch +revert-acpi-resources-use-ae_ctrl_terminate-to-terminate-resources-walks.patch +acpi-pnp-compare-the-string-length-in-the-matching_id.patch +alsa-hda-fix-regressions-on-clear-and-reconfig-sysfs.patch +alsa-hda-ca0132-fix-ae-5-rear-headphone-pincfg.patch +alsa-hda-realtek-make-bass-spk-volume-adjustable-on-a-yoga-laptop.patch +alsa-hda-realtek-enable-headset-mic-of-asus-x430un-with-alc256.patch +alsa-hda-realtek-enable-headset-mic-of-asus-q524uqk-with-alc255.patch +alsa-hda-realtek-add-supported-for-more-lenovo-alc285-headset-button.patch +alsa-pcm-oss-fix-a-few-more-ubsan-fixes.patch +alsa-hda-apply-jack-fixup-for-the-acer-veriton-n4640g-n6640g-n2510g.patch +alsa-hda-realtek-add-quirk-for-msi-gp73.patch +alsa-hda-realtek-apply-jack-fixup-for-quanta-nl3.patch +alsa-hda-realtek-remove-dummy-lineout-on-acer-travelmate-p648-p658.patch +alsa-hda-realtek-supported-dell-fixed-type-headset.patch +alsa-usb-audio-add-vid-to-support-native-dsd-reproduction-on-fiio-devices.patch +alsa-usb-audio-disable-sample-read-check-if-firmware-doesn-t-give-back.patch +alsa-usb-audio-add-alias-entry-for-asus-prime-trx40-pro-s.patch +alsa-core-memalloc-add-page-alignment-for-iram.patch +s390-smp-perform-initial-cpu-reset-also-for-smt-siblings.patch +s390-kexec_file-fix-diag308-subcode-when-loading-crash-kernel.patch +s390-idle-add-missing-mt_cycles-calculation.patch +s390-idle-fix-accounting-with-machine-checks.patch +s390-dasd-fix-hanging-device-offline-processing.patch +s390-dasd-prevent-inconsistent-lcu-device-data.patch +s390-dasd-fix-list-corruption-of-pavgroup-group-list.patch +s390-dasd-fix-list-corruption-of-lcu-list.patch +binder-add-flag-to-clear-buffer-on-txn-complete.patch +asoc-cx2072x-fix-doubly-definitions-of-playback-and-capture-streams.patch +asoc-amd-renoir-add-dmi-table-to-avoid-the-acp-mic-probe-broken-bios.patch +asoc-amd-raven-renoir-fix-the-pci-probe-pci-revision.patch +staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch +z3fold-simplify-freeing-slots.patch +z3fold-stricter-locking-and-more-careful-reclaim.patch +perf-x86-intel-add-event-constraint-for-cycle_activity.stalls_mem_any.patch +perf-x86-intel-fix-rtm_abort_event-encoding-on-ice-lake.patch +perf-x86-intel-lbr-fix-the-return-type-of-get_lbr_cycles.patch +powerpc-perf-exclude-kernel-samples-while-counting-events-in-user-space.patch +cpufreq-intel_pstate-use-most-recent-guaranteed-performance-values.patch +crypto-ecdh-avoid-unaligned-accesses-in-ecdh_set_secret.patch +crypto-arm-aes-ce-work-around-cortex-a57-a72-silion-errata.patch +m68k-fix-warning-splat-in-pmac_zilog-driver.patch +documentation-seqlock-s-locktype-lockname-g.patch +edac-i10nm-use-readl-to-access-mmio-registers.patch +edac-amd64-fix-pci-component-registration.patch +cpuset-fix-race-between-hotplug-work-and-later-cpu-offline.patch +dyndbg-fix-use-before-null-check.patch +usb-serial-mos7720-fix-parallel-port-state-restore.patch +usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch +usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch +usb-serial-keyspan_pda-fix-write-deadlock.patch +usb-serial-keyspan_pda-fix-stalled-writes.patch +usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch +usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch +usb-serial-keyspan_pda-fix-write-unthrottling.patch diff --git a/queue-5.10/staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch b/queue-5.10/staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch new file mode 100644 index 00000000000..28b627a4ae7 --- /dev/null +++ b/queue-5.10/staging-comedi-mf6x4-fix-ai-end-of-conversion-detection.patch @@ -0,0 +1,50 @@ +From 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 7 Dec 2020 14:58:06 +0000 +Subject: staging: comedi: mf6x4: Fix AI end-of-conversion detection + +From: Ian Abbott + +commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream. + +I have had reports from two different people that attempts to read the +analog input channels of the MF624 board fail with an `ETIMEDOUT` error. + +After triggering the conversion, the code calls `comedi_timeout()` with +`mf6x4_ai_eoc()` as the callback function to check if the conversion is +complete. The callback returns 0 if complete or `-EBUSY` if not yet +complete. `comedi_timeout()` returns `-ETIMEDOUT` if it has not +completed within a timeout period which is propagated as an error to the +user application. + +The existing code considers the conversion to be complete when the EOLC +bit is high. However, according to the user manuals for the MF624 and +MF634 boards, this test is incorrect because EOLC is an active low +signal that goes high when the conversion is triggered, and goes low +when the conversion is complete. Fix the problem by inverting the test +of the EOLC bit state. + +Fixes: 04b565021a83 ("comedi: Humusoft MF634 and MF624 DAQ cards driver") +Cc: # v4.4+ +Cc: Rostislav Lisovy +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20201207145806.4046-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/mf6x4.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/mf6x4.c ++++ b/drivers/staging/comedi/drivers/mf6x4.c +@@ -112,8 +112,9 @@ static int mf6x4_ai_eoc(struct comedi_de + struct mf6x4_private *devpriv = dev->private; + unsigned int status; + ++ /* EOLC goes low at end of conversion. */ + status = ioread32(devpriv->gpioc_reg); +- if (status & MF6X4_GPIOC_EOLC) ++ if ((status & MF6X4_GPIOC_EOLC) == 0) + return 0; + return -EBUSY; + } diff --git a/queue-5.10/usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch b/queue-5.10/usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch new file mode 100644 index 00000000000..b6371419772 --- /dev/null +++ b/queue-5.10/usb-serial-digi_acceleport-fix-write-wakeup-deadlocks.patch @@ -0,0 +1,156 @@ +From 5098e77962e7c8947f87bd8c5869c83e000a522a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 Oct 2020 11:43:06 +0100 +Subject: USB: serial: digi_acceleport: fix write-wakeup deadlocks + +From: Johan Hovold + +commit 5098e77962e7c8947f87bd8c5869c83e000a522a upstream. + +The driver must not call tty_wakeup() while holding its private lock as +line disciplines are allowed to call back into write() from +write_wakeup(), leading to a deadlock. + +Also remove the unneeded work struct that was used to defer wakeup in +order to work around a possible race in ancient times (see comment about +n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove +changelogs and old todo entries")). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/digi_acceleport.c | 45 ++++++++++------------------------- + 1 file changed, 13 insertions(+), 32 deletions(-) + +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -19,7 +19,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -198,14 +197,12 @@ struct digi_port { + int dp_throttle_restart; + wait_queue_head_t dp_flush_wait; + wait_queue_head_t dp_close_wait; /* wait queue for close */ +- struct work_struct dp_wakeup_work; + struct usb_serial_port *dp_port; + }; + + + /* Local Function Declarations */ + +-static void digi_wakeup_write_lock(struct work_struct *work); + static int digi_write_oob_command(struct usb_serial_port *port, + unsigned char *buf, int count, int interruptible); + static int digi_write_inb_command(struct usb_serial_port *port, +@@ -356,26 +353,6 @@ __releases(lock) + return timeout; + } + +- +-/* +- * Digi Wakeup Write +- * +- * Wake up port, line discipline, and tty processes sleeping +- * on writes. +- */ +- +-static void digi_wakeup_write_lock(struct work_struct *work) +-{ +- struct digi_port *priv = +- container_of(work, struct digi_port, dp_wakeup_work); +- struct usb_serial_port *port = priv->dp_port; +- unsigned long flags; +- +- spin_lock_irqsave(&priv->dp_port_lock, flags); +- tty_port_tty_wakeup(&port->port); +- spin_unlock_irqrestore(&priv->dp_port_lock, flags); +-} +- + /* + * Digi Write OOB Command + * +@@ -986,6 +963,7 @@ static void digi_write_bulk_callback(str + unsigned long flags; + int ret = 0; + int status = urb->status; ++ bool wakeup; + + /* port and serial sanity check */ + if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) { +@@ -1012,6 +990,7 @@ static void digi_write_bulk_callback(str + } + + /* try to send any buffered data on this port */ ++ wakeup = true; + spin_lock_irqsave(&priv->dp_port_lock, flags); + priv->dp_write_urb_in_use = 0; + if (priv->dp_out_buf_len > 0) { +@@ -1027,19 +1006,18 @@ static void digi_write_bulk_callback(str + if (ret == 0) { + priv->dp_write_urb_in_use = 1; + priv->dp_out_buf_len = 0; ++ wakeup = false; + } + } +- /* wake up processes sleeping on writes immediately */ +- tty_port_tty_wakeup(&port->port); +- /* also queue up a wakeup at scheduler time, in case we */ +- /* lost the race in write_chan(). */ +- schedule_work(&priv->dp_wakeup_work); +- + spin_unlock_irqrestore(&priv->dp_port_lock, flags); ++ + if (ret && ret != -EPERM) + dev_err_console(port, + "%s: usb_submit_urb failed, ret=%d, port=%d\n", + __func__, ret, priv->dp_port_num); ++ ++ if (wakeup) ++ tty_port_tty_wakeup(&port->port); + } + + static int digi_write_room(struct tty_struct *tty) +@@ -1239,7 +1217,6 @@ static int digi_port_init(struct usb_ser + init_waitqueue_head(&priv->dp_transmit_idle_wait); + init_waitqueue_head(&priv->dp_flush_wait); + init_waitqueue_head(&priv->dp_close_wait); +- INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock); + priv->dp_port = port; + + init_waitqueue_head(&port->write_wait); +@@ -1508,13 +1485,14 @@ static int digi_read_oob_callback(struct + rts = C_CRTSCTS(tty); + + if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) { ++ bool wakeup = false; ++ + spin_lock_irqsave(&priv->dp_port_lock, flags); + /* convert from digi flags to termiox flags */ + if (val & DIGI_READ_INPUT_SIGNALS_CTS) { + priv->dp_modem_signals |= TIOCM_CTS; +- /* port must be open to use tty struct */ + if (rts) +- tty_port_tty_wakeup(&port->port); ++ wakeup = true; + } else { + priv->dp_modem_signals &= ~TIOCM_CTS; + /* port must be open to use tty struct */ +@@ -1533,6 +1511,9 @@ static int digi_read_oob_callback(struct + priv->dp_modem_signals &= ~TIOCM_CD; + + spin_unlock_irqrestore(&priv->dp_port_lock, flags); ++ ++ if (wakeup) ++ tty_port_tty_wakeup(&port->port); + } else if (opcode == DIGI_CMD_TRANSMIT_IDLE) { + spin_lock_irqsave(&priv->dp_port_lock, flags); + priv->dp_transmit_idle = 1; diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch b/queue-5.10/usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch new file mode 100644 index 00000000000..f6ab1c5efe7 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-dropped-unthrottle-interrupts.patch @@ -0,0 +1,45 @@ +From 696c541c8c6cfa05d65aa24ae2b9e720fc01766e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:47 +0100 +Subject: USB: serial: keyspan_pda: fix dropped unthrottle interrupts + +From: Johan Hovold + +commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream. + +Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity +checks") broke write-unthrottle handling by dropping well-formed +unthrottle-interrupt packets which are precisely two bytes long. This +could lead to blocked writers not being woken up when buffer space again +becomes available. + +Instead, stop unconditionally printing the third byte which is +(presumably) only valid on modem-line changes. + +Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks") +Cc: stable # 4.11 +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -172,11 +172,11 @@ static void keyspan_pda_rx_interrupt(str + break; + case 1: + /* status interrupt */ +- if (len < 3) { ++ if (len < 2) { + dev_warn(&port->dev, "short interrupt message received\n"); + break; + } +- dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]); ++ dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]); + switch (data[1]) { + case 1: /* modemline change */ + break; diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-stalled-writes.patch b/queue-5.10/usb-serial-keyspan_pda-fix-stalled-writes.patch new file mode 100644 index 00000000000..d7a9eb0d893 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-stalled-writes.patch @@ -0,0 +1,35 @@ +From c01d2c58698f710c9e13ba3e2d296328606f74fd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:49 +0100 +Subject: USB: serial: keyspan_pda: fix stalled writes + +From: Johan Hovold + +commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream. + +Make sure to clear the write-busy flag also in case no new data was +submitted due to lack of device buffer space so that writing is +resumed once space again becomes available. + +Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.") +Cc: stable # 2.6.13 +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -548,7 +548,7 @@ static int keyspan_pda_write(struct tty_ + + rc = count; + exit: +- if (rc < 0) ++ if (rc <= 0) + set_bit(0, &port->write_urbs_free); + return rc; + } diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch b/queue-5.10/usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch new file mode 100644 index 00000000000..d4f76da7823 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-tx-unthrottle-use-after-free.patch @@ -0,0 +1,41 @@ +From 49fbb8e37a961396a5b6c82937c70df91de45e9d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:51 +0100 +Subject: USB: serial: keyspan_pda: fix tx-unthrottle use-after-free + +From: Johan Hovold + +commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream. + +The driver's transmit-unthrottle work was never flushed on disconnect, +something which could lead to the driver port data being freed while the +unthrottle work is still scheduled. + +Fix this by cancelling the unthrottle work when shutting down the port. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -647,8 +647,12 @@ error: + } + static void keyspan_pda_close(struct usb_serial_port *port) + { ++ struct keyspan_pda_private *priv = usb_get_serial_port_data(port); ++ + usb_kill_urb(port->write_urb); + usb_kill_urb(port->interrupt_in_urb); ++ ++ cancel_work_sync(&priv->unthrottle_work); + } + + diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-write-deadlock.patch b/queue-5.10/usb-serial-keyspan_pda-fix-write-deadlock.patch new file mode 100644 index 00000000000..585eda78746 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-write-deadlock.patch @@ -0,0 +1,52 @@ +From 7353cad7ee4deaefc16e94727e69285563e219f6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:48 +0100 +Subject: USB: serial: keyspan_pda: fix write deadlock + +From: Johan Hovold + +commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream. + +The write() callback can be called in interrupt context (e.g. when used +as a console) so interrupts must be disabled while holding the port lock +to prevent a possible deadlock. + +Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)") +Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.") +Cc: stable # 2.6.19 +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_ + int request_unthrottle = 0; + int rc = 0; + struct keyspan_pda_private *priv; ++ unsigned long flags; + + priv = usb_get_serial_port_data(port); + /* guess how much room is left in the device's ring buffer, and if we +@@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_ + the TX urb is in-flight (wait until it completes) + the device is full (wait until it says there is room) + */ +- spin_lock_bh(&port->lock); ++ spin_lock_irqsave(&port->lock, flags); + if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) { +- spin_unlock_bh(&port->lock); ++ spin_unlock_irqrestore(&port->lock, flags); + return 0; + } + clear_bit(0, &port->write_urbs_free); +- spin_unlock_bh(&port->lock); ++ spin_unlock_irqrestore(&port->lock, flags); + + /* At this point the URB is in our control, nobody else can submit it + again (the only sudden transition was the one from EINPROGRESS to diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-write-unthrottling.patch b/queue-5.10/usb-serial-keyspan_pda-fix-write-unthrottling.patch new file mode 100644 index 00000000000..d15c0320441 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-write-unthrottling.patch @@ -0,0 +1,104 @@ +From 320f9028c7873c3c7710e8e93e5c979f4c857490 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:52 +0100 +Subject: USB: serial: keyspan_pda: fix write unthrottling + +From: Johan Hovold + +commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream. + +The driver did not update its view of the available device buffer space +until write() was called in task context. This meant that write_room() +would return 0 even after the device had sent a write-unthrottle +notification, something which could lead to blocked writers not being +woken up (e.g. when using OPOST). + +Note that we must also request an unthrottle notification is case a +write() request fills the device buffer exactly. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 29 ++++++++++++++++++++--------- + 1 file changed, 20 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -40,6 +40,8 @@ + #define DRIVER_AUTHOR "Brian Warner " + #define DRIVER_DESC "USB Keyspan PDA Converter driver" + ++#define KEYSPAN_TX_THRESHOLD 16 ++ + struct keyspan_pda_private { + int tx_room; + int tx_throttled; +@@ -110,7 +112,7 @@ static void keyspan_pda_request_unthrott + 7, /* request_unthrottle */ + USB_TYPE_VENDOR | USB_RECIP_INTERFACE + | USB_DIR_OUT, +- 16, /* value: threshold */ ++ KEYSPAN_TX_THRESHOLD, + 0, /* index */ + NULL, + 0, +@@ -129,6 +131,8 @@ static void keyspan_pda_rx_interrupt(str + int retval; + int status = urb->status; + struct keyspan_pda_private *priv; ++ unsigned long flags; ++ + priv = usb_get_serial_port_data(port); + + switch (status) { +@@ -171,7 +175,10 @@ static void keyspan_pda_rx_interrupt(str + case 1: /* modemline change */ + break; + case 2: /* tx unthrottle interrupt */ ++ spin_lock_irqsave(&port->lock, flags); + priv->tx_throttled = 0; ++ priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD); ++ spin_unlock_irqrestore(&port->lock, flags); + /* queue up a wakeup at scheduler time */ + usb_serial_port_softint(port); + break; +@@ -505,7 +512,8 @@ static int keyspan_pda_write(struct tty_ + goto exit; + } + } +- if (count > priv->tx_room) { ++ ++ if (count >= priv->tx_room) { + /* we're about to completely fill the Tx buffer, so + we'll be throttled afterwards. */ + count = priv->tx_room; +@@ -560,14 +568,17 @@ static void keyspan_pda_write_bulk_callb + static int keyspan_pda_write_room(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct keyspan_pda_private *priv; +- priv = usb_get_serial_port_data(port); +- /* used by n_tty.c for processing of tabs and such. Giving it our +- conservative guess is probably good enough, but needs testing by +- running a console through the device. */ +- return priv->tx_room; +-} ++ struct keyspan_pda_private *priv = usb_get_serial_port_data(port); ++ unsigned long flags; ++ int room = 0; ++ ++ spin_lock_irqsave(&port->lock, flags); ++ if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled) ++ room = priv->tx_room; ++ spin_unlock_irqrestore(&port->lock, flags); + ++ return room; ++} + + static int keyspan_pda_chars_in_buffer(struct tty_struct *tty) + { diff --git a/queue-5.10/usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch b/queue-5.10/usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch new file mode 100644 index 00000000000..36ead4e7b98 --- /dev/null +++ b/queue-5.10/usb-serial-keyspan_pda-fix-write-wakeup-use-after-free.patch @@ -0,0 +1,81 @@ +From 37faf50615412947868c49aee62f68233307f4e4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Sun, 25 Oct 2020 18:45:50 +0100 +Subject: USB: serial: keyspan_pda: fix write-wakeup use-after-free + +From: Johan Hovold + +commit 37faf50615412947868c49aee62f68233307f4e4 upstream. + +The driver's deferred write wakeup was never flushed on disconnect, +something which could lead to the driver port data being freed while the +wakeup work is still scheduled. + +Fix this by using the usb-serial write wakeup which gets cancelled +properly on disconnect. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Acked-by: Sebastian Andrzej Siewior +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan_pda.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -43,8 +43,7 @@ + struct keyspan_pda_private { + int tx_room; + int tx_throttled; +- struct work_struct wakeup_work; +- struct work_struct unthrottle_work; ++ struct work_struct unthrottle_work; + struct usb_serial *serial; + struct usb_serial_port *port; + }; +@@ -97,15 +96,6 @@ static const struct usb_device_id id_tab + }; + #endif + +-static void keyspan_pda_wakeup_write(struct work_struct *work) +-{ +- struct keyspan_pda_private *priv = +- container_of(work, struct keyspan_pda_private, wakeup_work); +- struct usb_serial_port *port = priv->port; +- +- tty_port_tty_wakeup(&port->port); +-} +- + static void keyspan_pda_request_unthrottle(struct work_struct *work) + { + struct keyspan_pda_private *priv = +@@ -183,7 +173,7 @@ static void keyspan_pda_rx_interrupt(str + case 2: /* tx unthrottle interrupt */ + priv->tx_throttled = 0; + /* queue up a wakeup at scheduler time */ +- schedule_work(&priv->wakeup_work); ++ usb_serial_port_softint(port); + break; + default: + break; +@@ -563,7 +553,7 @@ static void keyspan_pda_write_bulk_callb + priv = usb_get_serial_port_data(port); + + /* queue up a wakeup at scheduler time */ +- schedule_work(&priv->wakeup_work); ++ usb_serial_port_softint(port); + } + + +@@ -715,7 +705,6 @@ static int keyspan_pda_port_probe(struct + if (!priv) + return -ENOMEM; + +- INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write); + INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle); + priv->serial = port->serial; + priv->port = port; diff --git a/queue-5.10/usb-serial-mos7720-fix-parallel-port-state-restore.patch b/queue-5.10/usb-serial-mos7720-fix-parallel-port-state-restore.patch new file mode 100644 index 00000000000..4f7b5522a4b --- /dev/null +++ b/queue-5.10/usb-serial-mos7720-fix-parallel-port-state-restore.patch @@ -0,0 +1,34 @@ +From 975323ab8f116667676c30ca3502a6757bd89e8d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 4 Nov 2020 17:47:27 +0100 +Subject: USB: serial: mos7720: fix parallel-port state restore + +From: Johan Hovold + +commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream. + +The parallel-port restore operations is called when a driver claims the +port and is supposed to restore the provided state (e.g. saved when +releasing the port). + +Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715") +Cc: stable # 2.6.35 +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -639,6 +639,8 @@ static void parport_mos7715_restore_stat + spin_unlock(&release_lock); + return; + } ++ mos_parport->shadowDCR = s->u.pc.ctr; ++ mos_parport->shadowECR = s->u.pc.ecr; + write_parport_reg_nonblock(mos_parport, MOS7720_DCR, + mos_parport->shadowDCR); + write_parport_reg_nonblock(mos_parport, MOS7720_ECR, diff --git a/queue-5.10/z3fold-simplify-freeing-slots.patch b/queue-5.10/z3fold-simplify-freeing-slots.patch new file mode 100644 index 00000000000..a5275672e0b --- /dev/null +++ b/queue-5.10/z3fold-simplify-freeing-slots.patch @@ -0,0 +1,183 @@ +From fc5488651c7d840c9cad9b0f273f2f31bd03413a Mon Sep 17 00:00:00 2001 +From: Vitaly Wool +Date: Mon, 14 Dec 2020 19:12:30 -0800 +Subject: z3fold: simplify freeing slots + +From: Vitaly Wool + +commit fc5488651c7d840c9cad9b0f273f2f31bd03413a upstream. + +Patch series "z3fold: stability / rt fixes". + +Address z3fold stability issues under stress load, primarily in the +reclaim and free aspects. Besides, it fixes the locking problems that +were only seen in real-time kernel configuration. + +This patch (of 3): + +There used to be two places in the code where slots could be freed, namely +when freeing the last allocated handle from the slots and when releasing +the z3fold header these slots aree linked to. The logic to decide on +whether to free certain slots was complicated and error prone in both +functions and it led to failures in RT case. + +To fix that, make free_handle() the single point of freeing slots. + +Link: https://lkml.kernel.org/r/20201209145151.18994-1-vitaly.wool@konsulko.com +Link: https://lkml.kernel.org/r/20201209145151.18994-2-vitaly.wool@konsulko.com +Signed-off-by: Vitaly Wool +Tested-by: Mike Galbraith +Cc: Sebastian Andrzej Siewior +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/z3fold.c | 55 +++++++++++++------------------------------------------ + 1 file changed, 13 insertions(+), 42 deletions(-) + +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -90,7 +90,7 @@ struct z3fold_buddy_slots { + * be enough slots to hold all possible variants + */ + unsigned long slot[BUDDY_MASK + 1]; +- unsigned long pool; /* back link + flags */ ++ unsigned long pool; /* back link */ + rwlock_t lock; + }; + #define HANDLE_FLAG_MASK (0x03) +@@ -182,13 +182,6 @@ enum z3fold_page_flags { + }; + + /* +- * handle flags, go under HANDLE_FLAG_MASK +- */ +-enum z3fold_handle_flags { +- HANDLES_ORPHANED = 0, +-}; +- +-/* + * Forward declarations + */ + static struct z3fold_header *__z3fold_alloc(struct z3fold_pool *, size_t, bool); +@@ -303,10 +296,9 @@ static inline void put_z3fold_header(str + z3fold_page_unlock(zhdr); + } + +-static inline void free_handle(unsigned long handle) ++static inline void free_handle(unsigned long handle, struct z3fold_header *zhdr) + { + struct z3fold_buddy_slots *slots; +- struct z3fold_header *zhdr; + int i; + bool is_free; + +@@ -316,22 +308,13 @@ static inline void free_handle(unsigned + if (WARN_ON(*(unsigned long *)handle == 0)) + return; + +- zhdr = handle_to_z3fold_header(handle); + slots = handle_to_slots(handle); + write_lock(&slots->lock); + *(unsigned long *)handle = 0; +- if (zhdr->slots == slots) { +- write_unlock(&slots->lock); +- return; /* simple case, nothing else to do */ +- } ++ if (zhdr->slots != slots) ++ zhdr->foreign_handles--; + +- /* we are freeing a foreign handle if we are here */ +- zhdr->foreign_handles--; + is_free = true; +- if (!test_bit(HANDLES_ORPHANED, &slots->pool)) { +- write_unlock(&slots->lock); +- return; +- } + for (i = 0; i <= BUDDY_MASK; i++) { + if (slots->slot[i]) { + is_free = false; +@@ -343,6 +326,8 @@ static inline void free_handle(unsigned + if (is_free) { + struct z3fold_pool *pool = slots_to_pool(slots); + ++ if (zhdr->slots == slots) ++ zhdr->slots = NULL; + kmem_cache_free(pool->c_handle, slots); + } + } +@@ -525,8 +510,6 @@ static void __release_z3fold_page(struct + { + struct page *page = virt_to_page(zhdr); + struct z3fold_pool *pool = zhdr_to_pool(zhdr); +- bool is_free = true; +- int i; + + WARN_ON(!list_empty(&zhdr->buddy)); + set_bit(PAGE_STALE, &page->private); +@@ -536,21 +519,6 @@ static void __release_z3fold_page(struct + list_del_init(&page->lru); + spin_unlock(&pool->lock); + +- /* If there are no foreign handles, free the handles array */ +- read_lock(&zhdr->slots->lock); +- for (i = 0; i <= BUDDY_MASK; i++) { +- if (zhdr->slots->slot[i]) { +- is_free = false; +- break; +- } +- } +- if (!is_free) +- set_bit(HANDLES_ORPHANED, &zhdr->slots->pool); +- read_unlock(&zhdr->slots->lock); +- +- if (is_free) +- kmem_cache_free(pool->c_handle, zhdr->slots); +- + if (locked) + z3fold_page_unlock(zhdr); + +@@ -973,6 +941,9 @@ lookup: + } + } + ++ if (zhdr && !zhdr->slots) ++ zhdr->slots = alloc_slots(pool, ++ can_sleep ? GFP_NOIO : GFP_ATOMIC); + return zhdr; + } + +@@ -1270,7 +1241,7 @@ static void z3fold_free(struct z3fold_po + } + + if (!page_claimed) +- free_handle(handle); ++ free_handle(handle, zhdr); + if (kref_put(&zhdr->refcount, release_z3fold_page_locked_list)) { + atomic64_dec(&pool->pages_nr); + return; +@@ -1429,19 +1400,19 @@ static int z3fold_reclaim_page(struct z3 + ret = pool->ops->evict(pool, middle_handle); + if (ret) + goto next; +- free_handle(middle_handle); ++ free_handle(middle_handle, zhdr); + } + if (first_handle) { + ret = pool->ops->evict(pool, first_handle); + if (ret) + goto next; +- free_handle(first_handle); ++ free_handle(first_handle, zhdr); + } + if (last_handle) { + ret = pool->ops->evict(pool, last_handle); + if (ret) + goto next; +- free_handle(last_handle); ++ free_handle(last_handle, zhdr); + } + next: + if (test_bit(PAGE_HEADLESS, &page->private)) { diff --git a/queue-5.10/z3fold-stricter-locking-and-more-careful-reclaim.patch b/queue-5.10/z3fold-stricter-locking-and-more-careful-reclaim.patch new file mode 100644 index 00000000000..9799edf3160 --- /dev/null +++ b/queue-5.10/z3fold-stricter-locking-and-more-careful-reclaim.patch @@ -0,0 +1,347 @@ +From dcf5aedb24f899d537e21c18ea552c780598d352 Mon Sep 17 00:00:00 2001 +From: Vitaly Wool +Date: Mon, 14 Dec 2020 19:12:33 -0800 +Subject: z3fold: stricter locking and more careful reclaim + +From: Vitaly Wool + +commit dcf5aedb24f899d537e21c18ea552c780598d352 upstream. + +Use temporary slots in reclaim function to avoid possible race when +freeing those. + +While at it, make sure we check CLAIMED flag under page lock in the +reclaim function to make sure we are not racing with z3fold_alloc(). + +Link: https://lkml.kernel.org/r/20201209145151.18994-4-vitaly.wool@konsulko.com +Signed-off-by: Vitaly Wool +Cc: +Cc: Mike Galbraith +Cc: Sebastian Andrzej Siewior +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/z3fold.c | 143 +++++++++++++++++++++++++++++++++++------------------------- + 1 file changed, 85 insertions(+), 58 deletions(-) + +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -182,6 +182,13 @@ enum z3fold_page_flags { + }; + + /* ++ * handle flags, go under HANDLE_FLAG_MASK ++ */ ++enum z3fold_handle_flags { ++ HANDLES_NOFREE = 0, ++}; ++ ++/* + * Forward declarations + */ + static struct z3fold_header *__z3fold_alloc(struct z3fold_pool *, size_t, bool); +@@ -311,6 +318,12 @@ static inline void free_handle(unsigned + slots = handle_to_slots(handle); + write_lock(&slots->lock); + *(unsigned long *)handle = 0; ++ ++ if (test_bit(HANDLES_NOFREE, &slots->pool)) { ++ write_unlock(&slots->lock); ++ return; /* simple case, nothing else to do */ ++ } ++ + if (zhdr->slots != slots) + zhdr->foreign_handles--; + +@@ -621,6 +634,28 @@ static inline void add_to_unbuddied(stru + } + } + ++static inline enum buddy get_free_buddy(struct z3fold_header *zhdr, int chunks) ++{ ++ enum buddy bud = HEADLESS; ++ ++ if (zhdr->middle_chunks) { ++ if (!zhdr->first_chunks && ++ chunks <= zhdr->start_middle - ZHDR_CHUNKS) ++ bud = FIRST; ++ else if (!zhdr->last_chunks) ++ bud = LAST; ++ } else { ++ if (!zhdr->first_chunks) ++ bud = FIRST; ++ else if (!zhdr->last_chunks) ++ bud = LAST; ++ else ++ bud = MIDDLE; ++ } ++ ++ return bud; ++} ++ + static inline void *mchunk_memmove(struct z3fold_header *zhdr, + unsigned short dst_chunk) + { +@@ -682,18 +717,7 @@ static struct z3fold_header *compact_sin + if (WARN_ON(new_zhdr == zhdr)) + goto out_fail; + +- if (new_zhdr->first_chunks == 0) { +- if (new_zhdr->middle_chunks != 0 && +- chunks >= new_zhdr->start_middle) { +- new_bud = LAST; +- } else { +- new_bud = FIRST; +- } +- } else if (new_zhdr->last_chunks == 0) { +- new_bud = LAST; +- } else if (new_zhdr->middle_chunks == 0) { +- new_bud = MIDDLE; +- } ++ new_bud = get_free_buddy(new_zhdr, chunks); + q = new_zhdr; + switch (new_bud) { + case FIRST: +@@ -815,9 +839,8 @@ static void do_compact_page(struct z3fol + return; + } + +- if (unlikely(PageIsolated(page) || +- test_bit(PAGE_CLAIMED, &page->private) || +- test_bit(PAGE_STALE, &page->private))) { ++ if (test_bit(PAGE_STALE, &page->private) || ++ test_and_set_bit(PAGE_CLAIMED, &page->private)) { + z3fold_page_unlock(zhdr); + return; + } +@@ -826,13 +849,16 @@ static void do_compact_page(struct z3fol + zhdr->mapped_count == 0 && compact_single_buddy(zhdr)) { + if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) + atomic64_dec(&pool->pages_nr); +- else ++ else { ++ clear_bit(PAGE_CLAIMED, &page->private); + z3fold_page_unlock(zhdr); ++ } + return; + } + + z3fold_compact_page(zhdr); + add_to_unbuddied(pool, zhdr); ++ clear_bit(PAGE_CLAIMED, &page->private); + z3fold_page_unlock(zhdr); + } + +@@ -1080,17 +1106,8 @@ static int z3fold_alloc(struct z3fold_po + retry: + zhdr = __z3fold_alloc(pool, size, can_sleep); + if (zhdr) { +- if (zhdr->first_chunks == 0) { +- if (zhdr->middle_chunks != 0 && +- chunks >= zhdr->start_middle) +- bud = LAST; +- else +- bud = FIRST; +- } else if (zhdr->last_chunks == 0) +- bud = LAST; +- else if (zhdr->middle_chunks == 0) +- bud = MIDDLE; +- else { ++ bud = get_free_buddy(zhdr, chunks); ++ if (bud == HEADLESS) { + if (kref_put(&zhdr->refcount, + release_z3fold_page_locked)) + atomic64_dec(&pool->pages_nr); +@@ -1236,7 +1253,6 @@ static void z3fold_free(struct z3fold_po + pr_err("%s: unknown bud %d\n", __func__, bud); + WARN_ON(1); + put_z3fold_header(zhdr); +- clear_bit(PAGE_CLAIMED, &page->private); + return; + } + +@@ -1251,8 +1267,7 @@ static void z3fold_free(struct z3fold_po + z3fold_page_unlock(zhdr); + return; + } +- if (unlikely(PageIsolated(page)) || +- test_and_set_bit(NEEDS_COMPACTING, &page->private)) { ++ if (test_and_set_bit(NEEDS_COMPACTING, &page->private)) { + put_z3fold_header(zhdr); + clear_bit(PAGE_CLAIMED, &page->private); + return; +@@ -1316,6 +1331,10 @@ static int z3fold_reclaim_page(struct z3 + struct page *page = NULL; + struct list_head *pos; + unsigned long first_handle = 0, middle_handle = 0, last_handle = 0; ++ struct z3fold_buddy_slots slots __attribute__((aligned(SLOTS_ALIGN))); ++ ++ rwlock_init(&slots.lock); ++ slots.pool = (unsigned long)pool | (1 << HANDLES_NOFREE); + + spin_lock(&pool->lock); + if (!pool->ops || !pool->ops->evict || retries == 0) { +@@ -1330,35 +1349,36 @@ static int z3fold_reclaim_page(struct z3 + list_for_each_prev(pos, &pool->lru) { + page = list_entry(pos, struct page, lru); + +- /* this bit could have been set by free, in which case +- * we pass over to the next page in the pool. +- */ +- if (test_and_set_bit(PAGE_CLAIMED, &page->private)) { +- page = NULL; +- continue; +- } +- +- if (unlikely(PageIsolated(page))) { +- clear_bit(PAGE_CLAIMED, &page->private); +- page = NULL; +- continue; +- } + zhdr = page_address(page); + if (test_bit(PAGE_HEADLESS, &page->private)) + break; + ++ if (kref_get_unless_zero(&zhdr->refcount) == 0) { ++ zhdr = NULL; ++ break; ++ } + if (!z3fold_page_trylock(zhdr)) { +- clear_bit(PAGE_CLAIMED, &page->private); ++ if (kref_put(&zhdr->refcount, ++ release_z3fold_page)) ++ atomic64_dec(&pool->pages_nr); + zhdr = NULL; + continue; /* can't evict at this point */ + } +- if (zhdr->foreign_handles) { +- clear_bit(PAGE_CLAIMED, &page->private); +- z3fold_page_unlock(zhdr); ++ ++ /* test_and_set_bit is of course atomic, but we still ++ * need to do it under page lock, otherwise checking ++ * that bit in __z3fold_alloc wouldn't make sense ++ */ ++ if (zhdr->foreign_handles || ++ test_and_set_bit(PAGE_CLAIMED, &page->private)) { ++ if (kref_put(&zhdr->refcount, ++ release_z3fold_page)) ++ atomic64_dec(&pool->pages_nr); ++ else ++ z3fold_page_unlock(zhdr); + zhdr = NULL; + continue; /* can't evict such page */ + } +- kref_get(&zhdr->refcount); + list_del_init(&zhdr->buddy); + zhdr->cpu = -1; + break; +@@ -1380,12 +1400,16 @@ static int z3fold_reclaim_page(struct z3 + first_handle = 0; + last_handle = 0; + middle_handle = 0; ++ memset(slots.slot, 0, sizeof(slots.slot)); + if (zhdr->first_chunks) +- first_handle = encode_handle(zhdr, FIRST); ++ first_handle = __encode_handle(zhdr, &slots, ++ FIRST); + if (zhdr->middle_chunks) +- middle_handle = encode_handle(zhdr, MIDDLE); ++ middle_handle = __encode_handle(zhdr, &slots, ++ MIDDLE); + if (zhdr->last_chunks) +- last_handle = encode_handle(zhdr, LAST); ++ last_handle = __encode_handle(zhdr, &slots, ++ LAST); + /* + * it's safe to unlock here because we hold a + * reference to this page +@@ -1400,19 +1424,16 @@ static int z3fold_reclaim_page(struct z3 + ret = pool->ops->evict(pool, middle_handle); + if (ret) + goto next; +- free_handle(middle_handle, zhdr); + } + if (first_handle) { + ret = pool->ops->evict(pool, first_handle); + if (ret) + goto next; +- free_handle(first_handle, zhdr); + } + if (last_handle) { + ret = pool->ops->evict(pool, last_handle); + if (ret) + goto next; +- free_handle(last_handle, zhdr); + } + next: + if (test_bit(PAGE_HEADLESS, &page->private)) { +@@ -1426,9 +1447,11 @@ next: + spin_unlock(&pool->lock); + clear_bit(PAGE_CLAIMED, &page->private); + } else { ++ struct z3fold_buddy_slots *slots = zhdr->slots; + z3fold_page_lock(zhdr); + if (kref_put(&zhdr->refcount, + release_z3fold_page_locked)) { ++ kmem_cache_free(pool->c_handle, slots); + atomic64_dec(&pool->pages_nr); + return 0; + } +@@ -1544,8 +1567,7 @@ static bool z3fold_page_isolate(struct p + VM_BUG_ON_PAGE(!PageMovable(page), page); + VM_BUG_ON_PAGE(PageIsolated(page), page); + +- if (test_bit(PAGE_HEADLESS, &page->private) || +- test_bit(PAGE_CLAIMED, &page->private)) ++ if (test_bit(PAGE_HEADLESS, &page->private)) + return false; + + zhdr = page_address(page); +@@ -1557,6 +1579,8 @@ static bool z3fold_page_isolate(struct p + if (zhdr->mapped_count != 0 || zhdr->foreign_handles != 0) + goto out; + ++ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) ++ goto out; + pool = zhdr_to_pool(zhdr); + spin_lock(&pool->lock); + if (!list_empty(&zhdr->buddy)) +@@ -1583,16 +1607,17 @@ static int z3fold_page_migrate(struct ad + + VM_BUG_ON_PAGE(!PageMovable(page), page); + VM_BUG_ON_PAGE(!PageIsolated(page), page); ++ VM_BUG_ON_PAGE(!test_bit(PAGE_CLAIMED, &page->private), page); + VM_BUG_ON_PAGE(!PageLocked(newpage), newpage); + + zhdr = page_address(page); + pool = zhdr_to_pool(zhdr); + +- if (!z3fold_page_trylock(zhdr)) { ++ if (!z3fold_page_trylock(zhdr)) + return -EAGAIN; +- } + if (zhdr->mapped_count != 0 || zhdr->foreign_handles != 0) { + z3fold_page_unlock(zhdr); ++ clear_bit(PAGE_CLAIMED, &page->private); + return -EBUSY; + } + if (work_pending(&zhdr->work)) { +@@ -1634,6 +1659,7 @@ static int z3fold_page_migrate(struct ad + queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work); + + page_mapcount_reset(page); ++ clear_bit(PAGE_CLAIMED, &page->private); + put_page(page); + return 0; + } +@@ -1657,6 +1683,7 @@ static void z3fold_page_putback(struct p + spin_lock(&pool->lock); + list_add(&page->lru, &pool->lru); + spin_unlock(&pool->lock); ++ clear_bit(PAGE_CLAIMED, &page->private); + z3fold_page_unlock(zhdr); + } + -- 2.47.3