From b544ab43fbaf6416047c8bc4ad53a24c5693e1f5 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 7 May 2021 23:21:17 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...gpu-avoid-incorrect-hu-format-string.patch | 50 ++ ...-change-the-key-code-of-the-gpio-key.patch | 221 +++++++++ ...1x-fix-reg-formatting-in-memory-node.patch | 393 ++++++++++++++++ .../arm-dts-ux500-fix-up-tvk-r3-sensors.patch | 121 +++++ ...500-rename-avdd-to-vdda-of-touchscre.patch | 35 ++ ...q-librem5-r3-mark-buck3-as-always-on.patch | 43 ++ ...disable-sxs-for-hisilicon-kunpeng920.patch | 75 +++ ...isp-don-t-let-it-go-past-pipes-array.patch | 42 ++ ...-wled-fix-fsc-update-issue-for-wled5.patch | 80 ++++ ...m-wled-use-sink_addr-for-sync-toggle.patch | 53 +++ ...ix-missing-a-memory-free-when-unload.patch | 60 +++ ...gic-bug_on-s-in-replace_path-to-asse.patch | 48 ++ ...error-handling-in-btrfs_update_reloc.patch | 51 +++ ...-error-handling-in-create_reloc_root.patch | 101 ++++ ...ar-context-for-stopped-channels-from.patch | 42 ++ ...troy-sbl-devices-when-moving-to-miss.patch | 113 +++++ ...e-for-l4_wkup-and-l4_cfg-interconnec.patch | 90 ++++ ...a10-fix-memory-leak-of-socfpga_clk-o.patch | 38 ++ ...-for-err-pointers-in-crypto_destroy_.patch | 149 ++++++ ...hisilicon-sec-fixes-a-printing-error.patch | 35 ++ ...-fix-pm-reference-leak-on-omap-aes.c.patch | 55 +++ ...to-qat-fix-unmap-invalid-dma-address.patch | 61 +++ ...fix-pm-reference-leak-in-sa_ul_probe.patch | 37 ++ ...p-fix-pm-reference-leak-on-stm32-cry.patch | 46 ++ ...h-fix-pm-reference-leak-on-stm32-has.patch | 64 +++ ...fix-pm-reference-leak-in-sun8i_ce_pr.patch | 37 ++ ...fix-pm-reference-leak-when-pm_runtim.patch | 52 +++ ...ded-orientation-quirk-for-onegx1-pro.patch | 56 +++ ...amd-display-changing-sr-exit-latency.patch | 43 ++ ...check-for-dsc-support-instead-of-asi.patch | 44 ++ ...dc-dce-dce_aux-remove-duplicate-line.patch | 62 +++ ...dchub-underflow-counter-increasing-i.patch | 52 +++ ...don-t-optimize-bandwidth-before-disa.patch | 44 ++ ...play-fix-debugfs-link_settings-entry.patch | 101 ++++ ...-display-fix-dml-prefetch-validation.patch | 49 ++ ...fix-ubsan-shift-out-of-bounds-warnin.patch | 248 ++++++++++ ...fix-ubsan-warning-for-not-a-valid-va.patch | 58 +++ ...try-ycbcr420-color-when-ycbcr444-fai.patch | 52 +++ ...d-pm-fix-workload-mismatch-on-vega10.patch | 36 ++ ...ay-buffer-interrupt_low_irq_context-.patch | 290 ++++++++++++ ...sic-reset-regression-issue-introduce.patch | 37 ++ ...-amdgpu-fix-null-pointer-dereference.patch | 60 +++ ...amdgpu-fix-some-unload-driver-issues.patch | 64 +++ ...the-xgmi-number-of-hops-reported-fro.patch | 55 +++ ...pu-ttm-fix-memory-leak-userptr-pages.patch | 47 ++ ...at-debugfs-hang_hws-file-causes-syst.patch | 81 ++++ ...ix-ubsan-shift-out-of-bounds-warning.patch | 67 +++ ...lid-usage-of-ast_max_hwc_width-in-cu.patch | 38 ++ ...x-memory-leak-when-unload-the-driver.patch | 93 ++++ ...it-check-to-import-to-value-of-prope.patch | 179 ++++++++ ...ncorrect-null-check-kbot-warnings-in.patch | 45 ++ ...figure-pp_sync_height-to-double-the-.patch | 57 +++ ...-not-multiply-vclk-line-count-by-100.patch | 71 +++ ...ot-run-release-if-qxl-failed-to-init.patch | 94 ++++ .../drm-qxl-release-shadow-on-shutdown.patch | 38 ++ ...on-ttm-fix-memory-leak-userptr-pages.patch | 47 ++ .../drm-vkms-fix-misuse-of-warn_on.patch | 47 ++ ...libstub-add-clang_flags-to-x86-flags.patch | 49 ++ ...ix-some-issues-when-hpdet-irq-fires-.patch | 96 ++++ ...a-fix-various-races-on-driver-unbind.patch | 132 ++++++ ...-dfl-pci-add-did-for-d5005-pac-cards.patch | 60 +++ ...revent-allocation-counter-corruption.patch | 51 +++ ...el_th-consistency-and-off-by-one-fix.patch | 49 ++ ...mte-fix-compilation-with-native-comp.patch | 55 +++ ...-arm64-mte-fix-mte-feature-detection.patch | 62 +++ ...ame-set-of-gfp-flags-as-does-single-.patch | 97 ++++ ...x-possible-use-after-free-in-adv76xx.patch | 43 ++ ...dia-pci-sta2x11-fix-kconfig-dependen.patch | 45 ++ ...x-memory-leak-in-dvb_usb_adapter_ini.patch | 83 ++++ queue-5.10/media-em28xx-fix-memory-leak.patch | 41 ++ .../media-gscpa-stv06xx-fix-memory-leak.patch | 84 ++++ ...a-sq905.c-fix-uninitialized-variable.patch | 36 ++ ...1-v4l2-fix-possible-use-after-free-i.patch | 44 ++ ...2-fix-possible-use-after-free-in-adv.patch | 43 ++ ...7-fix-possible-use-after-free-in-tda.patch | 43 ++ ...e-return-epipe-from-__capture_legacy.patch | 39 ++ ...a-ite-cir-check-for-receive-overflow.patch | 41 ++ ...164-fix-saa7164_encoder_register-mem.patch | 87 ++++ ...ti-fix-runtime-pm-imbalance-in-regs_.patch | 39 ++ ...ix-runtime-pm-imbalance-in-deinterla.patch | 40 ++ ...ix-possible-use-after-free-in-tc3587.patch | 43 ++ queue-5.10/media-vivid-update-edid.patch | 56 +++ ...na-fix-rumtime-pm-imbalance-on-error.patch | 39 ++ ...fd-da9063-support-smbus-and-i2c-mode.patch | 80 ++++ ...10-bmc-fix-the-register-access-range.patch | 37 ++ .../mmc-sdhci-brcmstb-remove-cqe-quirk.patch | 37 ++ ...c-imx-validate-pinctrl-before-use-it.patch | 44 ++ ...-sdhci-pci-add-pci-ids-for-intel-lkf.patch | 49 ++ ...roper-error-code-from-discovery-ctrl.patch | 52 +++ ...ad-power-state-in-pci_enable_device_.patch | 72 +++ ...-arm_pmu_platform-fix-error-handling.patch | 36 ++ ...tform-use-dev_err_probe-for-irq-erro.patch | 52 +++ .../perf-rework-perf_event_exit_event.patch | 271 +++++++++++ ...usb-fix-possible-use-after-free-in-t.patch | 45 ++ ...el_pmc_core-don-t-use-global-pmcdev-.patch | 81 ++++ ...t-account-for-increased-timeout-in-s.patch | 116 +++++ ...-bq27xxx-fix-power_avg-for-newer-ics.patch | 134 ++++++ ...ap-battery-fix-invalid-usage-of-list.patch | 39 ++ ...ap-charger-add-usleep-to-cpcap-charg.patch | 55 +++ ...eric-adc-battery-fix-possible-use-af.patch | 43 ++ ..._adc_battery-fix-possible-use-after-.patch | 44 ++ .../power-supply-use-irqf_oneshot.patch | 83 ++++ ...e-chacha20-constants-with-correct-en.patch | 78 ++++ ...add-parameter-check-for-s390_arch_ra.patch | 45 ++ ...-pci-expose-uid-uniqueness-guarantee.patch | 102 +++++ .../sched-fair-alternative-sched_slice.patch | 72 +++ ...e-percpu-threads-for-imbalance-pulls.patch | 76 +++ ...t-fix-task-util_est-update-filtering.patch | 94 ++++ ...-potential-task-count-underflow-bugs.patch | 56 +++ .../scsi-libfc-fix-a-format-specifier.patch | 45 ++ ...ash-when-a-reg_rpi-mailbox-fails-tri.patch | 60 +++ ...ror-handling-for-mailboxes-completed.patch | 299 ++++++++++++ ...correct-dbde-assignment-when-buildin.patch | 41 ++ ...2pt-connection-does-not-recover-afte.patch | 50 ++ ...-unsupported-mbox-port_capabilities-.patch | 431 ++++++++++++++++++ ...ays-check-the-return-value-of-qla24x.patch | 60 +++ ...si-qla2xxx-fix-use-after-free-in-bsg.patch | 61 +++ ...a-remove-check-for-asc-24h-in-alua_r.patch | 42 ++ .../scsi-smartpqi-add-new-pci-ids.patch | 221 +++++++++ ...rrect-request-leakage-during-reset-o.patch | 52 +++ ...csi-smartpqi-use-host-wide-tag-space.patch | 43 ++ ...si-fix-warning-in-pscsi_complete_cmd.patch | 46 ++ ...ctrl-clean-up-resctrl-features-check.patch | 331 ++++++++++++++ ...l-enable-gcc-checks-to-detect-buffer.patch | 80 ++++ ...l-fix-checking-for-0-for-unsigned-va.patch | 142 ++++++ ...l-fix-compilation-issues-for-global-.patch | 147 ++++++ ...l-fix-compilation-issues-for-other-g.patch | 56 +++ ...l-fix-incorrect-parsing-of-imc-count.patch | 79 ++++ ...-resctrl-fix-missing-options-n-and-p.patch | 44 ++ ...l-use-resctrl-info-for-feature-detec.patch | 157 +++++++ queue-5.10/series | 160 +++++++ ...ix-completion-of-power-gate-toggling.patch | 177 +++++++ ...e-only-prepare-attached-devices-on-c.patch | 58 +++ ...th79-always-call-chipselect-function.patch | 39 ++ ...-spi-master-setup-and-cleanup-assign.patch | 41 ++ ...pi-dln2-fix-reference-leak-to-master.patch | 40 ++ ...ap-100k-fix-reference-leak-to-master.patch | 58 +++ ...-pm-reference-leak-in-spi_qup_remove.patch | 40 ++ ...spi-sync-up-initial-chipselect-state.patch | 101 ++++ ...ng-wimax-i2400m-fix-byte-order-issue.patch | 36 ++ ...-check-memref-size-on-return-from-se.patch | 54 +++ ...intel-speed-select-increase-string-s.patch | 76 +++ ...-error-while-registering-tty-devices.patch | 101 ++++ ...-pm-reference-leak-in-usb_port_resum.patch | 39 ++ ...-gadget-check-for-disabled-lpm-quirk.patch | 95 ++++ ...ignore-ep-queue-requests-during-bus-.patch | 48 ++ ...get-f_uac1-validate-input-parameters.patch | 113 +++++ ...get-f_uac2-validate-input-parameters.patch | 100 ++++ ...-xudc-fix-possible-use-after-free-in.patch | 44 ++ ...c-add-binterval-checking-for-hs-mode.patch | 52 +++ ...x-pm-reference-leak-in-musb_irq_work.patch | 39 ++ ...id-size-of-processing-unit-descripto.patch | 75 +++ .../usb-xhci-fix-port-minor-revision.patch | 51 +++ ...tk-support-quirk-to-disable-usb2-lpm.patch | 58 +++ ...ng_flags-to-compressed-kbuild_cflags.patch | 47 ++ ...sed-64-check-sev-encryption-in-the-3.patch | 137 ++++++ ...pagate-clang_flags-to-realmode_flags.patch | 66 +++ ...equire-hypervisor-cpuid-bit-for-sev-.patch | 154 +++++++ ...ol-context-is-valid-before-dereferen.patch | 42 ++ ...array-allocation-was-successful-befo.patch | 38 ++ ...al-array-out-of-bounds-with-several-.patch | 54 +++ 161 files changed, 12557 insertions(+) create mode 100644 queue-5.10/amdgpu-avoid-incorrect-hu-format-string.patch create mode 100644 queue-5.10/arm-dts-at91-change-the-key-code-of-the-gpio-key.patch create mode 100644 queue-5.10/arm-dts-bcm5301x-fix-reg-formatting-in-memory-node.patch create mode 100644 queue-5.10/arm-dts-ux500-fix-up-tvk-r3-sensors.patch create mode 100644 queue-5.10/arm-tegra-acer-a500-rename-avdd-to-vdda-of-touchscre.patch create mode 100644 queue-5.10/arm64-dts-imx8mq-librem5-r3-mark-buck3-as-always-on.patch create mode 100644 queue-5.10/ata-ahci-disable-sxs-for-hisilicon-kunpeng920.patch create mode 100644 queue-5.10/atomisp-don-t-let-it-go-past-pipes-array.patch create mode 100644 queue-5.10/backlight-qcom-wled-fix-fsc-update-issue-for-wled5.patch create mode 100644 queue-5.10/backlight-qcom-wled-use-sink_addr-for-sync-toggle.patch create mode 100644 queue-5.10/block-rnbd-clt-fix-missing-a-memory-free-when-unload.patch create mode 100644 queue-5.10/btrfs-convert-logic-bug_on-s-in-replace_path-to-asse.patch create mode 100644 queue-5.10/btrfs-do-proper-error-handling-in-btrfs_update_reloc.patch create mode 100644 queue-5.10/btrfs-do-proper-error-handling-in-create_reloc_root.patch create mode 100644 queue-5.10/bus-mhi-core-clear-context-for-stopped-channels-from.patch create mode 100644 queue-5.10/bus-mhi-core-destroy-sbl-devices-when-moving-to-miss.patch create mode 100644 queue-5.10/bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-interconnec.patch create mode 100644 queue-5.10/clk-socfpga-arria10-fix-memory-leak-of-socfpga_clk-o.patch create mode 100644 queue-5.10/crypto-api-check-for-err-pointers-in-crypto_destroy_.patch create mode 100644 queue-5.10/crypto-hisilicon-sec-fixes-a-printing-error.patch create mode 100644 queue-5.10/crypto-omap-aes-fix-pm-reference-leak-on-omap-aes.c.patch create mode 100644 queue-5.10/crypto-qat-fix-unmap-invalid-dma-address.patch create mode 100644 queue-5.10/crypto-sa2ul-fix-pm-reference-leak-in-sa_ul_probe.patch create mode 100644 queue-5.10/crypto-stm32-cryp-fix-pm-reference-leak-on-stm32-cry.patch create mode 100644 queue-5.10/crypto-stm32-hash-fix-pm-reference-leak-on-stm32-has.patch create mode 100644 queue-5.10/crypto-sun8i-ce-fix-pm-reference-leak-in-sun8i_ce_pr.patch create mode 100644 queue-5.10/crypto-sun8i-ss-fix-pm-reference-leak-when-pm_runtim.patch create mode 100644 queue-5.10/drm-added-orientation-quirk-for-onegx1-pro.patch create mode 100644 queue-5.10/drm-amd-display-changing-sr-exit-latency.patch create mode 100644 queue-5.10/drm-amd-display-check-for-dsc-support-instead-of-asi.patch create mode 100644 queue-5.10/drm-amd-display-dc-dce-dce_aux-remove-duplicate-line.patch create mode 100644 queue-5.10/drm-amd-display-dchub-underflow-counter-increasing-i.patch create mode 100644 queue-5.10/drm-amd-display-don-t-optimize-bandwidth-before-disa.patch create mode 100644 queue-5.10/drm-amd-display-fix-debugfs-link_settings-entry.patch create mode 100644 queue-5.10/drm-amd-display-fix-dml-prefetch-validation.patch create mode 100644 queue-5.10/drm-amd-display-fix-ubsan-shift-out-of-bounds-warnin.patch create mode 100644 queue-5.10/drm-amd-display-fix-ubsan-warning-for-not-a-valid-va.patch create mode 100644 queue-5.10/drm-amd-display-try-ycbcr420-color-when-ycbcr444-fai.patch create mode 100644 queue-5.10/drm-amd-pm-fix-workload-mismatch-on-vega10.patch create mode 100644 queue-5.10/drm-amdgpu-display-buffer-interrupt_low_irq_context-.patch create mode 100644 queue-5.10/drm-amdgpu-fix-asic-reset-regression-issue-introduce.patch create mode 100644 queue-5.10/drm-amdgpu-fix-null-pointer-dereference.patch create mode 100644 queue-5.10/drm-amdgpu-fix-some-unload-driver-issues.patch create mode 100644 queue-5.10/drm-amdgpu-mask-the-xgmi-number-of-hops-reported-fro.patch create mode 100644 queue-5.10/drm-amdgpu-ttm-fix-memory-leak-userptr-pages.patch create mode 100644 queue-5.10/drm-amdkfd-fix-cat-debugfs-hang_hws-file-causes-syst.patch create mode 100644 queue-5.10/drm-amdkfd-fix-ubsan-shift-out-of-bounds-warning.patch create mode 100644 queue-5.10/drm-ast-fix-invalid-usage-of-ast_max_hwc_width-in-cu.patch create mode 100644 queue-5.10/drm-ast-fix-memory-leak-when-unload-the-driver.patch create mode 100644 queue-5.10/drm-komeda-fix-bit-check-to-import-to-value-of-prope.patch create mode 100644 queue-5.10/drm-msm-dp-fix-incorrect-null-check-kbot-warnings-in.patch create mode 100644 queue-5.10/drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch create mode 100644 queue-5.10/drm-msm-mdp5-do-not-multiply-vclk-line-count-by-100.patch create mode 100644 queue-5.10/drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch create mode 100644 queue-5.10/drm-qxl-release-shadow-on-shutdown.patch create mode 100644 queue-5.10/drm-radeon-ttm-fix-memory-leak-userptr-pages.patch create mode 100644 queue-5.10/drm-vkms-fix-misuse-of-warn_on.patch create mode 100644 queue-5.10/efi-libstub-add-clang_flags-to-x86-flags.patch create mode 100644 queue-5.10/extcon-arizona-fix-some-issues-when-hpdet-irq-fires-.patch create mode 100644 queue-5.10/extcon-arizona-fix-various-races-on-driver-unbind.patch create mode 100644 queue-5.10/fpga-dfl-pci-add-did-for-d5005-pac-cards.patch create mode 100644 queue-5.10/genirq-matrix-prevent-allocation-counter-corruption.patch create mode 100644 queue-5.10/intel_th-consistency-and-off-by-one-fix.patch create mode 100644 queue-5.10/kselftest-arm64-mte-fix-compilation-with-native-comp.patch create mode 100644 queue-5.10/kselftest-arm64-mte-fix-mte-feature-detection.patch create mode 100644 queue-5.10/kvfree_rcu-use-same-set-of-gfp-flags-as-does-single-.patch create mode 100644 queue-5.10/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch create mode 100644 queue-5.10/media-drivers-media-pci-sta2x11-fix-kconfig-dependen.patch create mode 100644 queue-5.10/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch create mode 100644 queue-5.10/media-em28xx-fix-memory-leak.patch create mode 100644 queue-5.10/media-gscpa-stv06xx-fix-memory-leak.patch create mode 100644 queue-5.10/media-gspca-sq905.c-fix-uninitialized-variable.patch create mode 100644 queue-5.10/media-i2c-adv7511-v4l2-fix-possible-use-after-free-i.patch create mode 100644 queue-5.10/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch create mode 100644 queue-5.10/media-i2c-tda1997-fix-possible-use-after-free-in-tda.patch create mode 100644 queue-5.10/media-imx-capture-return-epipe-from-__capture_legacy.patch create mode 100644 queue-5.10/media-ite-cir-check-for-receive-overflow.patch create mode 100644 queue-5.10/media-media-saa7164-fix-saa7164_encoder_register-mem.patch create mode 100644 queue-5.10/media-platform-sti-fix-runtime-pm-imbalance-in-regs_.patch create mode 100644 queue-5.10/media-sun8i-di-fix-runtime-pm-imbalance-in-deinterla.patch create mode 100644 queue-5.10/media-tc358743-fix-possible-use-after-free-in-tc3587.patch create mode 100644 queue-5.10/media-vivid-update-edid.patch create mode 100644 queue-5.10/mfd-arizona-fix-rumtime-pm-imbalance-on-error.patch create mode 100644 queue-5.10/mfd-da9063-support-smbus-and-i2c-mode.patch create mode 100644 queue-5.10/mfd-intel-m10-bmc-fix-the-register-access-range.patch create mode 100644 queue-5.10/mmc-sdhci-brcmstb-remove-cqe-quirk.patch create mode 100644 queue-5.10/mmc-sdhci-esdhc-imx-validate-pinctrl-before-use-it.patch create mode 100644 queue-5.10/mmc-sdhci-pci-add-pci-ids-for-intel-lkf.patch create mode 100644 queue-5.10/nvmet-return-proper-error-code-from-discovery-ctrl.patch create mode 100644 queue-5.10/pci-pm-do-not-read-power-state-in-pci_enable_device_.patch create mode 100644 queue-5.10/perf-arm_pmu_platform-fix-error-handling.patch create mode 100644 queue-5.10/perf-arm_pmu_platform-use-dev_err_probe-for-irq-erro.patch create mode 100644 queue-5.10/perf-rework-perf_event_exit_event.patch create mode 100644 queue-5.10/phy-phy-twl4030-usb-fix-possible-use-after-free-in-t.patch create mode 100644 queue-5.10/platform-x86-intel_pmc_core-don-t-use-global-pmcdev-.patch create mode 100644 queue-5.10/platform-x86-isst-account-for-increased-timeout-in-s.patch create mode 100644 queue-5.10/power-supply-bq27xxx-fix-power_avg-for-newer-ics.patch create mode 100644 queue-5.10/power-supply-cpcap-battery-fix-invalid-usage-of-list.patch create mode 100644 queue-5.10/power-supply-cpcap-charger-add-usleep-to-cpcap-charg.patch create mode 100644 queue-5.10/power-supply-generic-adc-battery-fix-possible-use-af.patch create mode 100644 queue-5.10/power-supply-s3c_adc_battery-fix-possible-use-after-.patch create mode 100644 queue-5.10/power-supply-use-irqf_oneshot.patch create mode 100644 queue-5.10/random-initialize-chacha20-constants-with-correct-en.patch create mode 100644 queue-5.10/s390-archrandom-add-parameter-check-for-s390_arch_ra.patch create mode 100644 queue-5.10/s390-pci-expose-uid-uniqueness-guarantee.patch create mode 100644 queue-5.10/sched-fair-alternative-sched_slice.patch create mode 100644 queue-5.10/sched-fair-ignore-percpu-threads-for-imbalance-pulls.patch create mode 100644 queue-5.10/sched-pelt-fix-task-util_est-update-filtering.patch create mode 100644 queue-5.10/sched-psi-handle-potential-task-count-underflow-bugs.patch create mode 100644 queue-5.10/scsi-libfc-fix-a-format-specifier.patch create mode 100644 queue-5.10/scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch create mode 100644 queue-5.10/scsi-lpfc-fix-error-handling-for-mailboxes-completed.patch create mode 100644 queue-5.10/scsi-lpfc-fix-incorrect-dbde-assignment-when-buildin.patch create mode 100644 queue-5.10/scsi-lpfc-fix-pt2pt-connection-does-not-recover-afte.patch create mode 100644 queue-5.10/scsi-lpfc-remove-unsupported-mbox-port_capabilities-.patch create mode 100644 queue-5.10/scsi-qla2xxx-always-check-the-return-value-of-qla24x.patch create mode 100644 queue-5.10/scsi-qla2xxx-fix-use-after-free-in-bsg.patch create mode 100644 queue-5.10/scsi-scsi_dh_alua-remove-check-for-asc-24h-in-alua_r.patch create mode 100644 queue-5.10/scsi-smartpqi-add-new-pci-ids.patch create mode 100644 queue-5.10/scsi-smartpqi-correct-request-leakage-during-reset-o.patch create mode 100644 queue-5.10/scsi-smartpqi-use-host-wide-tag-space.patch create mode 100644 queue-5.10/scsi-target-pscsi-fix-warning-in-pscsi_complete_cmd.patch create mode 100644 queue-5.10/selftests-resctrl-clean-up-resctrl-features-check.patch create mode 100644 queue-5.10/selftests-resctrl-enable-gcc-checks-to-detect-buffer.patch create mode 100644 queue-5.10/selftests-resctrl-fix-checking-for-0-for-unsigned-va.patch create mode 100644 queue-5.10/selftests-resctrl-fix-compilation-issues-for-global-.patch create mode 100644 queue-5.10/selftests-resctrl-fix-compilation-issues-for-other-g.patch create mode 100644 queue-5.10/selftests-resctrl-fix-incorrect-parsing-of-imc-count.patch create mode 100644 queue-5.10/selftests-resctrl-fix-missing-options-n-and-p.patch create mode 100644 queue-5.10/selftests-resctrl-use-resctrl-info-for-feature-detec.patch create mode 100644 queue-5.10/soc-tegra-pmc-fix-completion-of-power-gate-toggling.patch create mode 100644 queue-5.10/soundwire-cadence-only-prepare-attached-devices-on-c.patch create mode 100644 queue-5.10/spi-ath79-always-call-chipselect-function.patch create mode 100644 queue-5.10/spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch create mode 100644 queue-5.10/spi-dln2-fix-reference-leak-to-master.patch create mode 100644 queue-5.10/spi-omap-100k-fix-reference-leak-to-master.patch create mode 100644 queue-5.10/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch create mode 100644 queue-5.10/spi-sync-up-initial-chipselect-state.patch create mode 100644 queue-5.10/staging-wimax-i2400m-fix-byte-order-issue.patch create mode 100644 queue-5.10/tee-optee-do-not-check-memref-size-on-return-from-se.patch create mode 100644 queue-5.10/tools-power-x86-intel-speed-select-increase-string-s.patch create mode 100644 queue-5.10/tty-n_gsm-check-error-while-registering-tty-devices.patch create mode 100644 queue-5.10/usb-core-hub-fix-pm-reference-leak-in-usb_port_resum.patch create mode 100644 queue-5.10/usb-dwc3-gadget-check-for-disabled-lpm-quirk.patch create mode 100644 queue-5.10/usb-dwc3-gadget-ignore-ep-queue-requests-during-bus-.patch create mode 100644 queue-5.10/usb-gadget-f_uac1-validate-input-parameters.patch create mode 100644 queue-5.10/usb-gadget-f_uac2-validate-input-parameters.patch create mode 100644 queue-5.10/usb-gadget-tegra-xudc-fix-possible-use-after-free-in.patch create mode 100644 queue-5.10/usb-gadget-uvc-add-binterval-checking-for-hs-mode.patch create mode 100644 queue-5.10/usb-musb-fix-pm-reference-leak-in-musb_irq_work.patch create mode 100644 queue-5.10/usb-webcam-invalid-size-of-processing-unit-descripto.patch create mode 100644 queue-5.10/usb-xhci-fix-port-minor-revision.patch create mode 100644 queue-5.10/usb-xhci-mtk-support-quirk-to-disable-usb2-lpm.patch create mode 100644 queue-5.10/x86-boot-add-clang_flags-to-compressed-kbuild_cflags.patch create mode 100644 queue-5.10/x86-boot-compressed-64-check-sev-encryption-in-the-3.patch create mode 100644 queue-5.10/x86-build-propagate-clang_flags-to-realmode_flags.patch create mode 100644 queue-5.10/x86-sev-do-not-require-hypervisor-cpuid-bit-for-sev-.patch create mode 100644 queue-5.10/xhci-check-control-context-is-valid-before-dereferen.patch create mode 100644 queue-5.10/xhci-check-port-array-allocation-was-successful-befo.patch create mode 100644 queue-5.10/xhci-fix-potential-array-out-of-bounds-with-several-.patch diff --git a/queue-5.10/amdgpu-avoid-incorrect-hu-format-string.patch b/queue-5.10/amdgpu-avoid-incorrect-hu-format-string.patch new file mode 100644 index 00000000000..a4d43a8cfd7 --- /dev/null +++ b/queue-5.10/amdgpu-avoid-incorrect-hu-format-string.patch @@ -0,0 +1,50 @@ +From 80b0ff35d2aed27df923218b12bd62cd675b1688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 12:54:42 +0100 +Subject: amdgpu: avoid incorrect %hu format string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 7d98d416c2cc1c1f7d9508e887de4630e521d797 ] + +clang points out that the %hu format string does not match the type +of the variables here: + +drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c:263:7: warning: format specifies type 'unsigned short' but the argument has type 'unsigned int' [-Wformat] + version_major, version_minor); + ^~~~~~~~~~~~~ +include/drm/drm_print.h:498:19: note: expanded from macro 'DRM_ERROR' + __drm_err(fmt, ##__VA_ARGS__) + ~~~ ^~~~~~~~~~~ + +Change it to a regular %u, the same way a previous patch did for +another instance of the same warning. + +Reviewed-by: Christian König +Reviewed-by: Tom Rix +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +index f8bebf18ee36..665ead139c30 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -259,7 +259,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev) + if ((adev->asic_type == CHIP_POLARIS10 || + adev->asic_type == CHIP_POLARIS11) && + (adev->uvd.fw_version < FW_1_66_16)) +- DRM_ERROR("POLARIS10/11 UVD firmware version %hu.%hu is too old.\n", ++ DRM_ERROR("POLARIS10/11 UVD firmware version %u.%u is too old.\n", + version_major, version_minor); + } else { + unsigned int enc_major, enc_minor, dec_minor; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-at91-change-the-key-code-of-the-gpio-key.patch b/queue-5.10/arm-dts-at91-change-the-key-code-of-the-gpio-key.patch new file mode 100644 index 00000000000..ec5941334d6 --- /dev/null +++ b/queue-5.10/arm-dts-at91-change-the-key-code-of-the-gpio-key.patch @@ -0,0 +1,221 @@ +From 821d171d2f35dc285cdac4bc927c81fe9097f9b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 15:02:27 +0200 +Subject: ARM: dts: at91: change the key code of the gpio key + +From: Ludovic Desroches + +[ Upstream commit ca7a049ad1a72ec5f03d1330b53575237fcb727c ] + +Having a button code and not a key code causes issues with libinput. +udev won't set ID_INPUT_KEY. If it is forced, then it causes a bug +within libinput. + +Signed-off-by: Ludovic Desroches +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20210402130227.21478-1-nicolas.ferre@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sam9x60ek.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d2_icp.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d2_xplained.dts | 3 ++- + arch/arm/boot/dts/at91-sama5d3_xplained.dts | 3 ++- + arch/arm/boot/dts/at91sam9260ek.dts | 3 ++- + arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 3 ++- + 9 files changed, 18 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts +index 775ceb3acb6c..edca66c232c1 100644 +--- a/arch/arm/boot/dts/at91-sam9x60ek.dts ++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts +@@ -8,6 +8,7 @@ + */ + /dts-v1/; + #include "sam9x60.dtsi" ++#include + + / { + model = "Microchip SAM9X60-EK"; +@@ -84,7 +85,7 @@ + sw1 { + label = "SW1"; + gpios = <&pioD 18 GPIO_ACTIVE_LOW>; +- linux,code=<0x104>; ++ linux,code=; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts +index 0e159f879c15..d3cd2443ba25 100644 +--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts ++++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts +@@ -11,6 +11,7 @@ + #include "at91-sama5d27_som1.dtsi" + #include + #include ++#include + + / { + model = "Atmel SAMA5D27 SOM1 EK"; +@@ -467,7 +468,7 @@ + pb4 { + label = "USER"; + gpios = <&pioA PIN_PA29 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts +index 6b38fa3f5568..4883b84b4ede 100644 +--- a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts ++++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts +@@ -8,6 +8,7 @@ + */ + /dts-v1/; + #include "at91-sama5d27_wlsom1.dtsi" ++#include + + / { + model = "Microchip SAMA5D27 WLSOM1 EK"; +@@ -35,7 +36,7 @@ + sw4 { + label = "USER BUTTON"; + gpios = <&pioA PIN_PB2 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts +index 6783cf16ff81..19bb50f50c1f 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts +@@ -12,6 +12,7 @@ + #include "sama5d2.dtsi" + #include "sama5d2-pinfunc.h" + #include ++#include + #include + + / { +@@ -51,7 +52,7 @@ + sw4 { + label = "USER_PB1"; + gpios = <&pioA PIN_PD0 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts +index c894c7c788a9..1c6361ba1aca 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts +@@ -11,6 +11,7 @@ + #include "sama5d2-pinfunc.h" + #include + #include ++#include + #include + + / { +@@ -403,7 +404,7 @@ + bp1 { + label = "PB_USER"; + gpios = <&pioA PIN_PA10 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts +index 058fae1b4a76..d767968ae217 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts +@@ -10,6 +10,7 @@ + #include "sama5d2-pinfunc.h" + #include + #include ++#include + #include + + / { +@@ -713,7 +714,7 @@ + bp1 { + label = "PB_USER"; + gpios = <&pioA PIN_PB9 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +index 5179258f9247..9c55a921263b 100644 +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -7,6 +7,7 @@ + */ + /dts-v1/; + #include "sama5d36.dtsi" ++#include + + / { + model = "SAMA5D3 Xplained"; +@@ -354,7 +355,7 @@ + bp3 { + label = "PB_USER"; + gpios = <&pioE 29 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91sam9260ek.dts b/arch/arm/boot/dts/at91sam9260ek.dts +index d3446e42b598..ce96345d28a3 100644 +--- a/arch/arm/boot/dts/at91sam9260ek.dts ++++ b/arch/arm/boot/dts/at91sam9260ek.dts +@@ -7,6 +7,7 @@ + */ + /dts-v1/; + #include "at91sam9260.dtsi" ++#include + + / { + model = "Atmel at91sam9260ek"; +@@ -156,7 +157,7 @@ + btn4 { + label = "Button 4"; + gpios = <&pioA 31 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +index 6e6e672c0b86..87bb39060e8b 100644 +--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi ++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +@@ -5,6 +5,7 @@ + * Copyright (C) 2012 Jean-Christophe PLAGNIOL-VILLARD + */ + #include "at91sam9g20.dtsi" ++#include + + / { + +@@ -234,7 +235,7 @@ + btn4 { + label = "Button 4"; + gpios = <&pioA 31 GPIO_ACTIVE_LOW>; +- linux,code = <0x104>; ++ linux,code = ; + wakeup-source; + }; + }; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-bcm5301x-fix-reg-formatting-in-memory-node.patch b/queue-5.10/arm-dts-bcm5301x-fix-reg-formatting-in-memory-node.patch new file mode 100644 index 00000000000..1a4cd78e512 --- /dev/null +++ b/queue-5.10/arm-dts-bcm5301x-fix-reg-formatting-in-memory-node.patch @@ -0,0 +1,393 @@ +From d73d3e56763a4081dae3a241e38cadbd07f35eab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 13:55:00 +0100 +Subject: ARM: dts: BCM5301X: fix "reg" formatting in /memory node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 43986f38818278bb71a7fef6de689637bb734afe ] + +This fixes warnings/errors like: +arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dt.yaml: /: memory@0:reg:0: [0, 134217728, 2281701376, 402653184] is too long + From schema: /lib/python3.6/site-packages/dtschema/schemas/reg.yaml + +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts | 4 ++-- + arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts | 4 ++-- + arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts | 4 ++-- + arch/arm/boot/dts/bcm4708-netgear-r6250.dts | 4 ++-- + arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts | 4 ++-- + arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts | 4 ++-- + arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts | 4 ++-- + arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts | 4 ++-- + arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts | 4 ++-- + arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts | 4 ++-- + arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 4 ++-- + arch/arm/boot/dts/bcm4709-linksys-ea9200.dts | 4 ++-- + arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 4 ++-- + arch/arm/boot/dts/bcm4709-netgear-r8000.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-linksys-panamera.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-netgear-r8500.dts | 4 ++-- + arch/arm/boot/dts/bcm47094-phicomm-k3.dts | 4 ++-- + 23 files changed, 46 insertions(+), 46 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts +index 6a96655d8626..8ed403767540 100644 +--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts ++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts +index 3b0029e61b4c..667b118ba4ee 100644 +--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts ++++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts +index 90f57bad6b24..ff31ce45831a 100644 +--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts ++++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + spi { +diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts +index fed75e6ab58c..61c7b137607e 100644 +--- a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts ++++ b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts +@@ -22,8 +22,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts +index 79542e18915c..4c60eda296d9 100644 +--- a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts ++++ b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts +index abd35a518046..7d46561fca3c 100644 +--- a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts ++++ b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts +index c29950b43a95..0e273c598732 100644 +--- a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts ++++ b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts b/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts +index 4dcec6865469..083ec4036bd7 100644 +--- a/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts ++++ b/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + spi { +diff --git a/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts b/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts +index 0e349e39f608..8b1a05a0f1a1 100644 +--- a/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts ++++ b/arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + spi { +diff --git a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts +index 8f1e565c3db4..6c6bb7b17d27 100644 +--- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts ++++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts +@@ -21,8 +21,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts +index ce888b1835d1..d29e7f80ea6a 100644 +--- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts ++++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts +@@ -21,8 +21,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts +index ed8619b54d69..38fbefdf2e4e 100644 +--- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts ++++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts +@@ -18,8 +18,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + gpio-keys { +diff --git a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts +index 1f87993eae1d..7989a53597d4 100644 +--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts ++++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts +@@ -21,8 +21,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts +index 6c6199a53d09..87b655be674c 100644 +--- a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts ++++ b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts +@@ -32,8 +32,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts b/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts +index 911c65fbf251..e635a15041dd 100644 +--- a/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts ++++ b/arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts +@@ -21,8 +21,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + nand: nand@18028000 { +diff --git a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts +index 0faae8950375..36d63beba8cd 100644 +--- a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts ++++ b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + gpio-keys { +diff --git a/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts b/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts +index 50f7cd08cfbb..a6dc99955e19 100644 +--- a/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts ++++ b/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts b/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts +index bcc420f85b56..ff98837bc0db 100644 +--- a/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts ++++ b/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts +index 9ae815ddbb4b..2666195b6ffe 100644 +--- a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts ++++ b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts +@@ -18,8 +18,8 @@ + + memory { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts +index a21b2d185596..9f798025748b 100644 +--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts ++++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x08000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x08000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts b/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts +index 4d5c5aa7dc42..c8dfa4c58d2f 100644 +--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts ++++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-netgear-r8500.dts b/arch/arm/boot/dts/bcm47094-netgear-r8500.dts +index f42a1703f4ab..42097a4c2659 100644 +--- a/arch/arm/boot/dts/bcm47094-netgear-r8500.dts ++++ b/arch/arm/boot/dts/bcm47094-netgear-r8500.dts +@@ -18,8 +18,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + leds { +diff --git a/arch/arm/boot/dts/bcm47094-phicomm-k3.dts b/arch/arm/boot/dts/bcm47094-phicomm-k3.dts +index ac3a4483dcb3..a2566ad4619c 100644 +--- a/arch/arm/boot/dts/bcm47094-phicomm-k3.dts ++++ b/arch/arm/boot/dts/bcm47094-phicomm-k3.dts +@@ -15,8 +15,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x00000000 0x08000000 +- 0x88000000 0x18000000>; ++ reg = <0x00000000 0x08000000>, ++ <0x88000000 0x18000000>; + }; + + gpio-keys { +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-ux500-fix-up-tvk-r3-sensors.patch b/queue-5.10/arm-dts-ux500-fix-up-tvk-r3-sensors.patch new file mode 100644 index 00000000000..33c1ab130ba --- /dev/null +++ b/queue-5.10/arm-dts-ux500-fix-up-tvk-r3-sensors.patch @@ -0,0 +1,121 @@ +From 74c99c96ccd2a7fa6c1d8391183fe3caea1617e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 10:19:11 +0100 +Subject: ARM: dts: ux500: Fix up TVK R3 sensors + +From: Linus Walleij + +[ Upstream commit aeceecd40d94ed3c00bfe1cfe59dd1bfac2fc6fe ] + +The TVK1281618 R3 sensors are different from the R2 board, +some incorrectness is fixed and some new sensors added, we +also rename the nodes appropriately with accelerometer@ +etc. + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi | 73 +++++++++++++------ + 1 file changed, 50 insertions(+), 23 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi b/arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi +index 9f285c7cf914..c0de1337bdaa 100644 +--- a/arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi ++++ b/arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi +@@ -8,37 +8,43 @@ + / { + soc { + i2c@80128000 { +- /* Marked: +- * 129 +- * M35 +- * L3GD20 +- */ +- l3gd20@6a { +- /* Gyroscope */ +- compatible = "st,l3gd20"; +- status = "disabled"; ++ accelerometer@19 { ++ compatible = "st,lsm303dlhc-accel"; + st,drdy-int-pin = <1>; +- drive-open-drain; +- reg = <0x6a>; // 0x6a or 0x6b ++ reg = <0x19>; + vdd-supply = <&ab8500_ldo_aux1_reg>; + vddio-supply = <&db8500_vsmps2_reg>; ++ interrupt-parent = <&gpio2>; ++ interrupts = <18 IRQ_TYPE_EDGE_RISING>, ++ <19 IRQ_TYPE_EDGE_RISING>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&accel_tvk_mode>; + }; +- /* +- * Marked: +- * 2122 +- * C3H +- * DQEEE +- * LIS3DH? +- */ +- lis3dh@18 { +- /* Accelerometer */ +- compatible = "st,lis3dh-accel"; ++ magnetometer@1e { ++ compatible = "st,lsm303dlm-magn"; + st,drdy-int-pin = <1>; +- reg = <0x18>; ++ reg = <0x1e>; + vdd-supply = <&ab8500_ldo_aux1_reg>; + vddio-supply = <&db8500_vsmps2_reg>; ++ // This interrupt is not properly working with the driver ++ // interrupt-parent = <&gpio1>; ++ // interrupts = <0 IRQ_TYPE_EDGE_RISING>; + pinctrl-names = "default"; +- pinctrl-0 = <&accel_tvk_mode>; ++ pinctrl-0 = <&magn_tvk_mode>; ++ }; ++ gyroscope@68 { ++ /* Gyroscope */ ++ compatible = "st,l3g4200d-gyro"; ++ reg = <0x68>; ++ vdd-supply = <&ab8500_ldo_aux1_reg>; ++ vddio-supply = <&db8500_vsmps2_reg>; ++ }; ++ pressure@5c { ++ /* Barometer/pressure sensor */ ++ compatible = "st,lps001wp-press"; ++ reg = <0x5c>; ++ vdd-supply = <&ab8500_ldo_aux1_reg>; ++ vddio-supply = <&db8500_vsmps2_reg>; + }; + }; + +@@ -54,5 +60,26 @@ + }; + }; + }; ++ ++ pinctrl { ++ accelerometer { ++ accel_tvk_mode: accel_tvk { ++ /* Accelerometer interrupt lines 1 & 2 */ ++ tvk_cfg { ++ pins = "GPIO82_C1", "GPIO83_D3"; ++ ste,config = <&gpio_in_pd>; ++ }; ++ }; ++ }; ++ magnetometer { ++ magn_tvk_mode: magn_tvk { ++ /* GPIO 32 used for DRDY, pull this down */ ++ tvk_cfg { ++ pins = "GPIO32_V2"; ++ ste,config = <&gpio_in_pd>; ++ }; ++ }; ++ }; ++ }; + }; + }; +-- +2.30.2 + diff --git a/queue-5.10/arm-tegra-acer-a500-rename-avdd-to-vdda-of-touchscre.patch b/queue-5.10/arm-tegra-acer-a500-rename-avdd-to-vdda-of-touchscre.patch new file mode 100644 index 00000000000..ba184cf896c --- /dev/null +++ b/queue-5.10/arm-tegra-acer-a500-rename-avdd-to-vdda-of-touchscre.patch @@ -0,0 +1,35 @@ +From 4944142a673bfca50ebaac4fba65414e07078334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 15:09:58 +0300 +Subject: ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node + +From: Dmitry Osipenko + +[ Upstream commit b27b9689e1f3278919c6183c565d837d0aef6fc1 ] + +Rename avdd supply to vdda of the touchscreen node. The old supply name +was incorrect. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra20-acer-a500-picasso.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts +index a0b829738e8f..068aabcffb13 100644 +--- a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts ++++ b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts +@@ -448,7 +448,7 @@ + + reset-gpios = <&gpio TEGRA_GPIO(Q, 7) GPIO_ACTIVE_HIGH>; + +- avdd-supply = <&vdd_3v3_sys>; ++ vdda-supply = <&vdd_3v3_sys>; + vdd-supply = <&vdd_3v3_sys>; + }; + +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-imx8mq-librem5-r3-mark-buck3-as-always-on.patch b/queue-5.10/arm64-dts-imx8mq-librem5-r3-mark-buck3-as-always-on.patch new file mode 100644 index 00000000000..9bb892a0f7c --- /dev/null +++ b/queue-5.10/arm64-dts-imx8mq-librem5-r3-mark-buck3-as-always-on.patch @@ -0,0 +1,43 @@ +From 447b4b26847ef5d28f7d0dab2a842f02f9f11321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 09:35:30 +0100 +Subject: arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on + +From: Sebastian Krzyszkowiak + +[ Upstream commit a362b0cc94d476b097ba0ff466958c1d4e27e219 ] + +Commit 99e71c029213 ("arm64: dts: imx8mq-librem5: Don't mark buck3 as always on") +removed always-on marking from GPU regulator, which is great for power +saving - however it introduces additional i2c0 traffic which can be deadly +for devices from the Dogwood batch. + +To workaround the i2c0 shutdown issue on Dogwood, this commit marks +buck3 as always-on again - but only for Dogwood (r3). + +Signed-off-by: Sebastian Krzyszkowiak +Signed-off-by: Martin Kepplinger +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts b/arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts +index 6704ea2c72a3..cc29223ca188 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts +@@ -22,6 +22,10 @@ + ti,termination-current = <144000>; /* uA */ + }; + ++&buck3_reg { ++ regulator-always-on; ++}; ++ + &proximity { + proximity-near-level = <25>; + }; +-- +2.30.2 + diff --git a/queue-5.10/ata-ahci-disable-sxs-for-hisilicon-kunpeng920.patch b/queue-5.10/ata-ahci-disable-sxs-for-hisilicon-kunpeng920.patch new file mode 100644 index 00000000000..22d12e90d0a --- /dev/null +++ b/queue-5.10/ata-ahci-disable-sxs-for-hisilicon-kunpeng920.patch @@ -0,0 +1,75 @@ +From 8ad69d570da1eedc882e67fc6cf0eb2f2ce99510 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 18:24:36 +0800 +Subject: ata: ahci: Disable SXS for Hisilicon Kunpeng920 + +From: Xingui Yang + +[ Upstream commit 234e6d2c18f5b080cde874483c4c361f3ae7cffe ] + +On Hisilicon Kunpeng920, ESP is set to 1 by default for all ports of +SATA controller. In some scenarios, some ports are not external SATA ports, +and it cause disks connected to these ports to be identified as removable +disks. So disable the SXS capability on the software side to prevent users +from mistakenly considering non-removable disks as removable disks and +performing related operations. + +Signed-off-by: Xingui Yang +Signed-off-by: Luo Jiaxing +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/1615544676-61926-1-git-send-email-luojiaxing@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 5 +++++ + drivers/ata/ahci.h | 1 + + drivers/ata/libahci.c | 5 +++++ + 3 files changed, 11 insertions(+) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 00ba8e5a1ccc..33192a8f687d 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1772,6 +1772,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + hpriv->flags |= AHCI_HFLAG_NO_DEVSLP; + + #ifdef CONFIG_ARM64 ++ if (pdev->vendor == PCI_VENDOR_ID_HUAWEI && ++ pdev->device == 0xa235 && ++ pdev->revision < 0x30) ++ hpriv->flags |= AHCI_HFLAG_NO_SXS; ++ + if (pdev->vendor == 0x177d && pdev->device == 0xa01c) + hpriv->irq_handler = ahci_thunderx_irq_handler; + #endif +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 98b8baa47dc5..d1f284f0c83d 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -242,6 +242,7 @@ enum { + suspend/resume */ + AHCI_HFLAG_IGN_NOTSUPP_POWER_ON = (1 << 27), /* ignore -EOPNOTSUPP + from phy_power_on() */ ++ AHCI_HFLAG_NO_SXS = (1 << 28), /* SXS not supported */ + + /* ap->flags bits */ + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index ea5bf5f4cbed..fec2e9754aed 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -493,6 +493,11 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv) + cap |= HOST_CAP_ALPM; + } + ++ if ((cap & HOST_CAP_SXS) && (hpriv->flags & AHCI_HFLAG_NO_SXS)) { ++ dev_info(dev, "controller does not support SXS, disabling CAP_SXS\n"); ++ cap &= ~HOST_CAP_SXS; ++ } ++ + if (hpriv->force_port_map && port_map != hpriv->force_port_map) { + dev_info(dev, "forcing port_map 0x%x -> 0x%x\n", + port_map, hpriv->force_port_map); +-- +2.30.2 + diff --git a/queue-5.10/atomisp-don-t-let-it-go-past-pipes-array.patch b/queue-5.10/atomisp-don-t-let-it-go-past-pipes-array.patch new file mode 100644 index 00000000000..e545499dd7e --- /dev/null +++ b/queue-5.10/atomisp-don-t-let-it-go-past-pipes-array.patch @@ -0,0 +1,42 @@ +From b5cd5e7ee193ebc50de00f24d2dc31eb9b5d12ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 08:16:03 +0100 +Subject: atomisp: don't let it go past pipes array + +From: Mauro Carvalho Chehab + +[ Upstream commit 1f6c45ac5fd70ab59136ab5babc7def269f3f509 ] + +In practice, IA_CSS_PIPE_ID_NUM should never be used when +calling atomisp_q_video_buffers_to_css(), as the driver should +discover the right pipe before calling it. + +Yet, if some pipe parsing issue happens, it could end using +it. + +So, add a WARN_ON() to prevent such case. + +Reported-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_fops.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c +index 453bb6913550..f1e6b2597853 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c +@@ -221,6 +221,9 @@ int atomisp_q_video_buffers_to_css(struct atomisp_sub_device *asd, + unsigned long irqflags; + int err = 0; + ++ if (WARN_ON(css_pipe_id >= IA_CSS_PIPE_ID_NUM)) ++ return -EINVAL; ++ + while (pipe->buffers_in_css < ATOMISP_CSS_Q_DEPTH) { + struct videobuf_buffer *vb; + +-- +2.30.2 + diff --git a/queue-5.10/backlight-qcom-wled-fix-fsc-update-issue-for-wled5.patch b/queue-5.10/backlight-qcom-wled-fix-fsc-update-issue-for-wled5.patch new file mode 100644 index 00000000000..7f26cf082c1 --- /dev/null +++ b/queue-5.10/backlight-qcom-wled-fix-fsc-update-issue-for-wled5.patch @@ -0,0 +1,80 @@ +From 5f25c7555e8643e7a63eeb1468532e95afc73269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 18:09:39 +0530 +Subject: backlight: qcom-wled: Fix FSC update issue for WLED5 + +From: Kiran Gunda + +[ Upstream commit 4d6e9cdff7fbb6bef3e5559596fab3eeffaf95ca ] + +Currently, for WLED5, the FSC (Full scale current) setting is not +updated properly due to driver toggling the wrong register after +an FSC update. + +On WLED5 we should only toggle the MOD_SYNC bit after a brightness +update. For an FSC update we need to toggle the SYNC bits instead. + +Fix it by adopting the common wled3_sync_toggle() for WLED5 and +introducing new code to the brightness update path to compensate. + +Signed-off-by: Kiran Gunda +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/qcom-wled.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c +index 83a187fdaa1d..cd11c5776438 100644 +--- a/drivers/video/backlight/qcom-wled.c ++++ b/drivers/video/backlight/qcom-wled.c +@@ -348,7 +348,7 @@ static int wled3_sync_toggle(struct wled *wled) + return rc; + } + +-static int wled5_sync_toggle(struct wled *wled) ++static int wled5_mod_sync_toggle(struct wled *wled) + { + int rc; + u8 val; +@@ -445,10 +445,23 @@ static int wled_update_status(struct backlight_device *bl) + goto unlock_mutex; + } + +- rc = wled->wled_sync_toggle(wled); +- if (rc < 0) { +- dev_err(wled->dev, "wled sync failed rc:%d\n", rc); +- goto unlock_mutex; ++ if (wled->version < 5) { ++ rc = wled->wled_sync_toggle(wled); ++ if (rc < 0) { ++ dev_err(wled->dev, "wled sync failed rc:%d\n", rc); ++ goto unlock_mutex; ++ } ++ } else { ++ /* ++ * For WLED5 toggling the MOD_SYNC_BIT updates the ++ * brightness ++ */ ++ rc = wled5_mod_sync_toggle(wled); ++ if (rc < 0) { ++ dev_err(wled->dev, "wled mod sync failed rc:%d\n", ++ rc); ++ goto unlock_mutex; ++ } + } + } + +@@ -1459,7 +1472,7 @@ static int wled_configure(struct wled *wled) + size = ARRAY_SIZE(wled5_opts); + *cfg = wled5_config_defaults; + wled->wled_set_brightness = wled5_set_brightness; +- wled->wled_sync_toggle = wled5_sync_toggle; ++ wled->wled_sync_toggle = wled3_sync_toggle; + wled->wled_cabc_config = wled5_cabc_config; + wled->wled_ovp_delay = wled5_ovp_delay; + wled->wled_auto_detection_required = +-- +2.30.2 + diff --git a/queue-5.10/backlight-qcom-wled-use-sink_addr-for-sync-toggle.patch b/queue-5.10/backlight-qcom-wled-use-sink_addr-for-sync-toggle.patch new file mode 100644 index 00000000000..34a97fddd1d --- /dev/null +++ b/queue-5.10/backlight-qcom-wled-use-sink_addr-for-sync-toggle.patch @@ -0,0 +1,53 @@ +From aba4f3cddf551a849a29a595fae00291e920b6a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 11:11:10 +0100 +Subject: backlight: qcom-wled: Use sink_addr for sync toggle + +From: Obeida Shamoun + +[ Upstream commit cdfd4c689e2a52c313b35ddfc1852ff274f91acb ] + +WLED3_SINK_REG_SYNC is, as the name implies, a sink register offset. +Therefore, use the sink address as base instead of the ctrl address. + +This fixes the sync toggle on wled4, which can be observed by the fact +that adjusting brightness now works. + +It has no effect on wled3 because sink and ctrl base addresses are the +same. This allows adjusting the brightness without having to disable +then reenable the module. + +Signed-off-by: Obeida Shamoun +Signed-off-by: Konrad Dybcio +Signed-off-by: Marijn Suijten +Reviewed-by: Daniel Thompson +Acked-by: Kiran Gunda +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/qcom-wled.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c +index 3bc7800eb0a9..83a187fdaa1d 100644 +--- a/drivers/video/backlight/qcom-wled.c ++++ b/drivers/video/backlight/qcom-wled.c +@@ -336,13 +336,13 @@ static int wled3_sync_toggle(struct wled *wled) + unsigned int mask = GENMASK(wled->max_string_count - 1, 0); + + rc = regmap_update_bits(wled->regmap, +- wled->ctrl_addr + WLED3_SINK_REG_SYNC, ++ wled->sink_addr + WLED3_SINK_REG_SYNC, + mask, mask); + if (rc < 0) + return rc; + + rc = regmap_update_bits(wled->regmap, +- wled->ctrl_addr + WLED3_SINK_REG_SYNC, ++ wled->sink_addr + WLED3_SINK_REG_SYNC, + mask, WLED3_SINK_REG_SYNC_CLEAR); + + return rc; +-- +2.30.2 + diff --git a/queue-5.10/block-rnbd-clt-fix-missing-a-memory-free-when-unload.patch b/queue-5.10/block-rnbd-clt-fix-missing-a-memory-free-when-unload.patch new file mode 100644 index 00000000000..042468ebeac --- /dev/null +++ b/queue-5.10/block-rnbd-clt-fix-missing-a-memory-free-when-unload.patch @@ -0,0 +1,60 @@ +From 24a4ecc5239cec18627076a83765b005a6d22e69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 09:37:15 +0200 +Subject: block/rnbd-clt: Fix missing a memory free when unloading the module + +From: Gioh Kim + +[ Upstream commit 12b06533104e802df73c1fbe159437c19933d6c0 ] + +When unloading the rnbd-clt module, it does not free a memory +including the filename of the symbolic link to /sys/block/rnbdX. + +It is found by kmemleak as below. + +unreferenced object 0xffff9f1a83d3c740 (size 16): + comm "bash", pid 736, jiffies 4295179665 (age 9841.310s) + hex dump (first 16 bytes): + 21 64 65 76 21 6e 75 6c 6c 62 30 40 62 6c 61 00 !dev!nullb0@bla. + backtrace: + [<0000000039f0c55e>] 0xffffffffc0456c24 + [<000000001aab9513>] kernfs_fop_write+0xcf/0x1c0 + [<00000000db5aa4b3>] vfs_write+0xdb/0x1d0 + [<000000007a2e2207>] ksys_write+0x65/0xe0 + [<00000000055e280a>] do_syscall_64+0x50/0x1b0 + [<00000000c2b51831>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Signed-off-by: Gioh Kim +Signed-off-by: Jack Wang +Link: https://lore.kernel.org/r/20210419073722.15351-13-gi-oh.kim@ionos.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-clt-sysfs.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c +index d9dd138ca9c6..5613cd45866b 100644 +--- a/drivers/block/rnbd/rnbd-clt-sysfs.c ++++ b/drivers/block/rnbd/rnbd-clt-sysfs.c +@@ -433,10 +433,14 @@ void rnbd_clt_remove_dev_symlink(struct rnbd_clt_dev *dev) + * i.e. rnbd_clt_unmap_dev_store() leading to a sysfs warning because + * of sysfs link already was removed already. + */ +- if (dev->blk_symlink_name && try_module_get(THIS_MODULE)) { +- sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name); ++ if (dev->blk_symlink_name) { ++ if (try_module_get(THIS_MODULE)) { ++ sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name); ++ module_put(THIS_MODULE); ++ } ++ /* It should be freed always. */ + kfree(dev->blk_symlink_name); +- module_put(THIS_MODULE); ++ dev->blk_symlink_name = NULL; + } + } + +-- +2.30.2 + diff --git a/queue-5.10/btrfs-convert-logic-bug_on-s-in-replace_path-to-asse.patch b/queue-5.10/btrfs-convert-logic-bug_on-s-in-replace_path-to-asse.patch new file mode 100644 index 00000000000..0702786d7ba --- /dev/null +++ b/queue-5.10/btrfs-convert-logic-bug_on-s-in-replace_path-to-asse.patch @@ -0,0 +1,48 @@ +From c50f1cf8635937fab155a31e1b683b58804aafa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 15:25:21 -0500 +Subject: btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s + +From: Josef Bacik + +[ Upstream commit 7a9213a93546e7eaef90e6e153af6b8fc7553f10 ] + +A few BUG_ON()'s in replace_path are purely to keep us from making +logical mistakes, so replace them with ASSERT()'s. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index b3368cfccabf..c21545c5b34b 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1205,8 +1205,8 @@ int replace_path(struct btrfs_trans_handle *trans, struct reloc_control *rc, + int ret; + int slot; + +- BUG_ON(src->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(dest->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(src->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(dest->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); + + last_snapshot = btrfs_root_last_snapshot(&src->root_item); + again: +@@ -1241,7 +1241,7 @@ again: + struct btrfs_key first_key; + + level = btrfs_header_level(parent); +- BUG_ON(level < lowest_level); ++ ASSERT(level >= lowest_level); + + ret = btrfs_bin_search(parent, &key, &slot); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-5.10/btrfs-do-proper-error-handling-in-btrfs_update_reloc.patch b/queue-5.10/btrfs-do-proper-error-handling-in-btrfs_update_reloc.patch new file mode 100644 index 00000000000..963a6d58a3d --- /dev/null +++ b/queue-5.10/btrfs-do-proper-error-handling-in-btrfs_update_reloc.patch @@ -0,0 +1,51 @@ +From 7354bc7d740230b77f9cc9467629637a8c9fda5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 15:25:20 -0500 +Subject: btrfs: do proper error handling in btrfs_update_reloc_root + +From: Josef Bacik + +[ Upstream commit 592fbcd50c99b8adf999a2a54f9245caff333139 ] + +We call btrfs_update_root in btrfs_update_reloc_root, which can fail for +all sorts of reasons, including IO errors. Instead of panicing the box +lets return the error, now that all callers properly handle those +errors. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 575604ebea44..b3368cfccabf 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -897,7 +897,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, + int ret; + + if (!have_reloc_root(root)) +- goto out; ++ return 0; + + reloc_root = root->reloc_root; + root_item = &reloc_root->root_item; +@@ -930,10 +930,8 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, + + ret = btrfs_update_root(trans, fs_info->tree_root, + &reloc_root->root_key, root_item); +- BUG_ON(ret); + btrfs_put_root(reloc_root); +-out: +- return 0; ++ return ret; + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/btrfs-do-proper-error-handling-in-create_reloc_root.patch b/queue-5.10/btrfs-do-proper-error-handling-in-create_reloc_root.patch new file mode 100644 index 00000000000..180928359e5 --- /dev/null +++ b/queue-5.10/btrfs-do-proper-error-handling-in-create_reloc_root.patch @@ -0,0 +1,101 @@ +From 7d9b5cef037d92689c2aa51b5d44324d888f30aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 15:25:14 -0500 +Subject: btrfs: do proper error handling in create_reloc_root + +From: Josef Bacik + +[ Upstream commit 84c50ba5214c2f3c1be4a931d521ec19f55dfdc8 ] + +We do memory allocations here, read blocks from disk, all sorts of +operations that could easily fail at any given point. Instead of +panicing the box, simply return the error back up the chain, all callers +at this point have proper error handling. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 6a44d8f5e12e..575604ebea44 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -733,10 +733,12 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, + struct extent_buffer *eb; + struct btrfs_root_item *root_item; + struct btrfs_key root_key; +- int ret; ++ int ret = 0; ++ bool must_abort = false; + + root_item = kmalloc(sizeof(*root_item), GFP_NOFS); +- BUG_ON(!root_item); ++ if (!root_item) ++ return ERR_PTR(-ENOMEM); + + root_key.objectid = BTRFS_TREE_RELOC_OBJECTID; + root_key.type = BTRFS_ROOT_ITEM_KEY; +@@ -748,7 +750,9 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, + /* called by btrfs_init_reloc_root */ + ret = btrfs_copy_root(trans, root, root->commit_root, &eb, + BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(ret); ++ if (ret) ++ goto fail; ++ + /* + * Set the last_snapshot field to the generation of the commit + * root - like this ctree.c:btrfs_block_can_be_shared() behaves +@@ -769,9 +773,16 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, + */ + ret = btrfs_copy_root(trans, root, root->node, &eb, + BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(ret); ++ if (ret) ++ goto fail; + } + ++ /* ++ * We have changed references at this point, we must abort the ++ * transaction if anything fails. ++ */ ++ must_abort = true; ++ + memcpy(root_item, &root->root_item, sizeof(*root_item)); + btrfs_set_root_bytenr(root_item, eb->start); + btrfs_set_root_level(root_item, btrfs_header_level(eb)); +@@ -789,14 +800,25 @@ static struct btrfs_root *create_reloc_root(struct btrfs_trans_handle *trans, + + ret = btrfs_insert_root(trans, fs_info->tree_root, + &root_key, root_item); +- BUG_ON(ret); ++ if (ret) ++ goto fail; ++ + kfree(root_item); + + reloc_root = btrfs_read_tree_root(fs_info->tree_root, &root_key); +- BUG_ON(IS_ERR(reloc_root)); ++ if (IS_ERR(reloc_root)) { ++ ret = PTR_ERR(reloc_root); ++ goto abort; ++ } + set_bit(BTRFS_ROOT_SHAREABLE, &reloc_root->state); + reloc_root->last_trans = trans->transid; + return reloc_root; ++fail: ++ kfree(root_item); ++abort: ++ if (must_abort) ++ btrfs_abort_transaction(trans, ret); ++ return ERR_PTR(ret); + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/bus-mhi-core-clear-context-for-stopped-channels-from.patch b/queue-5.10/bus-mhi-core-clear-context-for-stopped-channels-from.patch new file mode 100644 index 00000000000..f60ecd381d6 --- /dev/null +++ b/queue-5.10/bus-mhi-core-clear-context-for-stopped-channels-from.patch @@ -0,0 +1,42 @@ +From f0420f9c8763ff5f525eb5ce656e4180ae056c60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 14:16:11 -0700 +Subject: bus: mhi: core: Clear context for stopped channels from remove() + +From: Bhaumik Bhatt + +[ Upstream commit 4e44ae3d6d9c2c2a6d9356dd279c925532d5cd8c ] + +If a channel was explicitly stopped but not reset and a driver +remove is issued, clean up the channel context such that it is +reflected on the device. This move is useful if a client driver +module is unloaded or a device crash occurs with the host having +placed the channel in a stopped state. + +Signed-off-by: Bhaumik Bhatt +Reviewed-by: Hemant Kumar +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/1617311778-1254-3-git-send-email-bbhatt@codeaurora.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/core/init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c +index 3422ea133deb..0d0386f67ffe 100644 +--- a/drivers/bus/mhi/core/init.c ++++ b/drivers/bus/mhi/core/init.c +@@ -1280,7 +1280,8 @@ static int mhi_driver_remove(struct device *dev) + + mutex_lock(&mhi_chan->mutex); + +- if (ch_state[dir] == MHI_CH_STATE_ENABLED && ++ if ((ch_state[dir] == MHI_CH_STATE_ENABLED || ++ ch_state[dir] == MHI_CH_STATE_STOP) && + !mhi_chan->offload_ch) + mhi_deinit_chan_ctxt(mhi_cntrl, mhi_chan); + +-- +2.30.2 + diff --git a/queue-5.10/bus-mhi-core-destroy-sbl-devices-when-moving-to-miss.patch b/queue-5.10/bus-mhi-core-destroy-sbl-devices-when-moving-to-miss.patch new file mode 100644 index 00000000000..15febe6c5b7 --- /dev/null +++ b/queue-5.10/bus-mhi-core-destroy-sbl-devices-when-moving-to-miss.patch @@ -0,0 +1,113 @@ +From 2c3e3ce82370808d3bbbd47218faf56a1a8dc67a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 15:23:02 -0800 +Subject: bus: mhi: core: Destroy SBL devices when moving to mission mode + +From: Bhaumik Bhatt + +[ Upstream commit 925089c1900f588615db5bf4e1d9064a5f2c18c7 ] + +Currently, client devices are created in SBL or AMSS (mission +mode) and only destroyed after power down or SYS ERROR. When +moving between certain execution environments, such as from SBL +to AMSS, no clean-up is required. This presents an issue where +SBL-specific channels are left open and client drivers now run in +an execution environment where they cannot operate. Fix this by +expanding the mhi_destroy_device() to do an execution environment +specific clean-up if one is requested. Close the gap and destroy +devices in such scenarios that allow SBL client drivers to clean +up once device enters mission mode. + +Signed-off-by: Bhaumik Bhatt +Reviewed-by: Loic Poulain +Reviewed-by: Hemant Kumar +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/1614208985-20851-2-git-send-email-bbhatt@codeaurora.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/core/main.c | 29 +++++++++++++++++++++++++---- + drivers/bus/mhi/core/pm.c | 3 +++ + 2 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/drivers/bus/mhi/core/main.c b/drivers/bus/mhi/core/main.c +index f46f772e2557..d86ce1a06b75 100644 +--- a/drivers/bus/mhi/core/main.c ++++ b/drivers/bus/mhi/core/main.c +@@ -227,8 +227,10 @@ static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) + + int mhi_destroy_device(struct device *dev, void *data) + { ++ struct mhi_chan *ul_chan, *dl_chan; + struct mhi_device *mhi_dev; + struct mhi_controller *mhi_cntrl; ++ enum mhi_ee_type ee = MHI_EE_MAX; + + if (dev->bus != &mhi_bus_type) + return 0; +@@ -240,6 +242,17 @@ int mhi_destroy_device(struct device *dev, void *data) + if (mhi_dev->dev_type == MHI_DEVICE_CONTROLLER) + return 0; + ++ ul_chan = mhi_dev->ul_chan; ++ dl_chan = mhi_dev->dl_chan; ++ ++ /* ++ * If execution environment is specified, remove only those devices that ++ * started in them based on ee_mask for the channels as we move on to a ++ * different execution environment ++ */ ++ if (data) ++ ee = *(enum mhi_ee_type *)data; ++ + /* + * For the suspend and resume case, this function will get called + * without mhi_unregister_controller(). Hence, we need to drop the +@@ -247,11 +260,19 @@ int mhi_destroy_device(struct device *dev, void *data) + * be sure that there will be no instances of mhi_dev left after + * this. + */ +- if (mhi_dev->ul_chan) +- put_device(&mhi_dev->ul_chan->mhi_dev->dev); ++ if (ul_chan) { ++ if (ee != MHI_EE_MAX && !(ul_chan->ee_mask & BIT(ee))) ++ return 0; + +- if (mhi_dev->dl_chan) +- put_device(&mhi_dev->dl_chan->mhi_dev->dev); ++ put_device(&ul_chan->mhi_dev->dev); ++ } ++ ++ if (dl_chan) { ++ if (ee != MHI_EE_MAX && !(dl_chan->ee_mask & BIT(ee))) ++ return 0; ++ ++ put_device(&dl_chan->mhi_dev->dev); ++ } + + dev_dbg(&mhi_cntrl->mhi_dev->dev, "destroy device for chan:%s\n", + mhi_dev->name); +diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c +index ce2aafe33d53..aeb895c08460 100644 +--- a/drivers/bus/mhi/core/pm.c ++++ b/drivers/bus/mhi/core/pm.c +@@ -376,6 +376,7 @@ static int mhi_pm_mission_mode_transition(struct mhi_controller *mhi_cntrl) + { + struct mhi_event *mhi_event; + struct device *dev = &mhi_cntrl->mhi_dev->dev; ++ enum mhi_ee_type current_ee = mhi_cntrl->ee; + int i, ret; + + dev_dbg(dev, "Processing Mission Mode transition\n"); +@@ -390,6 +391,8 @@ static int mhi_pm_mission_mode_transition(struct mhi_controller *mhi_cntrl) + + wake_up_all(&mhi_cntrl->state_event); + ++ device_for_each_child(&mhi_cntrl->mhi_dev->dev, ¤t_ee, ++ mhi_destroy_device); + mhi_cntrl->status_cb(mhi_cntrl, MHI_CB_EE_MISSION_MODE); + + /* Force MHI to be in M0 state before continuing */ +-- +2.30.2 + diff --git a/queue-5.10/bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-interconnec.patch b/queue-5.10/bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-interconnec.patch new file mode 100644 index 00000000000..bde6d18b376 --- /dev/null +++ b/queue-5.10/bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-interconnec.patch @@ -0,0 +1,90 @@ +From 177d218771dc151d6fe3f0c9fe1d7125aeb2305f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 11:35:07 +0200 +Subject: bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first + +From: Tony Lindgren + +[ Upstream commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6 ] + +We want to probe l4_wkup and l4_cfg interconnect devices first to avoid +issues with missing resources. Otherwise we attempt to probe l4_per +devices first causing pointless deferred probe and also annoyingh +renumbering of the MMC devices for example. + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 49 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 49 insertions(+) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 16e389dce111..9afbe4992a1d 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -635,6 +635,51 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata) + return 0; + } + ++/* Interconnect instances to probe before l4_per instances */ ++static struct resource early_bus_ranges[] = { ++ /* am3/4 l4_wkup */ ++ { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, }, ++ /* omap4/5 and dra7 l4_cfg */ ++ { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, }, ++ /* omap4 l4_wkup */ ++ { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, }, ++ /* omap5 and dra7 l4_wkup without dra7 dcan segment */ ++ { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, }, ++}; ++ ++static atomic_t sysc_defer = ATOMIC_INIT(10); ++ ++/** ++ * sysc_defer_non_critical - defer non_critical interconnect probing ++ * @ddata: device driver data ++ * ++ * We want to probe l4_cfg and l4_wkup interconnect instances before any ++ * l4_per instances as l4_per instances depend on resources on l4_cfg and ++ * l4_wkup interconnects. ++ */ ++static int sysc_defer_non_critical(struct sysc *ddata) ++{ ++ struct resource *res; ++ int i; ++ ++ if (!atomic_read(&sysc_defer)) ++ return 0; ++ ++ for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) { ++ res = &early_bus_ranges[i]; ++ if (ddata->module_pa >= res->start && ++ ddata->module_pa <= res->end) { ++ atomic_set(&sysc_defer, 0); ++ ++ return 0; ++ } ++ } ++ ++ atomic_dec_if_positive(&sysc_defer); ++ ++ return -EPROBE_DEFER; ++} ++ + static struct device_node *stdout_path; + + static void sysc_init_stdout_path(struct sysc *ddata) +@@ -859,6 +904,10 @@ static int sysc_map_and_check_registers(struct sysc *ddata) + if (error) + return error; + ++ error = sysc_defer_non_critical(ddata); ++ if (error) ++ return error; ++ + sysc_check_children(ddata); + + error = sysc_parse_registers(ddata); +-- +2.30.2 + diff --git a/queue-5.10/clk-socfpga-arria10-fix-memory-leak-of-socfpga_clk-o.patch b/queue-5.10/clk-socfpga-arria10-fix-memory-leak-of-socfpga_clk-o.patch new file mode 100644 index 00000000000..b96c3c3bff7 --- /dev/null +++ b/queue-5.10/clk-socfpga-arria10-fix-memory-leak-of-socfpga_clk-o.patch @@ -0,0 +1,38 @@ +From 5d75c48f564f0d183d859f2442aa2ad1c5231a8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 18:01:15 +0100 +Subject: clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return + +From: Colin Ian King + +[ Upstream commit 657d4d1934f75a2d978c3cf2086495eaa542e7a9 ] + +There is an error return path that is not kfree'ing socfpga_clk leading +to a memory leak. Fix this by adding in the missing kfree call. + +Addresses-Coverity: ("Resource leak") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210406170115.430990-1-colin.king@canonical.com +Acked-by: Dinh Nguyen +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/socfpga/clk-gate-a10.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/socfpga/clk-gate-a10.c b/drivers/clk/socfpga/clk-gate-a10.c +index cd5df9103614..d62778884208 100644 +--- a/drivers/clk/socfpga/clk-gate-a10.c ++++ b/drivers/clk/socfpga/clk-gate-a10.c +@@ -146,6 +146,7 @@ static void __init __socfpga_gate_init(struct device_node *node, + if (IS_ERR(socfpga_clk->sys_mgr_base_addr)) { + pr_err("%s: failed to find altr,sys-mgr regmap!\n", + __func__); ++ kfree(socfpga_clk); + return; + } + } +-- +2.30.2 + diff --git a/queue-5.10/crypto-api-check-for-err-pointers-in-crypto_destroy_.patch b/queue-5.10/crypto-api-check-for-err-pointers-in-crypto_destroy_.patch new file mode 100644 index 00000000000..e8008e1a10b --- /dev/null +++ b/queue-5.10/crypto-api-check-for-err-pointers-in-crypto_destroy_.patch @@ -0,0 +1,149 @@ +From 2016b14151abf21364c1b7fbd9763515c884e5ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 21:33:03 +0100 +Subject: crypto: api - check for ERR pointers in crypto_destroy_tfm() + +From: Ard Biesheuvel + +[ Upstream commit 83681f2bebb34dbb3f03fecd8f570308ab8b7c2c ] + +Given that crypto_alloc_tfm() may return ERR pointers, and to avoid +crashes on obscure error paths where such pointers are presented to +crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there +before dereferencing the second argument as a struct crypto_tfm +pointer. + +[0] https://lore.kernel.org/linux-crypto/000000000000de949705bc59e0f6@google.com/ + +Reported-by: syzbot+12cf5fbfdeba210a89dd@syzkaller.appspotmail.com +Reviewed-by: Eric Biggers +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/api.c | 2 +- + include/crypto/acompress.h | 2 ++ + include/crypto/aead.h | 2 ++ + include/crypto/akcipher.h | 2 ++ + include/crypto/hash.h | 4 ++++ + include/crypto/kpp.h | 2 ++ + include/crypto/rng.h | 2 ++ + include/crypto/skcipher.h | 2 ++ + 8 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/crypto/api.c b/crypto/api.c +index ed08cbd5b9d3..c4eda56cff89 100644 +--- a/crypto/api.c ++++ b/crypto/api.c +@@ -562,7 +562,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm) + { + struct crypto_alg *alg; + +- if (unlikely(!mem)) ++ if (IS_ERR_OR_NULL(mem)) + return; + + alg = tfm->__crt_alg; +diff --git a/include/crypto/acompress.h b/include/crypto/acompress.h +index fcde59c65a81..cb3d6b1c655d 100644 +--- a/include/crypto/acompress.h ++++ b/include/crypto/acompress.h +@@ -165,6 +165,8 @@ static inline struct crypto_acomp *crypto_acomp_reqtfm(struct acomp_req *req) + * crypto_free_acomp() -- free ACOMPRESS tfm handle + * + * @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp() ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_acomp(struct crypto_acomp *tfm) + { +diff --git a/include/crypto/aead.h b/include/crypto/aead.h +index c32a6f5664e9..fe956629f34c 100644 +--- a/include/crypto/aead.h ++++ b/include/crypto/aead.h +@@ -185,6 +185,8 @@ static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm) + /** + * crypto_free_aead() - zeroize and free aead handle + * @tfm: cipher handle to be freed ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_aead(struct crypto_aead *tfm) + { +diff --git a/include/crypto/akcipher.h b/include/crypto/akcipher.h +index 1d3aa252caba..5764b46bd1ec 100644 +--- a/include/crypto/akcipher.h ++++ b/include/crypto/akcipher.h +@@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm( + * crypto_free_akcipher() - free AKCIPHER tfm handle + * + * @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher() ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_akcipher(struct crypto_akcipher *tfm) + { +diff --git a/include/crypto/hash.h b/include/crypto/hash.h +index 13f8a6a54ca8..b2bc1e46e86a 100644 +--- a/include/crypto/hash.h ++++ b/include/crypto/hash.h +@@ -281,6 +281,8 @@ static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm) + /** + * crypto_free_ahash() - zeroize and free the ahash handle + * @tfm: cipher handle to be freed ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_ahash(struct crypto_ahash *tfm) + { +@@ -724,6 +726,8 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm) + /** + * crypto_free_shash() - zeroize and free the message digest handle + * @tfm: cipher handle to be freed ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_shash(struct crypto_shash *tfm) + { +diff --git a/include/crypto/kpp.h b/include/crypto/kpp.h +index 88b591215d5c..cccceadc164b 100644 +--- a/include/crypto/kpp.h ++++ b/include/crypto/kpp.h +@@ -154,6 +154,8 @@ static inline void crypto_kpp_set_flags(struct crypto_kpp *tfm, u32 flags) + * crypto_free_kpp() - free KPP tfm handle + * + * @tfm: KPP tfm handle allocated with crypto_alloc_kpp() ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_kpp(struct crypto_kpp *tfm) + { +diff --git a/include/crypto/rng.h b/include/crypto/rng.h +index 8b4b844b4eef..17bb3673d3c1 100644 +--- a/include/crypto/rng.h ++++ b/include/crypto/rng.h +@@ -111,6 +111,8 @@ static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm) + /** + * crypto_free_rng() - zeroize and free RNG handle + * @tfm: cipher handle to be freed ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_rng(struct crypto_rng *tfm) + { +diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h +index 6a733b171a5d..ef0fc9ed4342 100644 +--- a/include/crypto/skcipher.h ++++ b/include/crypto/skcipher.h +@@ -196,6 +196,8 @@ static inline struct crypto_tfm *crypto_skcipher_tfm( + /** + * crypto_free_skcipher() - zeroize and free cipher handle + * @tfm: cipher handle to be freed ++ * ++ * If @tfm is a NULL or error pointer, this function does nothing. + */ + static inline void crypto_free_skcipher(struct crypto_skcipher *tfm) + { +-- +2.30.2 + diff --git a/queue-5.10/crypto-hisilicon-sec-fixes-a-printing-error.patch b/queue-5.10/crypto-hisilicon-sec-fixes-a-printing-error.patch new file mode 100644 index 00000000000..ec00e47bcd1 --- /dev/null +++ b/queue-5.10/crypto-hisilicon-sec-fixes-a-printing-error.patch @@ -0,0 +1,35 @@ +From 77d7da9a7b03d75c5e3851e8553333232ebff188 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 15:28:23 +0800 +Subject: crypto: hisilicon/sec - fixes a printing error + +From: Longfang Liu + +[ Upstream commit 4b7aef0230418345be1fb77abbb1592801869901 ] + +When the log is output here, the device has not +been initialized yet. + +Signed-off-by: Longfang Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index bb493423668c..41f1fcacb280 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -544,7 +544,7 @@ static int sec_skcipher_init(struct crypto_skcipher *tfm) + crypto_skcipher_set_reqsize(tfm, sizeof(struct sec_req)); + ctx->c_ctx.ivsize = crypto_skcipher_ivsize(tfm); + if (ctx->c_ctx.ivsize > SEC_IV_SIZE) { +- dev_err(SEC_CTX_DEV(ctx), "get error skcipher iv size!\n"); ++ pr_err("get error skcipher iv size!\n"); + return -EINVAL; + } + +-- +2.30.2 + diff --git a/queue-5.10/crypto-omap-aes-fix-pm-reference-leak-on-omap-aes.c.patch b/queue-5.10/crypto-omap-aes-fix-pm-reference-leak-on-omap-aes.c.patch new file mode 100644 index 00000000000..338e79cd702 --- /dev/null +++ b/queue-5.10/crypto-omap-aes-fix-pm-reference-leak-on-omap-aes.c.patch @@ -0,0 +1,55 @@ +From f2a420e39e08a93647e8f401cd3297e132366cc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:39 +0800 +Subject: crypto: omap-aes - Fix PM reference leak on omap-aes.c + +From: Shixin Liu + +[ Upstream commit 1f34cc4a8da34fbb250efb928f9b8c6fe7ee0642 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-aes.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c +index 1b1e0ab0a831..0dd4c6b157de 100644 +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -103,7 +103,7 @@ static int omap_aes_hw_init(struct omap_aes_dev *dd) + dd->err = 0; + } + +- err = pm_runtime_get_sync(dd->dev); ++ err = pm_runtime_resume_and_get(dd->dev); + if (err < 0) { + dev_err(dd->dev, "failed to get sync: %d\n", err); + return err; +@@ -1133,7 +1133,7 @@ static int omap_aes_probe(struct platform_device *pdev) + pm_runtime_set_autosuspend_delay(dev, DEFAULT_AUTOSUSPEND_DELAY); + + pm_runtime_enable(dev); +- err = pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); + if (err < 0) { + dev_err(dev, "%s: failed to get_sync(%d)\n", + __func__, err); +@@ -1302,7 +1302,7 @@ static int omap_aes_suspend(struct device *dev) + + static int omap_aes_resume(struct device *dev) + { +- pm_runtime_get_sync(dev); ++ pm_runtime_resume_and_get(dev); + return 0; + } + #endif +-- +2.30.2 + diff --git a/queue-5.10/crypto-qat-fix-unmap-invalid-dma-address.patch b/queue-5.10/crypto-qat-fix-unmap-invalid-dma-address.patch new file mode 100644 index 00000000000..9809c6ec3ae --- /dev/null +++ b/queue-5.10/crypto-qat-fix-unmap-invalid-dma-address.patch @@ -0,0 +1,61 @@ +From 4eb9affee95d7329d7db5944ac72e5ff71ebed36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Mar 2021 14:35:01 +0800 +Subject: crypto: qat - fix unmap invalid dma address + +From: Hui Tang + +[ Upstream commit 792b32fad548281e1b7fe14df9063a96c54b32a2 ] + +'dma_mapping_error' return a negative value if 'dma_addr' is equal to +'DMA_MAPPING_ERROR' not zero, so fix initialization of 'dma_addr'. + +Signed-off-by: Hui Tang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_algs.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index d552dbcfe0a0..06abe1e2074e 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -670,7 +670,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + struct qat_alg_buf_list *bufl; + struct qat_alg_buf_list *buflout = NULL; + dma_addr_t blp; +- dma_addr_t bloutp = 0; ++ dma_addr_t bloutp; + struct scatterlist *sg; + size_t sz_out, sz = struct_size(bufl, bufers, n + 1); + +@@ -682,6 +682,9 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + if (unlikely(!bufl)) + return -ENOMEM; + ++ for_each_sg(sgl, sg, n, i) ++ bufl->bufers[i].addr = DMA_MAPPING_ERROR; ++ + blp = dma_map_single(dev, bufl, sz, DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, blp))) + goto err_in; +@@ -715,10 +718,14 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst, + dev_to_node(&GET_DEV(inst->accel_dev))); + if (unlikely(!buflout)) + goto err_in; ++ ++ bufers = buflout->bufers; ++ for_each_sg(sglout, sg, n, i) ++ bufers[i].addr = DMA_MAPPING_ERROR; ++ + bloutp = dma_map_single(dev, buflout, sz_out, DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, bloutp))) + goto err_out; +- bufers = buflout->bufers; + for_each_sg(sglout, sg, n, i) { + int y = sg_nctr; + +-- +2.30.2 + diff --git a/queue-5.10/crypto-sa2ul-fix-pm-reference-leak-in-sa_ul_probe.patch b/queue-5.10/crypto-sa2ul-fix-pm-reference-leak-in-sa_ul_probe.patch new file mode 100644 index 00000000000..77f2eab0357 --- /dev/null +++ b/queue-5.10/crypto-sa2ul-fix-pm-reference-leak-in-sa_ul_probe.patch @@ -0,0 +1,37 @@ +From f2f9eb6f42c3115102135993aa396d4c362ef306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:37 +0800 +Subject: crypto: sa2ul - Fix PM reference leak in sa_ul_probe() + +From: Shixin Liu + +[ Upstream commit 13343badae093977295341d5a050f51ef128821c ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sa2ul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c +index eda93fab95fe..39d56ab12f27 100644 +--- a/drivers/crypto/sa2ul.c ++++ b/drivers/crypto/sa2ul.c +@@ -2345,7 +2345,7 @@ static int sa_ul_probe(struct platform_device *pdev) + dev_set_drvdata(sa_k3_dev, dev_data); + + pm_runtime_enable(dev); +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { + dev_err(&pdev->dev, "%s: failed to get sync: %d\n", __func__, + ret); +-- +2.30.2 + diff --git a/queue-5.10/crypto-stm32-cryp-fix-pm-reference-leak-on-stm32-cry.patch b/queue-5.10/crypto-stm32-cryp-fix-pm-reference-leak-on-stm32-cry.patch new file mode 100644 index 00000000000..1a6eeee2c28 --- /dev/null +++ b/queue-5.10/crypto-stm32-cryp-fix-pm-reference-leak-on-stm32-cry.patch @@ -0,0 +1,46 @@ +From c0c94fbc04000b0cd66e7ce5a95bc86088151fb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:36 +0800 +Subject: crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c + +From: Shixin Liu + +[ Upstream commit 747bf30fd944f02f341b5f3bc7d97a13f2ae2fbe ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-cryp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c +index 2670c30332fa..7999b26a16ed 100644 +--- a/drivers/crypto/stm32/stm32-cryp.c ++++ b/drivers/crypto/stm32/stm32-cryp.c +@@ -542,7 +542,7 @@ static int stm32_cryp_hw_init(struct stm32_cryp *cryp) + int ret; + u32 cfg, hw_mode; + +- pm_runtime_get_sync(cryp->dev); ++ pm_runtime_resume_and_get(cryp->dev); + + /* Disable interrupt */ + stm32_cryp_write(cryp, CRYP_IMSCR, 0); +@@ -2043,7 +2043,7 @@ static int stm32_cryp_remove(struct platform_device *pdev) + if (!cryp) + return -ENODEV; + +- ret = pm_runtime_get_sync(cryp->dev); ++ ret = pm_runtime_resume_and_get(cryp->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/crypto-stm32-hash-fix-pm-reference-leak-on-stm32-has.patch b/queue-5.10/crypto-stm32-hash-fix-pm-reference-leak-on-stm32-has.patch new file mode 100644 index 00000000000..7d928ec0b18 --- /dev/null +++ b/queue-5.10/crypto-stm32-hash-fix-pm-reference-leak-on-stm32-has.patch @@ -0,0 +1,64 @@ +From b175915258431847d2b9b0aa873c46a757bae45c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:35 +0800 +Subject: crypto: stm32/hash - Fix PM reference leak on stm32-hash.c + +From: Shixin Liu + +[ Upstream commit 1cb3ad701970e68f18a9e5d090baf2b1b703d729 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-hash.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c +index e3e25278a970..ff5362da118d 100644 +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -812,7 +812,7 @@ static void stm32_hash_finish_req(struct ahash_request *req, int err) + static int stm32_hash_hw_init(struct stm32_hash_dev *hdev, + struct stm32_hash_request_ctx *rctx) + { +- pm_runtime_get_sync(hdev->dev); ++ pm_runtime_resume_and_get(hdev->dev); + + if (!(HASH_FLAGS_INIT & hdev->flags)) { + stm32_hash_write(hdev, HASH_CR, HASH_CR_INIT); +@@ -961,7 +961,7 @@ static int stm32_hash_export(struct ahash_request *req, void *out) + u32 *preg; + unsigned int i; + +- pm_runtime_get_sync(hdev->dev); ++ pm_runtime_resume_and_get(hdev->dev); + + while ((stm32_hash_read(hdev, HASH_SR) & HASH_SR_BUSY)) + cpu_relax(); +@@ -999,7 +999,7 @@ static int stm32_hash_import(struct ahash_request *req, const void *in) + + preg = rctx->hw_context; + +- pm_runtime_get_sync(hdev->dev); ++ pm_runtime_resume_and_get(hdev->dev); + + stm32_hash_write(hdev, HASH_IMR, *preg++); + stm32_hash_write(hdev, HASH_STR, *preg++); +@@ -1565,7 +1565,7 @@ static int stm32_hash_remove(struct platform_device *pdev) + if (!hdev) + return -ENODEV; + +- ret = pm_runtime_get_sync(hdev->dev); ++ ret = pm_runtime_resume_and_get(hdev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/crypto-sun8i-ce-fix-pm-reference-leak-in-sun8i_ce_pr.patch b/queue-5.10/crypto-sun8i-ce-fix-pm-reference-leak-in-sun8i_ce_pr.patch new file mode 100644 index 00000000000..96c3b83eae3 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ce-fix-pm-reference-leak-in-sun8i_ce_pr.patch @@ -0,0 +1,37 @@ +From 4229447866aed286611a721c11b863470f1a93bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:33 +0800 +Subject: crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe() + +From: Shixin Liu + +[ Upstream commit cc987ae9150c255352660d235ab27c834aa527be ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +index 158422ff5695..00194d1d9ae6 100644 +--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c ++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +@@ -932,7 +932,7 @@ static int sun8i_ce_probe(struct platform_device *pdev) + if (err) + goto error_alg; + +- err = pm_runtime_get_sync(ce->dev); ++ err = pm_runtime_resume_and_get(ce->dev); + if (err < 0) + goto error_alg; + +-- +2.30.2 + diff --git a/queue-5.10/crypto-sun8i-ss-fix-pm-reference-leak-when-pm_runtim.patch b/queue-5.10/crypto-sun8i-ss-fix-pm-reference-leak-when-pm_runtim.patch new file mode 100644 index 00000000000..c3efa250849 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-fix-pm-reference-leak-when-pm_runtim.patch @@ -0,0 +1,52 @@ +From f6315e88c774b729304ed968aa7ed15c66c86a47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:18:32 +0800 +Subject: crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() + fails + +From: Shixin Liu + +[ Upstream commit 06cd7423cf451d68bfab289278d7890c9ae01a14 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Signed-off-by: Shixin Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index ed2a69f82e1c..7c355bc2fb06 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -351,7 +351,7 @@ int sun8i_ss_cipher_init(struct crypto_tfm *tfm) + op->enginectx.op.prepare_request = NULL; + op->enginectx.op.unprepare_request = NULL; + +- err = pm_runtime_get_sync(op->ss->dev); ++ err = pm_runtime_resume_and_get(op->ss->dev); + if (err < 0) { + dev_err(op->ss->dev, "pm error %d\n", err); + goto error_pm; +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +index e0ddc684798d..80e89066dbd1 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +@@ -753,7 +753,7 @@ static int sun8i_ss_probe(struct platform_device *pdev) + if (err) + goto error_alg; + +- err = pm_runtime_get_sync(ss->dev); ++ err = pm_runtime_resume_and_get(ss->dev); + if (err < 0) + goto error_alg; + +-- +2.30.2 + diff --git a/queue-5.10/drm-added-orientation-quirk-for-onegx1-pro.patch b/queue-5.10/drm-added-orientation-quirk-for-onegx1-pro.patch new file mode 100644 index 00000000000..c08ce2e6a2f --- /dev/null +++ b/queue-5.10/drm-added-orientation-quirk-for-onegx1-pro.patch @@ -0,0 +1,56 @@ +From 33487763e6268b99abe7bb203f478b8406db110d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 12:56:26 -0800 +Subject: drm: Added orientation quirk for OneGX1 Pro + +From: Jared Baldridge + +[ Upstream commit 81ad7f9f78e4ff80e95be8282423f511b84f1166 ] + +The OneGX1 Pro has a fairly unique combination of generic strings, +but we additionally match on the BIOS date just to be safe. + +Signed-off-by: Jared Baldridge +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/41288ccb-1012-486b-81c1-a24c31850c91@www.fastmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 58f5dc2f6dd5..f6bdec7fa925 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -84,6 +84,13 @@ static const struct drm_dmi_panel_orientation_data itworks_tw891 = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data onegx1_pro = { ++ .width = 1200, ++ .height = 1920, ++ .bios_dates = (const char * const []){ "12/17/2020", NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { + .width = 720, + .height = 1280, +@@ -211,6 +218,13 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* OneGX1 Pro */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SYSTEM_PRODUCT_NAME"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"), ++ }, ++ .driver_data = (void *)&onegx1_pro, + }, { /* VIOS LTH17 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"), +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-changing-sr-exit-latency.patch b/queue-5.10/drm-amd-display-changing-sr-exit-latency.patch new file mode 100644 index 00000000000..93eb899be23 --- /dev/null +++ b/queue-5.10/drm-amd-display-changing-sr-exit-latency.patch @@ -0,0 +1,43 @@ +From 8f2a38f925ecd5f1d93cb65938f73cbd86c52f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 16:28:05 -0500 +Subject: drm/amd/display: changing sr exit latency + +From: Martin Leung + +[ Upstream commit efe213e5a57e0cd92fa4f328dc1963d330549982 ] + +[Why] +Hardware team remeasured, need to update timings +to increase latency slightly and avoid intermittent +underflows. + +[How] +sr exit latency update. + +Signed-off-by: Martin Leung +Reviewed-by: Alvin Lee +Acked-by: Qingqing Zhuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +index 2455d210ccf6..8465cae180da 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +@@ -180,7 +180,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_0_soc = { + }, + .min_dcfclk = 500.0, /* TODO: set this to actual min DCFCLK */ + .num_states = 1, +- .sr_exit_time_us = 12, ++ .sr_exit_time_us = 15.5, + .sr_enter_plus_exit_time_us = 20, + .urgent_latency_us = 4.0, + .urgent_latency_pixel_data_only_us = 4.0, +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-check-for-dsc-support-instead-of-asi.patch b/queue-5.10/drm-amd-display-check-for-dsc-support-instead-of-asi.patch new file mode 100644 index 00000000000..8a1c401c2a2 --- /dev/null +++ b/queue-5.10/drm-amd-display-check-for-dsc-support-instead-of-asi.patch @@ -0,0 +1,44 @@ +From 576203198bb519aa4b66398e486eab5bd3e7f9b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 17:09:52 -0500 +Subject: drm/amd/display: Check for DSC support instead of ASIC revision + +From: Eryk Brol + +[ Upstream commit 349a19b2f1b01e713268c7de9944ad669ccdf369 ] + +[why] +This check for ASIC revision is no longer useful and causes +lightup issues after a topology change in MST DSC scenario. +In this case, DSC configs should be recalculated for the new +topology. This check prevented that from happening on certain +ASICs that do, in fact, support DSC. + +[how] +Change the ASIC revision to instead check if DSC is supported. + +Signed-off-by: Eryk Brol +Acked-by: Bindu Ramamurthy +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c07737c45677..830d302be045 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8659,7 +8659,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, + } + + #if defined(CONFIG_DRM_AMD_DC_DCN) +- if (adev->asic_type >= CHIP_NAVI10) { ++ if (dc_resource_is_dsc_encoding_supported(dc)) { + for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { + if (drm_atomic_crtc_needs_modeset(new_crtc_state)) { + ret = add_affected_mst_dsc_crtcs(state, crtc); +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-dc-dce-dce_aux-remove-duplicate-line.patch b/queue-5.10/drm-amd-display-dc-dce-dce_aux-remove-duplicate-line.patch new file mode 100644 index 00000000000..674b36c1cc1 --- /dev/null +++ b/queue-5.10/drm-amd-display-dc-dce-dce_aux-remove-duplicate-line.patch @@ -0,0 +1,62 @@ +From a0cc804eaa71bd40d0a332ca85aebf1bbae1d30a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 13:42:36 +0000 +Subject: drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing 'field + overwritten' issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +[ Upstream commit 89adc10178fd6cb68c8ef1905d269070a4d3bd64 ] + +Fixes the following W=1 kernel build warning(s): + + In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:59: + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10014:58: warning: initialized field overwritten [-Woverride-init] + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:177:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10014:58: note: (near initialization for ‘aux_shift.AUX_SW_AUTOINCREMENT_DISABLE’) + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:177:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10013:56: warning: initialized field overwritten [-Woverride-init] + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce112/dce112_resource.c:181:2: note: in expansion of macro ‘DCE_AUX_MASK_SH_LIST’ + drivers/gpu/drm/amd/amdgpu/../include/asic_reg/dce/dce_11_2_sh_mask.h:10013:56: note: (near initialization for ‘aux_mask.AUX_SW_AUTOINCREMENT_DISABLE’) + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:214:16: note: in expansion of macro ‘AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK’ + drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.h:127:2: note: in expansion of macro ‘AUX_SF’ + +Cc: Harry Wentland +Cc: Leo Li +Cc: Alex Deucher +Cc: "Christian König" +Cc: David Airlie +Cc: Daniel Vetter +Cc: amd-gfx@lists.freedesktop.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Lee Jones +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_aux.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h +index 382465862f29..f72f02e016ae 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h +@@ -99,7 +99,6 @@ struct dce110_aux_registers { + AUX_SF(AUX_SW_CONTROL, AUX_SW_GO, mask_sh),\ + AUX_SF(AUX_SW_DATA, AUX_SW_AUTOINCREMENT_DISABLE, mask_sh),\ + AUX_SF(AUX_SW_DATA, AUX_SW_DATA_RW, mask_sh),\ +- AUX_SF(AUX_SW_DATA, AUX_SW_AUTOINCREMENT_DISABLE, mask_sh),\ + AUX_SF(AUX_SW_DATA, AUX_SW_INDEX, mask_sh),\ + AUX_SF(AUX_SW_DATA, AUX_SW_DATA, mask_sh),\ + AUX_SF(AUX_SW_STATUS, AUX_SW_REPLY_BYTE_COUNT, mask_sh),\ +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-dchub-underflow-counter-increasing-i.patch b/queue-5.10/drm-amd-display-dchub-underflow-counter-increasing-i.patch new file mode 100644 index 00000000000..55dec8dea7d --- /dev/null +++ b/queue-5.10/drm-amd-display-dchub-underflow-counter-increasing-i.patch @@ -0,0 +1,52 @@ +From 071bb41ce7c70129b47cb9f0569a932043316d95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 15:43:34 -0500 +Subject: drm/amd/display: DCHUB underflow counter increasing in some scenarios + +From: Aric Cyr + +[ Upstream commit 4710430a779e6077d81218ac768787545bff8c49 ] + +[Why] +When unplugging a display, the underflow counter can be seen to +increase because PSTATE switch is allowed even when some planes are not +blanked. + +[How] +Check that all planes are not active instead of all streams before +allowing PSTATE change. + +Tested-by: Daniel Wheeler +Signed-off-by: Aric Cyr +Acked-by: Solomon Chiu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c +index 95d883482227..cab47bb21172 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c +@@ -240,6 +240,7 @@ static void dcn3_update_clocks(struct clk_mgr *clk_mgr_base, + bool force_reset = false; + bool update_uclk = false; + bool p_state_change_support; ++ int total_plane_count; + + if (dc->work_arounds.skip_clock_update || !clk_mgr->smu_present) + return; +@@ -280,7 +281,8 @@ static void dcn3_update_clocks(struct clk_mgr *clk_mgr_base, + clk_mgr_base->clks.socclk_khz = new_clocks->socclk_khz; + + clk_mgr_base->clks.prev_p_state_change_support = clk_mgr_base->clks.p_state_change_support; +- p_state_change_support = new_clocks->p_state_change_support || (display_count == 0); ++ total_plane_count = clk_mgr_helper_get_active_plane_cnt(dc, context); ++ p_state_change_support = new_clocks->p_state_change_support || (total_plane_count == 0); + if (should_update_pstate_support(safe_to_lower, p_state_change_support, clk_mgr_base->clks.p_state_change_support)) { + clk_mgr_base->clks.p_state_change_support = p_state_change_support; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-don-t-optimize-bandwidth-before-disa.patch b/queue-5.10/drm-amd-display-don-t-optimize-bandwidth-before-disa.patch new file mode 100644 index 00000000000..f5247abe10e --- /dev/null +++ b/queue-5.10/drm-amd-display-don-t-optimize-bandwidth-before-disa.patch @@ -0,0 +1,44 @@ +From bba4d29e2d49245fe6bdeb6048d9674fea431062 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Feb 2021 18:13:59 -0500 +Subject: drm/amd/display: Don't optimize bandwidth before disabling planes + +From: Aric Cyr + +[ Upstream commit 6ad98e8aeb0106f453bb154933e8355849244990 ] + +[Why] +There is a window of time where we optimize bandwidth due to no streams +enabled will enable PSTATE changing but HUBPs are not disabled yet. +This results in underflow counter increasing in some hotplug scenarios. + +[How] +Set the optimize-bandwidth flag for later processing once all the HUBPs +are properly disabled. + +Signed-off-by: Aric Cyr +Acked-by: Bindu Ramamurthy +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index ffb21196bf59..921c4ca6e902 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2345,7 +2345,8 @@ static void commit_planes_do_stream_update(struct dc *dc, + if (pipe_ctx->stream_res.audio && !dc->debug.az_endpoint_mute_only) + pipe_ctx->stream_res.audio->funcs->az_disable(pipe_ctx->stream_res.audio); + +- dc->hwss.optimize_bandwidth(dc, dc->current_state); ++ dc->optimized_required = true; ++ + } else { + if (dc->optimize_seamless_boot_streams == 0) + dc->hwss.prepare_bandwidth(dc, dc->current_state); +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-debugfs-link_settings-entry.patch b/queue-5.10/drm-amd-display-fix-debugfs-link_settings-entry.patch new file mode 100644 index 00000000000..ca6990e1844 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-debugfs-link_settings-entry.patch @@ -0,0 +1,101 @@ +From e799a3f5b05224e80a8118b1988983fc5ff21ab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 11:22:36 -0500 +Subject: drm/amd/display: Fix debugfs link_settings entry + +From: Fangzhi Zuo + +[ Upstream commit c006a1c00de29e8cdcde1d0254ac23433ed3fee9 ] + +1. Catch invalid link_rate and link_count settings +2. Call dc interface to overwrite preferred link settings, and wait +until next stream update to apply the new settings. + +Tested-by: Daniel Wheeler +Signed-off-by: Fangzhi Zuo +Reviewed-by: Nicholas Kazlauskas +Acked-by: Solomon Chiu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +index 8cd646eef096..e02a55fc1382 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -150,7 +150,7 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size, + * + * --- to get dp configuration + * +- * cat link_settings ++ * cat /sys/kernel/debug/dri/0/DP-x/link_settings + * + * It will list current, verified, reported, preferred dp configuration. + * current -- for current video mode +@@ -163,7 +163,7 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size, + * echo > link_settings + * + * for example, to force to 2 lane, 2.7GHz, +- * echo 4 0xa > link_settings ++ * echo 4 0xa > /sys/kernel/debug/dri/0/DP-x/link_settings + * + * spread_spectrum could not be changed dynamically. + * +@@ -171,7 +171,7 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size, + * done. please check link settings after force operation to see if HW get + * programming. + * +- * cat link_settings ++ * cat /sys/kernel/debug/dri/0/DP-x/link_settings + * + * check current and preferred settings. + * +@@ -255,7 +255,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, + int max_param_num = 2; + uint8_t param_nums = 0; + long param[2]; +- bool valid_input = false; ++ bool valid_input = true; + + if (size == 0) + return -EINVAL; +@@ -282,9 +282,9 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, + case LANE_COUNT_ONE: + case LANE_COUNT_TWO: + case LANE_COUNT_FOUR: +- valid_input = true; + break; + default: ++ valid_input = false; + break; + } + +@@ -294,9 +294,9 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, + case LINK_RATE_RBR2: + case LINK_RATE_HIGH2: + case LINK_RATE_HIGH3: +- valid_input = true; + break; + default: ++ valid_input = false; + break; + } + +@@ -310,10 +310,11 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, + * spread spectrum will not be changed + */ + prefer_link_settings.link_spread = link->cur_link_settings.link_spread; ++ prefer_link_settings.use_link_rate_set = false; + prefer_link_settings.lane_count = param[0]; + prefer_link_settings.link_rate = param[1]; + +- dc_link_set_preferred_link_settings(dc, &prefer_link_settings, link); ++ dc_link_set_preferred_training_settings(dc, &prefer_link_settings, NULL, link, true); + + kfree(wr_buf); + return size; +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-dml-prefetch-validation.patch b/queue-5.10/drm-amd-display-fix-dml-prefetch-validation.patch new file mode 100644 index 00000000000..eb01edee2f2 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-dml-prefetch-validation.patch @@ -0,0 +1,49 @@ +From bb866bbc8625a699ad07a254061c8e56e5297bb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 11:04:26 -0500 +Subject: drm/amd/display: fix dml prefetch validation + +From: Dmytro Laktyushkin + +[ Upstream commit 8ee0fea4baf90e43efe2275de208a7809f9985bc ] + +Incorrect variable used, missing initialization during validation. + +Tested-by: Daniel Wheeler +Signed-off-by: Dmytro Laktyushkin +Reviewed-by: Eric Bernstein +Acked-by: Solomon Chiu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c | 1 + + drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +index 45f028986a8d..b3f0476899d3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +@@ -3437,6 +3437,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.DCCEnabledInAnyPlane = true; + } + } ++ mode_lib->vba.UrgentLatency = mode_lib->vba.UrgentLatencyPixelDataOnly; + for (i = 0; i <= mode_lib->vba.soc.num_states; i++) { + locals->FabricAndDRAMBandwidthPerState[i] = dml_min( + mode_lib->vba.DRAMSpeedPerState[i] * mode_lib->vba.NumberOfChannels +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +index 80170f9721ce..1bcda7eba4a6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +@@ -3510,6 +3510,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + mode_lib->vba.DCCEnabledInAnyPlane = true; + } + } ++ mode_lib->vba.UrgentLatency = mode_lib->vba.UrgentLatencyPixelDataOnly; + for (i = 0; i <= mode_lib->vba.soc.num_states; i++) { + locals->FabricAndDRAMBandwidthPerState[i] = dml_min( + mode_lib->vba.DRAMSpeedPerState[i] * mode_lib->vba.NumberOfChannels +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-ubsan-shift-out-of-bounds-warnin.patch b/queue-5.10/drm-amd-display-fix-ubsan-shift-out-of-bounds-warnin.patch new file mode 100644 index 00000000000..374521f2c74 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-ubsan-shift-out-of-bounds-warnin.patch @@ -0,0 +1,248 @@ +From e19cc0047b09b85c4a4959ad5011d8a2b1b80611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 14:25:44 -0500 +Subject: drm/amd/display: Fix UBSAN: shift-out-of-bounds warning + +From: Anson Jacob + +[ Upstream commit 54718747a6e1037317a8b3610c3be40621b2b75e ] + +[Why] +On NAVI14 CONFIG_UBSAN reported shift-out-of-bounds at +display_rq_dlg_calc_20v2.c:304:38 + +rq_param->misc.rq_c.blk256_height is 0 when chroma(*_c) is invalid. +dml_log2 returns -1023 for log2(0), although log2(0) is undefined. + +Which ended up as: +rq_param->dlg.rq_c.swath_height = 1 << -1023 + +[How] +Fix applied on all dml versions. +1. Ensure dml_log2 is only called if the argument is greater than 0. +2. Subtract req128_l/req128_c from log2_swath_height_l/log2_swath_height_c + only when it is greater than 0. + +Tested-by: Daniel Wheeler +Signed-off-by: Anson Jacob +Reviewed-by: Dmytro Laktyushkin +Reviewed-by: Jun Lei +Acked-by: Solomon Chiu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../dc/dml/dcn20/display_rq_dlg_calc_20.c | 28 +++++++++++++++---- + .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 28 +++++++++++++++---- + .../dc/dml/dcn21/display_rq_dlg_calc_21.c | 28 +++++++++++++++---- + .../dc/dml/dcn30/display_rq_dlg_calc_30.c | 28 +++++++++++++++---- + .../display/dc/dml/dml1_display_rq_dlg_calc.c | 28 +++++++++++++++---- + 5 files changed, 115 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +index 72423dc425dc..799bae229e67 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c +@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib, + if (surf_linear) { + log2_swath_height_l = 0; + log2_swath_height_c = 0; +- } else if (!surf_vert) { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c; + } else { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c; ++ unsigned int swath_height_l; ++ unsigned int swath_height_c; ++ ++ if (!surf_vert) { ++ swath_height_l = rq_param->misc.rq_l.blk256_height; ++ swath_height_c = rq_param->misc.rq_c.blk256_height; ++ } else { ++ swath_height_l = rq_param->misc.rq_l.blk256_width; ++ swath_height_c = rq_param->misc.rq_c.blk256_width; ++ } ++ ++ if (swath_height_l > 0) ++ log2_swath_height_l = dml_log2(swath_height_l); ++ ++ if (req128_l && log2_swath_height_l > 0) ++ log2_swath_height_l -= 1; ++ ++ if (swath_height_c > 0) ++ log2_swath_height_c = dml_log2(swath_height_c); ++ ++ if (req128_c && log2_swath_height_c > 0) ++ log2_swath_height_c -= 1; + } ++ + rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l; + rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c; + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c +index 9c78446c3a9d..6a6d5970d1d5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c +@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib, + if (surf_linear) { + log2_swath_height_l = 0; + log2_swath_height_c = 0; +- } else if (!surf_vert) { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c; + } else { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c; ++ unsigned int swath_height_l; ++ unsigned int swath_height_c; ++ ++ if (!surf_vert) { ++ swath_height_l = rq_param->misc.rq_l.blk256_height; ++ swath_height_c = rq_param->misc.rq_c.blk256_height; ++ } else { ++ swath_height_l = rq_param->misc.rq_l.blk256_width; ++ swath_height_c = rq_param->misc.rq_c.blk256_width; ++ } ++ ++ if (swath_height_l > 0) ++ log2_swath_height_l = dml_log2(swath_height_l); ++ ++ if (req128_l && log2_swath_height_l > 0) ++ log2_swath_height_l -= 1; ++ ++ if (swath_height_c > 0) ++ log2_swath_height_c = dml_log2(swath_height_c); ++ ++ if (req128_c && log2_swath_height_c > 0) ++ log2_swath_height_c -= 1; + } ++ + rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l; + rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c; + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c +index edd41d358291..dc1c81a6e377 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c +@@ -277,13 +277,31 @@ static void handle_det_buf_split( + if (surf_linear) { + log2_swath_height_l = 0; + log2_swath_height_c = 0; +- } else if (!surf_vert) { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c; + } else { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c; ++ unsigned int swath_height_l; ++ unsigned int swath_height_c; ++ ++ if (!surf_vert) { ++ swath_height_l = rq_param->misc.rq_l.blk256_height; ++ swath_height_c = rq_param->misc.rq_c.blk256_height; ++ } else { ++ swath_height_l = rq_param->misc.rq_l.blk256_width; ++ swath_height_c = rq_param->misc.rq_c.blk256_width; ++ } ++ ++ if (swath_height_l > 0) ++ log2_swath_height_l = dml_log2(swath_height_l); ++ ++ if (req128_l && log2_swath_height_l > 0) ++ log2_swath_height_l -= 1; ++ ++ if (swath_height_c > 0) ++ log2_swath_height_c = dml_log2(swath_height_c); ++ ++ if (req128_c && log2_swath_height_c > 0) ++ log2_swath_height_c -= 1; + } ++ + rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l; + rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c; + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c +index 416bf6fb67bd..58c312f80a07 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c +@@ -237,13 +237,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib, + if (surf_linear) { + log2_swath_height_l = 0; + log2_swath_height_c = 0; +- } else if (!surf_vert) { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c; + } else { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c; ++ unsigned int swath_height_l; ++ unsigned int swath_height_c; ++ ++ if (!surf_vert) { ++ swath_height_l = rq_param->misc.rq_l.blk256_height; ++ swath_height_c = rq_param->misc.rq_c.blk256_height; ++ } else { ++ swath_height_l = rq_param->misc.rq_l.blk256_width; ++ swath_height_c = rq_param->misc.rq_c.blk256_width; ++ } ++ ++ if (swath_height_l > 0) ++ log2_swath_height_l = dml_log2(swath_height_l); ++ ++ if (req128_l && log2_swath_height_l > 0) ++ log2_swath_height_l -= 1; ++ ++ if (swath_height_c > 0) ++ log2_swath_height_c = dml_log2(swath_height_c); ++ ++ if (req128_c && log2_swath_height_c > 0) ++ log2_swath_height_c -= 1; + } ++ + rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l; + rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c; + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +index 4c3e9cc30167..414da64f5734 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c +@@ -344,13 +344,31 @@ static void handle_det_buf_split( + if (surf_linear) { + log2_swath_height_l = 0; + log2_swath_height_c = 0; +- } else if (!surf_vert) { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c; + } else { +- log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l; +- log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c; ++ unsigned int swath_height_l; ++ unsigned int swath_height_c; ++ ++ if (!surf_vert) { ++ swath_height_l = rq_param->misc.rq_l.blk256_height; ++ swath_height_c = rq_param->misc.rq_c.blk256_height; ++ } else { ++ swath_height_l = rq_param->misc.rq_l.blk256_width; ++ swath_height_c = rq_param->misc.rq_c.blk256_width; ++ } ++ ++ if (swath_height_l > 0) ++ log2_swath_height_l = dml_log2(swath_height_l); ++ ++ if (req128_l && log2_swath_height_l > 0) ++ log2_swath_height_l -= 1; ++ ++ if (swath_height_c > 0) ++ log2_swath_height_c = dml_log2(swath_height_c); ++ ++ if (req128_c && log2_swath_height_c > 0) ++ log2_swath_height_c -= 1; + } ++ + rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l; + rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-ubsan-warning-for-not-a-valid-va.patch b/queue-5.10/drm-amd-display-fix-ubsan-warning-for-not-a-valid-va.patch new file mode 100644 index 00000000000..d89b9a6b9dd --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-ubsan-warning-for-not-a-valid-va.patch @@ -0,0 +1,58 @@ +From 26fba5ebe723d5fed675da0970d16c2eb77fcc13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 16:16:36 -0500 +Subject: drm/amd/display: Fix UBSAN warning for not a valid value for type + '_Bool' + +From: Anson Jacob + +[ Upstream commit 6a30a92997eee49554f72b462dce90abe54a496f ] + +[Why] +dc_cursor_position do not initialise position.translate_by_source when +crtc or plane->state->fb is NULL. UBSAN caught this error in +dce110_set_cursor_position, as the value was garbage. + +[How] +Initialise dc_cursor_position structure elements to 0 in handle_cursor_update +before calling get_cursor_position. + +Tested-by: Daniel Wheeler +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1471 +Reported-by: Lyude Paul +Signed-off-by: Anson Jacob +Reviewed-by: Aurabindo Jayamohanan Pillai +Acked-by: Solomon Chiu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 830d302be045..12a4f0675fb0 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -6800,10 +6800,6 @@ static int get_cursor_position(struct drm_plane *plane, struct drm_crtc *crtc, + int x, y; + int xorigin = 0, yorigin = 0; + +- position->enable = false; +- position->x = 0; +- position->y = 0; +- + if (!crtc || !plane->state->fb) + return 0; + +@@ -6850,7 +6846,7 @@ static void handle_cursor_update(struct drm_plane *plane, + struct dm_crtc_state *crtc_state = crtc ? to_dm_crtc_state(crtc->state) : NULL; + struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc); + uint64_t address = afb ? afb->address : 0; +- struct dc_cursor_position position; ++ struct dc_cursor_position position = {0}; + struct dc_cursor_attributes attributes; + int ret; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-try-ycbcr420-color-when-ycbcr444-fai.patch b/queue-5.10/drm-amd-display-try-ycbcr420-color-when-ycbcr444-fai.patch new file mode 100644 index 00000000000..7a3b4c305f3 --- /dev/null +++ b/queue-5.10/drm-amd-display-try-ycbcr420-color-when-ycbcr444-fai.patch @@ -0,0 +1,52 @@ +From a82357ce30547cf4a825c6c1e5df6867c8a9bc25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 16:13:48 +0100 +Subject: drm/amd/display: Try YCbCr420 color when YCbCr444 fails + +From: Werner Sembach + +[ Upstream commit 68eb3ae3c63708f823aeeb63bb15197c727bd9bf ] + +When encoder validation of a display mode fails, retry with less bandwidth +heavy YCbCr420 color mode, if available. This enables some HDMI 1.4 setups +to support 4k60Hz output, which previously failed silently. + +On some setups, while the monitor and the gpu support display modes with +pixel clocks of up to 600MHz, the link encoder might not. This prevents +YCbCr444 and RGB encoding for 4k60Hz, but YCbCr420 encoding might still be +possible. However, which color mode is used is decided before the link +encoder capabilities are checked. This patch fixes the problem by retrying +to find a display mode with YCbCr420 enforced and using it, if it is +valid. + +Reviewed-by: Harry Wentland +Signed-off-by: Werner Sembach +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 12a4f0675fb0..d18341b7daac 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5328,6 +5328,15 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector, + + } while (stream == NULL && requested_bpc >= 6); + ++ if (dc_result == DC_FAIL_ENC_VALIDATE && !aconnector->force_yuv420_output) { ++ DRM_DEBUG_KMS("Retry forcing YCbCr420 encoding\n"); ++ ++ aconnector->force_yuv420_output = true; ++ stream = create_validate_stream_for_sink(aconnector, drm_mode, ++ dm_state, old_stream); ++ aconnector->force_yuv420_output = false; ++ } ++ + return stream; + } + +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-pm-fix-workload-mismatch-on-vega10.patch b/queue-5.10/drm-amd-pm-fix-workload-mismatch-on-vega10.patch new file mode 100644 index 00000000000..4dc77eea585 --- /dev/null +++ b/queue-5.10/drm-amd-pm-fix-workload-mismatch-on-vega10.patch @@ -0,0 +1,36 @@ +From 041fe4e614daef81ea218523ce36f1d5824810c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 10:28:00 +0800 +Subject: drm/amd/pm: fix workload mismatch on vega10 + +From: Kenneth Feng + +[ Upstream commit 0979d43259e13846d86ba17e451e17fec185d240 ] + +Workload number mapped to the correct one. +This issue is only on vega10. + +Signed-off-by: Kenneth Feng +Reviewed-by: Kevin Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +index ed4eafc744d3..132c269c7c89 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +@@ -5159,7 +5159,7 @@ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui + + out: + smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_SetWorkloadMask, +- 1 << power_profile_mode, ++ (!power_profile_mode) ? 0 : 1 << (power_profile_mode - 1), + NULL); + hwmgr->power_profile_mode = power_profile_mode; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-display-buffer-interrupt_low_irq_context-.patch b/queue-5.10/drm-amdgpu-display-buffer-interrupt_low_irq_context-.patch new file mode 100644 index 00000000000..7afee40beb8 --- /dev/null +++ b/queue-5.10/drm-amdgpu-display-buffer-interrupt_low_irq_context-.patch @@ -0,0 +1,290 @@ +From 307b45dbc78eb3e074897a666890ad76d59835cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 12:06:34 -0500 +Subject: drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work + +From: Xiaogang Chen + +[ Upstream commit b6f91fc183f758461b9462cc93e673adbbf95c2d ] + +amdgpu DM handles INTERRUPT_LOW_IRQ_CONTEXT interrupt(hpd, hpd_rx) by using work +queue and uses single work_struct. If new interrupt is recevied before the +previous handler finished, new interrupts(same type) will be discarded and +driver just sends "amdgpu_dm_irq_schedule_work FAILED" message out. If some +important hpd, hpd_rx related interrupts are missed by driver the hot (un)plug +devices may cause system hang or instability, such as issues with system +resume from S3 sleep with mst device connected. + +This patch dynamically allocates new amdgpu_dm_irq_handler_data for new +interrupts if previous INTERRUPT_LOW_IRQ_CONTEXT interrupt work has not been +handled. So the new interrupt works can be queued to the same workqueue_struct, +instead of discard the new interrupts. All allocated amdgpu_dm_irq_handler_data +are put into a single linked list and will be reused after. + +Signed-off-by: Xiaogang Chen +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 14 +-- + .../drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 115 ++++++++++++------ + 2 files changed, 80 insertions(+), 49 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index a8a0e8cb1a11..1df7f1b18049 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -68,18 +68,6 @@ struct common_irq_params { + enum dc_irq_source irq_src; + }; + +-/** +- * struct irq_list_head - Linked-list for low context IRQ handlers. +- * +- * @head: The list_head within &struct handler_data +- * @work: A work_struct containing the deferred handler work +- */ +-struct irq_list_head { +- struct list_head head; +- /* In case this interrupt needs post-processing, 'work' will be queued*/ +- struct work_struct work; +-}; +- + /** + * struct dm_compressor_info - Buffer info used by frame buffer compression + * @cpu_addr: MMIO cpu addr +@@ -270,7 +258,7 @@ struct amdgpu_display_manager { + * Note that handlers are called in the same order as they were + * registered (FIFO). + */ +- struct irq_list_head irq_handler_list_low_tab[DAL_IRQ_SOURCES_NUMBER]; ++ struct list_head irq_handler_list_low_tab[DAL_IRQ_SOURCES_NUMBER]; + + /** + * @irq_handler_list_high_tab: +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +index 357778556b06..281b274e2b9b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +@@ -82,6 +82,7 @@ struct amdgpu_dm_irq_handler_data { + struct amdgpu_display_manager *dm; + /* DAL irq source which registered for this interrupt. */ + enum dc_irq_source irq_source; ++ struct work_struct work; + }; + + #define DM_IRQ_TABLE_LOCK(adev, flags) \ +@@ -111,20 +112,10 @@ static void init_handler_common_data(struct amdgpu_dm_irq_handler_data *hcd, + */ + static void dm_irq_work_func(struct work_struct *work) + { +- struct irq_list_head *irq_list_head = +- container_of(work, struct irq_list_head, work); +- struct list_head *handler_list = &irq_list_head->head; +- struct amdgpu_dm_irq_handler_data *handler_data; +- +- list_for_each_entry(handler_data, handler_list, list) { +- DRM_DEBUG_KMS("DM_IRQ: work_func: for dal_src=%d\n", +- handler_data->irq_source); ++ struct amdgpu_dm_irq_handler_data *handler_data = ++ container_of(work, struct amdgpu_dm_irq_handler_data, work); + +- DRM_DEBUG_KMS("DM_IRQ: schedule_work: for dal_src=%d\n", +- handler_data->irq_source); +- +- handler_data->handler(handler_data->handler_arg); +- } ++ handler_data->handler(handler_data->handler_arg); + + /* Call a DAL subcomponent which registered for interrupt notification + * at INTERRUPT_LOW_IRQ_CONTEXT. +@@ -156,7 +147,7 @@ static struct list_head *remove_irq_handler(struct amdgpu_device *adev, + break; + case INTERRUPT_LOW_IRQ_CONTEXT: + default: +- hnd_list = &adev->dm.irq_handler_list_low_tab[irq_source].head; ++ hnd_list = &adev->dm.irq_handler_list_low_tab[irq_source]; + break; + } + +@@ -287,7 +278,8 @@ void *amdgpu_dm_irq_register_interrupt(struct amdgpu_device *adev, + break; + case INTERRUPT_LOW_IRQ_CONTEXT: + default: +- hnd_list = &adev->dm.irq_handler_list_low_tab[irq_source].head; ++ hnd_list = &adev->dm.irq_handler_list_low_tab[irq_source]; ++ INIT_WORK(&handler_data->work, dm_irq_work_func); + break; + } + +@@ -369,7 +361,7 @@ void amdgpu_dm_irq_unregister_interrupt(struct amdgpu_device *adev, + int amdgpu_dm_irq_init(struct amdgpu_device *adev) + { + int src; +- struct irq_list_head *lh; ++ struct list_head *lh; + + DRM_DEBUG_KMS("DM_IRQ\n"); + +@@ -378,9 +370,7 @@ int amdgpu_dm_irq_init(struct amdgpu_device *adev) + for (src = 0; src < DAL_IRQ_SOURCES_NUMBER; src++) { + /* low context handler list init */ + lh = &adev->dm.irq_handler_list_low_tab[src]; +- INIT_LIST_HEAD(&lh->head); +- INIT_WORK(&lh->work, dm_irq_work_func); +- ++ INIT_LIST_HEAD(lh); + /* high context handler init */ + INIT_LIST_HEAD(&adev->dm.irq_handler_list_high_tab[src]); + } +@@ -397,8 +387,11 @@ int amdgpu_dm_irq_init(struct amdgpu_device *adev) + void amdgpu_dm_irq_fini(struct amdgpu_device *adev) + { + int src; +- struct irq_list_head *lh; ++ struct list_head *lh; ++ struct list_head *entry, *tmp; ++ struct amdgpu_dm_irq_handler_data *handler; + unsigned long irq_table_flags; ++ + DRM_DEBUG_KMS("DM_IRQ: releasing resources.\n"); + for (src = 0; src < DAL_IRQ_SOURCES_NUMBER; src++) { + DM_IRQ_TABLE_LOCK(adev, irq_table_flags); +@@ -407,7 +400,16 @@ void amdgpu_dm_irq_fini(struct amdgpu_device *adev) + * (because no code can schedule a new one). */ + lh = &adev->dm.irq_handler_list_low_tab[src]; + DM_IRQ_TABLE_UNLOCK(adev, irq_table_flags); +- flush_work(&lh->work); ++ ++ if (!list_empty(lh)) { ++ list_for_each_safe(entry, tmp, lh) { ++ handler = list_entry( ++ entry, ++ struct amdgpu_dm_irq_handler_data, ++ list); ++ flush_work(&handler->work); ++ } ++ } + } + } + +@@ -417,6 +419,8 @@ int amdgpu_dm_irq_suspend(struct amdgpu_device *adev) + struct list_head *hnd_list_h; + struct list_head *hnd_list_l; + unsigned long irq_table_flags; ++ struct list_head *entry, *tmp; ++ struct amdgpu_dm_irq_handler_data *handler; + + DM_IRQ_TABLE_LOCK(adev, irq_table_flags); + +@@ -427,14 +431,22 @@ int amdgpu_dm_irq_suspend(struct amdgpu_device *adev) + * will be disabled from manage_dm_interrupts on disable CRTC. + */ + for (src = DC_IRQ_SOURCE_HPD1; src <= DC_IRQ_SOURCE_HPD6RX; src++) { +- hnd_list_l = &adev->dm.irq_handler_list_low_tab[src].head; ++ hnd_list_l = &adev->dm.irq_handler_list_low_tab[src]; + hnd_list_h = &adev->dm.irq_handler_list_high_tab[src]; + if (!list_empty(hnd_list_l) || !list_empty(hnd_list_h)) + dc_interrupt_set(adev->dm.dc, src, false); + + DM_IRQ_TABLE_UNLOCK(adev, irq_table_flags); +- flush_work(&adev->dm.irq_handler_list_low_tab[src].work); + ++ if (!list_empty(hnd_list_l)) { ++ list_for_each_safe (entry, tmp, hnd_list_l) { ++ handler = list_entry( ++ entry, ++ struct amdgpu_dm_irq_handler_data, ++ list); ++ flush_work(&handler->work); ++ } ++ } + DM_IRQ_TABLE_LOCK(adev, irq_table_flags); + } + +@@ -454,7 +466,7 @@ int amdgpu_dm_irq_resume_early(struct amdgpu_device *adev) + + /* re-enable short pulse interrupts HW interrupt */ + for (src = DC_IRQ_SOURCE_HPD1RX; src <= DC_IRQ_SOURCE_HPD6RX; src++) { +- hnd_list_l = &adev->dm.irq_handler_list_low_tab[src].head; ++ hnd_list_l = &adev->dm.irq_handler_list_low_tab[src]; + hnd_list_h = &adev->dm.irq_handler_list_high_tab[src]; + if (!list_empty(hnd_list_l) || !list_empty(hnd_list_h)) + dc_interrupt_set(adev->dm.dc, src, true); +@@ -480,7 +492,7 @@ int amdgpu_dm_irq_resume_late(struct amdgpu_device *adev) + * will be enabled from manage_dm_interrupts on enable CRTC. + */ + for (src = DC_IRQ_SOURCE_HPD1; src <= DC_IRQ_SOURCE_HPD6; src++) { +- hnd_list_l = &adev->dm.irq_handler_list_low_tab[src].head; ++ hnd_list_l = &adev->dm.irq_handler_list_low_tab[src]; + hnd_list_h = &adev->dm.irq_handler_list_high_tab[src]; + if (!list_empty(hnd_list_l) || !list_empty(hnd_list_h)) + dc_interrupt_set(adev->dm.dc, src, true); +@@ -497,22 +509,53 @@ int amdgpu_dm_irq_resume_late(struct amdgpu_device *adev) + static void amdgpu_dm_irq_schedule_work(struct amdgpu_device *adev, + enum dc_irq_source irq_source) + { +- unsigned long irq_table_flags; +- struct work_struct *work = NULL; ++ struct list_head *handler_list = &adev->dm.irq_handler_list_low_tab[irq_source]; ++ struct amdgpu_dm_irq_handler_data *handler_data; ++ bool work_queued = false; + +- DM_IRQ_TABLE_LOCK(adev, irq_table_flags); ++ if (list_empty(handler_list)) ++ return; + +- if (!list_empty(&adev->dm.irq_handler_list_low_tab[irq_source].head)) +- work = &adev->dm.irq_handler_list_low_tab[irq_source].work; ++ list_for_each_entry (handler_data, handler_list, list) { ++ if (!queue_work(system_highpri_wq, &handler_data->work)) { ++ continue; ++ } else { ++ work_queued = true; ++ break; ++ } ++ } + +- DM_IRQ_TABLE_UNLOCK(adev, irq_table_flags); ++ if (!work_queued) { ++ struct amdgpu_dm_irq_handler_data *handler_data_add; ++ /*get the amdgpu_dm_irq_handler_data of first item pointed by handler_list*/ ++ handler_data = container_of(handler_list->next, struct amdgpu_dm_irq_handler_data, list); + +- if (work) { +- if (!schedule_work(work)) +- DRM_INFO("amdgpu_dm_irq_schedule_work FAILED src %d\n", +- irq_source); +- } ++ /*allocate a new amdgpu_dm_irq_handler_data*/ ++ handler_data_add = kzalloc(sizeof(*handler_data), GFP_KERNEL); ++ if (!handler_data_add) { ++ DRM_ERROR("DM_IRQ: failed to allocate irq handler!\n"); ++ return; ++ } ++ ++ /*copy new amdgpu_dm_irq_handler_data members from handler_data*/ ++ handler_data_add->handler = handler_data->handler; ++ handler_data_add->handler_arg = handler_data->handler_arg; ++ handler_data_add->dm = handler_data->dm; ++ handler_data_add->irq_source = irq_source; + ++ list_add_tail(&handler_data_add->list, handler_list); ++ ++ INIT_WORK(&handler_data_add->work, dm_irq_work_func); ++ ++ if (queue_work(system_highpri_wq, &handler_data_add->work)) ++ DRM_DEBUG("Queued work for handling interrupt from " ++ "display for IRQ source %d\n", ++ irq_source); ++ else ++ DRM_ERROR("Failed to queue work for handling interrupt " ++ "from display for IRQ source %d\n", ++ irq_source); ++ } + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-fix-asic-reset-regression-issue-introduce.patch b/queue-5.10/drm-amdgpu-fix-asic-reset-regression-issue-introduce.patch new file mode 100644 index 00000000000..733a7d70f0f --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-asic-reset-regression-issue-introduce.patch @@ -0,0 +1,37 @@ +From 666b21a3b394486ecc0c967c0cba146314654cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 10:30:15 -0500 +Subject: drm/amdgpu : Fix asic reset regression issue introduce by + 8f211fe8ac7c4f + +From: shaoyunl + +[ Upstream commit c8941550aa66b2a90f4b32c45d59e8571e33336e ] + +This recent change introduce SDMA interrupt info printing with irq->process function. +These functions do not require a set function to enable/disable the irq + +Signed-off-by: shaoyunl +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +index 300ac73b4738..2f70fdd6104f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +@@ -499,7 +499,7 @@ void amdgpu_irq_gpu_reset_resume_helper(struct amdgpu_device *adev) + for (j = 0; j < AMDGPU_MAX_IRQ_SRC_ID; ++j) { + struct amdgpu_irq_src *src = adev->irq.client[i].sources[j]; + +- if (!src) ++ if (!src || !src->funcs || !src->funcs->set) + continue; + for (k = 0; k < src->num_types; k++) + amdgpu_irq_update(adev, src, k); +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-fix-null-pointer-dereference.patch b/queue-5.10/drm-amdgpu-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..696ed3c976f --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-null-pointer-dereference.patch @@ -0,0 +1,60 @@ +From 0db6cda21df4237e3e270bf79cd770abe0c7da88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 17:52:18 +0800 +Subject: drm/amdgpu: fix NULL pointer dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guchun Chen + +[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ] + +ttm->sg needs to be checked before accessing its child member. + +Call Trace: + amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu] + ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm] + ttm_bo_release+0x17d/0x300 [ttm] + amdgpu_bo_unref+0x1a/0x30 [amdgpu] + amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu] + kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu] + kfd_ioctl+0x222/0x400 [amdgpu] + ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu] + __x64_sys_ioctl+0x8e/0xd0 + ? __context_tracking_exit+0x52/0x90 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x7f97f264d317 +Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317 +RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003 +RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004 +R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16 +R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000 + +Signed-off-by: Guchun Chen +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 06a662ea33dd..ab7755a3885a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -1034,7 +1034,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_bo_device *bdev, + DMA_BIDIRECTIONAL : DMA_TO_DEVICE; + + /* double check that we don't free the table twice */ +- if (!ttm->sg->sgl) ++ if (!ttm->sg || !ttm->sg->sgl) + return; + + /* unmap the pages mapped to the device */ +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-fix-some-unload-driver-issues.patch b/queue-5.10/drm-amdgpu-fix-some-unload-driver-issues.patch new file mode 100644 index 00000000000..84b719c1d4b --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-some-unload-driver-issues.patch @@ -0,0 +1,64 @@ +From cb1ee92537075115025e0429d9977369e764b09c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 19:30:51 +0800 +Subject: drm/amdgpu: Fix some unload driver issues +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Emily Deng + +[ Upstream commit bb0cd09be45ea457f25fdcbcb3d6cf2230f26c46 ] + +When unloading driver after killing some applications, it will hit sdma +flush tlb job timeout which is called by ttm_bo_delay_delete. So +to avoid the job submit after fence driver fini, call ttm_bo_lock_delayed_workqueue +before fence driver fini. And also put drm_sched_fini before waiting fence. + +Signed-off-by: Emily Deng +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 76d10f1c579b..7f2689d4b86d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3551,6 +3551,7 @@ void amdgpu_device_fini(struct amdgpu_device *adev) + { + dev_info(adev->dev, "amdgpu: finishing device.\n"); + flush_delayed_work(&adev->delayed_init_work); ++ ttm_bo_lock_delayed_workqueue(&adev->mman.bdev); + adev->shutdown = true; + + kfree(adev->pci_state); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +index fe2d495d08ab..d07c458c0bed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +@@ -532,6 +532,8 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) + + if (!ring || !ring->fence_drv.initialized) + continue; ++ if (!ring->no_scheduler) ++ drm_sched_fini(&ring->sched); + r = amdgpu_fence_wait_empty(ring); + if (r) { + /* no need to trigger GPU reset as we are unloading */ +@@ -540,8 +542,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) + if (ring->fence_drv.irq_src) + amdgpu_irq_put(adev, ring->fence_drv.irq_src, + ring->fence_drv.irq_type); +- if (!ring->no_scheduler) +- drm_sched_fini(&ring->sched); ++ + del_timer_sync(&ring->fence_drv.fallback_timer); + for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j) + dma_fence_put(ring->fence_drv.fences[j]); +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-mask-the-xgmi-number-of-hops-reported-fro.patch b/queue-5.10/drm-amdgpu-mask-the-xgmi-number-of-hops-reported-fro.patch new file mode 100644 index 00000000000..2493d63f06b --- /dev/null +++ b/queue-5.10/drm-amdgpu-mask-the-xgmi-number-of-hops-reported-fro.patch @@ -0,0 +1,55 @@ +From 91d1e0cdf136d24b93b7c3f7eb9afb2c8f8439d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jan 2021 15:24:59 -0500 +Subject: drm/amdgpu: mask the xgmi number of hops reported from psp to kfd + +From: Jonathan Kim + +[ Upstream commit 4ac5617c4b7d0f0a8f879997f8ceaa14636d7554 ] + +The psp supplies the link type in the upper 2 bits of the psp xgmi node +information num_hops field. With a new link type, Aldebaran has these +bits set to a non-zero value (1 = xGMI3) so the KFD topology will report +the incorrect IO link weights without proper masking. +The actual number of hops is located in the 3 least significant bits of +this field so mask if off accordingly before passing it to the KFD. + +Signed-off-by: Jonathan Kim +Reviewed-by: Amber Lin +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +index 1162913c8bf4..0526dec1d736 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +@@ -465,15 +465,22 @@ int amdgpu_xgmi_update_topology(struct amdgpu_hive_info *hive, struct amdgpu_dev + } + + ++/* ++ * NOTE psp_xgmi_node_info.num_hops layout is as follows: ++ * num_hops[7:6] = link type (0 = xGMI2, 1 = xGMI3, 2/3 = reserved) ++ * num_hops[5:3] = reserved ++ * num_hops[2:0] = number of hops ++ */ + int amdgpu_xgmi_get_hops_count(struct amdgpu_device *adev, + struct amdgpu_device *peer_adev) + { + struct psp_xgmi_topology_info *top = &adev->psp.xgmi_context.top_info; ++ uint8_t num_hops_mask = 0x7; + int i; + + for (i = 0 ; i < top->num_nodes; ++i) + if (top->nodes[i].node_id == peer_adev->gmc.xgmi.node_id) +- return top->nodes[i].num_hops; ++ return top->nodes[i].num_hops & num_hops_mask; + return -EINVAL; + } + +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-ttm-fix-memory-leak-userptr-pages.patch b/queue-5.10/drm-amdgpu-ttm-fix-memory-leak-userptr-pages.patch new file mode 100644 index 00000000000..fca8f5ac6fc --- /dev/null +++ b/queue-5.10/drm-amdgpu-ttm-fix-memory-leak-userptr-pages.patch @@ -0,0 +1,47 @@ +From 622e095d61fbb9cf34b4c75f79528a0360607888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 17:08:37 +0100 +Subject: drm/amdgpu/ttm: Fix memory leak userptr pages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Gomez + +[ Upstream commit 0f6f9dd490d524930081a6ef1d60171ce39220b9 ] + +If userptr pages have been pinned but not bounded, +they remain uncleared. + +Reviewed-by: Christian König +Signed-off-by: Daniel Gomez +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index a0248d78190f..06a662ea33dd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -1254,13 +1254,13 @@ static void amdgpu_ttm_backend_unbind(struct ttm_bo_device *bdev, + struct amdgpu_ttm_tt *gtt = (void *)ttm; + int r; + +- if (!gtt->bound) +- return; +- + /* if the pages have userptr pinning then clear that first */ + if (gtt->userptr) + amdgpu_ttm_tt_unpin_userptr(bdev, ttm); + ++ if (!gtt->bound) ++ return; ++ + if (gtt->offset == AMDGPU_BO_INVALID_OFFSET) + return; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amdkfd-fix-cat-debugfs-hang_hws-file-causes-syst.patch b/queue-5.10/drm-amdkfd-fix-cat-debugfs-hang_hws-file-causes-syst.patch new file mode 100644 index 00000000000..2e0c475d0c9 --- /dev/null +++ b/queue-5.10/drm-amdkfd-fix-cat-debugfs-hang_hws-file-causes-syst.patch @@ -0,0 +1,81 @@ +From d17d74893e6617c3c8eb640c1e12053e23408780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Mar 2021 16:28:18 +0800 +Subject: drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug + +From: Qu Huang + +[ Upstream commit d73610211eec8aa027850982b1a48980aa1bc96e ] + +Here is the system crash log: +[ 1272.884438] BUG: unable to handle kernel NULL pointer dereference at +(null) +[ 1272.884444] IP: [< (null)>] (null) +[ 1272.884447] PGD 825b09067 PUD 8267c8067 PMD 0 +[ 1272.884452] Oops: 0010 [#1] SMP +[ 1272.884509] CPU: 13 PID: 3485 Comm: cat Kdump: loaded Tainted: G +[ 1272.884515] task: ffff9a38dbd4d140 ti: ffff9a37cd3b8000 task.ti: +ffff9a37cd3b8000 +[ 1272.884517] RIP: 0010:[<0000000000000000>] [< (null)>] +(null) +[ 1272.884520] RSP: 0018:ffff9a37cd3bbe68 EFLAGS: 00010203 +[ 1272.884522] RAX: 0000000000000000 RBX: 0000000000000000 RCX: +0000000000014d5f +[ 1272.884524] RDX: fffffffffffffff4 RSI: 0000000000000001 RDI: +ffff9a38aca4d200 +[ 1272.884526] RBP: ffff9a37cd3bbed0 R08: ffff9a38dcd5f1a0 R09: +ffff9a31ffc07300 +[ 1272.884527] R10: ffff9a31ffc07300 R11: ffffffffaddd5e9d R12: +ffff9a38b4e0fb00 +[ 1272.884529] R13: 0000000000000001 R14: ffff9a37cd3bbf18 R15: +ffff9a38aca4d200 +[ 1272.884532] FS: 00007feccaa67740(0000) GS:ffff9a38dcd40000(0000) +knlGS:0000000000000000 +[ 1272.884534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1272.884536] CR2: 0000000000000000 CR3: 00000008267c0000 CR4: +00000000003407e0 +[ 1272.884537] Call Trace: +[ 1272.884544] [] ? seq_read+0x130/0x440 +[ 1272.884548] [] vfs_read+0x9f/0x170 +[ 1272.884552] [] SyS_read+0x7f/0xf0 +[ 1272.884557] [] system_call_fastpath+0x22/0x27 +[ 1272.884558] Code: Bad RIP value. +[ 1272.884562] RIP [< (null)>] (null) +[ 1272.884564] RSP +[ 1272.884566] CR2: 0000000000000000 + +Signed-off-by: Qu Huang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c +index 511712c2e382..673d5e34f213 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c +@@ -33,6 +33,11 @@ static int kfd_debugfs_open(struct inode *inode, struct file *file) + + return single_open(file, show, NULL); + } ++static int kfd_debugfs_hang_hws_read(struct seq_file *m, void *data) ++{ ++ seq_printf(m, "echo gpu_id > hang_hws\n"); ++ return 0; ++} + + static ssize_t kfd_debugfs_hang_hws_write(struct file *file, + const char __user *user_buf, size_t size, loff_t *ppos) +@@ -94,7 +99,7 @@ void kfd_debugfs_init(void) + debugfs_create_file("rls", S_IFREG | 0444, debugfs_root, + kfd_debugfs_rls_by_device, &kfd_debugfs_fops); + debugfs_create_file("hang_hws", S_IFREG | 0200, debugfs_root, +- NULL, &kfd_debugfs_hang_hws_fops); ++ kfd_debugfs_hang_hws_read, &kfd_debugfs_hang_hws_fops); + } + + void kfd_debugfs_fini(void) +-- +2.30.2 + diff --git a/queue-5.10/drm-amdkfd-fix-ubsan-shift-out-of-bounds-warning.patch b/queue-5.10/drm-amdkfd-fix-ubsan-shift-out-of-bounds-warning.patch new file mode 100644 index 00000000000..6c600c11714 --- /dev/null +++ b/queue-5.10/drm-amdkfd-fix-ubsan-shift-out-of-bounds-warning.patch @@ -0,0 +1,67 @@ +From e2e4b4aff3c7f2f2389eb2b1ff6e0b2fb4b6e142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 12:33:15 -0500 +Subject: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning + +From: Anson Jacob + +[ Upstream commit 50e2fc36e72d4ad672032ebf646cecb48656efe0 ] + +If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up +doing a shift operation where the number of bits shifted equals +number of bits in the operand. This behaviour is undefined. + +Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the +count is >= number of bits in the operand. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472 + +Reported-by: Lyude Paul +Signed-off-by: Anson Jacob +Reviewed-by: Alex Deucher +Reviewed-by: Felix Kuehling +Tested-by: Lyude Paul +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index 8e5cfb1f8a51..6ea8a4b6efde 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1128,6 +1128,9 @@ static int set_sched_resources(struct device_queue_manager *dqm) + + static int initialize_cpsch(struct device_queue_manager *dqm) + { ++ uint64_t num_sdma_queues; ++ uint64_t num_xgmi_sdma_queues; ++ + pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm)); + + mutex_init(&dqm->lock_hidden); +@@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager *dqm) + dqm->active_cp_queue_count = 0; + dqm->gws_queue_count = 0; + dqm->active_runlist = false; +- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm)); +- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm)); ++ ++ num_sdma_queues = get_num_sdma_queues(dqm); ++ if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap)) ++ dqm->sdma_bitmap = ULLONG_MAX; ++ else ++ dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1); ++ ++ num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm); ++ if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap)) ++ dqm->xgmi_sdma_bitmap = ULLONG_MAX; ++ else ++ dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1); + + INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception); + +-- +2.30.2 + diff --git a/queue-5.10/drm-ast-fix-invalid-usage-of-ast_max_hwc_width-in-cu.patch b/queue-5.10/drm-ast-fix-invalid-usage-of-ast_max_hwc_width-in-cu.patch new file mode 100644 index 00000000000..ca7666f6a05 --- /dev/null +++ b/queue-5.10/drm-ast-fix-invalid-usage-of-ast_max_hwc_width-in-cu.patch @@ -0,0 +1,38 @@ +From aa6f8c17c882f6b4942a999b5a756341847f07df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 14:46:24 +0100 +Subject: drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor + atomic_check + +From: Thomas Zimmermann + +[ Upstream commit ee4a92d690f30f3793df942939726bec0338e65b ] + +Use AST_MAX_HWC_HEIGHT for setting offset_y in the cursor plane's +atomic_check. The code used AST_MAX_HWC_WIDTH instead. This worked +because both constants has the same value. + +Signed-off-by: Thomas Zimmermann +Acked-by: Gerd Hoffmann +Link: https://patchwork.freedesktop.org/patch/msgid/20210209134632.12157-3-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_mode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 0a1e1cf57e19..a3c2f76668ab 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -688,7 +688,7 @@ ast_cursor_plane_helper_atomic_update(struct drm_plane *plane, + unsigned int offset_x, offset_y; + + offset_x = AST_MAX_HWC_WIDTH - fb->width; +- offset_y = AST_MAX_HWC_WIDTH - fb->height; ++ offset_y = AST_MAX_HWC_HEIGHT - fb->height; + + if (state->fb != old_state->fb) { + /* A new cursor image was installed. */ +-- +2.30.2 + diff --git a/queue-5.10/drm-ast-fix-memory-leak-when-unload-the-driver.patch b/queue-5.10/drm-ast-fix-memory-leak-when-unload-the-driver.patch new file mode 100644 index 00000000000..52b6e6c28f1 --- /dev/null +++ b/queue-5.10/drm-ast-fix-memory-leak-when-unload-the-driver.patch @@ -0,0 +1,93 @@ +From 5924ea8fe03126900ab97ae4a634d05c9ddf91cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Feb 2021 21:33:22 -0500 +Subject: drm/ast: fix memory leak when unload the driver + +From: Tong Zhang + +[ Upstream commit dc739820ff90acccd013f6bb420222978a982791 ] + +a connector is leaked upon module unload, it seems that we should do +similar to sample driver as suggested in drm_drv.c. + +Adding drm_atomic_helper_shutdown() in ast_pci_remove to prevent leaking. + +[ 153.822134] WARNING: CPU: 0 PID: 173 at drivers/gpu/drm/drm_mode_config.c:504 drm_mode_config_cle0 +[ 153.822698] Modules linked in: ast(-) drm_vram_helper drm_ttm_helper ttm [last unloaded: ttm] +[ 153.823197] CPU: 0 PID: 173 Comm: modprobe Tainted: G W 5.11.0-03615-g55f62bc873474 +[ 153.823708] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 +[ 153.824333] RIP: 0010:drm_mode_config_cleanup+0x418/0x470 +[ 153.824637] Code: 0c 00 00 00 00 48 8b 84 24 a8 00 00 00 65 48 33 04 25 28 00 00 00 75 65 48 81 c0 +[ 153.825668] RSP: 0018:ffff888103c9fb70 EFLAGS: 00010212 +[ 153.825962] RAX: ffff888102b0d100 RBX: ffff888102b0c298 RCX: ffffffff818d8b2b +[ 153.826356] RDX: dffffc0000000000 RSI: 000000007fffffff RDI: ffff888102b0c298 +[ 153.826748] RBP: ffff888103c9fba0 R08: 0000000000000001 R09: ffffed1020561857 +[ 153.827146] R10: ffff888102b0c2b7 R11: ffffed1020561856 R12: ffff888102b0c000 +[ 153.827538] R13: ffff888102b0c2d8 R14: ffff888102b0c2d8 R15: 1ffff11020793f70 +[ 153.827935] FS: 00007f24bff456a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 +[ 153.828380] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 153.828697] CR2: 0000000001c39018 CR3: 0000000103c90000 CR4: 00000000000006f0 +[ 153.829096] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 153.829486] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 153.829883] Call Trace: +[ 153.830024] ? drmm_mode_config_init+0x930/0x930 +[ 153.830281] ? cpumask_next+0x16/0x20 +[ 153.830488] ? mnt_get_count+0x66/0x80 +[ 153.830699] ? drm_mode_config_cleanup+0x470/0x470 +[ 153.830972] drm_managed_release+0xed/0x1c0 +[ 153.831208] drm_dev_release+0x3a/0x50 +[ 153.831420] release_nodes+0x39e/0x410 +[ 153.831631] ? devres_release+0x40/0x40 +[ 153.831852] device_release_driver_internal+0x158/0x270 +[ 153.832143] driver_detach+0x76/0xe0 +[ 153.832344] bus_remove_driver+0x7e/0x100 +[ 153.832568] pci_unregister_driver+0x28/0xf0 +[ 153.832821] __x64_sys_delete_module+0x268/0x300 +[ 153.833086] ? __ia32_sys_delete_module+0x300/0x300 +[ 153.833357] ? call_rcu+0x372/0x4f0 +[ 153.833553] ? fpregs_assert_state_consistent+0x4d/0x60 +[ 153.833840] ? exit_to_user_mode_prepare+0x2f/0x130 +[ 153.834118] do_syscall_64+0x33/0x40 +[ 153.834317] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 153.834597] RIP: 0033:0x7f24bfec7cf7 +[ 153.834797] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 +[ 153.835812] RSP: 002b:00007fff72e6cb58 EFLAGS: 00000202 ORIG_RAX: 00000000000000b0 +[ 153.836234] RAX: ffffffffffffffda RBX: 00007f24bff45690 RCX: 00007f24bfec7cf7 +[ 153.836623] RDX: 00000000ffffffff RSI: 0000000000000080 RDI: 0000000001c2fb10 +[ 153.837018] RBP: 0000000001c2fac0 R08: 2f2f2f2f2f2f2f2f R09: 0000000001c2fac0 +[ 153.837408] R10: fefefefefefefeff R11: 0000000000000202 R12: 0000000001c2fac0 +[ 153.837798] R13: 0000000001c2f9d0 R14: 0000000000000000 R15: 0000000000000001 +[ 153.838194] ---[ end trace b92031513bbe596c ]--- +[ 153.838441] [drm:drm_mode_config_cleanup] *ERROR* connector VGA-1 leaked! + +Signed-off-by: Tong Zhang +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20210222023322.984885-1-ztong0001@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c +index f0b4af1c390a..59d2466d40c6 100644 +--- a/drivers/gpu/drm/ast/ast_drv.c ++++ b/drivers/gpu/drm/ast/ast_drv.c +@@ -30,6 +30,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -138,6 +139,7 @@ static void ast_pci_remove(struct pci_dev *pdev) + struct drm_device *dev = pci_get_drvdata(pdev); + + drm_dev_unregister(dev); ++ drm_atomic_helper_shutdown(dev); + } + + static int ast_drm_freeze(struct drm_device *dev) +-- +2.30.2 + diff --git a/queue-5.10/drm-komeda-fix-bit-check-to-import-to-value-of-prope.patch b/queue-5.10/drm-komeda-fix-bit-check-to-import-to-value-of-prope.patch new file mode 100644 index 00000000000..c28036df28a --- /dev/null +++ b/queue-5.10/drm-komeda-fix-bit-check-to-import-to-value-of-prope.patch @@ -0,0 +1,179 @@ +From 4bff454420629a850e02d6b74715e6b9eb4e3393 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 13:11:02 +0000 +Subject: drm/komeda: Fix bit check to import to value of proper type + +From: Carsten Haitzler + +[ Upstream commit be3e477effba636ad25dcd244db264c6cd5c1f36 ] + +KASAN found this problem. find_first_bit() expects to look at a +pointer pointing to a long, but we look at a u32 - this is going to be +an issue with endianness but, KSAN already flags this as out-of-bounds +stack reads. This fixes it by just importing inot a local long. + +Signed-off-by: Carsten Haitzler +Acked-by: Liviu Dudau +Signed-off-by: Liviu Dudau +Link: https://patchwork.freedesktop.org/patch/msgid/20201218150812.68195-1-carsten.haitzler@foss.arm.com +Signed-off-by: Sasha Levin +--- + .../drm/arm/display/include/malidp_utils.h | 3 --- + .../drm/arm/display/komeda/komeda_pipeline.c | 16 +++++++++++----- + .../display/komeda/komeda_pipeline_state.c | 19 +++++++++++-------- + 3 files changed, 22 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/arm/display/include/malidp_utils.h b/drivers/gpu/drm/arm/display/include/malidp_utils.h +index 3bc383d5bf73..49a1d7f3539c 100644 +--- a/drivers/gpu/drm/arm/display/include/malidp_utils.h ++++ b/drivers/gpu/drm/arm/display/include/malidp_utils.h +@@ -13,9 +13,6 @@ + #define has_bit(nr, mask) (BIT(nr) & (mask)) + #define has_bits(bits, mask) (((bits) & (mask)) == (bits)) + +-#define dp_for_each_set_bit(bit, mask) \ +- for_each_set_bit((bit), ((unsigned long *)&(mask)), sizeof(mask) * 8) +- + #define dp_wait_cond(__cond, __tries, __min_range, __max_range) \ + ({ \ + int num_tries = __tries; \ +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.c b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.c +index 452e505a1fd3..79a6339840bb 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.c +@@ -46,8 +46,9 @@ void komeda_pipeline_destroy(struct komeda_dev *mdev, + { + struct komeda_component *c; + int i; ++ unsigned long avail_comps = pipe->avail_comps; + +- dp_for_each_set_bit(i, pipe->avail_comps) { ++ for_each_set_bit(i, &avail_comps, 32) { + c = komeda_pipeline_get_component(pipe, i); + komeda_component_destroy(mdev, c); + } +@@ -246,6 +247,7 @@ static void komeda_pipeline_dump(struct komeda_pipeline *pipe) + { + struct komeda_component *c; + int id; ++ unsigned long avail_comps = pipe->avail_comps; + + DRM_INFO("Pipeline-%d: n_layers: %d, n_scalers: %d, output: %s.\n", + pipe->id, pipe->n_layers, pipe->n_scalers, +@@ -257,7 +259,7 @@ static void komeda_pipeline_dump(struct komeda_pipeline *pipe) + pipe->of_output_links[1] ? + pipe->of_output_links[1]->full_name : "none"); + +- dp_for_each_set_bit(id, pipe->avail_comps) { ++ for_each_set_bit(id, &avail_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + + komeda_component_dump(c); +@@ -269,8 +271,9 @@ static void komeda_component_verify_inputs(struct komeda_component *c) + struct komeda_pipeline *pipe = c->pipeline; + struct komeda_component *input; + int id; ++ unsigned long supported_inputs = c->supported_inputs; + +- dp_for_each_set_bit(id, c->supported_inputs) { ++ for_each_set_bit(id, &supported_inputs, 32) { + input = komeda_pipeline_get_component(pipe, id); + if (!input) { + c->supported_inputs &= ~(BIT(id)); +@@ -301,8 +304,9 @@ static void komeda_pipeline_assemble(struct komeda_pipeline *pipe) + struct komeda_component *c; + struct komeda_layer *layer; + int i, id; ++ unsigned long avail_comps = pipe->avail_comps; + +- dp_for_each_set_bit(id, pipe->avail_comps) { ++ for_each_set_bit(id, &avail_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + komeda_component_verify_inputs(c); + } +@@ -354,13 +358,15 @@ void komeda_pipeline_dump_register(struct komeda_pipeline *pipe, + { + struct komeda_component *c; + u32 id; ++ unsigned long avail_comps; + + seq_printf(sf, "\n======== Pipeline-%d ==========\n", pipe->id); + + if (pipe->funcs && pipe->funcs->dump_register) + pipe->funcs->dump_register(pipe, sf); + +- dp_for_each_set_bit(id, pipe->avail_comps) { ++ avail_comps = pipe->avail_comps; ++ for_each_set_bit(id, &avail_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + + seq_printf(sf, "\n------%s------\n", c->name); +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c +index 8f32ae7c25d0..c3cdf283ecef 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c +@@ -1231,14 +1231,15 @@ komeda_pipeline_unbound_components(struct komeda_pipeline *pipe, + struct komeda_pipeline_state *old = priv_to_pipe_st(pipe->obj.state); + struct komeda_component_state *c_st; + struct komeda_component *c; +- u32 disabling_comps, id; ++ u32 id; ++ unsigned long disabling_comps; + + WARN_ON(!old); + + disabling_comps = (~new->active_comps) & old->active_comps; + + /* unbound all disabling component */ +- dp_for_each_set_bit(id, disabling_comps) { ++ for_each_set_bit(id, &disabling_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + c_st = komeda_component_get_state_and_set_user(c, + drm_st, NULL, new->crtc); +@@ -1286,7 +1287,8 @@ bool komeda_pipeline_disable(struct komeda_pipeline *pipe, + struct komeda_pipeline_state *old; + struct komeda_component *c; + struct komeda_component_state *c_st; +- u32 id, disabling_comps = 0; ++ u32 id; ++ unsigned long disabling_comps; + + old = komeda_pipeline_get_old_state(pipe, old_state); + +@@ -1296,10 +1298,10 @@ bool komeda_pipeline_disable(struct komeda_pipeline *pipe, + disabling_comps = old->active_comps & + pipe->standalone_disabled_comps; + +- DRM_DEBUG_ATOMIC("PIPE%d: active_comps: 0x%x, disabling_comps: 0x%x.\n", ++ DRM_DEBUG_ATOMIC("PIPE%d: active_comps: 0x%x, disabling_comps: 0x%lx.\n", + pipe->id, old->active_comps, disabling_comps); + +- dp_for_each_set_bit(id, disabling_comps) { ++ for_each_set_bit(id, &disabling_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + c_st = priv_to_comp_st(c->obj.state); + +@@ -1330,16 +1332,17 @@ void komeda_pipeline_update(struct komeda_pipeline *pipe, + struct komeda_pipeline_state *new = priv_to_pipe_st(pipe->obj.state); + struct komeda_pipeline_state *old; + struct komeda_component *c; +- u32 id, changed_comps = 0; ++ u32 id; ++ unsigned long changed_comps; + + old = komeda_pipeline_get_old_state(pipe, old_state); + + changed_comps = new->active_comps | old->active_comps; + +- DRM_DEBUG_ATOMIC("PIPE%d: active_comps: 0x%x, changed: 0x%x.\n", ++ DRM_DEBUG_ATOMIC("PIPE%d: active_comps: 0x%x, changed: 0x%lx.\n", + pipe->id, new->active_comps, changed_comps); + +- dp_for_each_set_bit(id, changed_comps) { ++ for_each_set_bit(id, &changed_comps, 32) { + c = komeda_pipeline_get_component(pipe, id); + + if (new->active_comps & BIT(c->id)) +-- +2.30.2 + diff --git a/queue-5.10/drm-msm-dp-fix-incorrect-null-check-kbot-warnings-in.patch b/queue-5.10/drm-msm-dp-fix-incorrect-null-check-kbot-warnings-in.patch new file mode 100644 index 00000000000..e4005463fa6 --- /dev/null +++ b/queue-5.10/drm-msm-dp-fix-incorrect-null-check-kbot-warnings-in.patch @@ -0,0 +1,45 @@ +From e6aec211ca2cda574af377ac67609596cfdb9f16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Mar 2021 11:17:18 -0800 +Subject: drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver + +From: Abhinav Kumar + +[ Upstream commit 7d649cfe0314aad2ba18042885ab9de2f13ad809 ] + +Fix an incorrect NULL check reported by kbot in the MSM DP driver + +smatch warnings: +drivers/gpu/drm/msm/dp/dp_hpd.c:37 dp_hpd_connect() +error: we previously assumed 'hpd_priv->dp_cb' could be null +(see line 37) + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Abhinav Kumar +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1614971839-2686-2-git-send-email-abhinavk@codeaurora.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_hpd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_hpd.c b/drivers/gpu/drm/msm/dp/dp_hpd.c +index 5b8fe32022b5..e1c90fa47411 100644 +--- a/drivers/gpu/drm/msm/dp/dp_hpd.c ++++ b/drivers/gpu/drm/msm/dp/dp_hpd.c +@@ -34,8 +34,8 @@ int dp_hpd_connect(struct dp_usbpd *dp_usbpd, bool hpd) + + dp_usbpd->hpd_high = hpd; + +- if (!hpd_priv->dp_cb && !hpd_priv->dp_cb->configure +- && !hpd_priv->dp_cb->disconnect) { ++ if (!hpd_priv->dp_cb || !hpd_priv->dp_cb->configure ++ || !hpd_priv->dp_cb->disconnect) { + pr_err("hpd dp_cb not initialized\n"); + return -EINVAL; + } +-- +2.30.2 + diff --git a/queue-5.10/drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch b/queue-5.10/drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch new file mode 100644 index 00000000000..9b4829afc9c --- /dev/null +++ b/queue-5.10/drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch @@ -0,0 +1,57 @@ +From ba9d708f5ec5c8cec0f28f005d0d10458438fc6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 23:47:24 +0200 +Subject: drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal + +From: Marijn Suijten + +[ Upstream commit 2ad52bdb220de5ab348098e3482b01235d15a842 ] + +Leaving this at a close-to-maximum register value 0xFFF0 means it takes +very long for the MDSS to generate a software vsync interrupt when the +hardware TE interrupt doesn't arrive. Configuring this to double the +vtotal (like some downstream kernels) leads to a frame to take at most +twice before the vsync signal, until hardware TE comes up. + +In this case the hardware interrupt responsible for providing this +signal - "disp-te" gpio - is not hooked up to the mdp5 vsync/pp logic at +all. This solves severe panel update issues observed on at least the +Xperia Loire and Tone series, until said gpio is properly hooked up to +an irq. + +Suggested-by: AngeloGioacchino Del Regno +Signed-off-by: Marijn Suijten +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210406214726.131534-2-marijn.suijten@somainline.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +index ff2c1d583c79..f6df4d3b1406 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +@@ -49,9 +49,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; + cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line); + ++ /* ++ * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on ++ * the vsync_clk equating to roughly half the desired panel refresh rate. ++ * This is only necessary as stability fallback if interrupts from the ++ * panel arrive too late or not at all, but is currently used by default ++ * because these panel interrupts are not wired up yet. ++ */ + mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg); + mdp5_write(mdp5_kms, +- REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), 0xfff0); ++ REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal)); ++ + mdp5_write(mdp5_kms, + REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay); + mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1); +-- +2.30.2 + diff --git a/queue-5.10/drm-msm-mdp5-do-not-multiply-vclk-line-count-by-100.patch b/queue-5.10/drm-msm-mdp5-do-not-multiply-vclk-line-count-by-100.patch new file mode 100644 index 00000000000..ac2a8444017 --- /dev/null +++ b/queue-5.10/drm-msm-mdp5-do-not-multiply-vclk-line-count-by-100.patch @@ -0,0 +1,71 @@ +From 8be2359aafb663111f327d7bf1fbb05aa2802512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 23:47:25 +0200 +Subject: drm/msm/mdp5: Do not multiply vclk line count by 100 + +From: Marijn Suijten + +[ Upstream commit 377569f82ea8228c421cef4da33e056a900b58ca ] + +Neither vtotal nor drm_mode_vrefresh contain a value that is +premultiplied by 100 making the x100 variable name incorrect and +resulting in vclks_line to become 100 times larger than it is supposed +to be. The hardware counts 100 clockticks too many before tearcheck, +leading to severe panel issues on at least the Sony Xperia lineup. + +This is likely an artifact from the original MDSS DSI panel driver where +the calculation [1] corrected for a premultiplied reference framerate by +100 [2]. It does not appear that the above values were ever +premultiplied in the history of the DRM MDP5 driver. + +With this change applied the value written to the SYNC_CONFIG_VSYNC +register is now identical to downstream kernels. + +[1]: https://source.codeaurora.org/quic/la/kernel/msm-3.18/tree/drivers/video/msm/mdss/mdss_mdp_intf_cmd.c?h=LA.UM.8.6.c26-02400-89xx.0#n288 +[2]: https://source.codeaurora.org/quic/la/kernel/msm-3.18/tree/drivers/video/msm/mdss/mdss_dsi_panel.c?h=LA.UM.8.6.c26-02400-89xx.0#n1648 + +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Marijn Suijten +Link: https://lore.kernel.org/r/20210406214726.131534-3-marijn.suijten@somainline.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +index f6df4d3b1406..0392d4dfe270 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c +@@ -20,7 +20,7 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + { + struct mdp5_kms *mdp5_kms = get_kms(encoder); + struct device *dev = encoder->dev->dev; +- u32 total_lines_x100, vclks_line, cfg; ++ u32 total_lines, vclks_line, cfg; + long vsync_clk_speed; + struct mdp5_hw_mixer *mixer = mdp5_crtc_get_mixer(encoder->crtc); + int pp_id = mixer->pp; +@@ -30,8 +30,8 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + return -EINVAL; + } + +- total_lines_x100 = mode->vtotal * drm_mode_vrefresh(mode); +- if (!total_lines_x100) { ++ total_lines = mode->vtotal * drm_mode_vrefresh(mode); ++ if (!total_lines) { + DRM_DEV_ERROR(dev, "%s: vtotal(%d) or vrefresh(%d) is 0\n", + __func__, mode->vtotal, drm_mode_vrefresh(mode)); + return -EINVAL; +@@ -43,7 +43,7 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + vsync_clk_speed); + return -EINVAL; + } +- vclks_line = vsync_clk_speed * 100 / total_lines_x100; ++ vclks_line = vsync_clk_speed / total_lines; + + cfg = MDP5_PP_SYNC_CONFIG_VSYNC_COUNTER_EN + | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; +-- +2.30.2 + diff --git a/queue-5.10/drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch b/queue-5.10/drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch new file mode 100644 index 00000000000..e0a1c6bb094 --- /dev/null +++ b/queue-5.10/drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch @@ -0,0 +1,94 @@ +From 6d6838248dc70a7b632eb9f514bd0d9138b26fd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Feb 2021 23:07:27 -0500 +Subject: drm/qxl: do not run release if qxl failed to init + +From: Tong Zhang + +[ Upstream commit b91907a6241193465ca92e357adf16822242296d ] + +if qxl_device_init() fail, drm device will not be registered, +in this case, do not run qxl_drm_release() + +[ 5.258534] ================================================================== +[ 5.258931] BUG: KASAN: user-memory-access in qxl_destroy_monitors_object+0x42/0xa0 [qxl] +[ 5.259388] Write of size 8 at addr 00000000000014dc by task modprobe/95 +[ 5.259754] +[ 5.259842] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc6-00007-g88bb507a74ea #62 +[ 5.260309] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda54 +[ 5.260917] Call Trace: +[ 5.261056] dump_stack+0x7d/0xa3 +[ 5.261245] kasan_report.cold+0x10c/0x10e +[ 5.261475] ? qxl_destroy_monitors_object+0x42/0xa0 [qxl] +[ 5.261789] check_memory_region+0x17c/0x1e0 +[ 5.262029] qxl_destroy_monitors_object+0x42/0xa0 [qxl] +[ 5.262332] qxl_modeset_fini+0x9/0x20 [qxl] +[ 5.262595] qxl_drm_release+0x22/0x30 [qxl] +[ 5.262841] drm_dev_release+0x32/0x50 +[ 5.263047] release_nodes+0x39e/0x410 +[ 5.263253] ? devres_release+0x40/0x40 +[ 5.263462] really_probe+0x2ea/0x420 +[ 5.263664] driver_probe_device+0x6d/0xd0 +[ 5.263888] device_driver_attach+0x82/0x90 +[ 5.264116] ? device_driver_attach+0x90/0x90 +[ 5.264353] __driver_attach+0x60/0x100 +[ 5.264563] ? device_driver_attach+0x90/0x90 +[ 5.264801] bus_for_each_dev+0xe1/0x140 +[ 5.265014] ? subsys_dev_iter_exit+0x10/0x10 +[ 5.265251] ? klist_node_init+0x61/0x80 +[ 5.265464] bus_add_driver+0x254/0x2a0 +[ 5.265673] driver_register+0xd3/0x150 +[ 5.265882] ? 0xffffffffc0048000 +[ 5.266064] do_one_initcall+0x84/0x250 +[ 5.266274] ? trace_event_raw_event_initcall_finish+0x150/0x150 +[ 5.266596] ? unpoison_range+0xf/0x30 +[ 5.266801] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 5.267082] ? unpoison_range+0xf/0x30 +[ 5.267287] ? unpoison_range+0xf/0x30 +[ 5.267491] do_init_module+0xf8/0x350 +[ 5.267697] load_module+0x3fe6/0x4340 +[ 5.267902] ? vm_unmap_ram+0x1d0/0x1d0 +[ 5.268115] ? module_frob_arch_sections+0x20/0x20 +[ 5.268375] ? __do_sys_finit_module+0x108/0x170 +[ 5.268624] __do_sys_finit_module+0x108/0x170 +[ 5.268865] ? __ia32_sys_init_module+0x40/0x40 +[ 5.269111] ? file_open_root+0x200/0x200 +[ 5.269330] ? do_sys_open+0x85/0xe0 +[ 5.269527] ? filp_open+0x50/0x50 +[ 5.269714] ? exit_to_user_mode_prepare+0xfc/0x130 +[ 5.269978] do_syscall_64+0x33/0x40 +[ 5.270176] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 5.270450] RIP: 0033:0x7fa3f685bcf7 +[ 5.270646] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d1 +[ 5.271634] RSP: 002b:00007ffca83048d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 5.272037] RAX: ffffffffffffffda RBX: 0000000001e94a70 RCX: 00007fa3f685bcf7 +[ 5.272416] RDX: 0000000000000000 RSI: 0000000001e939e0 RDI: 0000000000000003 +[ 5.272794] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 +[ 5.273171] R10: 00007fa3f68bf300 R11: 0000000000000246 R12: 0000000001e939e0 +[ 5.273550] R13: 0000000000000000 R14: 0000000001e93bd0 R15: 0000000000000001 +[ 5.273928] ================================================================== + +Signed-off-by: Tong Zhang +Link: http://patchwork.freedesktop.org/patch/msgid/20210203040727.868921-1-ztong0001@gmail.com +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c +index 6e7f16f4cec7..41cdf9d1e59d 100644 +--- a/drivers/gpu/drm/qxl/qxl_drv.c ++++ b/drivers/gpu/drm/qxl/qxl_drv.c +@@ -144,6 +144,8 @@ static void qxl_drm_release(struct drm_device *dev) + * reodering qxl_modeset_fini() + qxl_device_fini() calls is + * non-trivial though. + */ ++ if (!dev->registered) ++ return; + qxl_modeset_fini(qdev); + qxl_device_fini(qdev); + } +-- +2.30.2 + diff --git a/queue-5.10/drm-qxl-release-shadow-on-shutdown.patch b/queue-5.10/drm-qxl-release-shadow-on-shutdown.patch new file mode 100644 index 00000000000..a4cf03c9f02 --- /dev/null +++ b/queue-5.10/drm-qxl-release-shadow-on-shutdown.patch @@ -0,0 +1,38 @@ +From da1bbd6c466c5779a096f8b58b6dea133f7913fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 15:57:06 +0100 +Subject: drm/qxl: release shadow on shutdown + +From: Gerd Hoffmann + +[ Upstream commit 4ca77c513537700d3fae69030879f781dde1904c ] + +In case we have a shadow surface on shutdown release +it so it doesn't leak. + +Signed-off-by: Gerd Hoffmann +Acked-by: Thomas Zimmermann +Link: http://patchwork.freedesktop.org/patch/msgid/20210204145712.1531203-6-kraxel@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_display.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index 862ef59d4d03..1f0802f5d84e 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -1224,6 +1224,10 @@ int qxl_modeset_init(struct qxl_device *qdev) + + void qxl_modeset_fini(struct qxl_device *qdev) + { ++ if (qdev->dumb_shadow_bo) { ++ drm_gem_object_put(&qdev->dumb_shadow_bo->tbo.base); ++ qdev->dumb_shadow_bo = NULL; ++ } + qxl_destroy_monitors_object(qdev); + drm_mode_config_cleanup(&qdev->ddev); + } +-- +2.30.2 + diff --git a/queue-5.10/drm-radeon-ttm-fix-memory-leak-userptr-pages.patch b/queue-5.10/drm-radeon-ttm-fix-memory-leak-userptr-pages.patch new file mode 100644 index 00000000000..8abadbaf22e --- /dev/null +++ b/queue-5.10/drm-radeon-ttm-fix-memory-leak-userptr-pages.patch @@ -0,0 +1,47 @@ +From ad9326c79fea283007865b3ec904300f25a03506 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 09:32:36 +0100 +Subject: drm/radeon/ttm: Fix memory leak userptr pages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Gomez + +[ Upstream commit 5aeaa43e0ef1006320c077cbc49f4a8229ca3460 ] + +If userptr pages have been pinned but not bounded, +they remain uncleared. + +Reviewed-by: Christian König +Signed-off-by: Daniel Gomez +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_ttm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index 36150b7f31a9..a65cb349fac2 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -566,13 +566,14 @@ static void radeon_ttm_backend_unbind(struct ttm_bo_device *bdev, struct ttm_tt + struct radeon_ttm_tt *gtt = (void *)ttm; + struct radeon_device *rdev = radeon_get_rdev(bdev); + ++ if (gtt->userptr) ++ radeon_ttm_tt_unpin_userptr(bdev, ttm); ++ + if (!gtt->bound) + return; + + radeon_gart_unbind(rdev, gtt->offset, ttm->num_pages); + +- if (gtt->userptr) +- radeon_ttm_tt_unpin_userptr(bdev, ttm); + gtt->bound = false; + } + +-- +2.30.2 + diff --git a/queue-5.10/drm-vkms-fix-misuse-of-warn_on.patch b/queue-5.10/drm-vkms-fix-misuse-of-warn_on.patch new file mode 100644 index 00000000000..2da0d9eb56d --- /dev/null +++ b/queue-5.10/drm-vkms-fix-misuse-of-warn_on.patch @@ -0,0 +1,47 @@ +From b531306ade93d10ab5663a2e255f18c2ebc9a06d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 14:28:40 +0100 +Subject: drm/vkms: fix misuse of WARN_ON + +From: Dmitry Vyukov + +[ Upstream commit b4142fc4d52d051d4d8df1fb6c569e5b445d369e ] + +vkms_vblank_simulate() uses WARN_ON for timing-dependent condition +(timer overrun). This is a mis-use of WARN_ON, WARN_ON must be used +to denote kernel bugs. Use pr_warn() instead. + +Signed-off-by: Dmitry Vyukov +Reported-by: syzbot+4fc21a003c8332eb0bdd@syzkaller.appspotmail.com +Cc: Rodrigo Siqueira +Cc: Melissa Wen +Cc: Haneen Mohammed +Cc: Daniel Vetter +Cc: David Airlie +Cc: dri-devel@lists.freedesktop.org +Cc: linux-kernel@vger.kernel.org +Acked-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20210320132840.1315853-1-dvyukov@google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_crtc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c +index 09c012d54d58..1ae5cd47d954 100644 +--- a/drivers/gpu/drm/vkms/vkms_crtc.c ++++ b/drivers/gpu/drm/vkms/vkms_crtc.c +@@ -18,7 +18,8 @@ static enum hrtimer_restart vkms_vblank_simulate(struct hrtimer *timer) + + ret_overrun = hrtimer_forward_now(&output->vblank_hrtimer, + output->period_ns); +- WARN_ON(ret_overrun != 1); ++ if (ret_overrun != 1) ++ pr_warn("%s: vblank timer overrun\n", __func__); + + spin_lock(&output->lock); + ret = drm_crtc_handle_vblank(crtc); +-- +2.30.2 + diff --git a/queue-5.10/efi-libstub-add-clang_flags-to-x86-flags.patch b/queue-5.10/efi-libstub-add-clang_flags-to-x86-flags.patch new file mode 100644 index 00000000000..ff986996455 --- /dev/null +++ b/queue-5.10/efi-libstub-add-clang_flags-to-x86-flags.patch @@ -0,0 +1,49 @@ +From 50ce99634d2ec57a412feb25aa8c54f5d3404e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 17:04:35 -0700 +Subject: efi/libstub: Add $(CLANG_FLAGS) to x86 flags + +From: Nathan Chancellor + +[ Upstream commit 58d746c119dfa28e72fc35aacaf3d2a3ac625cd0 ] + +When cross compiling x86 on an ARM machine with clang, there are several +errors along the lines of: + + arch/x86/include/asm/page_64.h:52:7: error: invalid output constraint '=D' in asm + +This happens because the x86 flags in the EFI stub are not derived from +KBUILD_CFLAGS like the other architectures are and the clang flags that +set the target architecture ('--target=') and the path to the GNU cross +tools ('--prefix=') are not present, meaning that the host architecture +is targeted. + +These flags are available as $(CLANG_FLAGS) from the main Makefile so +add them to the cflags for x86 so that cross compiling works as expected. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Borislav Petkov +Acked-by: Ard Biesheuvel +Link: https://lkml.kernel.org/r/20210326000435.4785-4-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile +index 8a94388e38b3..a2ae9c3b9579 100644 +--- a/drivers/firmware/efi/libstub/Makefile ++++ b/drivers/firmware/efi/libstub/Makefile +@@ -13,7 +13,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \ + -Wno-pointer-sign \ + $(call cc-disable-warning, address-of-packed-member) \ + $(call cc-disable-warning, gnu) \ +- -fno-asynchronous-unwind-tables ++ -fno-asynchronous-unwind-tables \ ++ $(CLANG_FLAGS) + + # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly + # disable the stackleak plugin +-- +2.30.2 + diff --git a/queue-5.10/extcon-arizona-fix-some-issues-when-hpdet-irq-fires-.patch b/queue-5.10/extcon-arizona-fix-some-issues-when-hpdet-irq-fires-.patch new file mode 100644 index 00000000000..db8a419cccb --- /dev/null +++ b/queue-5.10/extcon-arizona-fix-some-issues-when-hpdet-irq-fires-.patch @@ -0,0 +1,96 @@ +From 6b1135250d5d78055b3551e87f055ef587bb2425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 16:17:56 +0100 +Subject: extcon: arizona: Fix some issues when HPDET IRQ fires after the jack + has been unplugged + +From: Hans de Goede + +[ Upstream commit c309a3e8793f7e01c4a4ec7960658380572cb576 ] + +When the jack is partially inserted and then removed again it may be +removed while the hpdet code is running. In this case the following +may happen: + +1. The "JACKDET rise" or ""JACKDET fall" IRQ triggers +2. arizona_jackdet runs and takes info->lock +3. The "HPDET" IRQ triggers +4. arizona_hpdet_irq runs, blocks on info->lock +5. arizona_jackdet calls arizona_stop_mic() and clears info->hpdet_done +6. arizona_jackdet releases info->lock +7. arizona_hpdet_irq now can continue running and: +7.1 Calls arizona_start_mic() (if a mic was detected) +7.2 sets info->hpdet_done + +Step 7 is undesirable / a bug: +7.1 causes the device to stay in a high power-state (with MICVDD enabled) +7.2 causes hpdet to not run on the next jack insertion, which in turn + causes the EXTCON_JACK_HEADPHONE state to never get set + +This fixes both issues by skipping these 2 steps when arizona_hpdet_irq +runs after the jack has been unplugged. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Acked-by: Charles Keepax +Tested-by: Charles Keepax +Acked-by: Chanwoo Choi +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-arizona.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c +index aae82db542a5..f7ef247de46a 100644 +--- a/drivers/extcon/extcon-arizona.c ++++ b/drivers/extcon/extcon-arizona.c +@@ -601,7 +601,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) + struct arizona *arizona = info->arizona; + int id_gpio = arizona->pdata.hpdet_id_gpio; + unsigned int report = EXTCON_JACK_HEADPHONE; +- int ret, reading; ++ int ret, reading, state; + bool mic = false; + + mutex_lock(&info->lock); +@@ -614,12 +614,11 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) + } + + /* If the cable was removed while measuring ignore the result */ +- ret = extcon_get_state(info->edev, EXTCON_MECHANICAL); +- if (ret < 0) { +- dev_err(arizona->dev, "Failed to check cable state: %d\n", +- ret); ++ state = extcon_get_state(info->edev, EXTCON_MECHANICAL); ++ if (state < 0) { ++ dev_err(arizona->dev, "Failed to check cable state: %d\n", state); + goto out; +- } else if (!ret) { ++ } else if (!state) { + dev_dbg(arizona->dev, "Ignoring HPDET for removed cable\n"); + goto done; + } +@@ -667,7 +666,7 @@ done: + gpio_set_value_cansleep(id_gpio, 0); + + /* If we have a mic then reenable MICDET */ +- if (mic || info->mic) ++ if (state && (mic || info->mic)) + arizona_start_mic(info); + + if (info->hpdet_active) { +@@ -675,7 +674,9 @@ done: + info->hpdet_active = false; + } + +- info->hpdet_done = true; ++ /* Do not set hp_det done when the cable has been unplugged */ ++ if (state) ++ info->hpdet_done = true; + + out: + mutex_unlock(&info->lock); +-- +2.30.2 + diff --git a/queue-5.10/extcon-arizona-fix-various-races-on-driver-unbind.patch b/queue-5.10/extcon-arizona-fix-various-races-on-driver-unbind.patch new file mode 100644 index 00000000000..7d68f51afca --- /dev/null +++ b/queue-5.10/extcon-arizona-fix-various-races-on-driver-unbind.patch @@ -0,0 +1,132 @@ +From 4706985a046a0b9a5760f9575771302208b8fe3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 16:17:57 +0100 +Subject: extcon: arizona: Fix various races on driver unbind + +From: Hans de Goede + +[ Upstream commit e5b499f6fb17bc95a813e85d0796522280203806 ] + +We must free/disable all interrupts and cancel all pending works +before doing further cleanup. + +Before this commit arizona_extcon_remove() was doing several +register writes to shut things down before disabling the IRQs +and it was cancelling only 1 of the 3 different works used. + +Move all the register-writes shutting things down to after +the disabling of the IRQs and add the 2 missing +cancel_delayed_work_sync() calls. + +This fixes various possible races on driver unbind. One of which +would always trigger on devices using the mic-clamp feature for +jack detection. The ARIZONA_MICD_CLAMP_MODE_MASK update was +done before disabling the IRQs, causing: +1. arizona_jackdet() to run +2. detect a jack being inserted (clamp disabled means jack inserted) +3. call arizona_start_mic() which: +3.1 Enables the MICVDD regulator +3.2 takes a pm_runtime_reference + +And this was all happening after the ARIZONA_MICD_ENA bit clearing, +which would undo 3.1 and 3.2 because the ARIZONA_MICD_CLAMP_MODE_MASK +update was being done after the ARIZONA_MICD_ENA bit clearing. + +So this means that arizona_extcon_remove() would exit with +1. MICVDD enabled and 2. The pm_runtime_reference being unbalanced. + +MICVDD still being enabled caused the following oops when the +regulator is released by the devm framework: + +[ 2850.745757] ------------[ cut here ]------------ +[ 2850.745827] WARNING: CPU: 2 PID: 2098 at drivers/regulator/core.c:2123 _regulator_put.part.0+0x19f/0x1b0 +[ 2850.745835] Modules linked in: extcon_arizona ... +... +[ 2850.746909] Call Trace: +[ 2850.746932] regulator_put+0x2d/0x40 +[ 2850.746946] release_nodes+0x22a/0x260 +[ 2850.746984] __device_release_driver+0x190/0x240 +[ 2850.747002] driver_detach+0xd4/0x120 +... +[ 2850.747337] ---[ end trace f455dfd7abd9781f ]--- + +Note this oops is just one of various theoretically possible races caused +by the wrong ordering inside arizona_extcon_remove(), this fixes the +ordering fixing all possible races, including the reported oops. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Acked-by: Charles Keepax +Tested-by: Charles Keepax +Acked-by: Chanwoo Choi +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-arizona.c | 40 +++++++++++++++++---------------- + 1 file changed, 21 insertions(+), 19 deletions(-) + +diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c +index f7ef247de46a..76aacbac5869 100644 +--- a/drivers/extcon/extcon-arizona.c ++++ b/drivers/extcon/extcon-arizona.c +@@ -1760,25 +1760,6 @@ static int arizona_extcon_remove(struct platform_device *pdev) + bool change; + int ret; + +- ret = regmap_update_bits_check(arizona->regmap, ARIZONA_MIC_DETECT_1, +- ARIZONA_MICD_ENA, 0, +- &change); +- if (ret < 0) { +- dev_err(&pdev->dev, "Failed to disable micd on remove: %d\n", +- ret); +- } else if (change) { +- regulator_disable(info->micvdd); +- pm_runtime_put(info->dev); +- } +- +- gpiod_put(info->micd_pol_gpio); +- +- pm_runtime_disable(&pdev->dev); +- +- regmap_update_bits(arizona->regmap, +- ARIZONA_MICD_CLAMP_CONTROL, +- ARIZONA_MICD_CLAMP_MODE_MASK, 0); +- + if (info->micd_clamp) { + jack_irq_rise = ARIZONA_IRQ_MICD_CLAMP_RISE; + jack_irq_fall = ARIZONA_IRQ_MICD_CLAMP_FALL; +@@ -1794,10 +1775,31 @@ static int arizona_extcon_remove(struct platform_device *pdev) + arizona_free_irq(arizona, jack_irq_rise, info); + arizona_free_irq(arizona, jack_irq_fall, info); + cancel_delayed_work_sync(&info->hpdet_work); ++ cancel_delayed_work_sync(&info->micd_detect_work); ++ cancel_delayed_work_sync(&info->micd_timeout_work); ++ ++ ret = regmap_update_bits_check(arizona->regmap, ARIZONA_MIC_DETECT_1, ++ ARIZONA_MICD_ENA, 0, ++ &change); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Failed to disable micd on remove: %d\n", ++ ret); ++ } else if (change) { ++ regulator_disable(info->micvdd); ++ pm_runtime_put(info->dev); ++ } ++ ++ regmap_update_bits(arizona->regmap, ++ ARIZONA_MICD_CLAMP_CONTROL, ++ ARIZONA_MICD_CLAMP_MODE_MASK, 0); + regmap_update_bits(arizona->regmap, ARIZONA_JACK_DETECT_ANALOGUE, + ARIZONA_JD1_ENA, 0); + arizona_clk32k_disable(arizona); + ++ gpiod_put(info->micd_pol_gpio); ++ ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/fpga-dfl-pci-add-did-for-d5005-pac-cards.patch b/queue-5.10/fpga-dfl-pci-add-did-for-d5005-pac-cards.patch new file mode 100644 index 00000000000..716813fbbab --- /dev/null +++ b/queue-5.10/fpga-dfl-pci-add-did-for-d5005-pac-cards.patch @@ -0,0 +1,60 @@ +From b8fdc0eb4207d9d3e3f4c042cbe06c730a9640c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Apr 2021 16:52:59 -0700 +Subject: fpga: dfl: pci: add DID for D5005 PAC cards + +From: Russ Weight + +[ Upstream commit a78a51a851ed3edc83264a67e2ba77a34f27965f ] + +This patch adds the approved PCI Express Device IDs for the +PF and VF for the card for D5005 PAC cards. + +Signed-off-by: Russ Weight +Signed-off-by: Matthew Gerlach +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/dfl-pci.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/fpga/dfl-pci.c b/drivers/fpga/dfl-pci.c +index a2203d03c9e2..bc108ee8e9eb 100644 +--- a/drivers/fpga/dfl-pci.c ++++ b/drivers/fpga/dfl-pci.c +@@ -61,14 +61,16 @@ static void cci_pci_free_irq(struct pci_dev *pcidev) + } + + /* PCI Device ID */ +-#define PCIE_DEVICE_ID_PF_INT_5_X 0xBCBD +-#define PCIE_DEVICE_ID_PF_INT_6_X 0xBCC0 +-#define PCIE_DEVICE_ID_PF_DSC_1_X 0x09C4 +-#define PCIE_DEVICE_ID_INTEL_PAC_N3000 0x0B30 ++#define PCIE_DEVICE_ID_PF_INT_5_X 0xBCBD ++#define PCIE_DEVICE_ID_PF_INT_6_X 0xBCC0 ++#define PCIE_DEVICE_ID_PF_DSC_1_X 0x09C4 ++#define PCIE_DEVICE_ID_INTEL_PAC_N3000 0x0B30 ++#define PCIE_DEVICE_ID_INTEL_PAC_D5005 0x0B2B + /* VF Device */ +-#define PCIE_DEVICE_ID_VF_INT_5_X 0xBCBF +-#define PCIE_DEVICE_ID_VF_INT_6_X 0xBCC1 +-#define PCIE_DEVICE_ID_VF_DSC_1_X 0x09C5 ++#define PCIE_DEVICE_ID_VF_INT_5_X 0xBCBF ++#define PCIE_DEVICE_ID_VF_INT_6_X 0xBCC1 ++#define PCIE_DEVICE_ID_VF_DSC_1_X 0x09C5 ++#define PCIE_DEVICE_ID_INTEL_PAC_D5005_VF 0x0B2C + + static struct pci_device_id cci_pcie_id_tbl[] = { + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_PF_INT_5_X),}, +@@ -78,6 +80,8 @@ static struct pci_device_id cci_pcie_id_tbl[] = { + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_PF_DSC_1_X),}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_VF_DSC_1_X),}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_N3000),}, ++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_D5005),}, ++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCIE_DEVICE_ID_INTEL_PAC_D5005_VF),}, + {0,} + }; + MODULE_DEVICE_TABLE(pci, cci_pcie_id_tbl); +-- +2.30.2 + diff --git a/queue-5.10/genirq-matrix-prevent-allocation-counter-corruption.patch b/queue-5.10/genirq-matrix-prevent-allocation-counter-corruption.patch new file mode 100644 index 00000000000..04d57498e4f --- /dev/null +++ b/queue-5.10/genirq-matrix-prevent-allocation-counter-corruption.patch @@ -0,0 +1,51 @@ +From b6745b38297cfff82cb91e22e030edf1c55012fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 12:18:23 +0100 +Subject: genirq/matrix: Prevent allocation counter corruption + +From: Vitaly Kuznetsov + +[ Upstream commit c93a5e20c3c2dabef8ea360a3d3f18c6f68233ab ] + +When irq_matrix_free() is called for an unallocated vector the +managed_allocated and total_allocated counters get out of sync with the +real state of the matrix. Later, when the last interrupt is freed, these +counters will underflow resulting in UINTMAX because the counters are +unsigned. + +While this is certainly a problem of the calling code, this can be catched +in the allocator by checking the allocation bit for the to be freed vector +which simplifies debugging. + +An example of the problem described above: +https://lore.kernel.org/lkml/20210318192819.636943062@linutronix.de/ + +Add the missing sanity check and emit a warning when it triggers. + +Suggested-by: Thomas Gleixner +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210319111823.1105248-1-vkuznets@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/irq/matrix.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c +index 651a4ad6d711..8e586858bcf4 100644 +--- a/kernel/irq/matrix.c ++++ b/kernel/irq/matrix.c +@@ -423,7 +423,9 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu, + if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end)) + return; + +- clear_bit(bit, cm->alloc_map); ++ if (WARN_ON_ONCE(!test_and_clear_bit(bit, cm->alloc_map))) ++ return; ++ + cm->allocated--; + if(managed) + cm->managed_allocated--; +-- +2.30.2 + diff --git a/queue-5.10/intel_th-consistency-and-off-by-one-fix.patch b/queue-5.10/intel_th-consistency-and-off-by-one-fix.patch new file mode 100644 index 00000000000..8e86872b24f --- /dev/null +++ b/queue-5.10/intel_th-consistency-and-off-by-one-fix.patch @@ -0,0 +1,49 @@ +From e90edaac71abd34c01a87c889da2f68c76afe782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 20:12:49 +0300 +Subject: intel_th: Consistency and off-by-one fix + +From: Pavel Machek + +[ Upstream commit 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 ] + +Consistently use "< ... +1" in for loops. + +Fix of-by-one in for_each_set_bit(). + +Signed-off-by: Pavel Machek +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/lkml/20190724095841.GA6952@amd/ +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210414171251.14672-6-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/intel_th/gth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index f72803a02391..28509b02a0b5 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -543,7 +543,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev, + output->active = false; + + for_each_set_bit(master, gth->output[output->port].master, +- TH_CONFIGURABLE_MASTERS) { ++ TH_CONFIGURABLE_MASTERS + 1) { + gth_master_set(gth, master, -1); + } + spin_unlock(>h->gth_lock); +@@ -697,7 +697,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, + othdev->output.port = -1; + othdev->output.active = false; + gth->output[port].output = NULL; +- for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++) ++ for (master = 0; master < TH_CONFIGURABLE_MASTERS + 1; master++) + if (gth->master[master] == port) + gth->master[master] = -1; + spin_unlock(>h->gth_lock); +-- +2.30.2 + diff --git a/queue-5.10/kselftest-arm64-mte-fix-compilation-with-native-comp.patch b/queue-5.10/kselftest-arm64-mte-fix-compilation-with-native-comp.patch new file mode 100644 index 00000000000..0e2b1033319 --- /dev/null +++ b/queue-5.10/kselftest-arm64-mte-fix-compilation-with-native-comp.patch @@ -0,0 +1,55 @@ +From 2459164861f0feb166176db47243edb48b6fd5d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:53:24 +0000 +Subject: kselftest/arm64: mte: Fix compilation with native compiler + +From: Andre Przywara + +[ Upstream commit 4a423645bc2690376a7a94b4bb7b2f74bc6206ff ] + +The mte selftest Makefile contains a check for GCC, to add the memtag +-march flag to the compiler options. This check fails if the compiler +is not explicitly specified, so reverts to the standard "cc", in which +case --version doesn't mention the "gcc" string we match against: +$ cc --version | head -n 1 +cc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0 + +This will not add the -march switch to the command line, so compilation +fails: +mte_helper.S: Assembler messages: +mte_helper.S:25: Error: selected processor does not support `irg x0,x0,xzr' +mte_helper.S:38: Error: selected processor does not support `gmi x1,x0,xzr' +... + +Actually clang accepts the same -march option as well, so we can just +drop this check and add this unconditionally to the command line, to avoid +any future issues with this check altogether (gcc actually prints +basename(argv[0]) when called with --version). + +Signed-off-by: Andre Przywara +Reviewed-by: Nick Desaulniers +Reviewed-by: Mark Brown +Link: https://lore.kernel.org/r/20210319165334.29213-2-andre.przywara@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/mte/Makefile | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/arm64/mte/Makefile b/tools/testing/selftests/arm64/mte/Makefile +index 2480226dfe57..4084ef108d05 100644 +--- a/tools/testing/selftests/arm64/mte/Makefile ++++ b/tools/testing/selftests/arm64/mte/Makefile +@@ -6,9 +6,7 @@ SRCS := $(filter-out mte_common_util.c,$(wildcard *.c)) + PROGS := $(patsubst %.c,%,$(SRCS)) + + #Add mte compiler option +-ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep gcc),) + CFLAGS += -march=armv8.5-a+memtag +-endif + + #check if the compiler works well + mte_cc_support := $(shell if ($(CC) $(CFLAGS) -E -x c /dev/null -o /dev/null 2>&1) then echo "1"; fi) +-- +2.30.2 + diff --git a/queue-5.10/kselftest-arm64-mte-fix-mte-feature-detection.patch b/queue-5.10/kselftest-arm64-mte-fix-mte-feature-detection.patch new file mode 100644 index 00000000000..d02088c4c71 --- /dev/null +++ b/queue-5.10/kselftest-arm64-mte-fix-mte-feature-detection.patch @@ -0,0 +1,62 @@ +From cc7262bd289691188b1f318e1d75692d02c644d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 16:53:29 +0000 +Subject: kselftest/arm64: mte: Fix MTE feature detection + +From: Andre Przywara + +[ Upstream commit 592432862cc4019075a7196d9961562c49507d6f ] + +To check whether the CPU and kernel support the MTE features we want +to test, we use an (emulated) CPU ID register read. However we only +check against a very particular feature version (0b0010), even though +the ARM ARM promises ID register features to be backwards compatible. + +While this could be fixed by using ">=" instead of "==", we should +actually use the explicit HWCAP2_MTE hardware capability, exposed by the +kernel via the ELF auxiliary vectors. + +That moves this responsibility to the kernel, and fixes running the +tests on machines with FEAT_MTE3 capability. + +Signed-off-by: Andre Przywara +Reviewed-by: Mark Brown +Link: https://lore.kernel.org/r/20210319165334.29213-7-andre.przywara@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/mte/mte_common_util.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/tools/testing/selftests/arm64/mte/mte_common_util.c b/tools/testing/selftests/arm64/mte/mte_common_util.c +index 39f8908988ea..70665ba88cbb 100644 +--- a/tools/testing/selftests/arm64/mte/mte_common_util.c ++++ b/tools/testing/selftests/arm64/mte/mte_common_util.c +@@ -278,22 +278,13 @@ int mte_switch_mode(int mte_option, unsigned long incl_mask) + return 0; + } + +-#define ID_AA64PFR1_MTE_SHIFT 8 +-#define ID_AA64PFR1_MTE 2 +- + int mte_default_setup(void) + { +- unsigned long hwcaps = getauxval(AT_HWCAP); ++ unsigned long hwcaps2 = getauxval(AT_HWCAP2); + unsigned long en = 0; + int ret; + +- if (!(hwcaps & HWCAP_CPUID)) { +- ksft_print_msg("FAIL: CPUID registers unavailable\n"); +- return KSFT_FAIL; +- } +- /* Read ID_AA64PFR1_EL1 register */ +- asm volatile("mrs %0, id_aa64pfr1_el1" : "=r"(hwcaps) : : "memory"); +- if (((hwcaps >> ID_AA64PFR1_MTE_SHIFT) & MT_TAG_MASK) != ID_AA64PFR1_MTE) { ++ if (!(hwcaps2 & HWCAP2_MTE)) { + ksft_print_msg("FAIL: MTE features unavailable\n"); + return KSFT_SKIP; + } +-- +2.30.2 + diff --git a/queue-5.10/kvfree_rcu-use-same-set-of-gfp-flags-as-does-single-.patch b/queue-5.10/kvfree_rcu-use-same-set-of-gfp-flags-as-does-single-.patch new file mode 100644 index 00000000000..5ced8e775cd --- /dev/null +++ b/queue-5.10/kvfree_rcu-use-same-set-of-gfp-flags-as-does-single-.patch @@ -0,0 +1,97 @@ +From fd6d679b24e3310a1aad26bbc21f6dea98a2bb85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jan 2021 21:05:05 +0100 +Subject: kvfree_rcu: Use same set of GFP flags as does single-argument + +From: Uladzislau Rezki (Sony) + +[ Upstream commit ee6ddf58475cce8a3d3697614679cd8cb4a6f583 ] + +Running an rcuscale stress-suite can lead to "Out of memory" of a +system. This can happen under high memory pressure with a small amount +of physical memory. + +For example, a KVM test configuration with 64 CPUs and 512 megabytes +can result in OOM when running rcuscale with below parameters: + +../kvm.sh --torture rcuscale --allcpus --duration 10 --kconfig CONFIG_NR_CPUS=64 \ +--bootargs "rcuscale.kfree_rcu_test=1 rcuscale.kfree_nthreads=16 rcuscale.holdoff=20 \ + rcuscale.kfree_loops=10000 torture.disable_onoff_at_boot" --trust-make + + +[ 12.054448] kworker/1:1H invoked oom-killer: gfp_mask=0x2cc0(GFP_KERNEL|__GFP_NOWARN), order=0, oom_score_adj=0 +[ 12.055303] CPU: 1 PID: 377 Comm: kworker/1:1H Not tainted 5.11.0-rc3+ #510 +[ 12.055416] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-1 04/01/2014 +[ 12.056485] Workqueue: events_highpri fill_page_cache_func +[ 12.056485] Call Trace: +[ 12.056485] dump_stack+0x57/0x6a +[ 12.056485] dump_header+0x4c/0x30a +[ 12.056485] ? del_timer_sync+0x20/0x30 +[ 12.056485] out_of_memory.cold.47+0xa/0x7e +[ 12.056485] __alloc_pages_slowpath.constprop.123+0x82f/0xc00 +[ 12.056485] __alloc_pages_nodemask+0x289/0x2c0 +[ 12.056485] __get_free_pages+0x8/0x30 +[ 12.056485] fill_page_cache_func+0x39/0xb0 +[ 12.056485] process_one_work+0x1ed/0x3b0 +[ 12.056485] ? process_one_work+0x3b0/0x3b0 +[ 12.060485] worker_thread+0x28/0x3c0 +[ 12.060485] ? process_one_work+0x3b0/0x3b0 +[ 12.060485] kthread+0x138/0x160 +[ 12.060485] ? kthread_park+0x80/0x80 +[ 12.060485] ret_from_fork+0x22/0x30 +[ 12.062156] Mem-Info: +[ 12.062350] active_anon:0 inactive_anon:0 isolated_anon:0 +[ 12.062350] active_file:0 inactive_file:0 isolated_file:0 +[ 12.062350] unevictable:0 dirty:0 writeback:0 +[ 12.062350] slab_reclaimable:2797 slab_unreclaimable:80920 +[ 12.062350] mapped:1 shmem:2 pagetables:8 bounce:0 +[ 12.062350] free:10488 free_pcp:1227 free_cma:0 +... +[ 12.101610] Out of memory and no killable processes... +[ 12.102042] Kernel panic - not syncing: System is deadlocked on memory +[ 12.102583] CPU: 1 PID: 377 Comm: kworker/1:1H Not tainted 5.11.0-rc3+ #510 +[ 12.102600] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-1 04/01/2014 + + +Because kvfree_rcu() has a fallback path, memory allocation failure is +not the end of the world. Furthermore, the added overhead of aggressive +GFP settings must be balanced against the overhead of the fallback path, +which is a cache miss for double-argument kvfree_rcu() and a call to +synchronize_rcu() for single-argument kvfree_rcu(). The current choice +of GFP_KERNEL|__GFP_NOWARN can result in longer latencies than a call +to synchronize_rcu(), so less-tenacious GFP flags would be helpful. + +Here is the tradeoff that must be balanced: + a) Minimize use of the fallback path, + b) Avoid pushing the system into OOM, + c) Bound allocation latency to that of synchronize_rcu(), and + d) Leave the emergency reserves to use cases lacking fallbacks. + +This commit therefore changes GFP flags from GFP_KERNEL|__GFP_NOWARN to +GFP_KERNEL|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_NOWARN. This combination +leaves the emergency reserves alone and can initiate reclaim, but will +not invoke the OOM killer. + +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 5dc36c6e80fd..8a5cc76ecac9 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -3386,7 +3386,7 @@ static void fill_page_cache_func(struct work_struct *work) + + for (i = 0; i < rcu_min_cached_objs; i++) { + bnode = (struct kvfree_rcu_bulk_data *) +- __get_free_page(GFP_KERNEL | __GFP_NOWARN); ++ __get_free_page(GFP_KERNEL | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); + + if (bnode) { + raw_spin_lock_irqsave(&krcp->lock, flags); +-- +2.30.2 + diff --git a/queue-5.10/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch b/queue-5.10/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch new file mode 100644 index 00000000000..1a713b2913e --- /dev/null +++ b/queue-5.10/media-adv7604-fix-possible-use-after-free-in-adv76xx.patch @@ -0,0 +1,43 @@ +From b00f6fca9ebcf3e959d9be29ed8620009af6d920 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:42:46 +0200 +Subject: media: adv7604: fix possible use-after-free in adv76xx_remove() + +From: Yang Yingliang + +[ Upstream commit fa56f5f1fe31c2050675fa63b84963ebd504a5b3 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7604.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 09004d928d11..d1f58795794f 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -3616,7 +3616,7 @@ static int adv76xx_remove(struct i2c_client *client) + io_write(sd, 0x6e, 0); + io_write(sd, 0x73, 0); + +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_async_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv76xx_unregister_clients(to_state(sd)); +-- +2.30.2 + diff --git a/queue-5.10/media-drivers-media-pci-sta2x11-fix-kconfig-dependen.patch b/queue-5.10/media-drivers-media-pci-sta2x11-fix-kconfig-dependen.patch new file mode 100644 index 00000000000..480a903d847 --- /dev/null +++ b/queue-5.10/media-drivers-media-pci-sta2x11-fix-kconfig-dependen.patch @@ -0,0 +1,45 @@ +From 0906d3c29562935b80472326b2a692a799d3b3d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 09:06:58 +0100 +Subject: media: drivers: media: pci: sta2x11: fix Kconfig dependency on + GPIOLIB + +From: Julian Braha + +[ Upstream commit 24df8b74c8b2fb42c49ffe8585562da0c96446ff ] + +When STA2X11_VIP is enabled, and GPIOLIB is disabled, +Kbuild gives the following warning: + +WARNING: unmet direct dependencies detected for VIDEO_ADV7180 + Depends on [n]: MEDIA_SUPPORT [=y] && GPIOLIB [=n] && VIDEO_V4L2 [=y] && I2C [=y] + Selected by [y]: + - STA2X11_VIP [=y] && MEDIA_SUPPORT [=y] && MEDIA_PCI_SUPPORT [=y] && MEDIA_CAMERA_SUPPORT [=y] && PCI [=y] && VIDEO_V4L2 [=y] && VIRT_TO_BUS [=y] && I2C [=y] && (STA2X11 [=n] || COMPILE_TEST [=y]) && MEDIA_SUBDRV_AUTOSELECT [=y] + +This is because STA2X11_VIP selects VIDEO_ADV7180 +without selecting or depending on GPIOLIB, +despite VIDEO_ADV7180 depending on GPIOLIB. + +Signed-off-by: Julian Braha +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/sta2x11/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/sta2x11/Kconfig b/drivers/media/pci/sta2x11/Kconfig +index 4dd98f94a91e..27bb78513631 100644 +--- a/drivers/media/pci/sta2x11/Kconfig ++++ b/drivers/media/pci/sta2x11/Kconfig +@@ -3,6 +3,7 @@ config STA2X11_VIP + tristate "STA2X11 VIP Video For Linux" + depends on PCI && VIDEO_V4L2 && VIRT_TO_BUS && I2C + depends on STA2X11 || COMPILE_TEST ++ select GPIOLIB if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_ADV7180 if MEDIA_SUBDRV_AUTOSELECT + select VIDEOBUF2_DMA_CONTIG + select MEDIA_CONTROLLER +-- +2.30.2 + diff --git a/queue-5.10/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch b/queue-5.10/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch new file mode 100644 index 00000000000..f23c48efe79 --- /dev/null +++ b/queue-5.10/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch @@ -0,0 +1,83 @@ +From be18f11f043907178b2bc035b81febd84b79a156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 21:32:19 +0200 +Subject: media: dvb-usb: fix memory leak in dvb_usb_adapter_init + +From: Pavel Skripkin + +[ Upstream commit b7cd0da982e3043f2eec7235ac5530cb18d6af1d ] + +syzbot reported memory leak in dvb-usb. The problem was +in invalid error handling in dvb_usb_adapter_init(). + +for (n = 0; n < d->props.num_adapters; n++) { +.... + if ((ret = dvb_usb_adapter_stream_init(adap)) || + (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || + (ret = dvb_usb_adapter_frontend_init(adap))) { + return ret; + } +... + d->num_adapters_initialized++; +... +} + +In case of error in dvb_usb_adapter_dvb_init() or +dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be +incremented, but dvb_usb_adapter_exit() relies on it: + + for (n = 0; n < d->num_adapters_initialized; n++) + +So, allocated objects won't be freed. + +Signed-off-by: Pavel Skripkin +Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index c1a7634e27b4..adc8b287326b 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -79,11 +79,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + } + +- if ((ret = dvb_usb_adapter_stream_init(adap)) || +- (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || +- (ret = dvb_usb_adapter_frontend_init(adap))) { ++ ret = dvb_usb_adapter_stream_init(adap); ++ if (ret) + return ret; +- } ++ ++ ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs); ++ if (ret) ++ goto dvb_init_err; ++ ++ ret = dvb_usb_adapter_frontend_init(adap); ++ if (ret) ++ goto frontend_init_err; + + /* use exclusive FE lock if there is multiple shared FEs */ + if (adap->fe_adap[1].fe) +@@ -103,6 +109,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + + return 0; ++ ++frontend_init_err: ++ dvb_usb_adapter_dvb_exit(adap); ++dvb_init_err: ++ dvb_usb_adapter_stream_exit(adap); ++ return ret; + } + + static int dvb_usb_adapter_exit(struct dvb_usb_device *d) +-- +2.30.2 + diff --git a/queue-5.10/media-em28xx-fix-memory-leak.patch b/queue-5.10/media-em28xx-fix-memory-leak.patch new file mode 100644 index 00000000000..0a50dbdc1e0 --- /dev/null +++ b/queue-5.10/media-em28xx-fix-memory-leak.patch @@ -0,0 +1,41 @@ +From 45ccb8852346c78b716287cd8b5d749ba9babb08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 19:07:53 +0100 +Subject: media: em28xx: fix memory leak + +From: Muhammad Usama Anjum + +[ Upstream commit 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 ] + +If some error occurs, URB buffers should also be freed. If they aren't +freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB +buffers as dvb is set to NULL. The function in which error occurs should +do all the cleanup for the allocations it had done. + +Tested the patch with the reproducer provided by syzbot. This patch +fixes the memleak. + +Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com +Signed-off-by: Muhammad Usama Anjum +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-dvb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index fb9cbfa81a84..3cd9e9556fa9 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1984,6 +1984,7 @@ ret: + return result; + + out_free: ++ em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); + kfree(dvb); + dev->dvb = NULL; + goto ret; +-- +2.30.2 + diff --git a/queue-5.10/media-gscpa-stv06xx-fix-memory-leak.patch b/queue-5.10/media-gscpa-stv06xx-fix-memory-leak.patch new file mode 100644 index 00000000000..dca9d4bd9e6 --- /dev/null +++ b/queue-5.10/media-gscpa-stv06xx-fix-memory-leak.patch @@ -0,0 +1,84 @@ +From 3a84a2ea511847d686edbcf9612973f824fe4986 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:31:20 +0200 +Subject: media: gscpa/stv06xx: fix memory leak + +From: Hans Verkuil + +[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ] + +For two of the supported sensors the stv06xx driver allocates memory which +is stored in sd->sensor_priv. This memory is freed on a disconnect, but if +the probe() fails, then it isn't freed and so this leaks memory. + +Add a new probe_error() op that drivers can use to free any allocated +memory in case there was a probe failure. + +Thanks to Pavel Skripkin for discovering the cause +of the memory leak. + +Reported-and-tested-by: syzbot+e7f4c64a4248a0340c37@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/gspca.c | 2 ++ + drivers/media/usb/gspca/gspca.h | 1 + + drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 +++++++++ + 3 files changed, 12 insertions(+) + +diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c +index 158c8e28ed2c..47d8f28bfdfc 100644 +--- a/drivers/media/usb/gspca/gspca.c ++++ b/drivers/media/usb/gspca/gspca.c +@@ -1576,6 +1576,8 @@ out: + #endif + v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler); + v4l2_device_unregister(&gspca_dev->v4l2_dev); ++ if (sd_desc->probe_error) ++ sd_desc->probe_error(gspca_dev); + kfree(gspca_dev->usb_buf); + kfree(gspca_dev); + return ret; +diff --git a/drivers/media/usb/gspca/gspca.h b/drivers/media/usb/gspca/gspca.h +index b0ced2e14006..a6554d5e9e1a 100644 +--- a/drivers/media/usb/gspca/gspca.h ++++ b/drivers/media/usb/gspca/gspca.h +@@ -105,6 +105,7 @@ struct sd_desc { + cam_cf_op config; /* called on probe */ + cam_op init; /* called on probe and resume */ + cam_op init_controls; /* called on probe */ ++ cam_v_op probe_error; /* called if probe failed, do cleanup here */ + cam_op start; /* called on stream on after URBs creation */ + cam_pkt_op pkt_scan; + /* optional operations */ +diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c +index 95673fc0a99c..d9bc2aacc885 100644 +--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c ++++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c +@@ -529,12 +529,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev, + static int stv06xx_config(struct gspca_dev *gspca_dev, + const struct usb_device_id *id); + ++static void stv06xx_probe_error(struct gspca_dev *gspca_dev) ++{ ++ struct sd *sd = (struct sd *)gspca_dev; ++ ++ kfree(sd->sensor_priv); ++ sd->sensor_priv = NULL; ++} ++ + /* sub-driver description */ + static const struct sd_desc sd_desc = { + .name = MODULE_NAME, + .config = stv06xx_config, + .init = stv06xx_init, + .init_controls = stv06xx_init_controls, ++ .probe_error = stv06xx_probe_error, + .start = stv06xx_start, + .stopN = stv06xx_stopN, + .pkt_scan = stv06xx_pkt_scan, +-- +2.30.2 + diff --git a/queue-5.10/media-gspca-sq905.c-fix-uninitialized-variable.patch b/queue-5.10/media-gspca-sq905.c-fix-uninitialized-variable.patch new file mode 100644 index 00000000000..e1d48af261b --- /dev/null +++ b/queue-5.10/media-gspca-sq905.c-fix-uninitialized-variable.patch @@ -0,0 +1,36 @@ +From e10ff5048d0962496f68e6a816d3964a1d692692 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 15:46:40 +0100 +Subject: media: gspca/sq905.c: fix uninitialized variable + +From: Hans Verkuil + +[ Upstream commit eaaea4681984c79d2b2b160387b297477f0c1aab ] + +act_len can be uninitialized if usb_bulk_msg() returns an error. +Set it to 0 to avoid a KMSAN error. + +Signed-off-by: Hans Verkuil +Reported-by: syzbot+a4e309017a5f3a24c7b3@syzkaller.appspotmail.com +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/sq905.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c +index 97799cfb832e..949111070971 100644 +--- a/drivers/media/usb/gspca/sq905.c ++++ b/drivers/media/usb/gspca/sq905.c +@@ -158,7 +158,7 @@ static int + sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock) + { + int ret; +- int act_len; ++ int act_len = 0; + + gspca_dev->usb_buf[0] = '\0'; + if (need_lock) +-- +2.30.2 + diff --git a/queue-5.10/media-i2c-adv7511-v4l2-fix-possible-use-after-free-i.patch b/queue-5.10/media-i2c-adv7511-v4l2-fix-possible-use-after-free-i.patch new file mode 100644 index 00000000000..8a39de8ae92 --- /dev/null +++ b/queue-5.10/media-i2c-adv7511-v4l2-fix-possible-use-after-free-i.patch @@ -0,0 +1,44 @@ +From adc4b2359c541011c6bd09ddf41f1dcc1fa94249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:48:12 +0200 +Subject: media: i2c: adv7511-v4l2: fix possible use-after-free in + adv7511_remove() + +From: Yang Yingliang + +[ Upstream commit 2c9541720c66899adf6f3600984cf3ef151295ad ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7511-v4l2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c +index a3161d709015..ab7883cff8b2 100644 +--- a/drivers/media/i2c/adv7511-v4l2.c ++++ b/drivers/media/i2c/adv7511-v4l2.c +@@ -1964,7 +1964,7 @@ static int adv7511_remove(struct i2c_client *client) + + adv7511_set_isr(sd, false); + adv7511_init_setup(sd); +- cancel_delayed_work(&state->edid_handler); ++ cancel_delayed_work_sync(&state->edid_handler); + i2c_unregister_device(state->i2c_edid); + i2c_unregister_device(state->i2c_cec); + i2c_unregister_device(state->i2c_pktmem); +-- +2.30.2 + diff --git a/queue-5.10/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch b/queue-5.10/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch new file mode 100644 index 00000000000..8bce42e49c9 --- /dev/null +++ b/queue-5.10/media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch @@ -0,0 +1,43 @@ +From 8972e3f8035975533b4a6a22bbafe94ae485576c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:50:53 +0200 +Subject: media: i2c: adv7842: fix possible use-after-free in adv7842_remove() + +From: Yang Yingliang + +[ Upstream commit 4a15275b6a18597079f18241c87511406575179a ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7842.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index 0855f648416d..f7d2b6cd3008 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -3586,7 +3586,7 @@ static int adv7842_remove(struct i2c_client *client) + struct adv7842_state *state = to_state(sd); + + adv7842_irq_enable(sd, false); +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_device_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv7842_unregister_clients(sd); +-- +2.30.2 + diff --git a/queue-5.10/media-i2c-tda1997-fix-possible-use-after-free-in-tda.patch b/queue-5.10/media-i2c-tda1997-fix-possible-use-after-free-in-tda.patch new file mode 100644 index 00000000000..de28f949a1b --- /dev/null +++ b/queue-5.10/media-i2c-tda1997-fix-possible-use-after-free-in-tda.patch @@ -0,0 +1,43 @@ +From 89c64c1debed2351a881502380b954b8d560e3d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:49:45 +0200 +Subject: media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() + +From: Yang Yingliang + +[ Upstream commit 7f820ab5d4eebfe2d970d32a76ae496a6c286f0f ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tda1997x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c +index a09bf0a39d05..89bb7e6dc7a4 100644 +--- a/drivers/media/i2c/tda1997x.c ++++ b/drivers/media/i2c/tda1997x.c +@@ -2804,7 +2804,7 @@ static int tda1997x_remove(struct i2c_client *client) + media_entity_cleanup(&sd->entity); + v4l2_ctrl_handler_free(&state->hdl); + regulator_bulk_disable(TDA1997X_NUM_SUPPLIES, state->supplies); +- cancel_delayed_work(&state->delayed_work_enable_hpd); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hpd); + mutex_destroy(&state->page_lock); + mutex_destroy(&state->lock); + +-- +2.30.2 + diff --git a/queue-5.10/media-imx-capture-return-epipe-from-__capture_legacy.patch b/queue-5.10/media-imx-capture-return-epipe-from-__capture_legacy.patch new file mode 100644 index 00000000000..1829f997c8e --- /dev/null +++ b/queue-5.10/media-imx-capture-return-epipe-from-__capture_legacy.patch @@ -0,0 +1,39 @@ +From f6acc7cb2e2a8b402dd52164a4b90a0a9079f2de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Feb 2021 05:26:47 +0100 +Subject: media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() + +From: Laurent Pinchart + +[ Upstream commit cc271b6754691af74d710b761eaf027e3743e243 ] + +The correct return code to report an invalid pipeline configuration is +-EPIPE. Return it instead of -EINVAL from __capture_legacy_try_fmt() +when the capture format doesn't match the media bus format of the +connected subdev. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Rui Miguel Silva +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx-media-capture.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c +index c1931eb2540e..b2f2cb3d6a60 100644 +--- a/drivers/staging/media/imx/imx-media-capture.c ++++ b/drivers/staging/media/imx/imx-media-capture.c +@@ -557,7 +557,7 @@ static int capture_validate_fmt(struct capture_priv *priv) + priv->vdev.fmt.fmt.pix.height != f.fmt.pix.height || + priv->vdev.cc->cs != cc->cs || + priv->vdev.compose.width != compose.width || +- priv->vdev.compose.height != compose.height) ? -EINVAL : 0; ++ priv->vdev.compose.height != compose.height) ? -EPIPE : 0; + } + + static int capture_start_streaming(struct vb2_queue *vq, unsigned int count) +-- +2.30.2 + diff --git a/queue-5.10/media-ite-cir-check-for-receive-overflow.patch b/queue-5.10/media-ite-cir-check-for-receive-overflow.patch new file mode 100644 index 00000000000..3f0200dcf99 --- /dev/null +++ b/queue-5.10/media-ite-cir-check-for-receive-overflow.patch @@ -0,0 +1,41 @@ +From 8c95c684b8d28cf663399616640656e8ba10f221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 09:08:35 +0100 +Subject: media: ite-cir: check for receive overflow + +From: Sean Young + +[ Upstream commit 28c7afb07ccfc0a939bb06ac1e7afe669901c65a ] + +It's best if this condition is reported. + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ite-cir.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c +index 0c6229592e13..e5c4a6941d26 100644 +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -276,8 +276,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data) + /* read the interrupt flags */ + iflags = dev->params.get_irq_causes(dev); + ++ /* Check for RX overflow */ ++ if (iflags & ITE_IRQ_RX_FIFO_OVERRUN) { ++ dev_warn(&dev->rdev->dev, "receive overflow\n"); ++ ir_raw_event_reset(dev->rdev); ++ } ++ + /* check for the receive interrupt */ +- if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { ++ if (iflags & ITE_IRQ_RX_FIFO) { + /* read the FIFO bytes */ + rx_bytes = + dev->params.get_rx_bytes(dev, rx_buf, +-- +2.30.2 + diff --git a/queue-5.10/media-media-saa7164-fix-saa7164_encoder_register-mem.patch b/queue-5.10/media-media-saa7164-fix-saa7164_encoder_register-mem.patch new file mode 100644 index 00000000000..5caa21c34e7 --- /dev/null +++ b/queue-5.10/media-media-saa7164-fix-saa7164_encoder_register-mem.patch @@ -0,0 +1,87 @@ +From c073b37c33d340fc9eb12a03c1caee914ae82674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 03:53:00 +0100 +Subject: media: media/saa7164: fix saa7164_encoder_register() memory leak bugs + +From: Daniel Niv + +[ Upstream commit c759b2970c561e3b56aa030deb13db104262adfe ] + +Add a fix for the memory leak bugs that can occur when the +saa7164_encoder_register() function fails. +The function allocates memory without explicitly freeing +it when errors occur. +Add a better error handling that deallocate the unused buffers before the +function exits during a fail. + +Signed-off-by: Daniel Niv +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7164/saa7164-encoder.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c +index 11e1eb6a6809..1d1d32e043f1 100644 +--- a/drivers/media/pci/saa7164/saa7164-encoder.c ++++ b/drivers/media/pci/saa7164/saa7164-encoder.c +@@ -1008,7 +1008,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + printk(KERN_ERR "%s() failed (errno = %d), NO PCI configuration\n", + __func__, result); + result = -ENOMEM; +- goto failed; ++ goto fail_pci; + } + + /* Establish encoder defaults here */ +@@ -1062,7 +1062,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + 100000, ENCODER_DEF_BITRATE); + if (hdl->error) { + result = hdl->error; +- goto failed; ++ goto fail_hdl; + } + + port->std = V4L2_STD_NTSC_M; +@@ -1080,7 +1080,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + printk(KERN_INFO "%s: can't allocate mpeg device\n", + dev->name); + result = -ENOMEM; +- goto failed; ++ goto fail_hdl; + } + + port->v4l_device->ctrl_handler = hdl; +@@ -1091,10 +1091,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + if (result < 0) { + printk(KERN_INFO "%s: can't register mpeg device\n", + dev->name); +- /* TODO: We're going to leak here if we don't dealloc +- The buffers above. The unreg function can't deal wit it. +- */ +- goto failed; ++ goto fail_reg; + } + + printk(KERN_INFO "%s: registered device video%d [mpeg]\n", +@@ -1116,9 +1113,14 @@ int saa7164_encoder_register(struct saa7164_port *port) + + saa7164_api_set_encoder(port); + saa7164_api_get_encoder(port); ++ return 0; + +- result = 0; +-failed: ++fail_reg: ++ video_device_release(port->v4l_device); ++ port->v4l_device = NULL; ++fail_hdl: ++ v4l2_ctrl_handler_free(hdl); ++fail_pci: + return result; + } + +-- +2.30.2 + diff --git a/queue-5.10/media-platform-sti-fix-runtime-pm-imbalance-in-regs_.patch b/queue-5.10/media-platform-sti-fix-runtime-pm-imbalance-in-regs_.patch new file mode 100644 index 00000000000..323a08484d3 --- /dev/null +++ b/queue-5.10/media-platform-sti-fix-runtime-pm-imbalance-in-regs_.patch @@ -0,0 +1,39 @@ +From 4ea74825921f47ff408b684aadf3f200f5f9401b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 07:43:13 +0200 +Subject: media: platform: sti: Fix runtime PM imbalance in regs_show + +From: Dinghao Liu + +[ Upstream commit 69306a947b3ae21e0d1cbfc9508f00fec86c7297 ] + +pm_runtime_get_sync() will increase the runtime PM counter +even it returns an error. Thus a pairing decrement is needed +to prevent refcount leak. Fix this by replacing this API with +pm_runtime_resume_and_get(), which will not change the runtime +PM counter on error. + +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-debug.c b/drivers/media/platform/sti/bdisp/bdisp-debug.c +index 2b270093009c..a27f638df11c 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-debug.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-debug.c +@@ -480,7 +480,7 @@ static int regs_show(struct seq_file *s, void *data) + int ret; + unsigned int i; + +- ret = pm_runtime_get_sync(bdisp->dev); ++ ret = pm_runtime_resume_and_get(bdisp->dev); + if (ret < 0) { + seq_puts(s, "Cannot wake up IP\n"); + return 0; +-- +2.30.2 + diff --git a/queue-5.10/media-sun8i-di-fix-runtime-pm-imbalance-in-deinterla.patch b/queue-5.10/media-sun8i-di-fix-runtime-pm-imbalance-in-deinterla.patch new file mode 100644 index 00000000000..5fce65cd55b --- /dev/null +++ b/queue-5.10/media-sun8i-di-fix-runtime-pm-imbalance-in-deinterla.patch @@ -0,0 +1,40 @@ +From 6cf87f8bce9410e90bfd23cf6a5e1d29bb993959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 07:46:06 +0200 +Subject: media: sun8i-di: Fix runtime PM imbalance in + deinterlace_start_streaming + +From: Dinghao Liu + +[ Upstream commit f1995d5e43cf897f63b4d7a7f84a252d891ae820 ] + +pm_runtime_get_sync() will increase the runtime PM counter +even it returns an error. Thus a pairing decrement is needed +to prevent refcount leak. Fix this by replacing this API with +pm_runtime_resume_and_get(), which will not change the runtime +PM counter on error. + +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c +index ba5d07886607..2c159483c56b 100644 +--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c ++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c +@@ -589,7 +589,7 @@ static int deinterlace_start_streaming(struct vb2_queue *vq, unsigned int count) + int ret; + + if (V4L2_TYPE_IS_OUTPUT(vq->type)) { +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { + dev_err(dev, "Failed to enable module\n"); + +-- +2.30.2 + diff --git a/queue-5.10/media-tc358743-fix-possible-use-after-free-in-tc3587.patch b/queue-5.10/media-tc358743-fix-possible-use-after-free-in-tc3587.patch new file mode 100644 index 00000000000..0afb380ddf0 --- /dev/null +++ b/queue-5.10/media-tc358743-fix-possible-use-after-free-in-tc3587.patch @@ -0,0 +1,43 @@ +From af8063f258dcc4599d9817315ef92f25fe2ac932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:39:29 +0200 +Subject: media: tc358743: fix possible use-after-free in tc358743_remove() + +From: Yang Yingliang + +[ Upstream commit 6107a4fdf8554a7aa9488bdc835bb010062fa8a9 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 831b5b54fd78..1b309bb743c7 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -2193,7 +2193,7 @@ static int tc358743_remove(struct i2c_client *client) + del_timer_sync(&state->timer); + flush_work(&state->work_i2c_poll); + } +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + cec_unregister_adapter(state->cec_adap); + v4l2_async_unregister_subdev(sd); + v4l2_device_unregister_subdev(sd); +-- +2.30.2 + diff --git a/queue-5.10/media-vivid-update-edid.patch b/queue-5.10/media-vivid-update-edid.patch new file mode 100644 index 00000000000..b6b4609c079 --- /dev/null +++ b/queue-5.10/media-vivid-update-edid.patch @@ -0,0 +1,56 @@ +From 46565d52bc855ae670e685c84c08b4fae2f96735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:48:21 +0100 +Subject: media: vivid: update EDID + +From: Hans Verkuil + +[ Upstream commit 443ec4bbc6116f6f492a7a1282bfd8422c862158 ] + +The EDID had a few mistakes as reported by edid-decode: + +Block 1, CTA-861 Extension Block: + Video Data Block: For improved preferred timing interoperability, set 'Native detailed modes' to 1. + Video Capability Data Block: S_PT is equal to S_IT and S_CE, so should be set to 0 instead. + +Fixed those. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vivid/vivid-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c +index aa8d350fd682..1e356dc65d31 100644 +--- a/drivers/media/test-drivers/vivid/vivid-core.c ++++ b/drivers/media/test-drivers/vivid/vivid-core.c +@@ -205,13 +205,13 @@ static const u8 vivid_hdmi_edid[256] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x7b, + +- 0x02, 0x03, 0x3f, 0xf0, 0x51, 0x61, 0x60, 0x5f, ++ 0x02, 0x03, 0x3f, 0xf1, 0x51, 0x61, 0x60, 0x5f, + 0x5e, 0x5d, 0x10, 0x1f, 0x04, 0x13, 0x22, 0x21, + 0x20, 0x05, 0x14, 0x02, 0x11, 0x01, 0x23, 0x09, + 0x07, 0x07, 0x83, 0x01, 0x00, 0x00, 0x6d, 0x03, + 0x0c, 0x00, 0x10, 0x00, 0x00, 0x3c, 0x21, 0x00, + 0x60, 0x01, 0x02, 0x03, 0x67, 0xd8, 0x5d, 0xc4, +- 0x01, 0x78, 0x00, 0x00, 0xe2, 0x00, 0xea, 0xe3, ++ 0x01, 0x78, 0x00, 0x00, 0xe2, 0x00, 0xca, 0xe3, + 0x05, 0x00, 0x00, 0xe3, 0x06, 0x01, 0x00, 0x4d, + 0xd0, 0x00, 0xa0, 0xf0, 0x70, 0x3e, 0x80, 0x30, + 0x20, 0x35, 0x00, 0xc0, 0x1c, 0x32, 0x00, 0x00, +@@ -220,7 +220,7 @@ static const u8 vivid_hdmi_edid[256] = { + 0x00, 0x00, 0x1a, 0x1a, 0x1d, 0x00, 0x80, 0x51, + 0xd0, 0x1c, 0x20, 0x40, 0x80, 0x35, 0x00, 0xc0, + 0x1c, 0x32, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, + }; + + static int vidioc_querycap(struct file *file, void *priv, +-- +2.30.2 + diff --git a/queue-5.10/mfd-arizona-fix-rumtime-pm-imbalance-on-error.patch b/queue-5.10/mfd-arizona-fix-rumtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..6b71c4e3db9 --- /dev/null +++ b/queue-5.10/mfd-arizona-fix-rumtime-pm-imbalance-on-error.patch @@ -0,0 +1,39 @@ +From 0ee621164cd6cf25dada4b7ecb01769b494fde0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 13:11:49 +0800 +Subject: mfd: arizona: Fix rumtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit fe6df2b48043bbe1e852b2320501d3b169363c35 ] + +pm_runtime_get_sync() will increase the rumtime PM counter +even it returns an error. Thus a pairing decrement is needed +to prevent refcount leak. Fix this by replacing this API with +pm_runtime_resume_and_get(), which will not change the runtime +PM counter on error. + +Signed-off-by: Dinghao Liu +Acked-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/arizona-irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/arizona-irq.c b/drivers/mfd/arizona-irq.c +index 077d9ab112b7..d919ae9691e2 100644 +--- a/drivers/mfd/arizona-irq.c ++++ b/drivers/mfd/arizona-irq.c +@@ -100,7 +100,7 @@ static irqreturn_t arizona_irq_thread(int irq, void *data) + unsigned int val; + int ret; + +- ret = pm_runtime_get_sync(arizona->dev); ++ ret = pm_runtime_resume_and_get(arizona->dev); + if (ret < 0) { + dev_err(arizona->dev, "Failed to resume device: %d\n", ret); + return IRQ_NONE; +-- +2.30.2 + diff --git a/queue-5.10/mfd-da9063-support-smbus-and-i2c-mode.patch b/queue-5.10/mfd-da9063-support-smbus-and-i2c-mode.patch new file mode 100644 index 00000000000..ffa30e0dafb --- /dev/null +++ b/queue-5.10/mfd-da9063-support-smbus-and-i2c-mode.patch @@ -0,0 +1,80 @@ +From 4a40cf161ff47aedcd1b665979128f13e66897bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 17:22:37 +0100 +Subject: mfd: da9063: Support SMBus and I2C mode + +From: Hubert Streidl + +[ Upstream commit 586478bfc9f7e16504d6f64cf18bcbdf6fd0cbc9 ] + +By default the PMIC DA9063 2-wire interface is SMBus compliant. This +means the PMIC will automatically reset the interface when the clock +signal ceases for more than the SMBus timeout of 35 ms. + +If the I2C driver / device is not capable of creating atomic I2C +transactions, a context change can cause a ceasing of the clock signal. +This can happen if for example a real-time thread is scheduled. Then +the DA9063 in SMBus mode will reset the 2-wire interface. Subsequently +a write message could end up in the wrong register. This could cause +unpredictable system behavior. + +The DA9063 PMIC also supports an I2C compliant mode for the 2-wire +interface. This mode does not reset the interface when the clock +signal ceases. Thus the problem depicted above does not occur. + +This patch tests for the bus functionality "I2C_FUNC_I2C". It can +reasonably be assumed that the bus cannot obey SMBus timings if +this functionality is set. SMBus commands most probably are emulated +in this case which is prone to the latency issue described above. + +This patch enables the I2C bus mode if I2C_FUNC_I2C is set or +otherwise keeps the default SMBus mode. + +Signed-off-by: Hubert Streidl +Signed-off-by: Mark Jonas +Reviewed-by: Wolfram Sang +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9063-i2c.c | 10 ++++++++++ + include/linux/mfd/da9063/registers.h | 3 +++ + 2 files changed, 13 insertions(+) + +diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c +index b8217ad303ce..3419814d016b 100644 +--- a/drivers/mfd/da9063-i2c.c ++++ b/drivers/mfd/da9063-i2c.c +@@ -442,6 +442,16 @@ static int da9063_i2c_probe(struct i2c_client *i2c, + return ret; + } + ++ /* If SMBus is not available and only I2C is possible, enter I2C mode */ ++ if (i2c_check_functionality(i2c->adapter, I2C_FUNC_I2C)) { ++ ret = regmap_clear_bits(da9063->regmap, DA9063_REG_CONFIG_J, ++ DA9063_TWOWIRE_TO); ++ if (ret < 0) { ++ dev_err(da9063->dev, "Failed to set Two-Wire Bus Mode.\n"); ++ return -EIO; ++ } ++ } ++ + return da9063_device_init(da9063, i2c->irq); + } + +diff --git a/include/linux/mfd/da9063/registers.h b/include/linux/mfd/da9063/registers.h +index 1dbabf1b3cb8..6e0f66a2e727 100644 +--- a/include/linux/mfd/da9063/registers.h ++++ b/include/linux/mfd/da9063/registers.h +@@ -1037,6 +1037,9 @@ + #define DA9063_NONKEY_PIN_AUTODOWN 0x02 + #define DA9063_NONKEY_PIN_AUTOFLPRT 0x03 + ++/* DA9063_REG_CONFIG_J (addr=0x10F) */ ++#define DA9063_TWOWIRE_TO 0x40 ++ + /* DA9063_REG_MON_REG_5 (addr=0x116) */ + #define DA9063_MON_A8_IDX_MASK 0x07 + #define DA9063_MON_A8_IDX_NONE 0x00 +-- +2.30.2 + diff --git a/queue-5.10/mfd-intel-m10-bmc-fix-the-register-access-range.patch b/queue-5.10/mfd-intel-m10-bmc-fix-the-register-access-range.patch new file mode 100644 index 00000000000..586090da7b1 --- /dev/null +++ b/queue-5.10/mfd-intel-m10-bmc-fix-the-register-access-range.patch @@ -0,0 +1,37 @@ +From 30129cef95a2a7a9c4f255491a0599f53d41185a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 23:55:45 +0800 +Subject: mfd: intel-m10-bmc: Fix the register access range + +From: Xu Yilun + +[ Upstream commit d9b326b2c3673f939941806146aee38e5c635fd0 ] + +This patch fixes the max register address of MAX 10 BMC. The range +0x20000000 ~ 0x200000fc are for control registers of the QSPI flash +controller, which are not accessible to host. + +Signed-off-by: Xu Yilun +Reviewed-by: Tom Rix +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + include/linux/mfd/intel-m10-bmc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mfd/intel-m10-bmc.h b/include/linux/mfd/intel-m10-bmc.h +index c8ef2f1654a4..06da62c25234 100644 +--- a/include/linux/mfd/intel-m10-bmc.h ++++ b/include/linux/mfd/intel-m10-bmc.h +@@ -11,7 +11,7 @@ + + #define M10BMC_LEGACY_SYS_BASE 0x300400 + #define M10BMC_SYS_BASE 0x300800 +-#define M10BMC_MEM_END 0x200000fc ++#define M10BMC_MEM_END 0x1fffffff + + /* Register offset of system registers */ + #define NIOS2_FW_VERSION 0x0 +-- +2.30.2 + diff --git a/queue-5.10/mmc-sdhci-brcmstb-remove-cqe-quirk.patch b/queue-5.10/mmc-sdhci-brcmstb-remove-cqe-quirk.patch new file mode 100644 index 00000000000..d4af3e4720e --- /dev/null +++ b/queue-5.10/mmc-sdhci-brcmstb-remove-cqe-quirk.patch @@ -0,0 +1,37 @@ +From 2ddf1391b88e643aad0fdebbe5d05aa216a439c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 15:28:34 -0400 +Subject: mmc: sdhci-brcmstb: Remove CQE quirk + +From: Al Cooper + +[ Upstream commit f0bdf98fab058efe7bf49732f70a0f26d1143154 ] + +Remove the CQHCI_QUIRK_SHORT_TXFR_DESC_SZ quirk because the +latest chips have this fixed and earlier chips have other +CQE problems that prevent the feature from being enabled. + +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20210325192834.42955-1-alcooperx@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-brcmstb.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c +index f9780c65ebe9..f24623aac2db 100644 +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -199,7 +199,6 @@ static int sdhci_brcmstb_add_host(struct sdhci_host *host, + if (dma64) { + dev_dbg(mmc_dev(host->mmc), "Using 64 bit DMA\n"); + cq_host->caps |= CQHCI_TASK_DESC_SZ_128; +- cq_host->quirks |= CQHCI_QUIRK_SHORT_TXFR_DESC_SZ; + } + + ret = cqhci_init(cq_host, host->mmc, dma64); +-- +2.30.2 + diff --git a/queue-5.10/mmc-sdhci-esdhc-imx-validate-pinctrl-before-use-it.patch b/queue-5.10/mmc-sdhci-esdhc-imx-validate-pinctrl-before-use-it.patch new file mode 100644 index 00000000000..8bc0f2b0ebf --- /dev/null +++ b/queue-5.10/mmc-sdhci-esdhc-imx-validate-pinctrl-before-use-it.patch @@ -0,0 +1,44 @@ +From 1ace56ddddd7fedc89e1cfac42ab7221665729c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 11:10:04 +0800 +Subject: mmc: sdhci-esdhc-imx: validate pinctrl before use it + +From: Peng Fan + +[ Upstream commit f410ee0aa2df050a9505f5c261953e9b18e21206 ] + +When imx_data->pinctrl is not a valid pointer, pinctrl_lookup_state +will trigger kernel panic. + +When we boot Dual OS on Jailhouse hypervisor, we let the 1st Linux to +configure pinmux ready for the 2nd OS, so the 2nd OS not have pinctrl +settings. + +Similar to this commit b62eee9f804e ("mmc: sdhci-esdhc-imx: no fail when no pinctrl available"). + +Reviewed-by: Bough Chen +Reviewed-by: Alice Guo +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/r/1614222604-27066-6-git-send-email-peng.fan@oss.nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 5d9b3106d2f7..d28809e47962 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -1504,7 +1504,7 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev, + + mmc_of_parse_voltage(np, &host->ocr_mask); + +- if (esdhc_is_usdhc(imx_data)) { ++ if (esdhc_is_usdhc(imx_data) && !IS_ERR(imx_data->pinctrl)) { + imx_data->pins_100mhz = pinctrl_lookup_state(imx_data->pinctrl, + ESDHC_PINCTRL_STATE_100MHZ); + imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl, +-- +2.30.2 + diff --git a/queue-5.10/mmc-sdhci-pci-add-pci-ids-for-intel-lkf.patch b/queue-5.10/mmc-sdhci-pci-add-pci-ids-for-intel-lkf.patch new file mode 100644 index 00000000000..c970115ac31 --- /dev/null +++ b/queue-5.10/mmc-sdhci-pci-add-pci-ids-for-intel-lkf.patch @@ -0,0 +1,49 @@ +From 00521c886841cb9fbf39ee8b94875d0d83e12ae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 07:53:56 +0200 +Subject: mmc: sdhci-pci: Add PCI IDs for Intel LKF + +From: Adrian Hunter + +[ Upstream commit ee629112be8b4eff71d4d3d108a28bc7dc877e13 ] + +Add PCI IDs for Intel LKF eMMC and SD card host controllers. + +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20210322055356.24923-1-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-pci-core.c | 2 ++ + drivers/mmc/host/sdhci-pci.h | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 936e4db9060f..bf04a08eeba1 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -1930,6 +1930,8 @@ static const struct pci_device_id pci_ids[] = { + SDHCI_PCI_DEVICE(INTEL, CMLH_SD, intel_byt_sd), + SDHCI_PCI_DEVICE(INTEL, JSL_EMMC, intel_glk_emmc), + SDHCI_PCI_DEVICE(INTEL, JSL_SD, intel_byt_sd), ++ SDHCI_PCI_DEVICE(INTEL, LKF_EMMC, intel_glk_emmc), ++ SDHCI_PCI_DEVICE(INTEL, LKF_SD, intel_byt_sd), + SDHCI_PCI_DEVICE(O2, 8120, o2), + SDHCI_PCI_DEVICE(O2, 8220, o2), + SDHCI_PCI_DEVICE(O2, 8221, o2), +diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h +index d0ed232af0eb..8f90c4163bb5 100644 +--- a/drivers/mmc/host/sdhci-pci.h ++++ b/drivers/mmc/host/sdhci-pci.h +@@ -57,6 +57,8 @@ + #define PCI_DEVICE_ID_INTEL_CMLH_SD 0x06f5 + #define PCI_DEVICE_ID_INTEL_JSL_EMMC 0x4dc4 + #define PCI_DEVICE_ID_INTEL_JSL_SD 0x4df8 ++#define PCI_DEVICE_ID_INTEL_LKF_EMMC 0x98c4 ++#define PCI_DEVICE_ID_INTEL_LKF_SD 0x98f8 + + #define PCI_DEVICE_ID_SYSKONNECT_8000 0x8000 + #define PCI_DEVICE_ID_VIA_95D0 0x95d0 +-- +2.30.2 + diff --git a/queue-5.10/nvmet-return-proper-error-code-from-discovery-ctrl.patch b/queue-5.10/nvmet-return-proper-error-code-from-discovery-ctrl.patch new file mode 100644 index 00000000000..ba819e5dc33 --- /dev/null +++ b/queue-5.10/nvmet-return-proper-error-code-from-discovery-ctrl.patch @@ -0,0 +1,52 @@ +From bbba28521e953071aed2708aa04d6dcce38a8e9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 14:52:39 +0800 +Subject: nvmet: return proper error code from discovery ctrl + +From: Hou Pu + +[ Upstream commit 79695dcd9ad4463a82def7f42960e6d7baa76f0b ] + +Return NVME_SC_INVALID_FIELD from discovery controller like normal +controller when executing identify or get log page command. + +Signed-off-by: Hou Pu +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/discovery.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c +index f40c05c33c3a..5b8ee824b100 100644 +--- a/drivers/nvme/target/discovery.c ++++ b/drivers/nvme/target/discovery.c +@@ -177,12 +177,14 @@ static void nvmet_execute_disc_get_log_page(struct nvmet_req *req) + if (req->cmd->get_log_page.lid != NVME_LOG_DISC) { + req->error_loc = + offsetof(struct nvme_get_log_page_command, lid); +- status = NVME_SC_INVALID_OPCODE | NVME_SC_DNR; ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out; + } + + /* Spec requires dword aligned offsets */ + if (offset & 0x3) { ++ req->error_loc = ++ offsetof(struct nvme_get_log_page_command, lpo); + status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out; + } +@@ -249,7 +251,7 @@ static void nvmet_execute_disc_identify(struct nvmet_req *req) + + if (req->cmd->identify.cns != NVME_ID_CNS_CTRL) { + req->error_loc = offsetof(struct nvme_identify, cns); +- status = NVME_SC_INVALID_OPCODE | NVME_SC_DNR; ++ status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto out; + } + +-- +2.30.2 + diff --git a/queue-5.10/pci-pm-do-not-read-power-state-in-pci_enable_device_.patch b/queue-5.10/pci-pm-do-not-read-power-state-in-pci_enable_device_.patch new file mode 100644 index 00000000000..a9a3142c983 --- /dev/null +++ b/queue-5.10/pci-pm-do-not-read-power-state-in-pci_enable_device_.patch @@ -0,0 +1,72 @@ +From 11cec7f25df863f071f5ccf031b9ce75cfc1435c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 16:51:40 +0100 +Subject: PCI: PM: Do not read power state in pci_enable_device_flags() + +From: Rafael J. Wysocki + +[ Upstream commit 4514d991d99211f225d83b7e640285f29f0755d0 ] + +It should not be necessary to update the current_state field of +struct pci_dev in pci_enable_device_flags() before calling +do_pci_enable_device() for the device, because none of the +code between that point and the pci_set_power_state() call in +do_pci_enable_device() invoked later depends on it. + +Moreover, doing that is actively harmful in some cases. For example, +if the given PCI device depends on an ACPI power resource whose _STA +method initially returns 0 ("off"), but the config space of the PCI +device is accessible and the power state retrieved from the +PCI_PM_CTRL register is D0, the current_state field in the struct +pci_dev representing that device will get out of sync with the +power.state of its ACPI companion object and that will lead to +power management issues going forward. + +To avoid such issues it is better to leave the current_state value +as is until it is changed to PCI_D0 by do_pci_enable_device() as +appropriate. However, the power state of the device is not changed +to PCI_D0 if it is already enabled when pci_enable_device_flags() +gets called for it, so update its current_state in that case, but +use pci_update_current_state() covering platform PM too for that. + +Link: https://lore.kernel.org/lkml/20210314000439.3138941-1-luzmaximilian@gmail.com/ +Reported-by: Maximilian Luz +Tested-by: Maximilian Luz +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 9e971fffeb6a..d5d9ea864fe6 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1874,20 +1874,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) + int err; + int i, bars = 0; + +- /* +- * Power state could be unknown at this point, either due to a fresh +- * boot or a device removal call. So get the current power state +- * so that things like MSI message writing will behave as expected +- * (e.g. if the device really is in D0 at enable time). +- */ +- if (dev->pm_cap) { +- u16 pmcsr; +- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); +- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); +- } +- +- if (atomic_inc_return(&dev->enable_cnt) > 1) ++ if (atomic_inc_return(&dev->enable_cnt) > 1) { ++ pci_update_current_state(dev, dev->current_state); + return 0; /* already enabled */ ++ } + + bridge = pci_upstream_bridge(dev); + if (bridge) +-- +2.30.2 + diff --git a/queue-5.10/perf-arm_pmu_platform-fix-error-handling.patch b/queue-5.10/perf-arm_pmu_platform-fix-error-handling.patch new file mode 100644 index 00000000000..d14d46e74b9 --- /dev/null +++ b/queue-5.10/perf-arm_pmu_platform-fix-error-handling.patch @@ -0,0 +1,36 @@ +From 70bed2380a4ce7a329bf7afa4add26b5962dba3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 16:02:41 +0000 +Subject: perf/arm_pmu_platform: Fix error handling + +From: Robin Murphy + +[ Upstream commit e338cb6bef254821a8c095018fd27254d74bfd6a ] + +If we're aborting after failing to register the PMU device, +we probably don't want to leak the IRQs that we've claimed. + +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/53031a607fc8412a60024bfb3bb8cd7141f998f5.1616774562.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_pmu_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c +index bb6ae955083a..ef9676418c9f 100644 +--- a/drivers/perf/arm_pmu_platform.c ++++ b/drivers/perf/arm_pmu_platform.c +@@ -235,7 +235,7 @@ int arm_pmu_device_probe(struct platform_device *pdev, + + ret = armpmu_register(pmu); + if (ret) +- goto out_free; ++ goto out_free_irqs; + + return 0; + +-- +2.30.2 + diff --git a/queue-5.10/perf-arm_pmu_platform-use-dev_err_probe-for-irq-erro.patch b/queue-5.10/perf-arm_pmu_platform-use-dev_err_probe-for-irq-erro.patch new file mode 100644 index 00000000000..cbc229c61f9 --- /dev/null +++ b/queue-5.10/perf-arm_pmu_platform-use-dev_err_probe-for-irq-erro.patch @@ -0,0 +1,52 @@ +From b312549de29393a4196ecc23df17124f750424c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 16:02:40 +0000 +Subject: perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors + +From: Robin Murphy + +[ Upstream commit 11fa1dc8020a2a9e0c59998920092d4df3fb7308 ] + +By virtue of using platform_irq_get_optional() under the covers, +platform_irq_count() needs the target interrupt controller to be +available and may return -EPROBE_DEFER if it isn't. Let's use +dev_err_probe() to avoid a spurious error log (and help debug any +deferral issues) in that case. + +Reported-by: Paul Menzel +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/073d5e0d3ed1f040592cb47ca6fe3759f40cc7d1.1616774562.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_pmu_platform.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c +index 933bd8410fc2..bb6ae955083a 100644 +--- a/drivers/perf/arm_pmu_platform.c ++++ b/drivers/perf/arm_pmu_platform.c +@@ -6,6 +6,7 @@ + * Copyright (C) 2010 ARM Ltd., Will Deacon + */ + #define pr_fmt(fmt) "hw perfevents: " fmt ++#define dev_fmt pr_fmt + + #include + #include +@@ -100,10 +101,8 @@ static int pmu_parse_irqs(struct arm_pmu *pmu) + struct pmu_hw_events __percpu *hw_events = pmu->hw_events; + + num_irqs = platform_irq_count(pdev); +- if (num_irqs < 0) { +- pr_err("unable to count PMU IRQs\n"); +- return num_irqs; +- } ++ if (num_irqs < 0) ++ return dev_err_probe(&pdev->dev, num_irqs, "unable to count PMU IRQs\n"); + + /* + * In this case we have no idea which CPUs are covered by the PMU. +-- +2.30.2 + diff --git a/queue-5.10/perf-rework-perf_event_exit_event.patch b/queue-5.10/perf-rework-perf_event_exit_event.patch new file mode 100644 index 00000000000..b7379ca5a00 --- /dev/null +++ b/queue-5.10/perf-rework-perf_event_exit_event.patch @@ -0,0 +1,271 @@ +From a09ad2a6b9196a69997464a9260b56cfb1867958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:35:56 +0200 +Subject: perf: Rework perf_event_exit_event() + +From: Peter Zijlstra + +[ Upstream commit ef54c1a476aef7eef26fe13ea10dc090952c00f8 ] + +Make perf_event_exit_event() more robust, such that we can use it from +other contexts. Specifically the up and coming remove_on_exec. + +For this to work we need to address a few issues. Remove_on_exec will +not destroy the entire context, so we cannot rely on TASK_TOMBSTONE to +disable event_function_call() and we thus have to use +perf_remove_from_context(). + +When using perf_remove_from_context(), there's two races to consider. +The first is against close(), where we can have concurrent tear-down +of the event. The second is against child_list iteration, which should +not find a half baked event. + +To address this, teach perf_remove_from_context() to special case +!ctx->is_active and about DETACH_CHILD. + +[ elver@google.com: fix racing parent/child exit in sync_child_event(). ] +Signed-off-by: Marco Elver +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210408103605.1676875-2-elver@google.com +Signed-off-by: Sasha Levin +--- + include/linux/perf_event.h | 1 + + kernel/events/core.c | 142 +++++++++++++++++++++---------------- + 2 files changed, 80 insertions(+), 63 deletions(-) + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index 22ce0604b448..072ac6c1ef2b 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -607,6 +607,7 @@ struct swevent_hlist { + #define PERF_ATTACH_TASK_DATA 0x08 + #define PERF_ATTACH_ITRACE 0x10 + #define PERF_ATTACH_SCHED_CB 0x20 ++#define PERF_ATTACH_CHILD 0x40 + + struct perf_cgroup; + struct perf_buffer; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8e1b8126c0e4..45fa7167cee2 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2209,6 +2209,26 @@ out: + perf_event__header_size(leader); + } + ++static void sync_child_event(struct perf_event *child_event); ++ ++static void perf_child_detach(struct perf_event *event) ++{ ++ struct perf_event *parent_event = event->parent; ++ ++ if (!(event->attach_state & PERF_ATTACH_CHILD)) ++ return; ++ ++ event->attach_state &= ~PERF_ATTACH_CHILD; ++ ++ if (WARN_ON_ONCE(!parent_event)) ++ return; ++ ++ lockdep_assert_held(&parent_event->child_mutex); ++ ++ sync_child_event(event); ++ list_del_init(&event->child_list); ++} ++ + static bool is_orphaned_event(struct perf_event *event) + { + return event->state == PERF_EVENT_STATE_DEAD; +@@ -2316,6 +2336,7 @@ group_sched_out(struct perf_event *group_event, + } + + #define DETACH_GROUP 0x01UL ++#define DETACH_CHILD 0x02UL + + /* + * Cross CPU call to remove a performance event +@@ -2339,6 +2360,8 @@ __perf_remove_from_context(struct perf_event *event, + event_sched_out(event, cpuctx, ctx); + if (flags & DETACH_GROUP) + perf_group_detach(event); ++ if (flags & DETACH_CHILD) ++ perf_child_detach(event); + list_del_event(event, ctx); + + if (!ctx->nr_events && ctx->is_active) { +@@ -2367,25 +2390,21 @@ static void perf_remove_from_context(struct perf_event *event, unsigned long fla + + lockdep_assert_held(&ctx->mutex); + +- event_function_call(event, __perf_remove_from_context, (void *)flags); +- + /* +- * The above event_function_call() can NO-OP when it hits +- * TASK_TOMBSTONE. In that case we must already have been detached +- * from the context (by perf_event_exit_event()) but the grouping +- * might still be in-tact. ++ * Because of perf_event_exit_task(), perf_remove_from_context() ought ++ * to work in the face of TASK_TOMBSTONE, unlike every other ++ * event_function_call() user. + */ +- WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT); +- if ((flags & DETACH_GROUP) && +- (event->attach_state & PERF_ATTACH_GROUP)) { +- /* +- * Since in that case we cannot possibly be scheduled, simply +- * detach now. +- */ +- raw_spin_lock_irq(&ctx->lock); +- perf_group_detach(event); ++ raw_spin_lock_irq(&ctx->lock); ++ if (!ctx->is_active) { ++ __perf_remove_from_context(event, __get_cpu_context(ctx), ++ ctx, (void *)flags); + raw_spin_unlock_irq(&ctx->lock); ++ return; + } ++ raw_spin_unlock_irq(&ctx->lock); ++ ++ event_function_call(event, __perf_remove_from_context, (void *)flags); + } + + /* +@@ -12249,14 +12268,17 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) + } + EXPORT_SYMBOL_GPL(perf_pmu_migrate_context); + +-static void sync_child_event(struct perf_event *child_event, +- struct task_struct *child) ++static void sync_child_event(struct perf_event *child_event) + { + struct perf_event *parent_event = child_event->parent; + u64 child_val; + +- if (child_event->attr.inherit_stat) +- perf_event_read_event(child_event, child); ++ if (child_event->attr.inherit_stat) { ++ struct task_struct *task = child_event->ctx->task; ++ ++ if (task && task != TASK_TOMBSTONE) ++ perf_event_read_event(child_event, task); ++ } + + child_val = perf_event_count(child_event); + +@@ -12271,60 +12293,53 @@ static void sync_child_event(struct perf_event *child_event, + } + + static void +-perf_event_exit_event(struct perf_event *child_event, +- struct perf_event_context *child_ctx, +- struct task_struct *child) ++perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx) + { +- struct perf_event *parent_event = child_event->parent; ++ struct perf_event *parent_event = event->parent; ++ unsigned long detach_flags = 0; + +- /* +- * Do not destroy the 'original' grouping; because of the context +- * switch optimization the original events could've ended up in a +- * random child task. +- * +- * If we were to destroy the original group, all group related +- * operations would cease to function properly after this random +- * child dies. +- * +- * Do destroy all inherited groups, we don't care about those +- * and being thorough is better. +- */ +- raw_spin_lock_irq(&child_ctx->lock); +- WARN_ON_ONCE(child_ctx->is_active); ++ if (parent_event) { ++ /* ++ * Do not destroy the 'original' grouping; because of the ++ * context switch optimization the original events could've ++ * ended up in a random child task. ++ * ++ * If we were to destroy the original group, all group related ++ * operations would cease to function properly after this ++ * random child dies. ++ * ++ * Do destroy all inherited groups, we don't care about those ++ * and being thorough is better. ++ */ ++ detach_flags = DETACH_GROUP | DETACH_CHILD; ++ mutex_lock(&parent_event->child_mutex); ++ } + +- if (parent_event) +- perf_group_detach(child_event); +- list_del_event(child_event, child_ctx); +- perf_event_set_state(child_event, PERF_EVENT_STATE_EXIT); /* is_event_hup() */ +- raw_spin_unlock_irq(&child_ctx->lock); ++ perf_remove_from_context(event, detach_flags); ++ ++ raw_spin_lock_irq(&ctx->lock); ++ if (event->state > PERF_EVENT_STATE_EXIT) ++ perf_event_set_state(event, PERF_EVENT_STATE_EXIT); ++ raw_spin_unlock_irq(&ctx->lock); + + /* +- * Parent events are governed by their filedesc, retain them. ++ * Child events can be freed. + */ +- if (!parent_event) { +- perf_event_wakeup(child_event); ++ if (parent_event) { ++ mutex_unlock(&parent_event->child_mutex); ++ /* ++ * Kick perf_poll() for is_event_hup(); ++ */ ++ perf_event_wakeup(parent_event); ++ free_event(event); ++ put_event(parent_event); + return; + } +- /* +- * Child events can be cleaned up. +- */ +- +- sync_child_event(child_event, child); + + /* +- * Remove this event from the parent's list +- */ +- WARN_ON_ONCE(parent_event->ctx->parent_ctx); +- mutex_lock(&parent_event->child_mutex); +- list_del_init(&child_event->child_list); +- mutex_unlock(&parent_event->child_mutex); +- +- /* +- * Kick perf_poll() for is_event_hup(). ++ * Parent events are governed by their filedesc, retain them. + */ +- perf_event_wakeup(parent_event); +- free_event(child_event); +- put_event(parent_event); ++ perf_event_wakeup(event); + } + + static void perf_event_exit_task_context(struct task_struct *child, int ctxn) +@@ -12381,7 +12396,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn) + perf_event_task(child, child_ctx, 0); + + list_for_each_entry_safe(child_event, next, &child_ctx->event_list, event_entry) +- perf_event_exit_event(child_event, child_ctx, child); ++ perf_event_exit_event(child_event, child_ctx); + + mutex_unlock(&child_ctx->mutex); + +@@ -12641,6 +12656,7 @@ inherit_event(struct perf_event *parent_event, + */ + raw_spin_lock_irqsave(&child_ctx->lock, flags); + add_event_to_ctx(child_event, child_ctx); ++ child_event->attach_state |= PERF_ATTACH_CHILD; + raw_spin_unlock_irqrestore(&child_ctx->lock, flags); + + /* +-- +2.30.2 + diff --git a/queue-5.10/phy-phy-twl4030-usb-fix-possible-use-after-free-in-t.patch b/queue-5.10/phy-phy-twl4030-usb-fix-possible-use-after-free-in-t.patch new file mode 100644 index 00000000000..16c60ab5e36 --- /dev/null +++ b/queue-5.10/phy-phy-twl4030-usb-fix-possible-use-after-free-in-t.patch @@ -0,0 +1,45 @@ +From c65f372bd1a6069c6f3f8f6e155f38f9833a0a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:27:16 +0800 +Subject: phy: phy-twl4030-usb: Fix possible use-after-free in + twl4030_usb_remove() + +From: Yang Yingliang + +[ Upstream commit e1723d8b87b73ab363256e7ca3af3ddb75855680 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-twl4030-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c +index 9887f908f540..812e5409d359 100644 +--- a/drivers/phy/ti/phy-twl4030-usb.c ++++ b/drivers/phy/ti/phy-twl4030-usb.c +@@ -779,7 +779,7 @@ static int twl4030_usb_remove(struct platform_device *pdev) + + usb_remove_phy(&twl->phy); + pm_runtime_get_sync(twl->dev); +- cancel_delayed_work(&twl->id_workaround_work); ++ cancel_delayed_work_sync(&twl->id_workaround_work); + device_remove_file(twl->dev, &dev_attr_vbus); + + /* set transceiver mode to power on defaults */ +-- +2.30.2 + diff --git a/queue-5.10/platform-x86-intel_pmc_core-don-t-use-global-pmcdev-.patch b/queue-5.10/platform-x86-intel_pmc_core-don-t-use-global-pmcdev-.patch new file mode 100644 index 00000000000..110ead7df6e --- /dev/null +++ b/queue-5.10/platform-x86-intel_pmc_core-don-t-use-global-pmcdev-.patch @@ -0,0 +1,81 @@ +From 36cf21b644fccd758f1a70ac22f32836853b1fa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 20:12:44 -0700 +Subject: platform/x86: intel_pmc_core: Don't use global pmcdev in quirks + +From: David E. Box + +[ Upstream commit c9f86d6ca6b5e23d30d16ade4b9fff5b922a610a ] + +The DMI callbacks, used for quirks, currently access the PMC by getting +the address a global pmc_dev struct. Instead, have the callbacks set a +global quirk specific variable. In probe, after calling dmi_check_system(), +pass pmc_dev to a function that will handle each quirk if its variable +condition is met. This allows removing the global pmc_dev later. + +Signed-off-by: David E. Box +Reviewed-by: Hans de Goede +Reviewed-by: Rajneesh Bhardwaj +Link: https://lore.kernel.org/r/20210417031252.3020837-2-david.e.box@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_pmc_core.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index e06b36e87a33..ca32a4c80f62 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -1186,9 +1186,15 @@ static const struct pci_device_id pmc_pci_ids[] = { + * the platform BIOS enforces 24Mhz crystal to shutdown + * before PMC can assert SLP_S0#. + */ ++static bool xtal_ignore; + static int quirk_xtal_ignore(const struct dmi_system_id *id) + { +- struct pmc_dev *pmcdev = &pmc; ++ xtal_ignore = true; ++ return 0; ++} ++ ++static void pmc_core_xtal_ignore(struct pmc_dev *pmcdev) ++{ + u32 value; + + value = pmc_core_reg_read(pmcdev, pmcdev->map->pm_vric1_offset); +@@ -1197,7 +1203,6 @@ static int quirk_xtal_ignore(const struct dmi_system_id *id) + /* Low Voltage Mode Enable */ + value &= ~SPT_PMC_VRIC1_SLPS0LVEN; + pmc_core_reg_write(pmcdev, pmcdev->map->pm_vric1_offset, value); +- return 0; + } + + static const struct dmi_system_id pmc_core_dmi_table[] = { +@@ -1212,6 +1217,14 @@ static const struct dmi_system_id pmc_core_dmi_table[] = { + {} + }; + ++static void pmc_core_do_dmi_quirks(struct pmc_dev *pmcdev) ++{ ++ dmi_check_system(pmc_core_dmi_table); ++ ++ if (xtal_ignore) ++ pmc_core_xtal_ignore(pmcdev); ++} ++ + static int pmc_core_probe(struct platform_device *pdev) + { + static bool device_initialized; +@@ -1253,7 +1266,7 @@ static int pmc_core_probe(struct platform_device *pdev) + mutex_init(&pmcdev->lock); + platform_set_drvdata(pdev, pmcdev); + pmcdev->pmc_xram_read_bit = pmc_core_check_read_lock_bit(); +- dmi_check_system(pmc_core_dmi_table); ++ pmc_core_do_dmi_quirks(pmcdev); + + /* + * On TGL, due to a hardware limitation, the GBE LTR blocks PC10 when +-- +2.30.2 + diff --git a/queue-5.10/platform-x86-isst-account-for-increased-timeout-in-s.patch b/queue-5.10/platform-x86-isst-account-for-increased-timeout-in-s.patch new file mode 100644 index 00000000000..6fb8d7bf4a0 --- /dev/null +++ b/queue-5.10/platform-x86-isst-account-for-increased-timeout-in-s.patch @@ -0,0 +1,116 @@ +From 8f428890b1425e0ab893a254e236ddc8e9f78c69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 15:08:40 -0700 +Subject: platform/x86: ISST: Account for increased timeout in some cases + +From: Srinivas Pandruvada + +[ Upstream commit 5c782817a981981917ec3c647cf521022ee07143 ] + +In some cases when firmware is busy or updating, some mailbox commands +still timeout on some newer CPUs. To fix this issue, change how we +process timeout. + +With this change, replaced timeout from using simple count with real +timeout in micro-seconds using ktime. When the command response takes +more than average processing time, yield to other tasks. The worst case +timeout is extended upto 1 milli-second. + +Signed-off-by: Srinivas Pandruvada +Link: https://lore.kernel.org/r/20210330220840.3113959-1-srinivas.pandruvada@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + .../intel_speed_select_if/isst_if_mbox_pci.c | 33 +++++++++++++------ + 1 file changed, 23 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +index 95f01e7a87d5..da958aa8468d 100644 +--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c ++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c +@@ -21,12 +21,16 @@ + #define PUNIT_MAILBOX_BUSY_BIT 31 + + /* +- * The average time to complete some commands is about 40us. The current +- * count is enough to satisfy 40us. But when the firmware is very busy, this +- * causes timeout occasionally. So increase to deal with some worst case +- * scenarios. Most of the command still complete in few us. ++ * The average time to complete mailbox commands is less than 40us. Most of ++ * the commands complete in few micro seconds. But the same firmware handles ++ * requests from all power management features. ++ * We can create a scenario where we flood the firmware with requests then ++ * the mailbox response can be delayed for 100s of micro seconds. So define ++ * two timeouts. One for average case and one for long. ++ * If the firmware is taking more than average, just call cond_resched(). + */ +-#define OS_MAILBOX_RETRY_COUNT 100 ++#define OS_MAILBOX_TIMEOUT_AVG_US 40 ++#define OS_MAILBOX_TIMEOUT_MAX_US 1000 + + struct isst_if_device { + struct mutex mutex; +@@ -35,11 +39,13 @@ struct isst_if_device { + static int isst_if_mbox_cmd(struct pci_dev *pdev, + struct isst_if_mbox_cmd *mbox_cmd) + { +- u32 retries, data; ++ s64 tm_delta = 0; ++ ktime_t tm; ++ u32 data; + int ret; + + /* Poll for rb bit == 0 */ +- retries = OS_MAILBOX_RETRY_COUNT; ++ tm = ktime_get(); + do { + ret = pci_read_config_dword(pdev, PUNIT_MAILBOX_INTERFACE, + &data); +@@ -48,11 +54,14 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev, + + if (data & BIT_ULL(PUNIT_MAILBOX_BUSY_BIT)) { + ret = -EBUSY; ++ tm_delta = ktime_us_delta(ktime_get(), tm); ++ if (tm_delta > OS_MAILBOX_TIMEOUT_AVG_US) ++ cond_resched(); + continue; + } + ret = 0; + break; +- } while (--retries); ++ } while (tm_delta < OS_MAILBOX_TIMEOUT_MAX_US); + + if (ret) + return ret; +@@ -74,7 +83,8 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev, + return ret; + + /* Poll for rb bit == 0 */ +- retries = OS_MAILBOX_RETRY_COUNT; ++ tm_delta = 0; ++ tm = ktime_get(); + do { + ret = pci_read_config_dword(pdev, PUNIT_MAILBOX_INTERFACE, + &data); +@@ -83,6 +93,9 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev, + + if (data & BIT_ULL(PUNIT_MAILBOX_BUSY_BIT)) { + ret = -EBUSY; ++ tm_delta = ktime_us_delta(ktime_get(), tm); ++ if (tm_delta > OS_MAILBOX_TIMEOUT_AVG_US) ++ cond_resched(); + continue; + } + +@@ -96,7 +109,7 @@ static int isst_if_mbox_cmd(struct pci_dev *pdev, + mbox_cmd->resp_data = data; + ret = 0; + break; +- } while (--retries); ++ } while (tm_delta < OS_MAILBOX_TIMEOUT_MAX_US); + + return ret; + } +-- +2.30.2 + diff --git a/queue-5.10/power-supply-bq27xxx-fix-power_avg-for-newer-ics.patch b/queue-5.10/power-supply-bq27xxx-fix-power_avg-for-newer-ics.patch new file mode 100644 index 00000000000..03b70fe0ba9 --- /dev/null +++ b/queue-5.10/power-supply-bq27xxx-fix-power_avg-for-newer-ics.patch @@ -0,0 +1,134 @@ +From d755968f76146bf3aa72491fde7d96d5a1978b96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 10:54:19 +0100 +Subject: power: supply: bq27xxx: fix power_avg for newer ICs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthias Schiffer + +[ Upstream commit c4d57c22ac65bd503716062a06fad55a01569cac ] + +On all newer bq27xxx ICs, the AveragePower register contains a signed +value; in addition to handling the raw value as unsigned, the driver +code also didn't convert it to µW as expected. + +At least for the BQ28Z610, the reference manual incorrectly states that +the value is in units of 1mW and not 10mW. I have no way of knowing +whether the manuals of other supported ICs contain the same error, or if +there are models that actually use 1mW. At least, the new code shouldn't +be *less* correct than the old version for any device. + +power_avg is removed from the cache structure, se we don't have to +extend it to store both a signed value and an error code. Always getting +an up-to-date value may be desirable anyways, as it avoids inconsistent +current and power readings when switching between charging and +discharging. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq27xxx_battery.c | 51 ++++++++++++++------------ + include/linux/power/bq27xxx_battery.h | 1 - + 2 files changed, 27 insertions(+), 25 deletions(-) + +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index 315e0909e6a4..72a2bcf3ab32 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -1631,27 +1631,6 @@ static int bq27xxx_battery_read_time(struct bq27xxx_device_info *di, u8 reg) + return tval * 60; + } + +-/* +- * Read an average power register. +- * Return < 0 if something fails. +- */ +-static int bq27xxx_battery_read_pwr_avg(struct bq27xxx_device_info *di) +-{ +- int tval; +- +- tval = bq27xxx_read(di, BQ27XXX_REG_AP, false); +- if (tval < 0) { +- dev_err(di->dev, "error reading average power register %02x: %d\n", +- BQ27XXX_REG_AP, tval); +- return tval; +- } +- +- if (di->opts & BQ27XXX_O_ZERO) +- return (tval * BQ27XXX_POWER_CONSTANT) / BQ27XXX_RS; +- else +- return tval; +-} +- + /* + * Returns true if a battery over temperature condition is detected + */ +@@ -1739,8 +1718,6 @@ void bq27xxx_battery_update(struct bq27xxx_device_info *di) + } + if (di->regs[BQ27XXX_REG_CYCT] != INVALID_REG_ADDR) + cache.cycle_count = bq27xxx_battery_read_cyct(di); +- if (di->regs[BQ27XXX_REG_AP] != INVALID_REG_ADDR) +- cache.power_avg = bq27xxx_battery_read_pwr_avg(di); + + /* We only have to read charge design full once */ + if (di->charge_design_full <= 0) +@@ -1803,6 +1780,32 @@ static int bq27xxx_battery_current(struct bq27xxx_device_info *di, + return 0; + } + ++/* ++ * Get the average power in µW ++ * Return < 0 if something fails. ++ */ ++static int bq27xxx_battery_pwr_avg(struct bq27xxx_device_info *di, ++ union power_supply_propval *val) ++{ ++ int power; ++ ++ power = bq27xxx_read(di, BQ27XXX_REG_AP, false); ++ if (power < 0) { ++ dev_err(di->dev, ++ "error reading average power register %02x: %d\n", ++ BQ27XXX_REG_AP, power); ++ return power; ++ } ++ ++ if (di->opts & BQ27XXX_O_ZERO) ++ val->intval = (power * BQ27XXX_POWER_CONSTANT) / BQ27XXX_RS; ++ else ++ /* Other gauges return a signed value in units of 10mW */ ++ val->intval = (int)((s16)power) * 10000; ++ ++ return 0; ++} ++ + static int bq27xxx_battery_status(struct bq27xxx_device_info *di, + union power_supply_propval *val) + { +@@ -1987,7 +1990,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, + ret = bq27xxx_simple_value(di->cache.energy, val); + break; + case POWER_SUPPLY_PROP_POWER_AVG: +- ret = bq27xxx_simple_value(di->cache.power_avg, val); ++ ret = bq27xxx_battery_pwr_avg(di, val); + break; + case POWER_SUPPLY_PROP_HEALTH: + ret = bq27xxx_simple_value(di->cache.health, val); +diff --git a/include/linux/power/bq27xxx_battery.h b/include/linux/power/bq27xxx_battery.h +index 111a40d0d3d5..8d5f4f40fb41 100644 +--- a/include/linux/power/bq27xxx_battery.h ++++ b/include/linux/power/bq27xxx_battery.h +@@ -53,7 +53,6 @@ struct bq27xxx_reg_cache { + int capacity; + int energy; + int flags; +- int power_avg; + int health; + }; + +-- +2.30.2 + diff --git a/queue-5.10/power-supply-cpcap-battery-fix-invalid-usage-of-list.patch b/queue-5.10/power-supply-cpcap-battery-fix-invalid-usage-of-list.patch new file mode 100644 index 00000000000..7ea61e9f7be --- /dev/null +++ b/queue-5.10/power-supply-cpcap-battery-fix-invalid-usage-of-list.patch @@ -0,0 +1,39 @@ +From 0bdda0bea3323ece01965f47c5af26f09e2c90c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 22:36:50 +0800 +Subject: power: supply: cpcap-battery: fix invalid usage of list cursor + +From: Guangqing Zhu + +[ Upstream commit d0a43c12ee9f57ddb284272187bd18726c2c2c98 ] + +Fix invalid usage of a list_for_each_entry in cpcap_battery_irq_thread(). +Empty list or fully traversed list points to list head, which is not +NULL (and before the first element containing real data). + +Signed-off-by: Guangqing Zhu +Reviewed-by: Tony Lindgren +Reviewed-by: Carl Philipp Klemm +Tested-by: Carl Philipp Klemm +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cpcap-battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c +index cebc5c8fda1b..793d4ca52f8a 100644 +--- a/drivers/power/supply/cpcap-battery.c ++++ b/drivers/power/supply/cpcap-battery.c +@@ -626,7 +626,7 @@ static irqreturn_t cpcap_battery_irq_thread(int irq, void *data) + break; + } + +- if (!d) ++ if (list_entry_is_head(d, &ddata->irq_list, node)) + return IRQ_NONE; + + latest = cpcap_battery_latest(ddata); +-- +2.30.2 + diff --git a/queue-5.10/power-supply-cpcap-charger-add-usleep-to-cpcap-charg.patch b/queue-5.10/power-supply-cpcap-charger-add-usleep-to-cpcap-charg.patch new file mode 100644 index 00000000000..0b7e24f24e8 --- /dev/null +++ b/queue-5.10/power-supply-cpcap-charger-add-usleep-to-cpcap-charg.patch @@ -0,0 +1,55 @@ +From 0b120603449fb6c9d99d8892bb81718d40739e73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jan 2021 22:48:53 +0100 +Subject: power: supply: cpcap-charger: Add usleep to cpcap charger to avoid + usb plug bounce + +From: Carl Philipp Klemm + +[ Upstream commit 751faedf06e895a17e985a88ef5b6364ffd797ed ] + +Adds 80000 us sleep when the usb cable is plugged in to hopefully avoid +bouncing contacts. + +Upon pluging in the usb cable vbus will bounce for some time, causing cpcap to +dissconnect charging due to detecting an undervoltage condition. This is a +scope of vbus on xt894 while quickly inserting the usb cable with firm force, +probed at the far side of the usb socket and vbus loaded with approx 1k: +http://uvos.xyz/maserati/usbplug.jpg. + +As can clearly be seen, vbus is all over the place for the first 15 ms or so +with a small blip at ~40 ms this causes the cpcap to trip up and disable +charging again. + +The delay helps cpcap_usb_detect avoid the worst of this. It is, however, still +not ideal as strong vibrations can cause the issue to reapear any time during +charging. I have however not been able to cause the device to stop charging due +to this in practice as it is hard to vibrate the device such that the vbus pins +start bouncing again but cpcap_usb_detect is not called again due to a detected +disconnect/reconnect event. + +Signed-off-by: Carl Philipp Klemm +Tested-by: Tony Lindgren +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cpcap-charger.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c +index 22fff01425d6..891e1eb8e39d 100644 +--- a/drivers/power/supply/cpcap-charger.c ++++ b/drivers/power/supply/cpcap-charger.c +@@ -633,6 +633,9 @@ static void cpcap_usb_detect(struct work_struct *work) + return; + } + ++ /* Delay for 80ms to avoid vbus bouncing when usb cable is plugged in */ ++ usleep_range(80000, 120000); ++ + /* Throttle chrgcurr2 interrupt for charger done and retry */ + switch (ddata->state) { + case CPCAP_CHARGER_CHARGING: +-- +2.30.2 + diff --git a/queue-5.10/power-supply-generic-adc-battery-fix-possible-use-af.patch b/queue-5.10/power-supply-generic-adc-battery-fix-possible-use-af.patch new file mode 100644 index 00000000000..8ba0081190d --- /dev/null +++ b/queue-5.10/power-supply-generic-adc-battery-fix-possible-use-af.patch @@ -0,0 +1,43 @@ +From 1ecef4778d5573ab088dbb0d2d3c13a77c5b0d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:17:06 +0800 +Subject: power: supply: generic-adc-battery: fix possible use-after-free in + gab_remove() + +From: Yang Yingliang + +[ Upstream commit b6cfa007b3b229771d9588970adb4ab3e0487f49 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/generic-adc-battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index caa829738ef7..58f09314741a 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -382,7 +382,7 @@ static int gab_remove(struct platform_device *pdev) + } + + kfree(adc_bat->psy_desc.properties); +- cancel_delayed_work(&adc_bat->bat_work); ++ cancel_delayed_work_sync(&adc_bat->bat_work); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/power-supply-s3c_adc_battery-fix-possible-use-after-.patch b/queue-5.10/power-supply-s3c_adc_battery-fix-possible-use-after-.patch new file mode 100644 index 00000000000..10c969a96c9 --- /dev/null +++ b/queue-5.10/power-supply-s3c_adc_battery-fix-possible-use-after-.patch @@ -0,0 +1,44 @@ +From 3bc12681d6f2d1d5fb167853f9a6035d1b67c7ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:19:03 +0800 +Subject: power: supply: s3c_adc_battery: fix possible use-after-free in + s3c_adc_bat_remove() + +From: Yang Yingliang + +[ Upstream commit 68ae256945d2abe9036a7b68af4cc65aff79d5b7 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/s3c_adc_battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/s3c_adc_battery.c b/drivers/power/supply/s3c_adc_battery.c +index 60b7f41ab063..ff46bcf5db01 100644 +--- a/drivers/power/supply/s3c_adc_battery.c ++++ b/drivers/power/supply/s3c_adc_battery.c +@@ -394,7 +394,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev) + gpio_free(pdata->gpio_charge_finished); + } + +- cancel_delayed_work(&bat_work); ++ cancel_delayed_work_sync(&bat_work); + + if (pdata->exit) + pdata->exit(); +-- +2.30.2 + diff --git a/queue-5.10/power-supply-use-irqf_oneshot.patch b/queue-5.10/power-supply-use-irqf_oneshot.patch new file mode 100644 index 00000000000..5cef70648ce --- /dev/null +++ b/queue-5.10/power-supply-use-irqf_oneshot.patch @@ -0,0 +1,83 @@ +From 904bbeb9f6c0c4ee489eb711cf35428fddb2f3e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 19:21:33 +0800 +Subject: power: supply: Use IRQF_ONESHOT + +From: dongjian + +[ Upstream commit 2469b836fa835c67648acad17d62bc805236a6ea ] + +Fixes coccicheck error: + +drivers/power/supply/pm2301_charger.c:1089:7-27: ERROR: +drivers/power/supply/lp8788-charger.c:502:8-28: ERROR: +drivers/power/supply/tps65217_charger.c:239:8-33: ERROR: +drivers/power/supply/tps65090-charger.c:303:8-33: ERROR: + +Threaded IRQ with no primary handler requested without IRQF_ONESHOT + +Signed-off-by: dongjian +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/lp8788-charger.c | 2 +- + drivers/power/supply/pm2301_charger.c | 2 +- + drivers/power/supply/tps65090-charger.c | 2 +- + drivers/power/supply/tps65217_charger.c | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c +index e7931ffb7151..397e5a03b7d9 100644 +--- a/drivers/power/supply/lp8788-charger.c ++++ b/drivers/power/supply/lp8788-charger.c +@@ -501,7 +501,7 @@ static int lp8788_set_irqs(struct platform_device *pdev, + + ret = request_threaded_irq(virq, NULL, + lp8788_charger_irq_thread, +- 0, name, pchg); ++ IRQF_ONESHOT, name, pchg); + if (ret) + break; + } +diff --git a/drivers/power/supply/pm2301_charger.c b/drivers/power/supply/pm2301_charger.c +index 2df6a2459d1f..34f168f62178 100644 +--- a/drivers/power/supply/pm2301_charger.c ++++ b/drivers/power/supply/pm2301_charger.c +@@ -1090,7 +1090,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client, + ret = request_threaded_irq(gpio_to_irq(pm2->pdata->gpio_irq_number), + NULL, + pm2xxx_charger_irq[0].isr, +- pm2->pdata->irq_type, ++ pm2->pdata->irq_type | IRQF_ONESHOT, + pm2xxx_charger_irq[0].name, pm2); + + if (ret != 0) { +diff --git a/drivers/power/supply/tps65090-charger.c b/drivers/power/supply/tps65090-charger.c +index 6b0098e5a88b..0990b2fa6cd8 100644 +--- a/drivers/power/supply/tps65090-charger.c ++++ b/drivers/power/supply/tps65090-charger.c +@@ -301,7 +301,7 @@ static int tps65090_charger_probe(struct platform_device *pdev) + + if (irq != -ENXIO) { + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, +- tps65090_charger_isr, 0, "tps65090-charger", cdata); ++ tps65090_charger_isr, IRQF_ONESHOT, "tps65090-charger", cdata); + if (ret) { + dev_err(cdata->dev, + "Unable to register irq %d err %d\n", irq, +diff --git a/drivers/power/supply/tps65217_charger.c b/drivers/power/supply/tps65217_charger.c +index 814c2b81fdfe..ba33d1617e0b 100644 +--- a/drivers/power/supply/tps65217_charger.c ++++ b/drivers/power/supply/tps65217_charger.c +@@ -238,7 +238,7 @@ static int tps65217_charger_probe(struct platform_device *pdev) + for (i = 0; i < NUM_CHARGER_IRQS; i++) { + ret = devm_request_threaded_irq(&pdev->dev, irq[i], NULL, + tps65217_charger_irq, +- 0, "tps65217-charger", ++ IRQF_ONESHOT, "tps65217-charger", + charger); + if (ret) { + dev_err(charger->dev, +-- +2.30.2 + diff --git a/queue-5.10/random-initialize-chacha20-constants-with-correct-en.patch b/queue-5.10/random-initialize-chacha20-constants-with-correct-en.patch new file mode 100644 index 00000000000..8ac9d231848 --- /dev/null +++ b/queue-5.10/random-initialize-chacha20-constants-with-correct-en.patch @@ -0,0 +1,78 @@ +From e3d55ef9d7f13e932d547543105fb809d3d52bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Mar 2021 22:13:47 -0700 +Subject: random: initialize ChaCha20 constants with correct endianness + +From: Eric Biggers + +[ Upstream commit a181e0fdb2164268274453b5b291589edbb9b22d ] + +On big endian CPUs, the ChaCha20-based CRNG is using the wrong +endianness for the ChaCha20 constants. + +This doesn't matter cryptographically, but technically it means it's not +ChaCha20 anymore. Fix it to always use the standard constants. + +Cc: linux-crypto@vger.kernel.org +Cc: Andy Lutomirski +Cc: Jann Horn +Cc: Theodore Ts'o +Acked-by: Ard Biesheuvel +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/random.c | 4 ++-- + include/crypto/chacha.h | 9 +++++++-- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/char/random.c b/drivers/char/random.c +index f462b9d2f5a5..340ad21491e2 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -819,7 +819,7 @@ static bool __init crng_init_try_arch_early(struct crng_state *crng) + + static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) + { +- memcpy(&crng->state[0], "expand 32-byte k", 16); ++ chacha_init_consts(crng->state); + _get_random_bytes(&crng->state[4], sizeof(__u32) * 12); + crng_init_try_arch(crng); + crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; +@@ -827,7 +827,7 @@ static void __maybe_unused crng_initialize_secondary(struct crng_state *crng) + + static void __init crng_initialize_primary(struct crng_state *crng) + { +- memcpy(&crng->state[0], "expand 32-byte k", 16); ++ chacha_init_consts(crng->state); + _extract_entropy(&input_pool, &crng->state[4], sizeof(__u32) * 12, 0); + if (crng_init_try_arch_early(crng) && trust_cpu) { + invalidate_batched_entropy(); +diff --git a/include/crypto/chacha.h b/include/crypto/chacha.h +index 3a1c72fdb7cf..dabaee698718 100644 +--- a/include/crypto/chacha.h ++++ b/include/crypto/chacha.h +@@ -47,13 +47,18 @@ static inline void hchacha_block(const u32 *state, u32 *out, int nrounds) + hchacha_block_generic(state, out, nrounds); + } + +-void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); +-static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) ++static inline void chacha_init_consts(u32 *state) + { + state[0] = 0x61707865; /* "expa" */ + state[1] = 0x3320646e; /* "nd 3" */ + state[2] = 0x79622d32; /* "2-by" */ + state[3] = 0x6b206574; /* "te k" */ ++} ++ ++void chacha_init_arch(u32 *state, const u32 *key, const u8 *iv); ++static inline void chacha_init_generic(u32 *state, const u32 *key, const u8 *iv) ++{ ++ chacha_init_consts(state); + state[4] = key[0]; + state[5] = key[1]; + state[6] = key[2]; +-- +2.30.2 + diff --git a/queue-5.10/s390-archrandom-add-parameter-check-for-s390_arch_ra.patch b/queue-5.10/s390-archrandom-add-parameter-check-for-s390_arch_ra.patch new file mode 100644 index 00000000000..335ff858ef4 --- /dev/null +++ b/queue-5.10/s390-archrandom-add-parameter-check-for-s390_arch_ra.patch @@ -0,0 +1,45 @@ +From 158ea589990fa43b5b5acf5bd99dc45a3116a8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 08:23:12 +0200 +Subject: s390/archrandom: add parameter check for s390_arch_random_generate + +From: Harald Freudenberger + +[ Upstream commit 28096067686c5a5cbd4c35b079749bd805df5010 ] + +A review of the code showed, that this function which is exposed +within the whole kernel should do a parameter check for the +amount of bytes requested. If this requested bytes is too high +an unsigned int overflow could happen causing this function to +try to memcpy a really big memory chunk. + +This is not a security issue as there are only two invocations +of this function from arch/s390/include/asm/archrandom.h and both +are not exposed to userland. + +Reported-by: Sven Schnelle +Signed-off-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/arch_random.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/s390/crypto/arch_random.c b/arch/s390/crypto/arch_random.c +index dd95cdbd22ce..4cbb4b6d85a8 100644 +--- a/arch/s390/crypto/arch_random.c ++++ b/arch/s390/crypto/arch_random.c +@@ -53,6 +53,10 @@ static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer); + + bool s390_arch_random_generate(u8 *buf, unsigned int nbytes) + { ++ /* max hunk is ARCH_RNG_BUF_SIZE */ ++ if (nbytes > ARCH_RNG_BUF_SIZE) ++ return false; ++ + /* lock rng buffer */ + if (!spin_trylock(&arch_rng_lock)) + return false; +-- +2.30.2 + diff --git a/queue-5.10/s390-pci-expose-uid-uniqueness-guarantee.patch b/queue-5.10/s390-pci-expose-uid-uniqueness-guarantee.patch new file mode 100644 index 00000000000..a46c8d4d2b8 --- /dev/null +++ b/queue-5.10/s390-pci-expose-uid-uniqueness-guarantee.patch @@ -0,0 +1,102 @@ +From e0256ad670e95044c9b065a4d1c78513ab37abb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 11:29:36 +0100 +Subject: s390/pci: expose UID uniqueness guarantee + +From: Niklas Schnelle + +[ Upstream commit 408f2c9c15682fc21b645fdec1f726492e235c4b ] + +On s390 each PCI device has a user-defined ID (UID) exposed under +/sys/bus/pci/devices//uid. This ID was designed to serve as the PCI +device's primary index and to match the device within Linux to the +device configured in the hypervisor. To serve as a primary identifier +the UID must be unique within the Linux instance, this is guaranteed by +the platform if and only if the UID Uniqueness Checking flag is set +within the CLP List PCI Functions response. + +While the UID has been exposed to userspace since commit ac4995b9d570 +("s390/pci: add some new arch specific pci attributes") whether or not +the platform guarantees its uniqueness for the lifetime of the Linux +instance while defined is not visible from userspace. Remedy this by +exposing this as a per device attribute at + +/sys/bus/pci/devices//uid_is_unique + +Keeping this a per device attribute allows for maximum flexibility if we +ever end up with some devices not having a UID or not enjoying the +guaranteed uniqueness. + +Signed-off-by: Niklas Schnelle +Reviewed-by: Viktor Mihajlovski +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + Documentation/s390/pci.rst | 14 +++++++++++--- + arch/s390/pci/pci_sysfs.c | 9 +++++++++ + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/Documentation/s390/pci.rst b/Documentation/s390/pci.rst +index 492850bff316..8157f0cddbc2 100644 +--- a/Documentation/s390/pci.rst ++++ b/Documentation/s390/pci.rst +@@ -50,7 +50,8 @@ Entries specific to zPCI functions and entries that hold zPCI information. + * /sys/bus/pci/slots/XXXXXXXX + + The slot entries are set up using the function identifier (FID) of the +- PCI function. ++ PCI function. The format depicted as XXXXXXXX above is 8 hexadecimal digits ++ with 0 padding and lower case hexadecimal digitis. + + - /sys/bus/pci/slots/XXXXXXXX/power + +@@ -88,8 +89,15 @@ Entries specific to zPCI functions and entries that hold zPCI information. + is attached to. + + - uid +- The unique identifier (UID) is defined when configuring an LPAR and is +- unique in the LPAR. ++ The user identifier (UID) may be defined as part of the machine ++ configuration or the z/VM or KVM guest configuration. If the accompanying ++ uid_is_unique attribute is 1 the platform guarantees that the UID is unique ++ within that instance and no devices with the same UID can be attached ++ during the lifetime of the system. ++ ++ - uid_is_unique ++ Indicates whether the user identifier (UID) is guaranteed to be and remain ++ unique within this Linux instance. + + - pfip/segmentX + The segments determine the isolation of a function. +diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c +index 5c028bee91b9..e14d346dafd6 100644 +--- a/arch/s390/pci/pci_sysfs.c ++++ b/arch/s390/pci/pci_sysfs.c +@@ -131,6 +131,13 @@ static ssize_t report_error_write(struct file *filp, struct kobject *kobj, + } + static BIN_ATTR(report_error, S_IWUSR, NULL, report_error_write, PAGE_SIZE); + ++static ssize_t uid_is_unique_show(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sysfs_emit(buf, "%d\n", zpci_unique_uid ? 1 : 0); ++} ++static DEVICE_ATTR_RO(uid_is_unique); ++ + static struct bin_attribute *zpci_bin_attrs[] = { + &bin_attr_util_string, + &bin_attr_report_error, +@@ -148,8 +155,10 @@ static struct attribute *zpci_dev_attrs[] = { + &dev_attr_uid.attr, + &dev_attr_recover.attr, + &dev_attr_mio_enabled.attr, ++ &dev_attr_uid_is_unique.attr, + NULL, + }; ++ + static struct attribute_group zpci_attr_group = { + .attrs = zpci_dev_attrs, + .bin_attrs = zpci_bin_attrs, +-- +2.30.2 + diff --git a/queue-5.10/sched-fair-alternative-sched_slice.patch b/queue-5.10/sched-fair-alternative-sched_slice.patch new file mode 100644 index 00000000000..3654d6a445b --- /dev/null +++ b/queue-5.10/sched-fair-alternative-sched_slice.patch @@ -0,0 +1,72 @@ +From 8ecb6d2a62d5246a1e70ab9b2df1b4a71577249b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:44:46 +0100 +Subject: sched,fair: Alternative sched_slice() + +From: Peter Zijlstra + +[ Upstream commit 0c2de3f054a59f15e01804b75a04355c48de628c ] + +The current sched_slice() seems to have issues; there's two possible +things that could be improved: + + - the 'nr_running' used for __sched_period() is daft when cgroups are + considered. Using the RQ wide h_nr_running seems like a much more + consistent number. + + - (esp) cgroups can slice it real fine, which makes for easy + over-scheduling, ensure min_gran is what the name says. + +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Valentin Schneider +Link: https://lkml.kernel.org/r/20210412102001.611897312@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 12 +++++++++++- + kernel/sched/features.h | 3 +++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 481f4cc0958f..a0239649c741 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -700,7 +700,13 @@ static u64 __sched_period(unsigned long nr_running) + */ + static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se) + { +- u64 slice = __sched_period(cfs_rq->nr_running + !se->on_rq); ++ unsigned int nr_running = cfs_rq->nr_running; ++ u64 slice; ++ ++ if (sched_feat(ALT_PERIOD)) ++ nr_running = rq_of(cfs_rq)->cfs.h_nr_running; ++ ++ slice = __sched_period(nr_running + !se->on_rq); + + for_each_sched_entity(se) { + struct load_weight *load; +@@ -717,6 +723,10 @@ static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se) + } + slice = __calc_delta(slice, se->load.weight, load); + } ++ ++ if (sched_feat(BASE_SLICE)) ++ slice = max(slice, (u64)sysctl_sched_min_granularity); ++ + return slice; + } + +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 68d369cba9e4..f1bf5e12d889 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -90,3 +90,6 @@ SCHED_FEAT(WA_BIAS, true) + */ + SCHED_FEAT(UTIL_EST, true) + SCHED_FEAT(UTIL_EST_FASTUP, true) ++ ++SCHED_FEAT(ALT_PERIOD, true) ++SCHED_FEAT(BASE_SLICE, true) +-- +2.30.2 + diff --git a/queue-5.10/sched-fair-ignore-percpu-threads-for-imbalance-pulls.patch b/queue-5.10/sched-fair-ignore-percpu-threads-for-imbalance-pulls.patch new file mode 100644 index 00000000000..9479ecc85e3 --- /dev/null +++ b/queue-5.10/sched-fair-ignore-percpu-threads-for-imbalance-pulls.patch @@ -0,0 +1,76 @@ +From e147fdb8e32c7065482908b820c57ff9faec0b8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 23:06:26 +0100 +Subject: sched/fair: Ignore percpu threads for imbalance pulls + +From: Lingutla Chandrasekhar + +[ Upstream commit 9bcb959d05eeb564dfc9cac13a59843a4fb2edf2 ] + +During load balance, LBF_SOME_PINNED will be set if any candidate task +cannot be detached due to CPU affinity constraints. This can result in +setting env->sd->parent->sgc->group_imbalance, which can lead to a group +being classified as group_imbalanced (rather than any of the other, lower +group_type) when balancing at a higher level. + +In workloads involving a single task per CPU, LBF_SOME_PINNED can often be +set due to per-CPU kthreads being the only other runnable tasks on any +given rq. This results in changing the group classification during +load-balance at higher levels when in reality there is nothing that can be +done for this affinity constraint: per-CPU kthreads, as the name implies, +don't get to move around (modulo hotplug shenanigans). + +It's not as clear for userspace tasks - a task could be in an N-CPU cpuset +with N-1 offline CPUs, making it an "accidental" per-CPU task rather than +an intended one. KTHREAD_IS_PER_CPU gives us an indisputable signal which +we can leverage here to not set LBF_SOME_PINNED. + +Note that the aforementioned classification to group_imbalance (when +nothing can be done) is especially problematic on big.LITTLE systems, which +have a topology the likes of: + + DIE [ ] + MC [ ][ ] + 0 1 2 3 + L L B B + + arch_scale_cpu_capacity(L) < arch_scale_cpu_capacity(B) + +Here, setting LBF_SOME_PINNED due to a per-CPU kthread when balancing at MC +level on CPUs [0-1] will subsequently prevent CPUs [2-3] from classifying +the [0-1] group as group_misfit_task when balancing at DIE level. Thus, if +CPUs [0-1] are running CPU-bound (misfit) tasks, ill-timed per-CPU kthreads +can significantly delay the upgmigration of said misfit tasks. Systems +relying on ASYM_PACKING are likely to face similar issues. + +Signed-off-by: Lingutla Chandrasekhar +[Use kthread_is_per_cpu() rather than p->nr_cpus_allowed] +[Reword changelog] +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20210407220628.3798191-2-valentin.schneider@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 8f5bbc1469ed..481f4cc0958f 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7552,6 +7552,10 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) + if (throttled_lb_pair(task_group(p), env->src_cpu, env->dst_cpu)) + return 0; + ++ /* Disregard pcpu kthreads; they are where they need to be. */ ++ if ((p->flags & PF_KTHREAD) && kthread_is_per_cpu(p)) ++ return 0; ++ + if (!cpumask_test_cpu(env->dst_cpu, p->cpus_ptr)) { + int cpu; + +-- +2.30.2 + diff --git a/queue-5.10/sched-pelt-fix-task-util_est-update-filtering.patch b/queue-5.10/sched-pelt-fix-task-util_est-update-filtering.patch new file mode 100644 index 00000000000..63704e480d2 --- /dev/null +++ b/queue-5.10/sched-pelt-fix-task-util_est-update-filtering.patch @@ -0,0 +1,94 @@ +From b49a1f654cbe14091ba9792dc77477d994af71a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 16:58:20 +0000 +Subject: sched/pelt: Fix task util_est update filtering + +From: Vincent Donnefort + +[ Upstream commit b89997aa88f0b07d8a6414c908af75062103b8c9 ] + +Being called for each dequeue, util_est reduces the number of its updates +by filtering out when the EWMA signal is different from the task util_avg +by less than 1%. It is a problem for a sudden util_avg ramp-up. Due to the +decay from a previous high util_avg, EWMA might now be close enough to +the new util_avg. No update would then happen while it would leave +ue.enqueued with an out-of-date value. + +Taking into consideration the two util_est members, EWMA and enqueued for +the filtering, ensures, for both, an up-to-date value. + +This is for now an issue only for the trace probe that might return the +stale value. Functional-wise, it isn't a problem, as the value is always +accessed through max(enqueued, ewma). + +This problem has been observed using LISA's UtilConvergence:test_means on +the sd845c board. + +No regression observed with Hackbench on sd845c and Perf-bench sched pipe +on hikey/hikey960. + +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Reviewed-by: Dietmar Eggemann +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20210225165820.1377125-1-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 348605306027..8f5bbc1469ed 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3948,6 +3948,8 @@ static inline void util_est_dequeue(struct cfs_rq *cfs_rq, + trace_sched_util_est_cfs_tp(cfs_rq); + } + ++#define UTIL_EST_MARGIN (SCHED_CAPACITY_SCALE / 100) ++ + /* + * Check if a (signed) value is within a specified (unsigned) margin, + * based on the observation that: +@@ -3965,7 +3967,7 @@ static inline void util_est_update(struct cfs_rq *cfs_rq, + struct task_struct *p, + bool task_sleep) + { +- long last_ewma_diff; ++ long last_ewma_diff, last_enqueued_diff; + struct util_est ue; + + if (!sched_feat(UTIL_EST)) +@@ -3986,6 +3988,8 @@ static inline void util_est_update(struct cfs_rq *cfs_rq, + if (ue.enqueued & UTIL_AVG_UNCHANGED) + return; + ++ last_enqueued_diff = ue.enqueued; ++ + /* + * Reset EWMA on utilization increases, the moving average is used only + * to smooth utilization decreases. +@@ -3999,12 +4003,17 @@ static inline void util_est_update(struct cfs_rq *cfs_rq, + } + + /* +- * Skip update of task's estimated utilization when its EWMA is ++ * Skip update of task's estimated utilization when its members are + * already ~1% close to its last activation value. + */ + last_ewma_diff = ue.enqueued - ue.ewma; +- if (within_margin(last_ewma_diff, (SCHED_CAPACITY_SCALE / 100))) ++ last_enqueued_diff -= ue.enqueued; ++ if (within_margin(last_ewma_diff, UTIL_EST_MARGIN)) { ++ if (!within_margin(last_enqueued_diff, UTIL_EST_MARGIN)) ++ goto done; ++ + return; ++ } + + /* + * To avoid overestimation of actual task utilization, skip updates if +-- +2.30.2 + diff --git a/queue-5.10/sched-psi-handle-potential-task-count-underflow-bugs.patch b/queue-5.10/sched-psi-handle-potential-task-count-underflow-bugs.patch new file mode 100644 index 00000000000..b0a8c8e2260 --- /dev/null +++ b/queue-5.10/sched-psi-handle-potential-task-count-underflow-bugs.patch @@ -0,0 +1,56 @@ +From 97c09fdaac130a2f4c25dc961884b1462cd90f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 20:32:16 +0530 +Subject: sched,psi: Handle potential task count underflow bugs more gracefully + +From: Charan Teja Reddy + +[ Upstream commit 9d10a13d1e4c349b76f1c675a874a7f981d6d3b4 ] + +psi_group_cpu->tasks, represented by the unsigned int, stores the +number of tasks that could be stalled on a psi resource(io/mem/cpu). +Decrementing these counters at zero leads to wrapping which further +leads to the psi_group_cpu->state_mask is being set with the +respective pressure state. This could result into the unnecessary time +sampling for the pressure state thus cause the spurious psi events. +This can further lead to wrong actions being taken at the user land +based on these psi events. + +Though psi_bug is set under these conditions but that just for debug +purpose. Fix it by decrementing the ->tasks count only when it is +non-zero. + +Signed-off-by: Charan Teja Reddy +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Johannes Weiner +Link: https://lkml.kernel.org/r/1618585336-37219-1-git-send-email-charante@codeaurora.org +Signed-off-by: Sasha Levin +--- + kernel/sched/psi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 967732c0766c..651218ded981 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -711,14 +711,15 @@ static void psi_group_change(struct psi_group *group, int cpu, + for (t = 0, m = clear; m; m &= ~(1 << t), t++) { + if (!(m & (1 << t))) + continue; +- if (groupc->tasks[t] == 0 && !psi_bug) { ++ if (groupc->tasks[t]) { ++ groupc->tasks[t]--; ++ } else if (!psi_bug) { + printk_deferred(KERN_ERR "psi: task underflow! cpu=%d t=%d tasks=[%u %u %u %u] clear=%x set=%x\n", + cpu, t, groupc->tasks[0], + groupc->tasks[1], groupc->tasks[2], + groupc->tasks[3], clear, set); + psi_bug = 1; + } +- groupc->tasks[t]--; + } + + for (t = 0; set; set &= ~(1 << t), t++) +-- +2.30.2 + diff --git a/queue-5.10/scsi-libfc-fix-a-format-specifier.patch b/queue-5.10/scsi-libfc-fix-a-format-specifier.patch new file mode 100644 index 00000000000..78f59622a5e --- /dev/null +++ b/queue-5.10/scsi-libfc-fix-a-format-specifier.patch @@ -0,0 +1,45 @@ +From ec343c4ad4a04c46e9d6a37d70971f8c48390b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 15:08:13 -0700 +Subject: scsi: libfc: Fix a format specifier + +From: Bart Van Assche + +[ Upstream commit 90d6697810f06aceea9de71ad836a8c7669789cd ] + +Since the 'mfs' member has been declared as 'u32' in include/scsi/libfc.h, +use the %u format specifier instead of %hu. This patch fixes the following +clang compiler warning: + +warning: format specifies type + 'unsigned short' but the argument has type 'u32' (aka 'unsigned int') + [-Wformat] + "lport->mfs:%hu\n", mfs, lport->mfs); + ~~~ ^~~~~~~~~~ + %u + +Link: https://lore.kernel.org/r/20210415220826.29438-8-bvanassche@acm.org +Cc: Hannes Reinecke +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libfc/fc_lport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c +index 6557fda85c5c..abb14b206be0 100644 +--- a/drivers/scsi/libfc/fc_lport.c ++++ b/drivers/scsi/libfc/fc_lport.c +@@ -1731,7 +1731,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, + + if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) { + FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, " +- "lport->mfs:%hu\n", mfs, lport->mfs); ++ "lport->mfs:%u\n", mfs, lport->mfs); + fc_lport_error(lport, fp); + goto out; + } +-- +2.30.2 + diff --git a/queue-5.10/scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch b/queue-5.10/scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch new file mode 100644 index 00000000000..dedf215ea3b --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch @@ -0,0 +1,60 @@ +From 5da535474e2d5c44515f06c8a6c4144e9c6d042f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Apr 2021 18:31:13 -0700 +Subject: scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO + response + +From: James Smart + +[ Upstream commit fffd18ec6579c2d9c72b212169259062fe747888 ] + +Fix a crash caused by a double put on the node when the driver completed an +ACC for an unsolicted abort on the same node. The second put was executed +by lpfc_nlp_not_used() and is wrong because the completion routine executes +the nlp_put when the iocbq was released. Additionally, the driver is +issuing a LOGO then immediately calls lpfc_nlp_set_state to put the node +into NPR. This call does nothing. + +Remove the lpfc_nlp_not_used call and additional set_state in the +completion routine. Remove the lpfc_nlp_set_state post issue_logo. Isn't +necessary. + +Link: https://lore.kernel.org/r/20210412013127.2387-3-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 2 -- + drivers/scsi/lpfc/lpfc_sli.c | 1 - + 2 files changed, 3 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index 17be94496110..6afcb1426e35 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -1984,8 +1984,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport, + ndlp->nlp_last_elscmd = ELS_CMD_PLOGI; + + lpfc_issue_els_logo(vport, ndlp, 0); +- ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE; +- lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); + return ndlp->nlp_state; + } + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index f103340820c6..5841d2523549 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -17836,7 +17836,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba, + if (cmd_iocbq) { + ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1; + lpfc_nlp_put(ndlp); +- lpfc_nlp_not_used(ndlp); + lpfc_sli_release_iocbq(phba, cmd_iocbq); + } + +-- +2.30.2 + diff --git a/queue-5.10/scsi-lpfc-fix-error-handling-for-mailboxes-completed.patch b/queue-5.10/scsi-lpfc-fix-error-handling-for-mailboxes-completed.patch new file mode 100644 index 00000000000..b3c24ff7c04 --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-error-handling-for-mailboxes-completed.patch @@ -0,0 +1,299 @@ +From c70fd74c531a16c81e0ffdae596f069aab388f20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Apr 2021 18:31:17 -0700 +Subject: scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL + mode + +From: James Smart + +[ Upstream commit 304ee43238fed517faa123e034b593905b8679f8 ] + +In SLI-4, when performing a mailbox command with MBX_POLL, the driver uses +the BMBX register to send the command rather than the MQ. A flag is set +indicating the BMBX register is active and saves the mailbox job struct +(mboxq) in the mbox_active element of the adapter. The routine then waits +for completion or timeout. The mailbox job struct is not freed by the +routine. In cases of timeout, the adapter will be reset. The +lpfc_sli_mbox_sys_flush() routine will clean up the mbox in preparation for +the reset. It clears the BMBX active flag and marks the job structure as +MBX_NOT_FINISHED. But, it never frees the mboxq job structure. Expectation +in both normal completion and timeout cases is that the issuer of the mbx +command will free the structure. Unfortunately, not all calling paths are +freeing the memory in cases of error. + +All calling paths were looked at and updated, if missing, to free the mboxq +memory regardless of completion status. + +Link: https://lore.kernel.org/r/20210412013127.2387-7-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_attr.c | 75 +++++++++++++++++++++-------------- + drivers/scsi/lpfc/lpfc_init.c | 9 ++--- + drivers/scsi/lpfc/lpfc_sli.c | 42 ++++++++++---------- + 3 files changed, 70 insertions(+), 56 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index e94eac194676..bdea2867516c 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1690,8 +1690,7 @@ lpfc_set_trunking(struct lpfc_hba *phba, char *buff_out) + lpfc_printf_log(phba, KERN_ERR, LOG_MBOX, + "0071 Set trunk mode failed with status: %d", + rc); +- if (rc != MBX_TIMEOUT) +- mempool_free(mbox, phba->mbox_mem_pool); ++ mempool_free(mbox, phba->mbox_mem_pool); + + return 0; + } +@@ -6780,15 +6779,19 @@ lpfc_get_stats(struct Scsi_Host *shost) + pmboxq->ctx_buf = NULL; + pmboxq->vport = vport; + +- if (vport->fc_flag & FC_OFFLINE_MODE) ++ if (vport->fc_flag & FC_OFFLINE_MODE) { + rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL); +- else +- rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); +- +- if (rc != MBX_SUCCESS) { +- if (rc != MBX_TIMEOUT) ++ if (rc != MBX_SUCCESS) { + mempool_free(pmboxq, phba->mbox_mem_pool); +- return NULL; ++ return NULL; ++ } ++ } else { ++ rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); ++ if (rc != MBX_SUCCESS) { ++ if (rc != MBX_TIMEOUT) ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return NULL; ++ } + } + + memset(hs, 0, sizeof (struct fc_host_statistics)); +@@ -6812,15 +6815,19 @@ lpfc_get_stats(struct Scsi_Host *shost) + pmboxq->ctx_buf = NULL; + pmboxq->vport = vport; + +- if (vport->fc_flag & FC_OFFLINE_MODE) ++ if (vport->fc_flag & FC_OFFLINE_MODE) { + rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL); +- else +- rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); +- +- if (rc != MBX_SUCCESS) { +- if (rc != MBX_TIMEOUT) ++ if (rc != MBX_SUCCESS) { + mempool_free(pmboxq, phba->mbox_mem_pool); +- return NULL; ++ return NULL; ++ } ++ } else { ++ rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); ++ if (rc != MBX_SUCCESS) { ++ if (rc != MBX_TIMEOUT) ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return NULL; ++ } + } + + hs->link_failure_count = pmb->un.varRdLnk.linkFailureCnt; +@@ -6893,15 +6900,19 @@ lpfc_reset_stats(struct Scsi_Host *shost) + pmboxq->vport = vport; + + if ((vport->fc_flag & FC_OFFLINE_MODE) || +- (!(psli->sli_flag & LPFC_SLI_ACTIVE))) ++ (!(psli->sli_flag & LPFC_SLI_ACTIVE))) { + rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL); +- else +- rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); +- +- if (rc != MBX_SUCCESS) { +- if (rc != MBX_TIMEOUT) ++ if (rc != MBX_SUCCESS) { + mempool_free(pmboxq, phba->mbox_mem_pool); +- return; ++ return; ++ } ++ } else { ++ rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); ++ if (rc != MBX_SUCCESS) { ++ if (rc != MBX_TIMEOUT) ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return; ++ } + } + + memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t)); +@@ -6911,15 +6922,19 @@ lpfc_reset_stats(struct Scsi_Host *shost) + pmboxq->vport = vport; + + if ((vport->fc_flag & FC_OFFLINE_MODE) || +- (!(psli->sli_flag & LPFC_SLI_ACTIVE))) ++ (!(psli->sli_flag & LPFC_SLI_ACTIVE))) { + rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL); +- else ++ if (rc != MBX_SUCCESS) { ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return; ++ } ++ } else { + rc = lpfc_sli_issue_mbox_wait(phba, pmboxq, phba->fc_ratov * 2); +- +- if (rc != MBX_SUCCESS) { +- if (rc != MBX_TIMEOUT) +- mempool_free( pmboxq, phba->mbox_mem_pool); +- return; ++ if (rc != MBX_SUCCESS) { ++ if (rc != MBX_TIMEOUT) ++ mempool_free(pmboxq, phba->mbox_mem_pool); ++ return; ++ } + } + + lso->link_failure_count = pmb->un.varRdLnk.linkFailureCnt; +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 40fe889033d4..b17a75216964 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -9636,8 +9636,7 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba) + "3250 QUERY_FW_CFG mailbox failed with status " + "x%x add_status x%x, mbx status x%x\n", + shdr_status, shdr_add_status, rc); +- if (rc != MBX_TIMEOUT) +- mempool_free(mboxq, phba->mbox_mem_pool); ++ mempool_free(mboxq, phba->mbox_mem_pool); + rc = -ENXIO; + goto out_error; + } +@@ -9653,8 +9652,7 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba) + "ulp1_mode:x%x\n", phba->sli4_hba.fw_func_mode, + phba->sli4_hba.ulp0_mode, phba->sli4_hba.ulp1_mode); + +- if (rc != MBX_TIMEOUT) +- mempool_free(mboxq, phba->mbox_mem_pool); ++ mempool_free(mboxq, phba->mbox_mem_pool); + + /* + * Set up HBA Event Queues (EQs) +@@ -10252,8 +10250,7 @@ lpfc_pci_function_reset(struct lpfc_hba *phba) + shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response); + shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, + &shdr->response); +- if (rc != MBX_TIMEOUT) +- mempool_free(mboxq, phba->mbox_mem_pool); ++ mempool_free(mboxq, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "0495 SLI_FUNCTION_RESET mailbox " +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 5841d2523549..3e5c0718555a 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -5546,12 +5546,10 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba) + phba->sli4_hba.lnk_info.lnk_no, + phba->BIOSVersion); + out_free_mboxq: +- if (rc != MBX_TIMEOUT) { +- if (bf_get(lpfc_mqe_command, &mboxq->u.mqe) == MBX_SLI4_CONFIG) +- lpfc_sli4_mbox_cmd_free(phba, mboxq); +- else +- mempool_free(mboxq, phba->mbox_mem_pool); +- } ++ if (bf_get(lpfc_mqe_command, &mboxq->u.mqe) == MBX_SLI4_CONFIG) ++ lpfc_sli4_mbox_cmd_free(phba, mboxq); ++ else ++ mempool_free(mboxq, phba->mbox_mem_pool); + return rc; + } + +@@ -5652,12 +5650,10 @@ retrieve_ppname: + } + + out_free_mboxq: +- if (rc != MBX_TIMEOUT) { +- if (bf_get(lpfc_mqe_command, &mboxq->u.mqe) == MBX_SLI4_CONFIG) +- lpfc_sli4_mbox_cmd_free(phba, mboxq); +- else +- mempool_free(mboxq, phba->mbox_mem_pool); +- } ++ if (bf_get(lpfc_mqe_command, &mboxq->u.mqe) == MBX_SLI4_CONFIG) ++ lpfc_sli4_mbox_cmd_free(phba, mboxq); ++ else ++ mempool_free(mboxq, phba->mbox_mem_pool); + return rc; + } + +@@ -16844,8 +16840,7 @@ lpfc_rq_destroy(struct lpfc_hba *phba, struct lpfc_queue *hrq, + "2509 RQ_DESTROY mailbox failed with " + "status x%x add_status x%x, mbx status x%x\n", + shdr_status, shdr_add_status, rc); +- if (rc != MBX_TIMEOUT) +- mempool_free(mbox, hrq->phba->mbox_mem_pool); ++ mempool_free(mbox, hrq->phba->mbox_mem_pool); + return -ENXIO; + } + bf_set(lpfc_mbx_rq_destroy_q_id, &mbox->u.mqe.un.rq_destroy.u.request, +@@ -16942,7 +16937,9 @@ lpfc_sli4_post_sgl(struct lpfc_hba *phba, + shdr = (union lpfc_sli4_cfg_shdr *) &post_sgl_pages->header.cfg_shdr; + shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response); + shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response); +- if (rc != MBX_TIMEOUT) ++ if (!phba->sli4_hba.intr_enable) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ else if (rc != MBX_TIMEOUT) + mempool_free(mbox, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +@@ -17139,7 +17136,9 @@ lpfc_sli4_post_sgl_list(struct lpfc_hba *phba, + shdr = (union lpfc_sli4_cfg_shdr *) &sgl->cfg_shdr; + shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response); + shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response); +- if (rc != MBX_TIMEOUT) ++ if (!phba->sli4_hba.intr_enable) ++ lpfc_sli4_mbox_cmd_free(phba, mbox); ++ else if (rc != MBX_TIMEOUT) + lpfc_sli4_mbox_cmd_free(phba, mbox); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +@@ -17252,7 +17251,9 @@ lpfc_sli4_post_io_sgl_block(struct lpfc_hba *phba, struct list_head *nblist, + shdr = (union lpfc_sli4_cfg_shdr *)&sgl->cfg_shdr; + shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response); + shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response); +- if (rc != MBX_TIMEOUT) ++ if (!phba->sli4_hba.intr_enable) ++ lpfc_sli4_mbox_cmd_free(phba, mbox); ++ else if (rc != MBX_TIMEOUT) + lpfc_sli4_mbox_cmd_free(phba, mbox); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +@@ -18607,8 +18608,7 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page) + shdr = (union lpfc_sli4_cfg_shdr *) &hdr_tmpl->header.cfg_shdr; + shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response); + shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response); +- if (rc != MBX_TIMEOUT) +- mempool_free(mboxq, phba->mbox_mem_pool); ++ mempool_free(mboxq, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "2514 POST_RPI_HDR mailbox failed with " +@@ -19852,7 +19852,9 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + break; + } + } +- if (rc != MBX_TIMEOUT) ++ if (!phba->sli4_hba.intr_enable) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ else if (rc != MBX_TIMEOUT) + mempool_free(mbox, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +-- +2.30.2 + diff --git a/queue-5.10/scsi-lpfc-fix-incorrect-dbde-assignment-when-buildin.patch b/queue-5.10/scsi-lpfc-fix-incorrect-dbde-assignment-when-buildin.patch new file mode 100644 index 00000000000..d8d1cd8e420 --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-incorrect-dbde-assignment-when-buildin.patch @@ -0,0 +1,41 @@ +From 179cd2c72c8e44c5e914a5cdc33bec2642604095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 09:18:00 -0800 +Subject: scsi: lpfc: Fix incorrect dbde assignment when building target abts + wqe + +From: James Smart + +[ Upstream commit 9302154c07bff4e7f7f43c506a1ac84540303d06 ] + +The wqe_dbde field indicates whether a Data BDE is present in Words 0:2 and +should therefore should be clear in the abts request wqe. By setting the +bit we can be misleading fw into error cases. + +Clear the wqe_dbde field. + +Link: https://lore.kernel.org/r/20210301171821.3427-2-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvmet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index d4ade7cdb93a..deab8931ab48 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -3300,7 +3300,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba, + bf_set(wqe_rcvoxid, &wqe_abts->xmit_sequence.wqe_com, xri); + + /* Word 10 */ +- bf_set(wqe_dbde, &wqe_abts->xmit_sequence.wqe_com, 1); + bf_set(wqe_iod, &wqe_abts->xmit_sequence.wqe_com, LPFC_WQE_IOD_WRITE); + bf_set(wqe_lenloc, &wqe_abts->xmit_sequence.wqe_com, + LPFC_WQE_LENLOC_WORD12); +-- +2.30.2 + diff --git a/queue-5.10/scsi-lpfc-fix-pt2pt-connection-does-not-recover-afte.patch b/queue-5.10/scsi-lpfc-fix-pt2pt-connection-does-not-recover-afte.patch new file mode 100644 index 00000000000..fac89e11b00 --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-pt2pt-connection-does-not-recover-afte.patch @@ -0,0 +1,50 @@ +From d9dc2ccfd3c599b7032cdcf16022f3be36167bef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 09:18:06 -0800 +Subject: scsi: lpfc: Fix pt2pt connection does not recover after LOGO + +From: James Smart + +[ Upstream commit bd4f5100424d17d4e560d6653902ef8e49b2fc1f ] + +On a pt2pt setup, between 2 initiators, if one side issues a a LOGO, there +is no relogin attempt. The FC specs are grey in this area on which port +(higher wwn or not) is to re-login. + +As there is no spec guidance, unconditionally re-PLOGI after the logout to +ensure a login is re-established. + +Link: https://lore.kernel.org/r/20210301171821.3427-8-jsmart2021@gmail.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index 92d6e7b98770..17be94496110 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -903,9 +903,14 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + } + } else if ((!(ndlp->nlp_type & NLP_FABRIC) && + ((ndlp->nlp_type & NLP_FCP_TARGET) || +- !(ndlp->nlp_type & NLP_FCP_INITIATOR))) || ++ (ndlp->nlp_type & NLP_NVME_TARGET) || ++ (vport->fc_flag & FC_PT2PT))) || + (ndlp->nlp_state == NLP_STE_ADISC_ISSUE)) { +- /* Only try to re-login if this is NOT a Fabric Node */ ++ /* Only try to re-login if this is NOT a Fabric Node ++ * AND the remote NPORT is a FCP/NVME Target or we ++ * are in pt2pt mode. NLP_STE_ADISC_ISSUE is a special ++ * case for LOGO as a response to ADISC behavior. ++ */ + mod_timer(&ndlp->nlp_delayfunc, + jiffies + msecs_to_jiffies(1000 * 1)); + spin_lock_irq(shost->host_lock); +-- +2.30.2 + diff --git a/queue-5.10/scsi-lpfc-remove-unsupported-mbox-port_capabilities-.patch b/queue-5.10/scsi-lpfc-remove-unsupported-mbox-port_capabilities-.patch new file mode 100644 index 00000000000..a135024a7bf --- /dev/null +++ b/queue-5.10/scsi-lpfc-remove-unsupported-mbox-port_capabilities-.patch @@ -0,0 +1,431 @@ +From a538eabb0e23f08ee0126c05b2abed9dc6637d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Apr 2021 18:31:22 -0700 +Subject: scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic + +From: James Smart + +[ Upstream commit b62232ba8caccaf1954e197058104a6478fac1af ] + +SLI-4 does not contain a PORT_CAPABILITIES mailbox command (only SLI-3 +does, and SLI-3 doesn't use it), yet there are SLI-4 code paths that have +code to issue the command. The command will always fail. + +Remove the code for the mailbox command and leave only the resulting +"failure path" logic. + +Link: https://lore.kernel.org/r/20210412013127.2387-12-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_crtn.h | 3 - + drivers/scsi/lpfc/lpfc_hw4.h | 174 +--------------------------------- + drivers/scsi/lpfc/lpfc_init.c | 103 +------------------- + drivers/scsi/lpfc/lpfc_mbox.c | 36 ------- + 4 files changed, 3 insertions(+), 313 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h +index 782f6f76f18a..26f4a345bd14 100644 +--- a/drivers/scsi/lpfc/lpfc_crtn.h ++++ b/drivers/scsi/lpfc/lpfc_crtn.h +@@ -55,9 +55,6 @@ void lpfc_register_new_vport(struct lpfc_hba *, struct lpfc_vport *, + void lpfc_unreg_vpi(struct lpfc_hba *, uint16_t, LPFC_MBOXQ_t *); + void lpfc_init_link(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t, uint32_t); + void lpfc_request_features(struct lpfc_hba *, struct lpfcMboxq *); +-void lpfc_supported_pages(struct lpfcMboxq *); +-void lpfc_pc_sli4_params(struct lpfcMboxq *); +-int lpfc_pc_sli4_params_get(struct lpfc_hba *, LPFC_MBOXQ_t *); + int lpfc_sli4_mbox_rsrc_extent(struct lpfc_hba *, struct lpfcMboxq *, + uint16_t, uint16_t, bool); + int lpfc_get_sli4_parameters(struct lpfc_hba *, LPFC_MBOXQ_t *); +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index 12e4e76233e6..47e832b7f2c2 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -124,6 +124,7 @@ struct lpfc_sli_intf { + /* Define SLI4 Alignment requirements. */ + #define LPFC_ALIGN_16_BYTE 16 + #define LPFC_ALIGN_64_BYTE 64 ++#define SLI4_PAGE_SIZE 4096 + + /* Define SLI4 specific definitions. */ + #define LPFC_MQ_CQE_BYTE_OFFSET 256 +@@ -2976,62 +2977,6 @@ struct lpfc_mbx_request_features { + #define lpfc_mbx_rq_ftr_rsp_mrqp_WORD word3 + }; + +-struct lpfc_mbx_supp_pages { +- uint32_t word1; +-#define qs_SHIFT 0 +-#define qs_MASK 0x00000001 +-#define qs_WORD word1 +-#define wr_SHIFT 1 +-#define wr_MASK 0x00000001 +-#define wr_WORD word1 +-#define pf_SHIFT 8 +-#define pf_MASK 0x000000ff +-#define pf_WORD word1 +-#define cpn_SHIFT 16 +-#define cpn_MASK 0x000000ff +-#define cpn_WORD word1 +- uint32_t word2; +-#define list_offset_SHIFT 0 +-#define list_offset_MASK 0x000000ff +-#define list_offset_WORD word2 +-#define next_offset_SHIFT 8 +-#define next_offset_MASK 0x000000ff +-#define next_offset_WORD word2 +-#define elem_cnt_SHIFT 16 +-#define elem_cnt_MASK 0x000000ff +-#define elem_cnt_WORD word2 +- uint32_t word3; +-#define pn_0_SHIFT 24 +-#define pn_0_MASK 0x000000ff +-#define pn_0_WORD word3 +-#define pn_1_SHIFT 16 +-#define pn_1_MASK 0x000000ff +-#define pn_1_WORD word3 +-#define pn_2_SHIFT 8 +-#define pn_2_MASK 0x000000ff +-#define pn_2_WORD word3 +-#define pn_3_SHIFT 0 +-#define pn_3_MASK 0x000000ff +-#define pn_3_WORD word3 +- uint32_t word4; +-#define pn_4_SHIFT 24 +-#define pn_4_MASK 0x000000ff +-#define pn_4_WORD word4 +-#define pn_5_SHIFT 16 +-#define pn_5_MASK 0x000000ff +-#define pn_5_WORD word4 +-#define pn_6_SHIFT 8 +-#define pn_6_MASK 0x000000ff +-#define pn_6_WORD word4 +-#define pn_7_SHIFT 0 +-#define pn_7_MASK 0x000000ff +-#define pn_7_WORD word4 +- uint32_t rsvd[27]; +-#define LPFC_SUPP_PAGES 0 +-#define LPFC_BLOCK_GUARD_PROFILES 1 +-#define LPFC_SLI4_PARAMETERS 2 +-}; +- + struct lpfc_mbx_memory_dump_type3 { + uint32_t word1; + #define lpfc_mbx_memory_dump_type3_type_SHIFT 0 +@@ -3248,121 +3193,6 @@ struct user_eeprom { + uint8_t reserved191[57]; + }; + +-struct lpfc_mbx_pc_sli4_params { +- uint32_t word1; +-#define qs_SHIFT 0 +-#define qs_MASK 0x00000001 +-#define qs_WORD word1 +-#define wr_SHIFT 1 +-#define wr_MASK 0x00000001 +-#define wr_WORD word1 +-#define pf_SHIFT 8 +-#define pf_MASK 0x000000ff +-#define pf_WORD word1 +-#define cpn_SHIFT 16 +-#define cpn_MASK 0x000000ff +-#define cpn_WORD word1 +- uint32_t word2; +-#define if_type_SHIFT 0 +-#define if_type_MASK 0x00000007 +-#define if_type_WORD word2 +-#define sli_rev_SHIFT 4 +-#define sli_rev_MASK 0x0000000f +-#define sli_rev_WORD word2 +-#define sli_family_SHIFT 8 +-#define sli_family_MASK 0x000000ff +-#define sli_family_WORD word2 +-#define featurelevel_1_SHIFT 16 +-#define featurelevel_1_MASK 0x000000ff +-#define featurelevel_1_WORD word2 +-#define featurelevel_2_SHIFT 24 +-#define featurelevel_2_MASK 0x0000001f +-#define featurelevel_2_WORD word2 +- uint32_t word3; +-#define fcoe_SHIFT 0 +-#define fcoe_MASK 0x00000001 +-#define fcoe_WORD word3 +-#define fc_SHIFT 1 +-#define fc_MASK 0x00000001 +-#define fc_WORD word3 +-#define nic_SHIFT 2 +-#define nic_MASK 0x00000001 +-#define nic_WORD word3 +-#define iscsi_SHIFT 3 +-#define iscsi_MASK 0x00000001 +-#define iscsi_WORD word3 +-#define rdma_SHIFT 4 +-#define rdma_MASK 0x00000001 +-#define rdma_WORD word3 +- uint32_t sge_supp_len; +-#define SLI4_PAGE_SIZE 4096 +- uint32_t word5; +-#define if_page_sz_SHIFT 0 +-#define if_page_sz_MASK 0x0000ffff +-#define if_page_sz_WORD word5 +-#define loopbk_scope_SHIFT 24 +-#define loopbk_scope_MASK 0x0000000f +-#define loopbk_scope_WORD word5 +-#define rq_db_window_SHIFT 28 +-#define rq_db_window_MASK 0x0000000f +-#define rq_db_window_WORD word5 +- uint32_t word6; +-#define eq_pages_SHIFT 0 +-#define eq_pages_MASK 0x0000000f +-#define eq_pages_WORD word6 +-#define eqe_size_SHIFT 8 +-#define eqe_size_MASK 0x000000ff +-#define eqe_size_WORD word6 +- uint32_t word7; +-#define cq_pages_SHIFT 0 +-#define cq_pages_MASK 0x0000000f +-#define cq_pages_WORD word7 +-#define cqe_size_SHIFT 8 +-#define cqe_size_MASK 0x000000ff +-#define cqe_size_WORD word7 +- uint32_t word8; +-#define mq_pages_SHIFT 0 +-#define mq_pages_MASK 0x0000000f +-#define mq_pages_WORD word8 +-#define mqe_size_SHIFT 8 +-#define mqe_size_MASK 0x000000ff +-#define mqe_size_WORD word8 +-#define mq_elem_cnt_SHIFT 16 +-#define mq_elem_cnt_MASK 0x000000ff +-#define mq_elem_cnt_WORD word8 +- uint32_t word9; +-#define wq_pages_SHIFT 0 +-#define wq_pages_MASK 0x0000ffff +-#define wq_pages_WORD word9 +-#define wqe_size_SHIFT 8 +-#define wqe_size_MASK 0x000000ff +-#define wqe_size_WORD word9 +- uint32_t word10; +-#define rq_pages_SHIFT 0 +-#define rq_pages_MASK 0x0000ffff +-#define rq_pages_WORD word10 +-#define rqe_size_SHIFT 8 +-#define rqe_size_MASK 0x000000ff +-#define rqe_size_WORD word10 +- uint32_t word11; +-#define hdr_pages_SHIFT 0 +-#define hdr_pages_MASK 0x0000000f +-#define hdr_pages_WORD word11 +-#define hdr_size_SHIFT 8 +-#define hdr_size_MASK 0x0000000f +-#define hdr_size_WORD word11 +-#define hdr_pp_align_SHIFT 16 +-#define hdr_pp_align_MASK 0x0000ffff +-#define hdr_pp_align_WORD word11 +- uint32_t word12; +-#define sgl_pages_SHIFT 0 +-#define sgl_pages_MASK 0x0000000f +-#define sgl_pages_WORD word12 +-#define sgl_pp_align_SHIFT 16 +-#define sgl_pp_align_MASK 0x0000ffff +-#define sgl_pp_align_WORD word12 +- uint32_t rsvd_13_63[51]; +-}; + #define SLI4_PAGE_ALIGN(addr) (((addr)+((SLI4_PAGE_SIZE)-1)) \ + &(~((SLI4_PAGE_SIZE)-1))) + +@@ -3988,8 +3818,6 @@ struct lpfc_mqe { + struct lpfc_mbx_post_hdr_tmpl hdr_tmpl; + struct lpfc_mbx_query_fw_config query_fw_cfg; + struct lpfc_mbx_set_beacon_config beacon_config; +- struct lpfc_mbx_supp_pages supp_pages; +- struct lpfc_mbx_pc_sli4_params sli4_params; + struct lpfc_mbx_get_sli4_parameters get_sli4_parameters; + struct lpfc_mbx_set_link_diag_state link_diag_state; + struct lpfc_mbx_set_link_diag_loopback link_diag_loopback; +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index b17a75216964..2dde5ddc687d 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -6548,8 +6548,6 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) + LPFC_MBOXQ_t *mboxq; + MAILBOX_t *mb; + int rc, i, max_buf_size; +- uint8_t pn_page[LPFC_MAX_SUPPORTED_PAGES] = {0}; +- struct lpfc_mqe *mqe; + int longs; + int extra; + uint64_t wwn; +@@ -6783,32 +6781,6 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) + + lpfc_nvme_mod_param_dep(phba); + +- /* Get the Supported Pages if PORT_CAPABILITIES is supported by port. */ +- lpfc_supported_pages(mboxq); +- rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL); +- if (!rc) { +- mqe = &mboxq->u.mqe; +- memcpy(&pn_page[0], ((uint8_t *)&mqe->un.supp_pages.word3), +- LPFC_MAX_SUPPORTED_PAGES); +- for (i = 0; i < LPFC_MAX_SUPPORTED_PAGES; i++) { +- switch (pn_page[i]) { +- case LPFC_SLI4_PARAMETERS: +- phba->sli4_hba.pc_sli4_params.supported = 1; +- break; +- default: +- break; +- } +- } +- /* Read the port's SLI4 Parameters capabilities if supported. */ +- if (phba->sli4_hba.pc_sli4_params.supported) +- rc = lpfc_pc_sli4_params_get(phba, mboxq); +- if (rc) { +- mempool_free(mboxq, phba->mbox_mem_pool); +- rc = -EIO; +- goto out_free_bsmbx; +- } +- } +- + /* + * Get sli4 parameters that override parameters from Port capabilities. + * If this call fails, it isn't critical unless the SLI4 parameters come +@@ -12046,78 +12018,6 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba) + phba->pport->work_port_events = 0; + } + +- /** +- * lpfc_pc_sli4_params_get - Get the SLI4_PARAMS port capabilities. +- * @phba: Pointer to HBA context object. +- * @mboxq: Pointer to the mailboxq memory for the mailbox command response. +- * +- * This function is called in the SLI4 code path to read the port's +- * sli4 capabilities. +- * +- * This function may be be called from any context that can block-wait +- * for the completion. The expectation is that this routine is called +- * typically from probe_one or from the online routine. +- **/ +-int +-lpfc_pc_sli4_params_get(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq) +-{ +- int rc; +- struct lpfc_mqe *mqe; +- struct lpfc_pc_sli4_params *sli4_params; +- uint32_t mbox_tmo; +- +- rc = 0; +- mqe = &mboxq->u.mqe; +- +- /* Read the port's SLI4 Parameters port capabilities */ +- lpfc_pc_sli4_params(mboxq); +- if (!phba->sli4_hba.intr_enable) +- rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL); +- else { +- mbox_tmo = lpfc_mbox_tmo_val(phba, mboxq); +- rc = lpfc_sli_issue_mbox_wait(phba, mboxq, mbox_tmo); +- } +- +- if (unlikely(rc)) +- return 1; +- +- sli4_params = &phba->sli4_hba.pc_sli4_params; +- sli4_params->if_type = bf_get(if_type, &mqe->un.sli4_params); +- sli4_params->sli_rev = bf_get(sli_rev, &mqe->un.sli4_params); +- sli4_params->sli_family = bf_get(sli_family, &mqe->un.sli4_params); +- sli4_params->featurelevel_1 = bf_get(featurelevel_1, +- &mqe->un.sli4_params); +- sli4_params->featurelevel_2 = bf_get(featurelevel_2, +- &mqe->un.sli4_params); +- sli4_params->proto_types = mqe->un.sli4_params.word3; +- sli4_params->sge_supp_len = mqe->un.sli4_params.sge_supp_len; +- sli4_params->if_page_sz = bf_get(if_page_sz, &mqe->un.sli4_params); +- sli4_params->rq_db_window = bf_get(rq_db_window, &mqe->un.sli4_params); +- sli4_params->loopbk_scope = bf_get(loopbk_scope, &mqe->un.sli4_params); +- sli4_params->eq_pages_max = bf_get(eq_pages, &mqe->un.sli4_params); +- sli4_params->eqe_size = bf_get(eqe_size, &mqe->un.sli4_params); +- sli4_params->cq_pages_max = bf_get(cq_pages, &mqe->un.sli4_params); +- sli4_params->cqe_size = bf_get(cqe_size, &mqe->un.sli4_params); +- sli4_params->mq_pages_max = bf_get(mq_pages, &mqe->un.sli4_params); +- sli4_params->mqe_size = bf_get(mqe_size, &mqe->un.sli4_params); +- sli4_params->mq_elem_cnt = bf_get(mq_elem_cnt, &mqe->un.sli4_params); +- sli4_params->wq_pages_max = bf_get(wq_pages, &mqe->un.sli4_params); +- sli4_params->wqe_size = bf_get(wqe_size, &mqe->un.sli4_params); +- sli4_params->rq_pages_max = bf_get(rq_pages, &mqe->un.sli4_params); +- sli4_params->rqe_size = bf_get(rqe_size, &mqe->un.sli4_params); +- sli4_params->hdr_pages_max = bf_get(hdr_pages, &mqe->un.sli4_params); +- sli4_params->hdr_size = bf_get(hdr_size, &mqe->un.sli4_params); +- sli4_params->hdr_pp_align = bf_get(hdr_pp_align, &mqe->un.sli4_params); +- sli4_params->sgl_pages_max = bf_get(sgl_pages, &mqe->un.sli4_params); +- sli4_params->sgl_pp_align = bf_get(sgl_pp_align, &mqe->un.sli4_params); +- +- /* Make sure that sge_supp_len can be handled by the driver */ +- if (sli4_params->sge_supp_len > LPFC_MAX_SGE_SIZE) +- sli4_params->sge_supp_len = LPFC_MAX_SGE_SIZE; +- +- return rc; +-} +- + /** + * lpfc_get_sli4_parameters - Get the SLI4 Config PARAMETERS. + * @phba: Pointer to HBA context object. +@@ -12176,7 +12076,8 @@ lpfc_get_sli4_parameters(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq) + else + phba->sli3_options &= ~LPFC_SLI4_PHWQ_ENABLED; + sli4_params->sge_supp_len = mbx_sli4_parameters->sge_supp_len; +- sli4_params->loopbk_scope = bf_get(loopbk_scope, mbx_sli4_parameters); ++ sli4_params->loopbk_scope = bf_get(cfg_loopbk_scope, ++ mbx_sli4_parameters); + sli4_params->oas_supported = bf_get(cfg_oas, mbx_sli4_parameters); + sli4_params->cqv = bf_get(cfg_cqv, mbx_sli4_parameters); + sli4_params->mqv = bf_get(cfg_mqv, mbx_sli4_parameters); +diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c +index 3414ffcb26fe..8764fdfc41d4 100644 +--- a/drivers/scsi/lpfc/lpfc_mbox.c ++++ b/drivers/scsi/lpfc/lpfc_mbox.c +@@ -2624,39 +2624,3 @@ lpfc_resume_rpi(struct lpfcMboxq *mbox, struct lpfc_nodelist *ndlp) + resume_rpi->event_tag = ndlp->phba->fc_eventTag; + } + +-/** +- * lpfc_supported_pages - Initialize the PORT_CAPABILITIES supported pages +- * mailbox command. +- * @mbox: pointer to lpfc mbox command to initialize. +- * +- * The PORT_CAPABILITIES supported pages mailbox command is issued to +- * retrieve the particular feature pages supported by the port. +- **/ +-void +-lpfc_supported_pages(struct lpfcMboxq *mbox) +-{ +- struct lpfc_mbx_supp_pages *supp_pages; +- +- memset(mbox, 0, sizeof(*mbox)); +- supp_pages = &mbox->u.mqe.un.supp_pages; +- bf_set(lpfc_mqe_command, &mbox->u.mqe, MBX_PORT_CAPABILITIES); +- bf_set(cpn, supp_pages, LPFC_SUPP_PAGES); +-} +- +-/** +- * lpfc_pc_sli4_params - Initialize the PORT_CAPABILITIES SLI4 Params mbox cmd. +- * @mbox: pointer to lpfc mbox command to initialize. +- * +- * The PORT_CAPABILITIES SLI4 parameters mailbox command is issued to +- * retrieve the particular SLI4 features supported by the port. +- **/ +-void +-lpfc_pc_sli4_params(struct lpfcMboxq *mbox) +-{ +- struct lpfc_mbx_pc_sli4_params *sli4_params; +- +- memset(mbox, 0, sizeof(*mbox)); +- sli4_params = &mbox->u.mqe.un.sli4_params; +- bf_set(lpfc_mqe_command, &mbox->u.mqe, MBX_PORT_CAPABILITIES); +- bf_set(cpn, sli4_params, LPFC_SLI4_PARAMETERS); +-} +-- +2.30.2 + diff --git a/queue-5.10/scsi-qla2xxx-always-check-the-return-value-of-qla24x.patch b/queue-5.10/scsi-qla2xxx-always-check-the-return-value-of-qla24x.patch new file mode 100644 index 00000000000..36c345a8e67 --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-always-check-the-return-value-of-qla24x.patch @@ -0,0 +1,60 @@ +From a53ca11fd6b55687ab05a5ad9e3876d3ac515508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 16:23:58 -0700 +Subject: scsi: qla2xxx: Always check the return value of + qla24xx_get_isp_stats() + +From: Bart Van Assche + +[ Upstream commit a2b2cc660822cae08c351c7f6b452bfd1330a4f7 ] + +This patch fixes the following Coverity warning: + + CID 361199 (#1 of 1): Unchecked return value (CHECKED_RETURN) + 3. check_return: Calling qla24xx_get_isp_stats without checking return + value (as is done elsewhere 4 out of 5 times). + +Link: https://lore.kernel.org/r/20210320232359.941-7-bvanassche@acm.org +Cc: Quinn Tran +Cc: Mike Christie +Cc: Himanshu Madhani +Cc: Daniel Wagner +Cc: Lee Duncan +Reviewed-by: Daniel Wagner +Reviewed-by: Himanshu Madhani +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_attr.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index ab45ac1e5a72..6a2c4a6fcded 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2855,6 +2855,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) + vha->qla_stats.jiffies_at_last_reset = get_jiffies_64(); + + if (IS_FWI2_CAPABLE(ha)) { ++ int rval; ++ + stats = dma_alloc_coherent(&ha->pdev->dev, + sizeof(*stats), &stats_dma, GFP_KERNEL); + if (!stats) { +@@ -2864,7 +2866,11 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) + } + + /* reset firmware statistics */ +- qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0); ++ rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0); ++ if (rval != QLA_SUCCESS) ++ ql_log(ql_log_warn, vha, 0x70de, ++ "Resetting ISP statistics failed: rval = %d\n", ++ rval); + + dma_free_coherent(&ha->pdev->dev, sizeof(*stats), + stats, stats_dma); +-- +2.30.2 + diff --git a/queue-5.10/scsi-qla2xxx-fix-use-after-free-in-bsg.patch b/queue-5.10/scsi-qla2xxx-fix-use-after-free-in-bsg.patch new file mode 100644 index 00000000000..ca076f588ad --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-fix-use-after-free-in-bsg.patch @@ -0,0 +1,61 @@ +From ad3edb1f18274c6c94f1d4d9de555186081745fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 01:52:22 -0700 +Subject: scsi: qla2xxx: Fix use after free in bsg + +From: Quinn Tran + +[ Upstream commit 2ce35c0821afc2acd5ee1c3f60d149f8b2520ce8 ] + +On bsg command completion, bsg_job_done() was called while qla driver +continued to access the bsg_job buffer. bsg_job_done() would free up +resources that ended up being reused by other task while the driver +continued to access the buffers. As a result, driver was reading garbage +data. + +localhost kernel: BUG: KASAN: use-after-free in sg_next+0x64/0x80 +localhost kernel: Read of size 8 at addr ffff8883228a3330 by task swapper/26/0 +localhost kernel: +localhost kernel: CPU: 26 PID: 0 Comm: swapper/26 Kdump: +loaded Tainted: G OE --------- - - 4.18.0-193.el8.x86_64+debug #1 +localhost kernel: Hardware name: HP ProLiant DL360 +Gen9/ProLiant DL360 Gen9, BIOS P89 08/12/2016 +localhost kernel: Call Trace: +localhost kernel: +localhost kernel: dump_stack+0x9a/0xf0 +localhost kernel: print_address_description.cold.3+0x9/0x23b +localhost kernel: kasan_report.cold.4+0x65/0x95 +localhost kernel: debug_dma_unmap_sg.part.12+0x10d/0x2d0 +localhost kernel: qla2x00_bsg_sp_free+0xaf6/0x1010 [qla2xxx] + +Link: https://lore.kernel.org/r/20210329085229.4367-6-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_bsg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index 23b604832a54..7fa085969a63 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -24,10 +24,11 @@ void qla2x00_bsg_job_done(srb_t *sp, int res) + struct bsg_job *bsg_job = sp->u.bsg_job; + struct fc_bsg_reply *bsg_reply = bsg_job->reply; + ++ sp->free(sp); ++ + bsg_reply->result = res; + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); +- sp->free(sp); + } + + void qla2x00_bsg_sp_free(srb_t *sp) +-- +2.30.2 + diff --git a/queue-5.10/scsi-scsi_dh_alua-remove-check-for-asc-24h-in-alua_r.patch b/queue-5.10/scsi-scsi_dh_alua-remove-check-for-asc-24h-in-alua_r.patch new file mode 100644 index 00000000000..789e89ec1e8 --- /dev/null +++ b/queue-5.10/scsi-scsi_dh_alua-remove-check-for-asc-24h-in-alua_r.patch @@ -0,0 +1,42 @@ +From c465a6878c8895be128f4773e5c2446c1e89e1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 16:11:54 -0400 +Subject: scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() + +From: Ewan D. Milne + +[ Upstream commit bc3f2b42b70eb1b8576e753e7d0e117bbb674496 ] + +Some arrays return ILLEGAL_REQUEST with ASC 00h if they don't support the +RTPG extended header so remove the check for INVALID FIELD IN CDB. + +Link: https://lore.kernel.org/r/20210331201154.20348-1-emilne@redhat.com +Reviewed-by: Hannes Reinecke +Signed-off-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 308bda2e9c00..df5a3bbeba5e 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -565,10 +565,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + * even though it shouldn't according to T10. + * The retry without rtpg_ext_hdr_req set + * handles this. ++ * Note: some arrays return a sense key of ILLEGAL_REQUEST ++ * with ASC 00h if they don't support the extended header. + */ + if (!(pg->flags & ALUA_RTPG_EXT_HDR_UNSUPP) && +- sense_hdr.sense_key == ILLEGAL_REQUEST && +- sense_hdr.asc == 0x24 && sense_hdr.ascq == 0) { ++ sense_hdr.sense_key == ILLEGAL_REQUEST) { + pg->flags |= ALUA_RTPG_EXT_HDR_UNSUPP; + goto retry; + } +-- +2.30.2 + diff --git a/queue-5.10/scsi-smartpqi-add-new-pci-ids.patch b/queue-5.10/scsi-smartpqi-add-new-pci-ids.patch new file mode 100644 index 00000000000..625150f98d7 --- /dev/null +++ b/queue-5.10/scsi-smartpqi-add-new-pci-ids.patch @@ -0,0 +1,221 @@ +From 34c5caee27cf972666ff8ce769d9184acce4af17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 14:17:48 -0600 +Subject: scsi: smartpqi: Add new PCI IDs + +From: Kevin Barnett + +[ Upstream commit 75fbeacca3ad30835e903002dba98dd909b4dfff ] + +Add support for newer hardware. + +Link: https://lore.kernel.org/r/161549386882.25025.2594251735886014958.stgit@brunhilda +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Acked-by: Martin Wilck +Signed-off-by: Kevin Barnett +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 156 ++++++++++++++++++++++++++ + 1 file changed, 156 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index afd004fdce76..5083e5d2b467 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -8226,6 +8226,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x152d, 0x8a37) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x193d, 0x8460) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x193d, 0x1104) +@@ -8298,6 +8302,22 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1bd4, 0x004f) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1bd4, 0x0051) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1bd4, 0x0052) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1bd4, 0x0053) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1bd4, 0x0054) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x19e5, 0xd227) +@@ -8458,6 +8478,122 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADAPTEC2, 0x1380) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1400) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1402) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1410) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1411) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1412) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1420) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1430) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1440) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1441) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1450) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1452) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1460) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1461) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1462) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1470) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1471) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1472) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1480) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1490) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x1491) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14a0) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14a1) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14b0) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14b1) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14c0) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14c1) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14d0) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14e0) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_ADAPTEC2, 0x14f0) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADVANTECH, 0x8312) +@@ -8522,6 +8658,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_HP, 0x1001) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_HP, 0x1002) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_HP, 0x1100) +@@ -8530,6 +8670,22 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_HP, 0x1101) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1590, 0x0294) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1590, 0x02db) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1590, 0x02dc) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1590, 0x032e) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1d8d, 0x0800) +-- +2.30.2 + diff --git a/queue-5.10/scsi-smartpqi-correct-request-leakage-during-reset-o.patch b/queue-5.10/scsi-smartpqi-correct-request-leakage-during-reset-o.patch new file mode 100644 index 00000000000..c3b38c48306 --- /dev/null +++ b/queue-5.10/scsi-smartpqi-correct-request-leakage-during-reset-o.patch @@ -0,0 +1,52 @@ +From 58f70a374486c809f85ac8090a0918684c9dd761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 14:15:03 -0600 +Subject: scsi: smartpqi: Correct request leakage during reset operations + +From: Murthy Bhat + +[ Upstream commit b622a601a13ae5974c5b0aeecb990c224b8db0d9 ] + +While failing queued I/Os in TMF path, there was a request leak and hence +stale entries in request pool with ref count being non-zero. In shutdown +path we have a BUG_ON to catch stuck I/O either in firmware or in the +driver. The stale requests caused a system crash. The I/O request pool +leakage also lead to a significant performance drop. + +Link: https://lore.kernel.org/r/161549370379.25025.12793264112620796062.stgit@brunhilda +Reviewed-by: Scott Teel +Reviewed-by: Scott Benesh +Reviewed-by: Kevin Barnett +Signed-off-by: Murthy Bhat +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 9300a677510d..afd004fdce76 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -5491,6 +5491,8 @@ static void pqi_fail_io_queued_for_device(struct pqi_ctrl_info *ctrl_info, + + list_del(&io_request->request_list_entry); + set_host_byte(scmd, DID_RESET); ++ pqi_free_io_request(io_request); ++ scsi_dma_unmap(scmd); + pqi_scsi_done(scmd); + } + +@@ -5527,6 +5529,8 @@ static void pqi_fail_io_queued_for_all_devices(struct pqi_ctrl_info *ctrl_info) + + list_del(&io_request->request_list_entry); + set_host_byte(scmd, DID_RESET); ++ pqi_free_io_request(io_request); ++ scsi_dma_unmap(scmd); + pqi_scsi_done(scmd); + } + +-- +2.30.2 + diff --git a/queue-5.10/scsi-smartpqi-use-host-wide-tag-space.patch b/queue-5.10/scsi-smartpqi-use-host-wide-tag-space.patch new file mode 100644 index 00000000000..6781348e369 --- /dev/null +++ b/queue-5.10/scsi-smartpqi-use-host-wide-tag-space.patch @@ -0,0 +1,43 @@ +From b62adcd9ebdd7ae25328ea909d76d0ae611360a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 14:14:57 -0600 +Subject: scsi: smartpqi: Use host-wide tag space + +From: Don Brace + +[ Upstream commit c6d3ee209b9e863c6251f72101511340451ca324 ] + +Correct SCSI midlayer sending more requests than exposed host queue depth +causing firmware ASSERT and lockup issues by enabling host-wide tags. + +Note: This also results in better performance. + +Link: https://lore.kernel.org/r/161549369787.25025.8975999483518581619.stgit@brunhilda +Suggested-by: Ming Lei +Suggested-by: John Garry +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Reviewed-by: Mike McGowen +Reviewed-by: Kevin Barnett +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 9d0229656681..9300a677510d 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -6601,6 +6601,7 @@ static int pqi_register_scsi(struct pqi_ctrl_info *ctrl_info) + shost->irq = pci_irq_vector(ctrl_info->pci_dev, 0); + shost->unique_id = shost->irq; + shost->nr_hw_queues = ctrl_info->num_queue_groups; ++ shost->host_tagset = 1; + shost->hostdata[0] = (unsigned long)ctrl_info; + + rc = scsi_add_host(shost, &ctrl_info->pci_dev->dev); +-- +2.30.2 + diff --git a/queue-5.10/scsi-target-pscsi-fix-warning-in-pscsi_complete_cmd.patch b/queue-5.10/scsi-target-pscsi-fix-warning-in-pscsi_complete_cmd.patch new file mode 100644 index 00000000000..a274297f45c --- /dev/null +++ b/queue-5.10/scsi-target-pscsi-fix-warning-in-pscsi_complete_cmd.patch @@ -0,0 +1,46 @@ +From d32a56371cbdc68a558055c3c290e43412e7ff1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Feb 2021 21:56:26 -0800 +Subject: scsi: target: pscsi: Fix warning in pscsi_complete_cmd() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chaitanya Kulkarni + +[ Upstream commit fd48c056a32ed6e7754c7c475490f3bed54ed378 ] + +This fixes a compilation warning in pscsi_complete_cmd(): + + drivers/target/target_core_pscsi.c: In function ‘pscsi_complete_cmd’: + drivers/target/target_core_pscsi.c:624:5: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] + ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ + +Link: https://lore.kernel.org/r/20210228055645.22253-5-chaitanya.kulkarni@wdc.com +Reviewed-by: Mike Christie +Reviewed-by: Johannes Thumshirn +Signed-off-by: Chaitanya Kulkarni +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_pscsi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 723a51a3f431..f10f0aa6cd37 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -620,8 +620,9 @@ static void pscsi_complete_cmd(struct se_cmd *cmd, u8 scsi_status, + unsigned char *buf; + + buf = transport_kmap_data_sg(cmd); +- if (!buf) ++ if (!buf) { + ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ ++ } + + if (cdb[0] == MODE_SENSE_10) { + if (!(buf[3] & 0x80)) +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-clean-up-resctrl-features-check.patch b/queue-5.10/selftests-resctrl-clean-up-resctrl-features-check.patch new file mode 100644 index 00000000000..02bb235bb90 --- /dev/null +++ b/queue-5.10/selftests-resctrl-clean-up-resctrl-features-check.patch @@ -0,0 +1,331 @@ +From 771beeee624768f22d022af0f6e5e508da2abc98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:38 +0000 +Subject: selftests/resctrl: Clean up resctrl features check + +From: Fenghua Yu + +[ Upstream commit 2428673638ea28fa93d2a38b1c3e8d70122b00ee ] + +Checking resctrl features call strcmp() to compare feature strings +(e.g. "mba", "cat" etc). The checkings are error prone and don't have +good coding style. Define the constant strings in macros and call +strncmp() to solve the potential issues. + +Suggested-by: Shuah Khan +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cache.c | 8 +++---- + tools/testing/selftests/resctrl/cat_test.c | 2 +- + tools/testing/selftests/resctrl/cqm_test.c | 2 +- + tools/testing/selftests/resctrl/fill_buf.c | 4 ++-- + tools/testing/selftests/resctrl/mba_test.c | 2 +- + tools/testing/selftests/resctrl/mbm_test.c | 2 +- + tools/testing/selftests/resctrl/resctrl.h | 5 +++++ + .../testing/selftests/resctrl/resctrl_tests.c | 12 +++++----- + tools/testing/selftests/resctrl/resctrl_val.c | 22 +++++++++---------- + tools/testing/selftests/resctrl/resctrlfs.c | 17 +++++++------- + 10 files changed, 41 insertions(+), 35 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c +index 38dbf4962e33..5922cc1b0386 100644 +--- a/tools/testing/selftests/resctrl/cache.c ++++ b/tools/testing/selftests/resctrl/cache.c +@@ -182,7 +182,7 @@ int measure_cache_vals(struct resctrl_val_param *param, int bm_pid) + /* + * Measure cache miss from perf. + */ +- if (!strcmp(param->resctrl_val, "cat")) { ++ if (!strncmp(param->resctrl_val, CAT_STR, sizeof(CAT_STR))) { + ret = get_llc_perf(&llc_perf_miss); + if (ret < 0) + return ret; +@@ -192,7 +192,7 @@ int measure_cache_vals(struct resctrl_val_param *param, int bm_pid) + /* + * Measure llc occupancy from resctrl. + */ +- if (!strcmp(param->resctrl_val, "cqm")) { ++ if (!strncmp(param->resctrl_val, CQM_STR, sizeof(CQM_STR))) { + ret = get_llc_occu_resctrl(&llc_occu_resc); + if (ret < 0) + return ret; +@@ -234,7 +234,7 @@ int cat_val(struct resctrl_val_param *param) + if (ret) + return ret; + +- if ((strcmp(resctrl_val, "cat") == 0)) { ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { + ret = initialize_llc_perf(); + if (ret) + return ret; +@@ -242,7 +242,7 @@ int cat_val(struct resctrl_val_param *param) + + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { +- if (strcmp(resctrl_val, "cat") == 0) { ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { + ret = param->setup(1, param); + if (ret) { + ret = 0; +diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c +index bdeeb5772592..20823725daca 100644 +--- a/tools/testing/selftests/resctrl/cat_test.c ++++ b/tools/testing/selftests/resctrl/cat_test.c +@@ -164,7 +164,7 @@ int cat_perf_miss_val(int cpu_no, int n, char *cache_type) + return -1; + + struct resctrl_val_param param = { +- .resctrl_val = "cat", ++ .resctrl_val = CAT_STR, + .cpu_no = cpu_no, + .mum_resctrlfs = 0, + .setup = cat_setup, +diff --git a/tools/testing/selftests/resctrl/cqm_test.c b/tools/testing/selftests/resctrl/cqm_test.c +index de33d1c0466e..271752e9ef5b 100644 +--- a/tools/testing/selftests/resctrl/cqm_test.c ++++ b/tools/testing/selftests/resctrl/cqm_test.c +@@ -145,7 +145,7 @@ int cqm_resctrl_val(int cpu_no, int n, char **benchmark_cmd) + } + + struct resctrl_val_param param = { +- .resctrl_val = "cqm", ++ .resctrl_val = CQM_STR, + .ctrlgrp = "c1", + .mongrp = "m1", + .cpu_no = cpu_no, +diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c +index 79c611c99a3d..51e5cf22632f 100644 +--- a/tools/testing/selftests/resctrl/fill_buf.c ++++ b/tools/testing/selftests/resctrl/fill_buf.c +@@ -115,7 +115,7 @@ static int fill_cache_read(unsigned char *start_ptr, unsigned char *end_ptr, + + while (1) { + ret = fill_one_span_read(start_ptr, end_ptr); +- if (!strcmp(resctrl_val, "cat")) ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) + break; + } + +@@ -134,7 +134,7 @@ static int fill_cache_write(unsigned char *start_ptr, unsigned char *end_ptr, + { + while (1) { + fill_one_span_write(start_ptr, end_ptr); +- if (!strcmp(resctrl_val, "cat")) ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) + break; + } + +diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c +index 7bf8eaa6204b..6449fbd96096 100644 +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -141,7 +141,7 @@ void mba_test_cleanup(void) + int mba_schemata_change(int cpu_no, char *bw_report, char **benchmark_cmd) + { + struct resctrl_val_param param = { +- .resctrl_val = "mba", ++ .resctrl_val = MBA_STR, + .ctrlgrp = "c1", + .mongrp = "m1", + .cpu_no = cpu_no, +diff --git a/tools/testing/selftests/resctrl/mbm_test.c b/tools/testing/selftests/resctrl/mbm_test.c +index 4700f7453f81..ec6cfe01c9c2 100644 +--- a/tools/testing/selftests/resctrl/mbm_test.c ++++ b/tools/testing/selftests/resctrl/mbm_test.c +@@ -114,7 +114,7 @@ void mbm_test_cleanup(void) + int mbm_bw_change(int span, int cpu_no, char *bw_report, char **benchmark_cmd) + { + struct resctrl_val_param param = { +- .resctrl_val = "mbm", ++ .resctrl_val = MBM_STR, + .ctrlgrp = "c1", + .mongrp = "m1", + .span = span, +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index 12b77182cb44..36da6136af96 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -62,6 +62,11 @@ struct resctrl_val_param { + int (*setup)(int num, ...); + }; + ++#define MBM_STR "mbm" ++#define MBA_STR "mba" ++#define CQM_STR "cqm" ++#define CAT_STR "cat" ++ + extern pid_t bm_pid, ppid; + extern int tests_run; + +diff --git a/tools/testing/selftests/resctrl/resctrl_tests.c b/tools/testing/selftests/resctrl/resctrl_tests.c +index 425cc85ac883..4b109a59f72d 100644 +--- a/tools/testing/selftests/resctrl/resctrl_tests.c ++++ b/tools/testing/selftests/resctrl/resctrl_tests.c +@@ -85,13 +85,13 @@ int main(int argc, char **argv) + cqm_test = false; + cat_test = false; + while (token) { +- if (!strcmp(token, "mbm")) { ++ if (!strncmp(token, MBM_STR, sizeof(MBM_STR))) { + mbm_test = true; +- } else if (!strcmp(token, "mba")) { ++ } else if (!strncmp(token, MBA_STR, sizeof(MBA_STR))) { + mba_test = true; +- } else if (!strcmp(token, "cqm")) { ++ } else if (!strncmp(token, CQM_STR, sizeof(CQM_STR))) { + cqm_test = true; +- } else if (!strcmp(token, "cat")) { ++ } else if (!strncmp(token, CAT_STR, sizeof(CAT_STR))) { + cat_test = true; + } else { + printf("invalid argument\n"); +@@ -161,7 +161,7 @@ int main(int argc, char **argv) + if (!is_amd && mbm_test) { + printf("# Starting MBM BW change ...\n"); + if (!has_ben) +- sprintf(benchmark_cmd[5], "%s", "mba"); ++ sprintf(benchmark_cmd[5], "%s", MBA_STR); + res = mbm_bw_change(span, cpu_no, bw_report, benchmark_cmd); + printf("%sok MBM: bw change\n", res ? "not " : ""); + mbm_test_cleanup(); +@@ -181,7 +181,7 @@ int main(int argc, char **argv) + if (cqm_test) { + printf("# Starting CQM test ...\n"); + if (!has_ben) +- sprintf(benchmark_cmd[5], "%s", "cqm"); ++ sprintf(benchmark_cmd[5], "%s", CQM_STR); + res = cqm_resctrl_val(cpu_no, no_of_bits, benchmark_cmd); + printf("%sok CQM: test\n", res ? "not " : ""); + cqm_test_cleanup(); +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index 520fea3606d1..aed71fd0713b 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -397,10 +397,10 @@ static void initialize_mem_bw_resctrl(const char *ctrlgrp, const char *mongrp, + return; + } + +- if (strcmp(resctrl_val, "mbm") == 0) ++ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) + set_mbm_path(ctrlgrp, mongrp, resource_id); + +- if ((strcmp(resctrl_val, "mba") == 0)) { ++ if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { + if (ctrlgrp) + sprintf(mbm_total_path, CON_MBM_LOCAL_BYTES_PATH, + RESCTRL_PATH, ctrlgrp, resource_id); +@@ -524,7 +524,7 @@ static void initialize_llc_occu_resctrl(const char *ctrlgrp, const char *mongrp, + return; + } + +- if (strcmp(resctrl_val, "cqm") == 0) ++ if (!strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) + set_cqm_path(ctrlgrp, mongrp, resource_id); + } + +@@ -579,8 +579,8 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + if (strcmp(param->filename, "") == 0) + sprintf(param->filename, "stdio"); + +- if ((strcmp(resctrl_val, "mba")) == 0 || +- (strcmp(resctrl_val, "mbm")) == 0) { ++ if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR)) || ++ !strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) { + ret = validate_bw_report_request(param->bw_report); + if (ret) + return ret; +@@ -674,15 +674,15 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + if (ret) + goto out; + +- if ((strcmp(resctrl_val, "mbm") == 0) || +- (strcmp(resctrl_val, "mba") == 0)) { ++ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || ++ !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { + ret = initialize_mem_bw_imc(); + if (ret) + goto out; + + initialize_mem_bw_resctrl(param->ctrlgrp, param->mongrp, + param->cpu_no, resctrl_val); +- } else if (strcmp(resctrl_val, "cqm") == 0) ++ } else if (!strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) + initialize_llc_occu_resctrl(param->ctrlgrp, param->mongrp, + param->cpu_no, resctrl_val); + +@@ -710,8 +710,8 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + + /* Test runs until the callback setup() tells the test to stop. */ + while (1) { +- if ((strcmp(resctrl_val, "mbm") == 0) || +- (strcmp(resctrl_val, "mba") == 0)) { ++ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || ++ !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { + ret = param->setup(1, param); + if (ret) { + ret = 0; +@@ -721,7 +721,7 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) + ret = measure_vals(param, &bw_resc_start); + if (ret) + break; +- } else if (strcmp(resctrl_val, "cqm") == 0) { ++ } else if (!strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) { + ret = param->setup(1, param); + if (ret) { + ret = 0; +diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c +index 2a16100c9c3f..4174e48e06d1 100644 +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -334,7 +334,7 @@ void run_benchmark(int signum, siginfo_t *info, void *ucontext) + operation = atoi(benchmark_cmd[4]); + sprintf(resctrl_val, "%s", benchmark_cmd[5]); + +- if (strcmp(resctrl_val, "cqm") != 0) ++ if (strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) + buffer_span = span * MB; + else + buffer_span = span; +@@ -459,8 +459,8 @@ int write_bm_pid_to_resctrl(pid_t bm_pid, char *ctrlgrp, char *mongrp, + goto out; + + /* Create mon grp and write pid into it for "mbm" and "cqm" test */ +- if ((strcmp(resctrl_val, "cqm") == 0) || +- (strcmp(resctrl_val, "mbm") == 0)) { ++ if (!strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR)) || ++ !strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) { + if (strlen(mongrp)) { + sprintf(monitorgroup_p, "%s/mon_groups", controlgroup); + sprintf(monitorgroup, "%s/%s", monitorgroup_p, mongrp); +@@ -505,9 +505,9 @@ int write_schemata(char *ctrlgrp, char *schemata, int cpu_no, char *resctrl_val) + int resource_id, ret = 0; + FILE *fp; + +- if ((strcmp(resctrl_val, "mba") != 0) && +- (strcmp(resctrl_val, "cat") != 0) && +- (strcmp(resctrl_val, "cqm") != 0)) ++ if (strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR)) && ++ strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR)) && ++ strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) + return -ENOENT; + + if (!schemata) { +@@ -528,9 +528,10 @@ int write_schemata(char *ctrlgrp, char *schemata, int cpu_no, char *resctrl_val) + else + sprintf(controlgroup, "%s/schemata", RESCTRL_PATH); + +- if (!strcmp(resctrl_val, "cat") || !strcmp(resctrl_val, "cqm")) ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR)) || ++ !strncmp(resctrl_val, CQM_STR, sizeof(CQM_STR))) + sprintf(schema, "%s%d%c%s", "L3:", resource_id, '=', schemata); +- if (strcmp(resctrl_val, "mba") == 0) ++ if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) + sprintf(schema, "%s%d%c%s", "MB:", resource_id, '=', schemata); + + fp = fopen(controlgroup, "w"); +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-enable-gcc-checks-to-detect-buffer.patch b/queue-5.10/selftests-resctrl-enable-gcc-checks-to-detect-buffer.patch new file mode 100644 index 00000000000..10e7edfe590 --- /dev/null +++ b/queue-5.10/selftests-resctrl-enable-gcc-checks-to-detect-buffer.patch @@ -0,0 +1,80 @@ +From 616439673c2f4ad7e1ad845c934be6ebd5c499e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:35 +0000 +Subject: selftests/resctrl: Enable gcc checks to detect buffer overflows + +From: Fenghua Yu + +[ Upstream commit a9d26a302dea29eb84f491b1340a57e56c631a71 ] + +David reported a buffer overflow error in the check_results() function of +the cmt unit test and he suggested enabling _FORTIFY_SOURCE gcc compiler +option to automatically detect any such errors. + +Feature Test Macros man page describes_FORTIFY_SOURCE as below + +"Defining this macro causes some lightweight checks to be performed to +detect some buffer overflow errors when employing various string and memory +manipulation functions (for example, memcpy, memset, stpcpy, strcpy, +strncpy, strcat, strncat, sprintf, snprintf, vsprintf, vsnprintf, gets, and +wide character variants thereof). For some functions, argument consistency +is checked; for example, a check is made that open has been supplied with a +mode argument when the specified flags include O_CREAT. Not all problems +are detected, just some common cases. + +If _FORTIFY_SOURCE is set to 1, with compiler optimization level 1 (gcc +-O1) and above, checks that shouldn't change the behavior of conforming +programs are performed. + +With _FORTIFY_SOURCE set to 2, some more checking is added, but some +conforming programs might fail. + +Some of the checks can be performed at compile time (via macros logic +implemented in header files), and result in compiler warnings; other checks +take place at run time, and result in a run-time error if the check fails. + +Use of this macro requires compiler support, available with gcc since +version 4.0." + +Fix the buffer overflow error in the check_results() function of the cmt +unit test and enable _FORTIFY_SOURCE gcc check to catch any future buffer +overflow errors. + +Reported-by: David Binderman +Suggested-by: David Binderman +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/Makefile | 2 +- + tools/testing/selftests/resctrl/cqm_test.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/Makefile b/tools/testing/selftests/resctrl/Makefile +index d585cc1948cc..6bcee2ec91a9 100644 +--- a/tools/testing/selftests/resctrl/Makefile ++++ b/tools/testing/selftests/resctrl/Makefile +@@ -1,5 +1,5 @@ + CC = $(CROSS_COMPILE)gcc +-CFLAGS = -g -Wall ++CFLAGS = -g -Wall -O2 -D_FORTIFY_SOURCE=2 + SRCS=$(wildcard *.c) + OBJS=$(SRCS:.c=.o) + +diff --git a/tools/testing/selftests/resctrl/cqm_test.c b/tools/testing/selftests/resctrl/cqm_test.c +index c8756152bd61..5e7308ac63be 100644 +--- a/tools/testing/selftests/resctrl/cqm_test.c ++++ b/tools/testing/selftests/resctrl/cqm_test.c +@@ -86,7 +86,7 @@ static int check_results(struct resctrl_val_param *param, int no_of_bits) + return errno; + } + +- while (fgets(temp, 1024, fp)) { ++ while (fgets(temp, sizeof(temp), fp)) { + char *token = strtok(temp, ":\t"); + int fields = 0; + +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-fix-checking-for-0-for-unsigned-va.patch b/queue-5.10/selftests-resctrl-fix-checking-for-0-for-unsigned-va.patch new file mode 100644 index 00000000000..a0d80e77a3a --- /dev/null +++ b/queue-5.10/selftests-resctrl-fix-checking-for-0-for-unsigned-va.patch @@ -0,0 +1,142 @@ +From 8210240c339931139b79e0d130cd18d57b0a4898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:54 +0000 +Subject: selftests/resctrl: Fix checking for < 0 for unsigned values + +From: Fenghua Yu + +[ Upstream commit 1205b688c92558a04d8dd4cbc2b213e0fceba5db ] + +Dan reported following static checker warnings + +tools/testing/selftests/resctrl/resctrl_val.c:545 measure_vals() +warn: 'bw_imc' unsigned <= 0 + +tools/testing/selftests/resctrl/resctrl_val.c:549 measure_vals() +warn: 'bw_resc_end' unsigned <= 0 + +These warnings are reported because +1. measure_vals() declares 'bw_imc' and 'bw_resc_end' as unsigned long + variables +2. Return value of get_mem_bw_imc() and get_mem_bw_resctrl() are assigned + to 'bw_imc' and 'bw_resc_end' respectively +3. The returned values are checked for <= 0 to see if the calls failed + +Checking for < 0 for an unsigned value doesn't make any sense. + +Fix this issue by changing the implementation of get_mem_bw_imc() and +get_mem_bw_resctrl() such that they now accept reference to a variable +and set the variable appropriately upon success and return 0, else return +< 0 on error. + +Reported-by: Dan Carpenter +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_val.c | 41 +++++++++++-------- + 1 file changed, 23 insertions(+), 18 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index 5478c23c62ba..8df557894059 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -300,9 +300,9 @@ static int initialize_mem_bw_imc(void) + * Memory B/W utilized by a process on a socket can be calculated using + * iMC counters. Perf events are used to read these counters. + * +- * Return: >= 0 on success. < 0 on failure. ++ * Return: = 0 on success. < 0 on failure. + */ +-static float get_mem_bw_imc(int cpu_no, char *bw_report) ++static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc) + { + float reads, writes, of_mul_read, of_mul_write; + int imc, j, ret; +@@ -373,13 +373,18 @@ static float get_mem_bw_imc(int cpu_no, char *bw_report) + close(imc_counters_config[imc][WRITE].fd); + } + +- if (strcmp(bw_report, "reads") == 0) +- return reads; ++ if (strcmp(bw_report, "reads") == 0) { ++ *bw_imc = reads; ++ return 0; ++ } + +- if (strcmp(bw_report, "writes") == 0) +- return writes; ++ if (strcmp(bw_report, "writes") == 0) { ++ *bw_imc = writes; ++ return 0; ++ } + +- return (reads + writes); ++ *bw_imc = reads + writes; ++ return 0; + } + + void set_mbm_path(const char *ctrlgrp, const char *mongrp, int resource_id) +@@ -438,9 +443,8 @@ static void initialize_mem_bw_resctrl(const char *ctrlgrp, const char *mongrp, + * 1. If con_mon grp is given, then read from it + * 2. If con_mon grp is not given, then read from root con_mon grp + */ +-static unsigned long get_mem_bw_resctrl(void) ++static int get_mem_bw_resctrl(unsigned long *mbm_total) + { +- unsigned long mbm_total = 0; + FILE *fp; + + fp = fopen(mbm_total_path, "r"); +@@ -449,7 +453,7 @@ static unsigned long get_mem_bw_resctrl(void) + + return -1; + } +- if (fscanf(fp, "%lu", &mbm_total) <= 0) { ++ if (fscanf(fp, "%lu", mbm_total) <= 0) { + perror("Could not get mbm local bytes"); + fclose(fp); + +@@ -457,7 +461,7 @@ static unsigned long get_mem_bw_resctrl(void) + } + fclose(fp); + +- return mbm_total; ++ return 0; + } + + pid_t bm_pid, ppid; +@@ -549,7 +553,8 @@ static void initialize_llc_occu_resctrl(const char *ctrlgrp, const char *mongrp, + static int + measure_vals(struct resctrl_val_param *param, unsigned long *bw_resc_start) + { +- unsigned long bw_imc, bw_resc, bw_resc_end; ++ unsigned long bw_resc, bw_resc_end; ++ float bw_imc; + int ret; + + /* +@@ -559,13 +564,13 @@ measure_vals(struct resctrl_val_param *param, unsigned long *bw_resc_start) + * Compare the two values to validate resctrl value. + * It takes 1sec to measure the data. + */ +- bw_imc = get_mem_bw_imc(param->cpu_no, param->bw_report); +- if (bw_imc <= 0) +- return bw_imc; ++ ret = get_mem_bw_imc(param->cpu_no, param->bw_report, &bw_imc); ++ if (ret < 0) ++ return ret; + +- bw_resc_end = get_mem_bw_resctrl(); +- if (bw_resc_end <= 0) +- return bw_resc_end; ++ ret = get_mem_bw_resctrl(&bw_resc_end); ++ if (ret < 0) ++ return ret; + + bw_resc = (bw_resc_end - *bw_resc_start) / MB; + ret = print_results_bw(param->filename, bm_pid, bw_imc, bw_resc); +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-fix-compilation-issues-for-global-.patch b/queue-5.10/selftests-resctrl-fix-compilation-issues-for-global-.patch new file mode 100644 index 00000000000..530de6a3516 --- /dev/null +++ b/queue-5.10/selftests-resctrl-fix-compilation-issues-for-global-.patch @@ -0,0 +1,147 @@ +From a7d6dae8e08c26d46d393a37c5fa8b9b7210798d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:36 +0000 +Subject: selftests/resctrl: Fix compilation issues for global variables + +From: Fenghua Yu + +[ Upstream commit 8236c51d85a64643588505a6791e022cc8d84864 ] + +Reinette reported following compilation issue on Fedora 32, gcc version +10.1.1 + +/usr/bin/ld: cqm_test.o:/cqm_test.c:22: multiple definition of +`cache_size'; cat_test.o:/cat_test.c:23: first defined here + +The same issue is reported for long_mask, cbm_mask, count_of_bits etc +variables as well. Compiler isn't happy because these variables are +defined globally in two .c files namely cqm_test.c and cat_test.c and +the compiler during compilation finds that the variable is already +defined (multiple definition error). + +Taking a closer look at the usage of these variables reveals that these +variables are used only locally in functions such as cqm_resctrl_val() +(defined in cqm_test.c) and cat_perf_miss_val() (defined in cat_test.c). +These variables are not shared between those functions. So, there is no +need for these variables to be global. Hence, fix this issue by making +them static variables. + +Reported-by: Reinette Chatre +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/cat_test.c | 10 +++++----- + tools/testing/selftests/resctrl/cqm_test.c | 10 +++++----- + tools/testing/selftests/resctrl/resctrl.h | 2 +- + tools/testing/selftests/resctrl/resctrlfs.c | 10 +++++----- + 4 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c +index 5da43767b973..bdeeb5772592 100644 +--- a/tools/testing/selftests/resctrl/cat_test.c ++++ b/tools/testing/selftests/resctrl/cat_test.c +@@ -17,10 +17,10 @@ + #define MAX_DIFF_PERCENT 4 + #define MAX_DIFF 1000000 + +-int count_of_bits; +-char cbm_mask[256]; +-unsigned long long_mask; +-unsigned long cache_size; ++static int count_of_bits; ++static char cbm_mask[256]; ++static unsigned long long_mask; ++static unsigned long cache_size; + + /* + * Change schemata. Write schemata to specified +@@ -136,7 +136,7 @@ int cat_perf_miss_val(int cpu_no, int n, char *cache_type) + return -1; + + /* Get default cbm mask for L3/L2 cache */ +- ret = get_cbm_mask(cache_type); ++ ret = get_cbm_mask(cache_type, cbm_mask); + if (ret) + return ret; + +diff --git a/tools/testing/selftests/resctrl/cqm_test.c b/tools/testing/selftests/resctrl/cqm_test.c +index 5e7308ac63be..de33d1c0466e 100644 +--- a/tools/testing/selftests/resctrl/cqm_test.c ++++ b/tools/testing/selftests/resctrl/cqm_test.c +@@ -16,10 +16,10 @@ + #define MAX_DIFF 2000000 + #define MAX_DIFF_PERCENT 15 + +-int count_of_bits; +-char cbm_mask[256]; +-unsigned long long_mask; +-unsigned long cache_size; ++static int count_of_bits; ++static char cbm_mask[256]; ++static unsigned long long_mask; ++static unsigned long cache_size; + + static int cqm_setup(int num, ...) + { +@@ -125,7 +125,7 @@ int cqm_resctrl_val(int cpu_no, int n, char **benchmark_cmd) + if (!validate_resctrl_feature_request("cqm")) + return -1; + +- ret = get_cbm_mask("L3"); ++ ret = get_cbm_mask("L3", cbm_mask); + if (ret) + return ret; + +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index 39bf59c6b9c5..959c71e39bdc 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -92,7 +92,7 @@ void tests_cleanup(void); + void mbm_test_cleanup(void); + int mba_schemata_change(int cpu_no, char *bw_report, char **benchmark_cmd); + void mba_test_cleanup(void); +-int get_cbm_mask(char *cache_type); ++int get_cbm_mask(char *cache_type, char *cbm_mask); + int get_cache_size(int cpu_no, char *cache_type, unsigned long *cache_size); + void ctrlc_handler(int signum, siginfo_t *info, void *ptr); + int cat_val(struct resctrl_val_param *param); +diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c +index 19c0ec4045a4..2a16100c9c3f 100644 +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -49,8 +49,6 @@ static int find_resctrl_mount(char *buffer) + return -ENOENT; + } + +-char cbm_mask[256]; +- + /* + * remount_resctrlfs - Remount resctrl FS at /sys/fs/resctrl + * @mum_resctrlfs: Should the resctrl FS be remounted? +@@ -205,16 +203,18 @@ int get_cache_size(int cpu_no, char *cache_type, unsigned long *cache_size) + /* + * get_cbm_mask - Get cbm mask for given cache + * @cache_type: Cache level L2/L3 +- * +- * Mask is stored in cbm_mask which is global variable. ++ * @cbm_mask: cbm_mask returned as a string + * + * Return: = 0 on success, < 0 on failure. + */ +-int get_cbm_mask(char *cache_type) ++int get_cbm_mask(char *cache_type, char *cbm_mask) + { + char cbm_mask_path[1024]; + FILE *fp; + ++ if (!cbm_mask) ++ return -1; ++ + sprintf(cbm_mask_path, "%s/%s/cbm_mask", CBM_MASK_PATH, cache_type); + + fp = fopen(cbm_mask_path, "r"); +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-fix-compilation-issues-for-other-g.patch b/queue-5.10/selftests-resctrl-fix-compilation-issues-for-other-g.patch new file mode 100644 index 00000000000..bfc7cb7d662 --- /dev/null +++ b/queue-5.10/selftests-resctrl-fix-compilation-issues-for-other-g.patch @@ -0,0 +1,56 @@ +From c116fb78d38cb6829e860419ed5d43a9a1027978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:37 +0000 +Subject: selftests/resctrl: Fix compilation issues for other global variables + +From: Fenghua Yu + +[ Upstream commit 896016d2ad051811ff9c9c087393adc063322fbc ] + +Reinette reported following compilation issue on Fedora 32, gcc version +10.1.1 + +/usr/bin/ld: resctrl_tests.o:/resctrl.h:65: multiple definition +of `bm_pid'; cache.o:/resctrl.h:65: first defined here + +Other variables are ppid, tests_run, llc_occup_path, is_amd. Compiler +isn't happy because these variables are defined globally in two .c files +but are not declared as extern. + +To fix issues for the global variables, declare them as extern. + +Chang Log: +- Split this patch from v4's patch 1 (Shuah). + +Reported-by: Reinette Chatre +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index 959c71e39bdc..12b77182cb44 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -62,11 +62,11 @@ struct resctrl_val_param { + int (*setup)(int num, ...); + }; + +-pid_t bm_pid, ppid; +-int tests_run; ++extern pid_t bm_pid, ppid; ++extern int tests_run; + +-char llc_occup_path[1024]; +-bool is_amd; ++extern char llc_occup_path[1024]; ++extern bool is_amd; + + bool check_resctrlfs_support(void); + int filter_dmesg(void); +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-fix-incorrect-parsing-of-imc-count.patch b/queue-5.10/selftests-resctrl-fix-incorrect-parsing-of-imc-count.patch new file mode 100644 index 00000000000..dbfa9d25f72 --- /dev/null +++ b/queue-5.10/selftests-resctrl-fix-incorrect-parsing-of-imc-count.patch @@ -0,0 +1,79 @@ +From e781826ad69c6cb5995c82e5a918719c95cc2830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:53 +0000 +Subject: selftests/resctrl: Fix incorrect parsing of iMC counters + +From: Fenghua Yu + +[ Upstream commit d81343b5eedf84be71a4313e8fd073d0c510afcf ] + +iMC (Integrated Memory Controller) counters are usually at +"/sys/bus/event_source/devices/" and are named as "uncore_imc_". +num_of_imcs() function tries to count number of such iMC counters so that +it could appropriately initialize required number of perf_attr structures +that could be used to read these iMC counters. + +num_of_imcs() function assumes that all the directories under this path +that start with "uncore_imc" are iMC counters. But, on some systems there +could be directories named as "uncore_imc_free_running" which aren't iMC +counters. Trying to read from such directories will result in "not found +file" errors and MBM/MBA tests will fail. + +Hence, fix the logic in num_of_imcs() such that it looks at the first +character after "uncore_imc_" to check if it's a numerical digit or not. If +it's a digit then the directory represents an iMC counter, else, skip the +directory. + +Reported-by: Reinette Chatre +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_val.c | 22 +++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index aed71fd0713b..5478c23c62ba 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -221,8 +221,8 @@ static int read_from_imc_dir(char *imc_dir, int count) + */ + static int num_of_imcs(void) + { ++ char imc_dir[512], *temp; + unsigned int count = 0; +- char imc_dir[512]; + struct dirent *ep; + int ret; + DIR *dp; +@@ -230,7 +230,25 @@ static int num_of_imcs(void) + dp = opendir(DYN_PMU_PATH); + if (dp) { + while ((ep = readdir(dp))) { +- if (strstr(ep->d_name, UNCORE_IMC)) { ++ temp = strstr(ep->d_name, UNCORE_IMC); ++ if (!temp) ++ continue; ++ ++ /* ++ * imc counters are named as "uncore_imc_", hence ++ * increment the pointer to point to . Note that ++ * sizeof(UNCORE_IMC) would count for null character as ++ * well and hence the last underscore character in ++ * uncore_imc'_' need not be counted. ++ */ ++ temp = temp + sizeof(UNCORE_IMC); ++ ++ /* ++ * Some directories under "DYN_PMU_PATH" could have ++ * names like "uncore_imc_free_running", hence, check if ++ * first character is a numerical digit or not. ++ */ ++ if (temp[0] >= '0' && temp[0] <= '9') { + sprintf(imc_dir, "%s/%s/", DYN_PMU_PATH, + ep->d_name); + ret = read_from_imc_dir(imc_dir, count); +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-fix-missing-options-n-and-p.patch b/queue-5.10/selftests-resctrl-fix-missing-options-n-and-p.patch new file mode 100644 index 00000000000..a2f7a9d8ad3 --- /dev/null +++ b/queue-5.10/selftests-resctrl-fix-missing-options-n-and-p.patch @@ -0,0 +1,44 @@ +From d050e3a06be9ec455b55c442119892191e60f66b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:40 +0000 +Subject: selftests/resctrl: Fix missing options "-n" and "-p" + +From: Fenghua Yu + +[ Upstream commit d7af3d0d515cbdf63b6c3398a3c15ecb1bc2bd38 ] + +resctrl test suite accepts command line arguments (like -b, -t, -n and -p) +as documented in the help. But passing -n and -p throws an invalid option +error. This happens because -n and -p are missing in the list of +characters that getopt() recognizes as valid arguments. Hence, they are +treated as invalid options. + +Fix this by adding them to the list of characters that getopt() recognizes +as valid arguments. Please note that the main() function already has the +logic to deal with the values passed as part of these arguments and hence +no changes are needed there. + +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_tests.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_tests.c b/tools/testing/selftests/resctrl/resctrl_tests.c +index 4b109a59f72d..ac2269610aa9 100644 +--- a/tools/testing/selftests/resctrl/resctrl_tests.c ++++ b/tools/testing/selftests/resctrl/resctrl_tests.c +@@ -73,7 +73,7 @@ int main(int argc, char **argv) + } + } + +- while ((c = getopt(argc_new, argv, "ht:b:")) != -1) { ++ while ((c = getopt(argc_new, argv, "ht:b:n:p:")) != -1) { + char *token; + + switch (c) { +-- +2.30.2 + diff --git a/queue-5.10/selftests-resctrl-use-resctrl-info-for-feature-detec.patch b/queue-5.10/selftests-resctrl-use-resctrl-info-for-feature-detec.patch new file mode 100644 index 00000000000..743ba4c73e2 --- /dev/null +++ b/queue-5.10/selftests-resctrl-use-resctrl-info-for-feature-detec.patch @@ -0,0 +1,157 @@ +From 1aa1e155bdf4fcecfe80c48d0163fc60e12c65be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Mar 2021 02:22:47 +0000 +Subject: selftests/resctrl: Use resctrl/info for feature detection + +From: Fenghua Yu + +[ Upstream commit ee0415681eb661efa1eb2db7acc263f2c7df1e23 ] + +Resctrl test suite before running any unit test (like cmt, cat, mbm and +mba) should first check if the feature is enabled (by kernel and not just +supported by H/W) on the platform or not. +validate_resctrl_feature_request() is supposed to do that. This function +intends to grep for relevant flags in /proc/cpuinfo but there are several +issues here + +1. validate_resctrl_feature_request() calls fgrep() to get flags from + /proc/cpuinfo. But, fgrep() can only return a string with maximum of 255 + characters and hence the complete cpu flags are never returned. +2. The substring search logic is also busted. If strstr() finds requested + resctrl feature in the cpu flags, it returns pointer to the first + occurrence. But, the logic negates the return value of strstr() and + hence validate_resctrl_feature_request() returns false if the feature is + present in the cpu flags and returns true if the feature is not present. +3. validate_resctrl_feature_request() checks if a resctrl feature is + reported in /proc/cpuinfo flags or not. Having a cpu flag means that the + H/W supports the feature, but it doesn't mean that the kernel enabled + it. A user could selectively enable only a subset of resctrl features + using kernel command line arguments. Hence, /proc/cpuinfo isn't a + reliable source to check if a feature is enabled or not. + +The 3rd issue being the major one and fixing it requires changing the way +validate_resctrl_feature_request() works. Since, /proc/cpuinfo isn't the +right place to check if a resctrl feature is enabled or not, a more +appropriate place is /sys/fs/resctrl/info directory. Change +validate_resctrl_feature_request() such that, + +1. For cat, check if /sys/fs/resctrl/info/L3 directory is present or not +2. For mba, check if /sys/fs/resctrl/info/MB directory is present or not +3. For cmt, check if /sys/fs/resctrl/info/L3_MON directory is present and + check if /sys/fs/resctrl/info/L3_MON/mon_features has llc_occupancy +4. For mbm, check if /sys/fs/resctrl/info/L3_MON directory is present and + check if /sys/fs/resctrl/info/L3_MON/mon_features has + mbm__bytes + +Please note that only L3_CAT, L3_CMT, MBA and MBM are supported. CDP and L2 +variants can be added later. + +Reported-by: Reinette Chatre +Tested-by: Babu Moger +Signed-off-by: Fenghua Yu +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl.h | 6 ++- + tools/testing/selftests/resctrl/resctrlfs.c | 52 ++++++++++++++++----- + 2 files changed, 46 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h +index 36da6136af96..9dcc96e1ad3d 100644 +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -28,6 +28,10 @@ + #define RESCTRL_PATH "/sys/fs/resctrl" + #define PHYS_ID_PATH "/sys/devices/system/cpu/cpu" + #define CBM_MASK_PATH "/sys/fs/resctrl/info" ++#define L3_PATH "/sys/fs/resctrl/info/L3" ++#define MB_PATH "/sys/fs/resctrl/info/MB" ++#define L3_MON_PATH "/sys/fs/resctrl/info/L3_MON" ++#define L3_MON_FEATURES_PATH "/sys/fs/resctrl/info/L3_MON/mon_features" + + #define PARENT_EXIT(err_msg) \ + do { \ +@@ -79,7 +83,7 @@ int remount_resctrlfs(bool mum_resctrlfs); + int get_resource_id(int cpu_no, int *resource_id); + int umount_resctrlfs(void); + int validate_bw_report_request(char *bw_report); +-bool validate_resctrl_feature_request(char *resctrl_val); ++bool validate_resctrl_feature_request(const char *resctrl_val); + char *fgrep(FILE *inf, const char *str); + int taskset_benchmark(pid_t bm_pid, int cpu_no); + void run_benchmark(int signum, siginfo_t *info, void *ucontext); +diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c +index 4174e48e06d1..b57170f53861 100644 +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -616,26 +616,56 @@ char *fgrep(FILE *inf, const char *str) + * validate_resctrl_feature_request - Check if requested feature is valid. + * @resctrl_val: Requested feature + * +- * Return: 0 on success, non-zero on failure ++ * Return: True if the feature is supported, else false + */ +-bool validate_resctrl_feature_request(char *resctrl_val) ++bool validate_resctrl_feature_request(const char *resctrl_val) + { +- FILE *inf = fopen("/proc/cpuinfo", "r"); ++ struct stat statbuf; + bool found = false; + char *res; ++ FILE *inf; + +- if (!inf) ++ if (!resctrl_val) + return false; + +- res = fgrep(inf, "flags"); +- +- if (res) { +- char *s = strchr(res, ':'); ++ if (remount_resctrlfs(false)) ++ return false; + +- found = s && !strstr(s, resctrl_val); +- free(res); ++ if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { ++ if (!stat(L3_PATH, &statbuf)) ++ return true; ++ } else if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { ++ if (!stat(MB_PATH, &statbuf)) ++ return true; ++ } else if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || ++ !strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { ++ if (!stat(L3_MON_PATH, &statbuf)) { ++ inf = fopen(L3_MON_FEATURES_PATH, "r"); ++ if (!inf) ++ return false; ++ ++ if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { ++ res = fgrep(inf, "llc_occupancy"); ++ if (res) { ++ found = true; ++ free(res); ++ } ++ } ++ ++ if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) { ++ res = fgrep(inf, "mbm_total_bytes"); ++ if (res) { ++ free(res); ++ res = fgrep(inf, "mbm_local_bytes"); ++ if (res) { ++ found = true; ++ free(res); ++ } ++ } ++ } ++ fclose(inf); ++ } + } +- fclose(inf); + + return found; + } +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index d680a3b834b..f4509fa1040 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -48,3 +48,163 @@ btrfs-fix-race-between-transaction-aborts-and-fsyncs-leading-to-use-after-free.p posix-timers-preserve-return-value-in-clock_adjtime32.patch fbdev-zero-fill-colormap-in-fbcmap.c.patch cpuidle-tegra-fix-c7-idling-state-on-tegra114.patch +bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-interconnec.patch +staging-wimax-i2400m-fix-byte-order-issue.patch +spi-ath79-always-call-chipselect-function.patch +spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch +bus-mhi-core-destroy-sbl-devices-when-moving-to-miss.patch +crypto-api-check-for-err-pointers-in-crypto_destroy_.patch +crypto-qat-fix-unmap-invalid-dma-address.patch +usb-gadget-uvc-add-binterval-checking-for-hs-mode.patch +usb-webcam-invalid-size-of-processing-unit-descripto.patch +x86-sev-do-not-require-hypervisor-cpuid-bit-for-sev-.patch +x86-boot-compressed-64-check-sev-encryption-in-the-3.patch +crypto-hisilicon-sec-fixes-a-printing-error.patch +genirq-matrix-prevent-allocation-counter-corruption.patch +usb-gadget-f_uac2-validate-input-parameters.patch +usb-gadget-f_uac1-validate-input-parameters.patch +usb-dwc3-gadget-ignore-ep-queue-requests-during-bus-.patch +usb-xhci-fix-port-minor-revision.patch +kselftest-arm64-mte-fix-compilation-with-native-comp.patch +arm-tegra-acer-a500-rename-avdd-to-vdda-of-touchscre.patch +pci-pm-do-not-read-power-state-in-pci_enable_device_.patch +kselftest-arm64-mte-fix-mte-feature-detection.patch +arm-dts-bcm5301x-fix-reg-formatting-in-memory-node.patch +arm-dts-ux500-fix-up-tvk-r3-sensors.patch +x86-build-propagate-clang_flags-to-realmode_flags.patch +x86-boot-add-clang_flags-to-compressed-kbuild_cflags.patch +efi-libstub-add-clang_flags-to-x86-flags.patch +soc-tegra-pmc-fix-completion-of-power-gate-toggling.patch +arm64-dts-imx8mq-librem5-r3-mark-buck3-as-always-on.patch +tee-optee-do-not-check-memref-size-on-return-from-se.patch +soundwire-cadence-only-prepare-attached-devices-on-c.patch +perf-arm_pmu_platform-use-dev_err_probe-for-irq-erro.patch +perf-arm_pmu_platform-fix-error-handling.patch +random-initialize-chacha20-constants-with-correct-en.patch +usb-xhci-mtk-support-quirk-to-disable-usb2-lpm.patch +fpga-dfl-pci-add-did-for-d5005-pac-cards.patch +xhci-check-port-array-allocation-was-successful-befo.patch +xhci-check-control-context-is-valid-before-dereferen.patch +xhci-fix-potential-array-out-of-bounds-with-several-.patch +bus-mhi-core-clear-context-for-stopped-channels-from.patch +arm-dts-at91-change-the-key-code-of-the-gpio-key.patch +tools-power-x86-intel-speed-select-increase-string-s.patch +platform-x86-isst-account-for-increased-timeout-in-s.patch +spi-dln2-fix-reference-leak-to-master.patch +spi-omap-100k-fix-reference-leak-to-master.patch +spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch +usb-gadget-tegra-xudc-fix-possible-use-after-free-in.patch +usb-musb-fix-pm-reference-leak-in-musb_irq_work.patch +usb-core-hub-fix-pm-reference-leak-in-usb_port_resum.patch +usb-dwc3-gadget-check-for-disabled-lpm-quirk.patch +tty-n_gsm-check-error-while-registering-tty-devices.patch +intel_th-consistency-and-off-by-one-fix.patch +phy-phy-twl4030-usb-fix-possible-use-after-free-in-t.patch +crypto-sun8i-ss-fix-pm-reference-leak-when-pm_runtim.patch +crypto-sun8i-ce-fix-pm-reference-leak-in-sun8i_ce_pr.patch +crypto-stm32-hash-fix-pm-reference-leak-on-stm32-has.patch +crypto-stm32-cryp-fix-pm-reference-leak-on-stm32-cry.patch +crypto-sa2ul-fix-pm-reference-leak-in-sa_ul_probe.patch +crypto-omap-aes-fix-pm-reference-leak-on-omap-aes.c.patch +platform-x86-intel_pmc_core-don-t-use-global-pmcdev-.patch +spi-sync-up-initial-chipselect-state.patch +btrfs-do-proper-error-handling-in-create_reloc_root.patch +btrfs-do-proper-error-handling-in-btrfs_update_reloc.patch +btrfs-convert-logic-bug_on-s-in-replace_path-to-asse.patch +drm-added-orientation-quirk-for-onegx1-pro.patch +drm-qxl-do-not-run-release-if-qxl-failed-to-init.patch +drm-qxl-release-shadow-on-shutdown.patch +drm-ast-fix-invalid-usage-of-ast_max_hwc_width-in-cu.patch +drm-amd-display-changing-sr-exit-latency.patch +drm-ast-fix-memory-leak-when-unload-the-driver.patch +drm-amd-display-check-for-dsc-support-instead-of-asi.patch +drm-amd-display-don-t-optimize-bandwidth-before-disa.patch +drm-amdgpu-display-buffer-interrupt_low_irq_context-.patch +drm-amd-display-dc-dce-dce_aux-remove-duplicate-line.patch +scsi-lpfc-fix-incorrect-dbde-assignment-when-buildin.patch +scsi-lpfc-fix-pt2pt-connection-does-not-recover-afte.patch +drm-amdgpu-fix-some-unload-driver-issues.patch +sched-pelt-fix-task-util_est-update-filtering.patch +kvfree_rcu-use-same-set-of-gfp-flags-as-does-single-.patch +scsi-target-pscsi-fix-warning-in-pscsi_complete_cmd.patch +media-ite-cir-check-for-receive-overflow.patch +media-drivers-media-pci-sta2x11-fix-kconfig-dependen.patch +media-imx-capture-return-epipe-from-__capture_legacy.patch +atomisp-don-t-let-it-go-past-pipes-array.patch +power-supply-bq27xxx-fix-power_avg-for-newer-ics.patch +extcon-arizona-fix-some-issues-when-hpdet-irq-fires-.patch +extcon-arizona-fix-various-races-on-driver-unbind.patch +media-media-saa7164-fix-saa7164_encoder_register-mem.patch +media-gspca-sq905.c-fix-uninitialized-variable.patch +power-supply-use-irqf_oneshot.patch +backlight-qcom-wled-use-sink_addr-for-sync-toggle.patch +backlight-qcom-wled-fix-fsc-update-issue-for-wled5.patch +drm-amdgpu-mask-the-xgmi-number-of-hops-reported-fro.patch +drm-amdkfd-fix-ubsan-shift-out-of-bounds-warning.patch +drm-amdgpu-fix-asic-reset-regression-issue-introduce.patch +drm-amd-pm-fix-workload-mismatch-on-vega10.patch +drm-amd-display-fix-ubsan-warning-for-not-a-valid-va.patch +drm-amd-display-dchub-underflow-counter-increasing-i.patch +drm-amd-display-fix-dml-prefetch-validation.patch +scsi-qla2xxx-always-check-the-return-value-of-qla24x.patch +drm-vkms-fix-misuse-of-warn_on.patch +scsi-qla2xxx-fix-use-after-free-in-bsg.patch +mmc-sdhci-esdhc-imx-validate-pinctrl-before-use-it.patch +mmc-sdhci-pci-add-pci-ids-for-intel-lkf.patch +mmc-sdhci-brcmstb-remove-cqe-quirk.patch +ata-ahci-disable-sxs-for-hisilicon-kunpeng920.patch +drm-komeda-fix-bit-check-to-import-to-value-of-prope.patch +nvmet-return-proper-error-code-from-discovery-ctrl.patch +selftests-resctrl-enable-gcc-checks-to-detect-buffer.patch +selftests-resctrl-fix-compilation-issues-for-global-.patch +selftests-resctrl-fix-compilation-issues-for-other-g.patch +selftests-resctrl-clean-up-resctrl-features-check.patch +selftests-resctrl-fix-missing-options-n-and-p.patch +selftests-resctrl-use-resctrl-info-for-feature-detec.patch +selftests-resctrl-fix-incorrect-parsing-of-imc-count.patch +selftests-resctrl-fix-checking-for-0-for-unsigned-va.patch +power-supply-cpcap-charger-add-usleep-to-cpcap-charg.patch +s390-pci-expose-uid-uniqueness-guarantee.patch +scsi-smartpqi-use-host-wide-tag-space.patch +scsi-smartpqi-correct-request-leakage-during-reset-o.patch +scsi-smartpqi-add-new-pci-ids.patch +scsi-scsi_dh_alua-remove-check-for-asc-24h-in-alua_r.patch +media-em28xx-fix-memory-leak.patch +media-vivid-update-edid.patch +drm-msm-dp-fix-incorrect-null-check-kbot-warnings-in.patch +clk-socfpga-arria10-fix-memory-leak-of-socfpga_clk-o.patch +power-supply-generic-adc-battery-fix-possible-use-af.patch +power-supply-s3c_adc_battery-fix-possible-use-after-.patch +media-tc358743-fix-possible-use-after-free-in-tc3587.patch +media-adv7604-fix-possible-use-after-free-in-adv76xx.patch +media-i2c-adv7511-v4l2-fix-possible-use-after-free-i.patch +media-i2c-tda1997-fix-possible-use-after-free-in-tda.patch +media-i2c-adv7842-fix-possible-use-after-free-in-adv.patch +media-platform-sti-fix-runtime-pm-imbalance-in-regs_.patch +media-sun8i-di-fix-runtime-pm-imbalance-in-deinterla.patch +media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch +media-gscpa-stv06xx-fix-memory-leak.patch +sched-fair-ignore-percpu-threads-for-imbalance-pulls.patch +drm-msm-mdp5-configure-pp_sync_height-to-double-the-.patch +drm-msm-mdp5-do-not-multiply-vclk-line-count-by-100.patch +drm-amdgpu-ttm-fix-memory-leak-userptr-pages.patch +drm-radeon-ttm-fix-memory-leak-userptr-pages.patch +drm-amd-display-fix-debugfs-link_settings-entry.patch +drm-amd-display-fix-ubsan-shift-out-of-bounds-warnin.patch +drm-amdkfd-fix-cat-debugfs-hang_hws-file-causes-syst.patch +amdgpu-avoid-incorrect-hu-format-string.patch +drm-amd-display-try-ycbcr420-color-when-ycbcr444-fai.patch +drm-amdgpu-fix-null-pointer-dereference.patch +scsi-lpfc-fix-crash-when-a-reg_rpi-mailbox-fails-tri.patch +scsi-lpfc-fix-error-handling-for-mailboxes-completed.patch +scsi-lpfc-remove-unsupported-mbox-port_capabilities-.patch +mfd-intel-m10-bmc-fix-the-register-access-range.patch +mfd-da9063-support-smbus-and-i2c-mode.patch +mfd-arizona-fix-rumtime-pm-imbalance-on-error.patch +scsi-libfc-fix-a-format-specifier.patch +perf-rework-perf_event_exit_event.patch +sched-fair-alternative-sched_slice.patch +block-rnbd-clt-fix-missing-a-memory-free-when-unload.patch +s390-archrandom-add-parameter-check-for-s390_arch_ra.patch +sched-psi-handle-potential-task-count-underflow-bugs.patch +power-supply-cpcap-battery-fix-invalid-usage-of-list.patch diff --git a/queue-5.10/soc-tegra-pmc-fix-completion-of-power-gate-toggling.patch b/queue-5.10/soc-tegra-pmc-fix-completion-of-power-gate-toggling.patch new file mode 100644 index 00000000000..4e3318c350e --- /dev/null +++ b/queue-5.10/soc-tegra-pmc-fix-completion-of-power-gate-toggling.patch @@ -0,0 +1,177 @@ +From 18042db7471d7e70c0a62e49a691d1aafcea5e79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 15:24:59 +0300 +Subject: soc/tegra: pmc: Fix completion of power-gate toggling + +From: Dmitry Osipenko + +[ Upstream commit c45e66a6b9f40f2e95bc6d97fbf3daa1ebe88c6b ] + +The SW-initiated power gate toggling is dropped by PMC if there is +contention with a HW-initiated toggling, i.e. when one of CPU cores is +gated by cpuidle driver. Software should retry the toggling after 10 +microseconds on Tegra20/30 SoCs, hence add the retrying. On Tegra114+ the +toggling method was changed in hardware, the TOGGLE_START bit indicates +whether PMC is busy or could accept the command to toggle, hence handle +that bit properly. + +The problem pops up after enabling dynamic power gating of 3D hardware, +where 3D power domain fails to turn on/off "randomly". + +The programming sequence and quirks are documented in TRMs, but PMC +driver obliviously re-used the Tegra20 logic for Tegra30+, which strikes +back now. The 10 microseconds and other timeouts aren't documented in TRM, +they are taken from downstream kernel. + +Link: https://nv-tegra.nvidia.com/gitweb/?p=linux-2.6.git;a=commit;h=311dd1c318b70e93bcefec15456a10ff2b9eb0ff +Link: https://nv-tegra.nvidia.com/gitweb/?p=linux-3.10.git;a=commit;h=7f36693c47cb23730a6b2822e0975be65fb0c51d +Tested-by: Peter Geis # Ouya T30 +Tested-by: Nicolas Chauvet # PAZ00 T20 and TK1 T124 +Tested-by: Matt Merhar # Ouya T30 +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/soc/tegra/pmc.c | 70 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 65 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c +index df9a5ca8c99c..0118bd986f90 100644 +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -317,6 +317,8 @@ struct tegra_pmc_soc { + bool invert); + int (*irq_set_wake)(struct irq_data *data, unsigned int on); + int (*irq_set_type)(struct irq_data *data, unsigned int type); ++ int (*powergate_set)(struct tegra_pmc *pmc, unsigned int id, ++ bool new_state); + + const char * const *reset_sources; + unsigned int num_reset_sources; +@@ -517,6 +519,63 @@ static int tegra_powergate_lookup(struct tegra_pmc *pmc, const char *name) + return -ENODEV; + } + ++static int tegra20_powergate_set(struct tegra_pmc *pmc, unsigned int id, ++ bool new_state) ++{ ++ unsigned int retries = 100; ++ bool status; ++ int ret; ++ ++ /* ++ * As per TRM documentation, the toggle command will be dropped by PMC ++ * if there is contention with a HW-initiated toggling (i.e. CPU core ++ * power-gated), the command should be retried in that case. ++ */ ++ do { ++ tegra_pmc_writel(pmc, PWRGATE_TOGGLE_START | id, PWRGATE_TOGGLE); ++ ++ /* wait for PMC to execute the command */ ++ ret = readx_poll_timeout(tegra_powergate_state, id, status, ++ status == new_state, 1, 10); ++ } while (ret == -ETIMEDOUT && retries--); ++ ++ return ret; ++} ++ ++static inline bool tegra_powergate_toggle_ready(struct tegra_pmc *pmc) ++{ ++ return !(tegra_pmc_readl(pmc, PWRGATE_TOGGLE) & PWRGATE_TOGGLE_START); ++} ++ ++static int tegra114_powergate_set(struct tegra_pmc *pmc, unsigned int id, ++ bool new_state) ++{ ++ bool status; ++ int err; ++ ++ /* wait while PMC power gating is contended */ ++ err = readx_poll_timeout(tegra_powergate_toggle_ready, pmc, status, ++ status == true, 1, 100); ++ if (err) ++ return err; ++ ++ tegra_pmc_writel(pmc, PWRGATE_TOGGLE_START | id, PWRGATE_TOGGLE); ++ ++ /* wait for PMC to accept the command */ ++ err = readx_poll_timeout(tegra_powergate_toggle_ready, pmc, status, ++ status == true, 1, 100); ++ if (err) ++ return err; ++ ++ /* wait for PMC to execute the command */ ++ err = readx_poll_timeout(tegra_powergate_state, id, status, ++ status == new_state, 10, 100000); ++ if (err) ++ return err; ++ ++ return 0; ++} ++ + /** + * tegra_powergate_set() - set the state of a partition + * @pmc: power management controller +@@ -526,7 +585,6 @@ static int tegra_powergate_lookup(struct tegra_pmc *pmc, const char *name) + static int tegra_powergate_set(struct tegra_pmc *pmc, unsigned int id, + bool new_state) + { +- bool status; + int err; + + if (id == TEGRA_POWERGATE_3D && pmc->soc->has_gpu_clamps) +@@ -539,10 +597,7 @@ static int tegra_powergate_set(struct tegra_pmc *pmc, unsigned int id, + return 0; + } + +- tegra_pmc_writel(pmc, PWRGATE_TOGGLE_START | id, PWRGATE_TOGGLE); +- +- err = readx_poll_timeout(tegra_powergate_state, id, status, +- status == new_state, 10, 100000); ++ err = pmc->soc->powergate_set(pmc, id, new_state); + + mutex_unlock(&pmc->powergates_lock); + +@@ -2699,6 +2754,7 @@ static const struct tegra_pmc_soc tegra20_pmc_soc = { + .regs = &tegra20_pmc_regs, + .init = tegra20_pmc_init, + .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, ++ .powergate_set = tegra20_powergate_set, + .reset_sources = NULL, + .num_reset_sources = 0, + .reset_levels = NULL, +@@ -2757,6 +2813,7 @@ static const struct tegra_pmc_soc tegra30_pmc_soc = { + .regs = &tegra20_pmc_regs, + .init = tegra20_pmc_init, + .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, ++ .powergate_set = tegra20_powergate_set, + .reset_sources = tegra30_reset_sources, + .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), + .reset_levels = NULL, +@@ -2811,6 +2868,7 @@ static const struct tegra_pmc_soc tegra114_pmc_soc = { + .regs = &tegra20_pmc_regs, + .init = tegra20_pmc_init, + .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, ++ .powergate_set = tegra114_powergate_set, + .reset_sources = tegra30_reset_sources, + .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), + .reset_levels = NULL, +@@ -2925,6 +2983,7 @@ static const struct tegra_pmc_soc tegra124_pmc_soc = { + .regs = &tegra20_pmc_regs, + .init = tegra20_pmc_init, + .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, ++ .powergate_set = tegra114_powergate_set, + .reset_sources = tegra30_reset_sources, + .num_reset_sources = ARRAY_SIZE(tegra30_reset_sources), + .reset_levels = NULL, +@@ -3048,6 +3107,7 @@ static const struct tegra_pmc_soc tegra210_pmc_soc = { + .regs = &tegra20_pmc_regs, + .init = tegra20_pmc_init, + .setup_irq_polarity = tegra20_pmc_setup_irq_polarity, ++ .powergate_set = tegra114_powergate_set, + .irq_set_wake = tegra210_pmc_irq_set_wake, + .irq_set_type = tegra210_pmc_irq_set_type, + .reset_sources = tegra210_reset_sources, +-- +2.30.2 + diff --git a/queue-5.10/soundwire-cadence-only-prepare-attached-devices-on-c.patch b/queue-5.10/soundwire-cadence-only-prepare-attached-devices-on-c.patch new file mode 100644 index 00000000000..e0b950fa30a --- /dev/null +++ b/queue-5.10/soundwire-cadence-only-prepare-attached-devices-on-c.patch @@ -0,0 +1,58 @@ +From 0be5a959b52464b6adfdfc93418b320c1496061d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 09:37:07 +0800 +Subject: soundwire: cadence: only prepare attached devices on clock stop + +From: Pierre-Louis Bossart + +[ Upstream commit 58ef9356260c291a4321e07ff507f31a1d8212af ] + +We sometimes see COMMAND_IGNORED responses during the clock stop +sequence. It turns out we already have information if devices are +present on a link, so we should only prepare those when they +are attached. + +In addition, even when COMMAND_IGNORED are received, we should still +proceed with the clock stop. The device will not be prepared but +that's not a problem. + +The only case where the clock stop will fail is if the Cadence IP +reports an error (including a timeout), or if the devices throw a +COMMAND_FAILED response. + +BugLink: https://github.com/thesofproject/linux/issues/2621 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Reviewed-by: Guennadi Liakhovetski +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20210323013707.21455-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index 580660599f46..c6d421a4b91b 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -1449,10 +1449,12 @@ int sdw_cdns_clock_stop(struct sdw_cdns *cdns, bool block_wake) + } + + /* Prepare slaves for clock stop */ +- ret = sdw_bus_prep_clk_stop(&cdns->bus); +- if (ret < 0) { +- dev_err(cdns->dev, "prepare clock stop failed %d", ret); +- return ret; ++ if (slave_present) { ++ ret = sdw_bus_prep_clk_stop(&cdns->bus); ++ if (ret < 0 && ret != -ENODATA) { ++ dev_err(cdns->dev, "prepare clock stop failed %d\n", ret); ++ return ret; ++ } + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/spi-ath79-always-call-chipselect-function.patch b/queue-5.10/spi-ath79-always-call-chipselect-function.patch new file mode 100644 index 00000000000..f166dfdce3b --- /dev/null +++ b/queue-5.10/spi-ath79-always-call-chipselect-function.patch @@ -0,0 +1,39 @@ +From bffae651e9976924224a3b285ff0d8de6454409d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 17:08:36 +0100 +Subject: spi: ath79: always call chipselect function + +From: David Bauer + +[ Upstream commit 19e2132174583beb90c1bd3e9c842bc6d5c944d1 ] + +spi-bitbang has to call the chipselect function on the ath79 SPI driver +in order to communicate with the SPI slave device, as the ath79 SPI +driver has three dedicated chipselect lines but can also be used with +GPIOs for the CS lines. + +Fixes commit 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional") + +Signed-off-by: David Bauer +Link: https://lore.kernel.org/r/20210303160837.165771-1-mail@david-bauer.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-ath79.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c +index eb9a243e9526..436327fb58de 100644 +--- a/drivers/spi/spi-ath79.c ++++ b/drivers/spi/spi-ath79.c +@@ -158,6 +158,7 @@ static int ath79_spi_probe(struct platform_device *pdev) + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32); + master->setup = spi_bitbang_setup; + master->cleanup = spi_bitbang_cleanup; ++ master->flags = SPI_MASTER_GPIO_SS; + if (pdata) { + master->bus_num = pdata->bus_num; + master->num_chipselect = pdata->num_chipselect; +-- +2.30.2 + diff --git a/queue-5.10/spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch b/queue-5.10/spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch new file mode 100644 index 00000000000..a9fe45f02a0 --- /dev/null +++ b/queue-5.10/spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch @@ -0,0 +1,41 @@ +From fc6aed5b4087bca37b247488ea11148f4965a821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 17:08:37 +0100 +Subject: spi: ath79: remove spi-master setup and cleanup assignment + +From: David Bauer + +[ Upstream commit ffb597b2bd3cd78b9bfb68f536743cd46dbb2cc4 ] + +This removes the assignment of setup and cleanup functions for the ath79 +target. Assigning the setup-method will lead to 'setup_transfer' not +being assigned in spi_bitbang_init. Because of this, performing any +TX/RX operation will lead to a kernel oops. + +Also drop the redundant cleanup assignment, as it's also assigned in +spi_bitbang_init. + +Signed-off-by: David Bauer +Link: https://lore.kernel.org/r/20210303160837.165771-2-mail@david-bauer.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-ath79.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c +index 436327fb58de..98ace748cd98 100644 +--- a/drivers/spi/spi-ath79.c ++++ b/drivers/spi/spi-ath79.c +@@ -156,8 +156,6 @@ static int ath79_spi_probe(struct platform_device *pdev) + + master->use_gpio_descriptors = true; + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32); +- master->setup = spi_bitbang_setup; +- master->cleanup = spi_bitbang_cleanup; + master->flags = SPI_MASTER_GPIO_SS; + if (pdata) { + master->bus_num = pdata->bus_num; +-- +2.30.2 + diff --git a/queue-5.10/spi-dln2-fix-reference-leak-to-master.patch b/queue-5.10/spi-dln2-fix-reference-leak-to-master.patch new file mode 100644 index 00000000000..0c3e49bd23c --- /dev/null +++ b/queue-5.10/spi-dln2-fix-reference-leak-to-master.patch @@ -0,0 +1,40 @@ +From e70bffea36ea427aa543045d78798b057a55f986 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 08:29:55 +0000 +Subject: spi: dln2: Fix reference leak to master + +From: Wei Yongjun + +[ Upstream commit 9b844b087124c1538d05f40fda8a4fec75af55be ] + +Call spi_master_get() holds the reference count to master device, thus +we need an additional spi_master_put() call to reduce the reference +count, otherwise we will leak a reference to master. + +This commit fix it by removing the unnecessary spi_master_get(). + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210409082955.2907950-1-weiyongjun1@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-dln2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c +index 75b33d7d14b0..9a4d942fafcf 100644 +--- a/drivers/spi/spi-dln2.c ++++ b/drivers/spi/spi-dln2.c +@@ -780,7 +780,7 @@ exit_free_master: + + static int dln2_spi_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct dln2_spi *dln2 = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +-- +2.30.2 + diff --git a/queue-5.10/spi-omap-100k-fix-reference-leak-to-master.patch b/queue-5.10/spi-omap-100k-fix-reference-leak-to-master.patch new file mode 100644 index 00000000000..51c5c144650 --- /dev/null +++ b/queue-5.10/spi-omap-100k-fix-reference-leak-to-master.patch @@ -0,0 +1,58 @@ +From 4dfd6ead81f1bc3bcf7b5da50b2792c510613621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 08:29:54 +0000 +Subject: spi: omap-100k: Fix reference leak to master + +From: Wei Yongjun + +[ Upstream commit a23faea76d4cf5f75decb574491e66f9ecd707e7 ] + +Call spi_master_get() holds the reference count to master device, thus +we need an additional spi_master_put() call to reduce the reference +count, otherwise we will leak a reference to master. + +This commit fix it by removing the unnecessary spi_master_get(). + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210409082954.2906933-1-weiyongjun1@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap-100k.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index 36a4922a134a..ccd817ee4917 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -424,7 +424,7 @@ err: + + static int omap1_spi100k_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +@@ -438,7 +438,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev) + #ifdef CONFIG_PM + static int omap1_spi100k_runtime_suspend(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + clk_disable_unprepare(spi100k->ick); +@@ -449,7 +449,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev) + + static int omap1_spi100k_runtime_resume(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + int ret; + +-- +2.30.2 + diff --git a/queue-5.10/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch b/queue-5.10/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch new file mode 100644 index 00000000000..3b8f4e3b6f8 --- /dev/null +++ b/queue-5.10/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch @@ -0,0 +1,40 @@ +From f7bc9fb7e3a27079116d08640ca405f44749321a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 09:54:58 +0000 +Subject: spi: qup: fix PM reference leak in spi_qup_remove() + +From: Wang Li + +[ Upstream commit cec77e0a249892ceb10061bf17b63f9fb111d870 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Wang Li +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20210409095458.29921-1-wangli74@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 8dcb2e70735c..d39dec6d1c91 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1263,7 +1263,7 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/spi-sync-up-initial-chipselect-state.patch b/queue-5.10/spi-sync-up-initial-chipselect-state.patch new file mode 100644 index 00000000000..9e6082ce7f8 --- /dev/null +++ b/queue-5.10/spi-sync-up-initial-chipselect-state.patch @@ -0,0 +1,101 @@ +From 1534b9cac3b99a7f5564c8f27e261a0dd4e32b21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 21:59:56 +0200 +Subject: spi: sync up initial chipselect state + +From: David Bauer + +[ Upstream commit d347b4aaa1a042ea528e385d9070b74c77a14321 ] + +When initially probing the SPI slave device, the call for disabling an +SPI device without the SPI_CS_HIGH flag is not applied, as the +condition for checking whether or not the state to be applied equals the +one currently set evaluates to true. + +This however might not necessarily be the case, as the chipselect might +be active. + +Add a force flag to spi_set_cs which allows to override this +early exit condition. Set it to false everywhere except when called +from spi_setup to sync up the initial CS state. + +Fixes commit d40f0b6f2e21 ("spi: Avoid setting the chip select if we don't +need to") + +Signed-off-by: David Bauer +Link: https://lore.kernel.org/r/20210416195956.121811-1-mail@david-bauer.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 4257a2d368f7..1eee8b3c1b38 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -787,7 +787,7 @@ int spi_register_board_info(struct spi_board_info const *info, unsigned n) + + /*-------------------------------------------------------------------------*/ + +-static void spi_set_cs(struct spi_device *spi, bool enable) ++static void spi_set_cs(struct spi_device *spi, bool enable, bool force) + { + bool enable1 = enable; + +@@ -795,7 +795,7 @@ static void spi_set_cs(struct spi_device *spi, bool enable) + * Avoid calling into the driver (or doing delays) if the chip select + * isn't actually changing from the last time this was called. + */ +- if ((spi->controller->last_cs_enable == enable) && ++ if (!force && (spi->controller->last_cs_enable == enable) && + (spi->controller->last_cs_mode_high == (spi->mode & SPI_CS_HIGH))) + return; + +@@ -1243,7 +1243,7 @@ static int spi_transfer_one_message(struct spi_controller *ctlr, + struct spi_statistics *statm = &ctlr->statistics; + struct spi_statistics *stats = &msg->spi->statistics; + +- spi_set_cs(msg->spi, true); ++ spi_set_cs(msg->spi, true, false); + + SPI_STATISTICS_INCREMENT_FIELD(statm, messages); + SPI_STATISTICS_INCREMENT_FIELD(stats, messages); +@@ -1311,9 +1311,9 @@ fallback_pio: + &msg->transfers)) { + keep_cs = true; + } else { +- spi_set_cs(msg->spi, false); ++ spi_set_cs(msg->spi, false, false); + _spi_transfer_cs_change_delay(msg, xfer); +- spi_set_cs(msg->spi, true); ++ spi_set_cs(msg->spi, true, false); + } + } + +@@ -1322,7 +1322,7 @@ fallback_pio: + + out: + if (ret != 0 || !keep_cs) +- spi_set_cs(msg->spi, false); ++ spi_set_cs(msg->spi, false, false); + + if (msg->status == -EINPROGRESS) + msg->status = ret; +@@ -3400,11 +3400,11 @@ int spi_setup(struct spi_device *spi) + */ + status = 0; + +- spi_set_cs(spi, false); ++ spi_set_cs(spi, false, true); + pm_runtime_mark_last_busy(spi->controller->dev.parent); + pm_runtime_put_autosuspend(spi->controller->dev.parent); + } else { +- spi_set_cs(spi, false); ++ spi_set_cs(spi, false, true); + } + + mutex_unlock(&spi->controller->io_mutex); +-- +2.30.2 + diff --git a/queue-5.10/staging-wimax-i2400m-fix-byte-order-issue.patch b/queue-5.10/staging-wimax-i2400m-fix-byte-order-issue.patch new file mode 100644 index 00000000000..552b5dc103d --- /dev/null +++ b/queue-5.10/staging-wimax-i2400m-fix-byte-order-issue.patch @@ -0,0 +1,36 @@ +From 3bad1b4dc16a99d7e543fd89850fc45323f14f1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Feb 2021 21:01:05 +0530 +Subject: staging: wimax/i2400m: fix byte-order issue + +From: karthik alapati + +[ Upstream commit 0c37baae130df39b19979bba88bde2ee70a33355 ] + +fix sparse byte-order warnings by converting host byte-order +type to __le16 byte-order types before assigning to hdr.length + +Signed-off-by: karthik alapati +Link: https://lore.kernel.org/r/0ae5c5c4c646506d8be871e7be5705542671a1d5.1613921277.git.mail@karthek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wimax/i2400m/op-rfkill.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c +index 5c79f052cad2..34f81f16b5a0 100644 +--- a/drivers/net/wimax/i2400m/op-rfkill.c ++++ b/drivers/net/wimax/i2400m/op-rfkill.c +@@ -86,7 +86,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, + if (cmd == NULL) + goto error_alloc; + cmd->hdr.type = cpu_to_le16(I2400M_MT_CMD_RF_CONTROL); +- cmd->hdr.length = sizeof(cmd->sw_rf); ++ cmd->hdr.length = cpu_to_le16(sizeof(cmd->sw_rf)); + cmd->hdr.version = cpu_to_le16(I2400M_L3L4_VERSION); + cmd->sw_rf.hdr.type = cpu_to_le16(I2400M_TLV_RF_OPERATION); + cmd->sw_rf.hdr.length = cpu_to_le16(sizeof(cmd->sw_rf.status)); +-- +2.30.2 + diff --git a/queue-5.10/tee-optee-do-not-check-memref-size-on-return-from-se.patch b/queue-5.10/tee-optee-do-not-check-memref-size-on-return-from-se.patch new file mode 100644 index 00000000000..e8c33c5e059 --- /dev/null +++ b/queue-5.10/tee-optee-do-not-check-memref-size-on-return-from-se.patch @@ -0,0 +1,54 @@ +From bb25515b3bda6f43268675305d918c2db0aadefa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 11:40:37 +0100 +Subject: tee: optee: do not check memref size on return from Secure World + +From: Jerome Forissier + +[ Upstream commit c650b8dc7a7910eb25af0aac1720f778b29e679d ] + +When Secure World returns, it may have changed the size attribute of the +memory references passed as [in/out] parameters. The GlobalPlatform TEE +Internal Core API specification does not restrict the values that this +size can take. In particular, Secure World may increase the value to be +larger than the size of the input buffer to indicate that it needs more. + +Therefore, the size check in optee_from_msg_param() is incorrect and +needs to be removed. This fixes a number of failed test cases in the +GlobalPlatform TEE Initial Configuratiom Test Suite v2_0_0_0-2017_06_09 +when OP-TEE is compiled without dynamic shared memory support +(CFG_CORE_DYN_SHM=n). + +Reviewed-by: Sumit Garg +Suggested-by: Jens Wiklander +Signed-off-by: Jerome Forissier +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/core.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c +index cf4718c6d35d..63542c1cc291 100644 +--- a/drivers/tee/optee/core.c ++++ b/drivers/tee/optee/core.c +@@ -79,16 +79,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params, + return rc; + p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa; + p->u.memref.shm = shm; +- +- /* Check that the memref is covered by the shm object */ +- if (p->u.memref.size) { +- size_t o = p->u.memref.shm_offs + +- p->u.memref.size - 1; +- +- rc = tee_shm_get_pa(shm, o, NULL); +- if (rc) +- return rc; +- } + break; + case OPTEE_MSG_ATTR_TYPE_RMEM_INPUT: + case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT: +-- +2.30.2 + diff --git a/queue-5.10/tools-power-x86-intel-speed-select-increase-string-s.patch b/queue-5.10/tools-power-x86-intel-speed-select-increase-string-s.patch new file mode 100644 index 00000000000..6cd8f889adc --- /dev/null +++ b/queue-5.10/tools-power-x86-intel-speed-select-increase-string-s.patch @@ -0,0 +1,76 @@ +From c5aa5f5b80d0df735c3c3cfbdd25c4f9f54a33a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:31:49 -0800 +Subject: tools/power/x86/intel-speed-select: Increase string size + +From: Srinivas Pandruvada + +[ Upstream commit 2e70b710f36c80b6e78cf32a5c30b46dbb72213c ] + +The current string size to print cpulist can accommodate upto 80 +logical CPUs per package. But this limit is not enough. So increase +the string size. Also prevent buffer overflow, if the string size +reaches limit. + +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + tools/power/x86/intel-speed-select/isst-display.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/tools/power/x86/intel-speed-select/isst-display.c b/tools/power/x86/intel-speed-select/isst-display.c +index e105fece47b6..f32ce0362eb7 100644 +--- a/tools/power/x86/intel-speed-select/isst-display.c ++++ b/tools/power/x86/intel-speed-select/isst-display.c +@@ -25,10 +25,14 @@ static void printcpulist(int str_len, char *str, int mask_size, + index = snprintf(&str[curr_index], + str_len - curr_index, ","); + curr_index += index; ++ if (curr_index >= str_len) ++ break; + } + index = snprintf(&str[curr_index], str_len - curr_index, "%d", + i); + curr_index += index; ++ if (curr_index >= str_len) ++ break; + first = 0; + } + } +@@ -64,10 +68,14 @@ static void printcpumask(int str_len, char *str, int mask_size, + index = snprintf(&str[curr_index], str_len - curr_index, "%08x", + mask[i]); + curr_index += index; ++ if (curr_index >= str_len) ++ break; + if (i) { + strncat(&str[curr_index], ",", str_len - curr_index); + curr_index++; + } ++ if (curr_index >= str_len) ++ break; + } + + free(mask); +@@ -185,7 +193,7 @@ static void _isst_pbf_display_information(int cpu, FILE *outf, int level, + int disp_level) + { + char header[256]; +- char value[256]; ++ char value[512]; + + snprintf(header, sizeof(header), "speed-select-base-freq-properties"); + format_and_print(outf, disp_level, header, NULL); +@@ -349,7 +357,7 @@ void isst_ctdp_display_information(int cpu, FILE *outf, int tdp_level, + struct isst_pkg_ctdp *pkg_dev) + { + char header[256]; +- char value[256]; ++ char value[512]; + static int level; + int i; + +-- +2.30.2 + diff --git a/queue-5.10/tty-n_gsm-check-error-while-registering-tty-devices.patch b/queue-5.10/tty-n_gsm-check-error-while-registering-tty-devices.patch new file mode 100644 index 00000000000..6528738e347 --- /dev/null +++ b/queue-5.10/tty-n_gsm-check-error-while-registering-tty-devices.patch @@ -0,0 +1,101 @@ +From a5d4fd2319123602bcf16dd9a48f55acfb8e3447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 11:57:58 +0800 +Subject: tty: n_gsm: check error while registering tty devices + +From: Hillf Danton + +[ Upstream commit 0a360e8b65d62fe1a994f0a8da4f8d20877b2100 ] + +Add the error path for registering tty devices and roll back in case of error +in bid to avoid the UAF like the below one reported. + +Plus syzbot reported general protection fault in cdev_del() on Sep 24, 2020 +and both cases are down to the kobject_put() in tty_cdev_add(). + + ------------[ cut here ]------------ + refcount_t: underflow; use-after-free. + WARNING: CPU: 1 PID: 8923 at lib/refcount.c:28 + refcount_warn_saturate+0x1cf/0x210 -origin/lib/refcount.c:28 + Modules linked in: + CPU: 1 PID: 8923 Comm: executor Not tainted 5.12.0-rc5+ #8 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS + 1.13.0-1ubuntu1.1 04/01/2014 + RIP: 0010:refcount_warn_saturate+0x1cf/0x210 -origin/lib/refcount.c:28 + Code: 4f ff ff ff e8 32 fa b5 fe 48 c7 c7 3d f8 f6 86 e8 d6 ab c6 fe + c6 05 7c 34 67 04 01 48 c7 c7 68 f8 6d 86 31 c0 e8 81 2e 9d fe <0f> 0b + e9 22 ff ff ff e8 05 fa b5 fe 48 c7 c7 3e f8 f6 86 e8 a9 ab + RSP: 0018:ffffc90001633c60 EFLAGS: 00010246 + RAX: 15d08b2e34b77800 RBX: 0000000000000003 RCX: ffff88804c056c80 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: 0000000000000003 R08: ffffffff813767aa R09: 0001ffffffffffff + R10: 0001ffffffffffff R11: ffff88804c056c80 R12: ffff888040b7d000 + R13: ffff88804c206938 R14: ffff88804c206900 R15: ffff888041b18488 + FS: 00000000022c9940(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f9f9b122008 CR3: 0000000044b4b000 CR4: 0000000000750ee0 + PKRU: 55555554 + Call Trace: + __refcount_sub_and_test -origin/./include/linux/refcount.h:283 [inline] + __refcount_dec_and_test -origin/./include/linux/refcount.h:315 [inline] + refcount_dec_and_test -origin/./include/linux/refcount.h:333 [inline] + kref_put -origin/./include/linux/kref.h:64 [inline] + kobject_put+0x17b/0x180 -origin/lib/kobject.c:753 + cdev_del+0x4b/0x50 -origin/fs/char_dev.c:597 + tty_unregister_device+0x99/0xd0 -origin/drivers/tty/tty_io.c:3343 + gsmld_detach_gsm -origin/drivers/tty/n_gsm.c:2409 [inline] + gsmld_close+0x6c/0x140 -origin/drivers/tty/n_gsm.c:2478 + tty_ldisc_close -origin/drivers/tty/tty_ldisc.c:488 [inline] + tty_ldisc_kill -origin/drivers/tty/tty_ldisc.c:636 [inline] + tty_ldisc_release+0x1b6/0x400 -origin/drivers/tty/tty_ldisc.c:809 + tty_release_struct+0x19/0xb0 -origin/drivers/tty/tty_io.c:1714 + tty_release+0x9ad/0xa00 -origin/drivers/tty/tty_io.c:1885 + __fput+0x260/0x4e0 -origin/fs/file_table.c:280 + ____fput+0x11/0x20 -origin/fs/file_table.c:313 + task_work_run+0x8e/0x110 -origin/kernel/task_work.c:140 + tracehook_notify_resume -origin/./include/linux/tracehook.h:189 [inline] + exit_to_user_mode_loop -origin/kernel/entry/common.c:174 [inline] + exit_to_user_mode_prepare+0x16b/0x1a0 -origin/kernel/entry/common.c:208 + __syscall_exit_to_user_mode_work -origin/kernel/entry/common.c:290 [inline] + syscall_exit_to_user_mode+0x20/0x40 -origin/kernel/entry/common.c:301 + do_syscall_64+0x45/0x80 -origin/arch/x86/entry/common.c:56 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Reported-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com +Reported-and-tested-by: Hao Sun +Signed-off-by: Hillf Danton +Link: https://lore.kernel.org/r/20210412035758.1974-1-hdanton@sina.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index fea1eeac5b90..d76880ae68c8 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2382,8 +2382,18 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm) + /* Don't register device 0 - this is the control channel and not + a usable tty interface */ + base = mux_num_to_base(gsm); /* Base for this MUX */ +- for (i = 1; i < NUM_DLCI; i++) +- tty_register_device(gsm_tty_driver, base + i, NULL); ++ for (i = 1; i < NUM_DLCI; i++) { ++ struct device *dev; ++ ++ dev = tty_register_device(gsm_tty_driver, ++ base + i, NULL); ++ if (IS_ERR(dev)) { ++ for (i--; i >= 1; i--) ++ tty_unregister_device(gsm_tty_driver, ++ base + i); ++ return PTR_ERR(dev); ++ } ++ } + } + return ret; + } +-- +2.30.2 + diff --git a/queue-5.10/usb-core-hub-fix-pm-reference-leak-in-usb_port_resum.patch b/queue-5.10/usb-core-hub-fix-pm-reference-leak-in-usb_port_resum.patch new file mode 100644 index 00000000000..fe993dbe556 --- /dev/null +++ b/queue-5.10/usb-core-hub-fix-pm-reference-leak-in-usb_port_resum.patch @@ -0,0 +1,39 @@ +From 8b55a7a96927ece0df952e2ceae1967c4f2a9a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 21:08:31 +0800 +Subject: usb: core: hub: Fix PM reference leak in usb_port_resume() + +From: Bixuan Cui + +[ Upstream commit 025f97d188006eeee4417bb475a6878d1e0eed3f ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +thus a pairing decrement is needed. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Link: https://lore.kernel.org/r/20210408130831.56239-1-cuibixuan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 17202b2ee063..22a86ae4f639 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3555,7 +3555,7 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + u16 portchange, portstatus; + + if (!test_and_set_bit(port1, hub->child_usage_bits)) { +- status = pm_runtime_get_sync(&port_dev->dev); ++ status = pm_runtime_resume_and_get(&port_dev->dev); + if (status < 0) { + dev_dbg(&udev->dev, "can't resume usb port, status %d\n", + status); +-- +2.30.2 + diff --git a/queue-5.10/usb-dwc3-gadget-check-for-disabled-lpm-quirk.patch b/queue-5.10/usb-dwc3-gadget-check-for-disabled-lpm-quirk.patch new file mode 100644 index 00000000000..7ae1a23b0bf --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-check-for-disabled-lpm-quirk.patch @@ -0,0 +1,95 @@ +From 8feea5c0d0bf8435e6c99378f308c1702d4cf85e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 19:13:18 -0700 +Subject: usb: dwc3: gadget: Check for disabled LPM quirk + +From: Thinh Nguyen + +[ Upstream commit 475e8be53d0496f9bc6159f4abb3ff5f9b90e8de ] + +If the device doesn't support LPM, make sure to disable the LPM +capability and don't advertise to the host that it supports it. + +Acked-by: Felipe Balbi +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/9e68527ff932b1646f92a7593d4092a903754666.1618366071.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 2 ++ + drivers/usb/dwc3/core.h | 4 +++- + drivers/usb/dwc3/gadget.c | 9 ++++++++- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 3101f0dcf6ae..1ffeb00b9391 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1297,6 +1297,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) + "snps,usb3_lpm_capable"); + dwc->usb2_lpm_disable = device_property_read_bool(dev, + "snps,usb2-lpm-disable"); ++ dwc->usb2_gadget_lpm_disable = device_property_read_bool(dev, ++ "snps,usb2-gadget-lpm-disable"); + device_property_read_u8(dev, "snps,rx-thr-num-pkt-prd", + &rx_thr_num_pkt_prd); + device_property_read_u8(dev, "snps,rx-max-burst-prd", +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 1b241f937d8f..575a93b4f120 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -1026,7 +1026,8 @@ struct dwc3_scratchpad_array { + * @dis_start_transfer_quirk: set if start_transfer failure SW workaround is + * not needed for DWC_usb31 version 1.70a-ea06 and below + * @usb3_lpm_capable: set if hadrware supports Link Power Management +- * @usb2_lpm_disable: set to disable usb2 lpm ++ * @usb2_lpm_disable: set to disable usb2 lpm for host ++ * @usb2_gadget_lpm_disable: set to disable usb2 lpm for gadget + * @disable_scramble_quirk: set if we enable the disable scramble quirk + * @u2exit_lfps_quirk: set if we enable u2exit lfps quirk + * @u2ss_inp3_quirk: set if we enable P3 OK for U2/SS Inactive quirk +@@ -1227,6 +1228,7 @@ struct dwc3 { + unsigned dis_start_transfer_quirk:1; + unsigned usb3_lpm_capable:1; + unsigned usb2_lpm_disable:1; ++ unsigned usb2_gadget_lpm_disable:1; + + unsigned disable_scramble_quirk:1; + unsigned u2exit_lfps_quirk:1; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 5b5520286eff..0ffd2a4e6309 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3398,6 +3398,7 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc) + /* Enable USB2 LPM Capability */ + + if (!DWC3_VER_IS_WITHIN(DWC3, ANY, 194A) && ++ !dwc->usb2_gadget_lpm_disable && + (speed != DWC3_DSTS_SUPERSPEED) && + (speed != DWC3_DSTS_SUPERSPEED_PLUS)) { + reg = dwc3_readl(dwc->regs, DWC3_DCFG); +@@ -3424,6 +3425,12 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc) + + dwc3_gadget_dctl_write_safe(dwc, reg); + } else { ++ if (dwc->usb2_gadget_lpm_disable) { ++ reg = dwc3_readl(dwc->regs, DWC3_DCFG); ++ reg &= ~DWC3_DCFG_LPM_CAP; ++ dwc3_writel(dwc->regs, DWC3_DCFG, reg); ++ } ++ + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + reg &= ~DWC3_DCTL_HIRD_THRES_MASK; + dwc3_gadget_dctl_write_safe(dwc, reg); +@@ -3871,7 +3878,7 @@ int dwc3_gadget_init(struct dwc3 *dwc) + dwc->gadget->speed = USB_SPEED_UNKNOWN; + dwc->gadget->sg_supported = true; + dwc->gadget->name = "dwc3-gadget"; +- dwc->gadget->lpm_capable = true; ++ dwc->gadget->lpm_capable = !dwc->usb2_gadget_lpm_disable; + + /* + * FIXME We might be setting max_speed to +Date: Fri, 19 Mar 2021 02:31:25 -0700 +Subject: usb: dwc3: gadget: Ignore EP queue requests during bus reset + +From: Wesley Cheng + +[ Upstream commit 71ca43f30df9c642970f9dc9b2d6f463f4967e7b ] + +The current dwc3_gadget_reset_interrupt() will stop any active +transfers, but only addresses blocking of EP queuing for while we are +coming from a disconnected scenario, i.e. after receiving the disconnect +event. If the host decides to issue a bus reset on the device, the +connected parameter will still be set to true, allowing for EP queuing +to continue while we are disabling the functions. To avoid this, set the +connected flag to false until the stop active transfers is complete. + +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1616146285-19149-3-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 65ff41e3a18e..5b5520286eff 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3267,6 +3267,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) + { + u32 reg; + ++ /* ++ * Ideally, dwc3_reset_gadget() would trigger the function ++ * drivers to stop any active transfers through ep disable. ++ * However, for functions which defer ep disable, such as mass ++ * storage, we will need to rely on the call to stop active ++ * transfers here, and avoid allowing of request queuing. ++ */ ++ dwc->connected = false; ++ + /* + * WORKAROUND: DWC3 revisions <1.88a have an issue which + * would cause a missing Disconnect Event if there's a +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-f_uac1-validate-input-parameters.patch b/queue-5.10/usb-gadget-f_uac1-validate-input-parameters.patch new file mode 100644 index 00000000000..8e51b3fec59 --- /dev/null +++ b/queue-5.10/usb-gadget-f_uac1-validate-input-parameters.patch @@ -0,0 +1,113 @@ +From 20d1cb9d657412cf31b7f57e820b3706fce571d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 13:49:34 +0200 +Subject: usb: gadget: f_uac1: validate input parameters + +From: Ruslan Bilovol + +[ Upstream commit a59c68a6a3d1b18e2494f526eb19893a34fa6ec6 ] + +Currently user can configure UAC1 function with +parameters that violate UAC1 spec or are not supported +by UAC1 gadget implementation. + +This can lead to incorrect behavior if such gadget +is connected to the host - like enumeration failure +or other issues depending on host's UAC1 driver +implementation, bringing user to a long hours +of debugging the issue. + +Instead of silently accept these parameters, throw +an error if they are not valid. + +Signed-off-by: Ruslan Bilovol +Link: https://lore.kernel.org/r/1614599375-8803-5-git-send-email-ruslan.bilovol@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_uac1.c | 43 ++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c +index 560382e0a8f3..e65f474ad7b3 100644 +--- a/drivers/usb/gadget/function/f_uac1.c ++++ b/drivers/usb/gadget/function/f_uac1.c +@@ -19,6 +19,9 @@ + #include "u_audio.h" + #include "u_uac1.h" + ++/* UAC1 spec: 3.7.2.3 Audio Channel Cluster Format */ ++#define UAC1_CHANNEL_MASK 0x0FFF ++ + struct f_uac1 { + struct g_audio g_audio; + u8 ac_intf, as_in_intf, as_out_intf; +@@ -30,6 +33,11 @@ static inline struct f_uac1 *func_to_uac1(struct usb_function *f) + return container_of(f, struct f_uac1, g_audio.func); + } + ++static inline struct f_uac1_opts *g_audio_to_uac1_opts(struct g_audio *audio) ++{ ++ return container_of(audio->func.fi, struct f_uac1_opts, func_inst); ++} ++ + /* + * DESCRIPTORS ... most are static, but strings and full + * configuration descriptors are built on demand. +@@ -505,11 +513,42 @@ static void f_audio_disable(struct usb_function *f) + + /*-------------------------------------------------------------------------*/ + ++static int f_audio_validate_opts(struct g_audio *audio, struct device *dev) ++{ ++ struct f_uac1_opts *opts = g_audio_to_uac1_opts(audio); ++ ++ if (!opts->p_chmask && !opts->c_chmask) { ++ dev_err(dev, "Error: no playback and capture channels\n"); ++ return -EINVAL; ++ } else if (opts->p_chmask & ~UAC1_CHANNEL_MASK) { ++ dev_err(dev, "Error: unsupported playback channels mask\n"); ++ return -EINVAL; ++ } else if (opts->c_chmask & ~UAC1_CHANNEL_MASK) { ++ dev_err(dev, "Error: unsupported capture channels mask\n"); ++ return -EINVAL; ++ } else if ((opts->p_ssize < 1) || (opts->p_ssize > 4)) { ++ dev_err(dev, "Error: incorrect playback sample size\n"); ++ return -EINVAL; ++ } else if ((opts->c_ssize < 1) || (opts->c_ssize > 4)) { ++ dev_err(dev, "Error: incorrect capture sample size\n"); ++ return -EINVAL; ++ } else if (!opts->p_srate) { ++ dev_err(dev, "Error: incorrect playback sampling rate\n"); ++ return -EINVAL; ++ } else if (!opts->c_srate) { ++ dev_err(dev, "Error: incorrect capture sampling rate\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /* audio function driver setup/binding */ + static int f_audio_bind(struct usb_configuration *c, struct usb_function *f) + { + struct usb_composite_dev *cdev = c->cdev; + struct usb_gadget *gadget = cdev->gadget; ++ struct device *dev = &gadget->dev; + struct f_uac1 *uac1 = func_to_uac1(f); + struct g_audio *audio = func_to_g_audio(f); + struct f_uac1_opts *audio_opts; +@@ -519,6 +558,10 @@ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f) + int rate; + int status; + ++ status = f_audio_validate_opts(audio, dev); ++ if (status) ++ return status; ++ + audio_opts = container_of(f->fi, struct f_uac1_opts, func_inst); + + us = usb_gstrings_attach(cdev, uac1_strings, ARRAY_SIZE(strings_uac1)); +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-f_uac2-validate-input-parameters.patch b/queue-5.10/usb-gadget-f_uac2-validate-input-parameters.patch new file mode 100644 index 00000000000..7a48003f79a --- /dev/null +++ b/queue-5.10/usb-gadget-f_uac2-validate-input-parameters.patch @@ -0,0 +1,100 @@ +From 749792e16969cd00959bf24cd29f2b7e57d79d7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 13:49:33 +0200 +Subject: usb: gadget: f_uac2: validate input parameters + +From: Ruslan Bilovol + +[ Upstream commit 3713d5ceb04d5ab6a5e2b86dfca49170053f3a5e ] + +Currently user can configure UAC2 function with +parameters that violate UAC2 spec or are not supported +by UAC2 gadget implementation. + +This can lead to incorrect behavior if such gadget +is connected to the host - like enumeration failure +or other issues depending on host's UAC2 driver +implementation, bringing user to a long hours +of debugging the issue. + +Instead of silently accept these parameters, throw +an error if they are not valid. + +Signed-off-by: Ruslan Bilovol +Link: https://lore.kernel.org/r/1614599375-8803-4-git-send-email-ruslan.bilovol@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_uac2.c | 39 ++++++++++++++++++++++++++-- + 1 file changed, 37 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index 6f03e944e0e3..dd960cea642f 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -14,6 +14,9 @@ + #include "u_audio.h" + #include "u_uac2.h" + ++/* UAC2 spec: 4.1 Audio Channel Cluster Descriptor */ ++#define UAC2_CHANNEL_MASK 0x07FFFFFF ++ + /* + * The driver implements a simple UAC_2 topology. + * USB-OUT -> IT_1 -> OT_3 -> ALSA_Capture +@@ -604,6 +607,36 @@ static void setup_descriptor(struct f_uac2_opts *opts) + hs_audio_desc[i] = NULL; + } + ++static int afunc_validate_opts(struct g_audio *agdev, struct device *dev) ++{ ++ struct f_uac2_opts *opts = g_audio_to_uac2_opts(agdev); ++ ++ if (!opts->p_chmask && !opts->c_chmask) { ++ dev_err(dev, "Error: no playback and capture channels\n"); ++ return -EINVAL; ++ } else if (opts->p_chmask & ~UAC2_CHANNEL_MASK) { ++ dev_err(dev, "Error: unsupported playback channels mask\n"); ++ return -EINVAL; ++ } else if (opts->c_chmask & ~UAC2_CHANNEL_MASK) { ++ dev_err(dev, "Error: unsupported capture channels mask\n"); ++ return -EINVAL; ++ } else if ((opts->p_ssize < 1) || (opts->p_ssize > 4)) { ++ dev_err(dev, "Error: incorrect playback sample size\n"); ++ return -EINVAL; ++ } else if ((opts->c_ssize < 1) || (opts->c_ssize > 4)) { ++ dev_err(dev, "Error: incorrect capture sample size\n"); ++ return -EINVAL; ++ } else if (!opts->p_srate) { ++ dev_err(dev, "Error: incorrect playback sampling rate\n"); ++ return -EINVAL; ++ } else if (!opts->c_srate) { ++ dev_err(dev, "Error: incorrect capture sampling rate\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int + afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + { +@@ -612,11 +645,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + struct usb_composite_dev *cdev = cfg->cdev; + struct usb_gadget *gadget = cdev->gadget; + struct device *dev = &gadget->dev; +- struct f_uac2_opts *uac2_opts; ++ struct f_uac2_opts *uac2_opts = g_audio_to_uac2_opts(agdev); + struct usb_string *us; + int ret; + +- uac2_opts = container_of(fn->fi, struct f_uac2_opts, func_inst); ++ ret = afunc_validate_opts(agdev, dev); ++ if (ret) ++ return ret; + + us = usb_gstrings_attach(cdev, fn_strings, ARRAY_SIZE(strings_fn)); + if (IS_ERR(us)) +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-tegra-xudc-fix-possible-use-after-free-in.patch b/queue-5.10/usb-gadget-tegra-xudc-fix-possible-use-after-free-in.patch new file mode 100644 index 00000000000..57d5eb59d92 --- /dev/null +++ b/queue-5.10/usb-gadget-tegra-xudc-fix-possible-use-after-free-in.patch @@ -0,0 +1,44 @@ +From 9cde226b91e4bfc88eef3eb8a8ce8cdfed540327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 17:29:47 +0800 +Subject: usb: gadget: tegra-xudc: Fix possible use-after-free in + tegra_xudc_remove() + +From: Yang Yingliang + +[ Upstream commit a932ee40c276767cd55fadec9e38829bf441db41 ] + +This driver's remove path calls cancel_delayed_work(). However, that +function does not wait until the work function finishes. This means +that the callback function may still be running after the driver's +remove function has finished, which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +the work is properly cancelled, no longer running, and unable +to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210407092947.3271507-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 580bef8eb4cb..2319c9737c2b 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3883,7 +3883,7 @@ static int tegra_xudc_remove(struct platform_device *pdev) + + pm_runtime_get_sync(xudc->dev); + +- cancel_delayed_work(&xudc->plc_reset_work); ++ cancel_delayed_work_sync(&xudc->plc_reset_work); + cancel_work_sync(&xudc->usb_role_sw_work); + + usb_del_gadget_udc(&xudc->gadget); +-- +2.30.2 + diff --git a/queue-5.10/usb-gadget-uvc-add-binterval-checking-for-hs-mode.patch b/queue-5.10/usb-gadget-uvc-add-binterval-checking-for-hs-mode.patch new file mode 100644 index 00000000000..859530ca9a1 --- /dev/null +++ b/queue-5.10/usb-gadget-uvc-add-binterval-checking-for-hs-mode.patch @@ -0,0 +1,52 @@ +From 44364e9a4cf0a27ee9b406880db9b23f25f5aac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 13:53:38 +0100 +Subject: usb: gadget: uvc: add bInterval checking for HS mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pawel Laszczak + +[ Upstream commit 26adde04acdff14a1f28d4a5dce46a8513a3038b ] + +Patch adds extra checking for bInterval passed by configfs. +The 5.6.4 chapter of USB Specification (rev. 2.0) say: +"A high-bandwidth endpoint must specify a period of 1x125 µs +(i.e., a bInterval value of 1)." + +The issue was observed during testing UVC class on CV. +I treat this change as improvement because we can control +bInterval by configfs. + +Reviewed-by: Peter Chen +Reviewed-by: Laurent Pinchart +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20210308125338.4824-1-pawell@gli-login.cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_uvc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index 44b4352a2676..ed77a126a74f 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -633,7 +633,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) + + uvc_hs_streaming_ep.wMaxPacketSize = + cpu_to_le16(max_packet_size | ((max_packet_mult - 1) << 11)); +- uvc_hs_streaming_ep.bInterval = opts->streaming_interval; ++ ++ /* A high-bandwidth endpoint must specify a bInterval value of 1 */ ++ if (max_packet_mult > 1) ++ uvc_hs_streaming_ep.bInterval = 1; ++ else ++ uvc_hs_streaming_ep.bInterval = opts->streaming_interval; + + uvc_ss_streaming_ep.wMaxPacketSize = cpu_to_le16(max_packet_size); + uvc_ss_streaming_ep.bInterval = opts->streaming_interval; +-- +2.30.2 + diff --git a/queue-5.10/usb-musb-fix-pm-reference-leak-in-musb_irq_work.patch b/queue-5.10/usb-musb-fix-pm-reference-leak-in-musb_irq_work.patch new file mode 100644 index 00000000000..784e92b7ee6 --- /dev/null +++ b/queue-5.10/usb-musb-fix-pm-reference-leak-in-musb_irq_work.patch @@ -0,0 +1,39 @@ +From 7ab091d642dbe1c0bc471420e39b8b06d0f4b2c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 17:18:36 +0800 +Subject: usb: musb: fix PM reference leak in musb_irq_work() + +From: Bixuan Cui + +[ Upstream commit 9535b99533904e9bc1607575aa8e9539a55435d7 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +thus a pairing decrement is needed. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Link: https://lore.kernel.org/r/20210408091836.55227-1-cuibixuan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/musb_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index fc0457db62e1..8f09a387b773 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2070,7 +2070,7 @@ static void musb_irq_work(struct work_struct *data) + struct musb *musb = container_of(data, struct musb, irq_work.work); + int error; + +- error = pm_runtime_get_sync(musb->controller); ++ error = pm_runtime_resume_and_get(musb->controller); + if (error < 0) { + dev_err(musb->controller, "Could not enable: %i\n", error); + +-- +2.30.2 + diff --git a/queue-5.10/usb-webcam-invalid-size-of-processing-unit-descripto.patch b/queue-5.10/usb-webcam-invalid-size-of-processing-unit-descripto.patch new file mode 100644 index 00000000000..45befd5b2aa --- /dev/null +++ b/queue-5.10/usb-webcam-invalid-size-of-processing-unit-descripto.patch @@ -0,0 +1,75 @@ +From 818ee7952752924018ef1b580eb1e365fd7ad247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 08:17:48 +0100 +Subject: usb: webcam: Invalid size of Processing Unit Descriptor + +From: Pawel Laszczak + +[ Upstream commit 6a154ec9ef6762c774cd2b50215c7a8f0f08a862 ] + +According with USB Device Class Definition for Video Device the +Processing Unit Descriptor bLength should be 12 (10 + bmControlSize), +but it has 11. + +Invalid length caused that Processing Unit Descriptor Test Video form +CV tool failed. To fix this issue patch adds bmVideoStandards into +uvc_processing_unit_descriptor structure. + +The bmVideoStandards field was added in UVC 1.1 and it wasn't part of +UVC 1.0a. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Pawel Laszczak +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20210315071748.29706-1-pawell@gli-login.cadence.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_uvc.c | 1 + + drivers/usb/gadget/legacy/webcam.c | 1 + + include/uapi/linux/usb/video.h | 3 ++- + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index ed77a126a74f..f48a00e49794 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -822,6 +822,7 @@ static struct usb_function_instance *uvc_alloc_inst(void) + pd->bmControls[0] = 1; + pd->bmControls[1] = 0; + pd->iProcessing = 0; ++ pd->bmVideoStandards = 0; + + od = &opts->uvc_output_terminal; + od->bLength = UVC_DT_OUTPUT_TERMINAL_SIZE; +diff --git a/drivers/usb/gadget/legacy/webcam.c b/drivers/usb/gadget/legacy/webcam.c +index a9f8eb8e1c76..2c9eab2b863d 100644 +--- a/drivers/usb/gadget/legacy/webcam.c ++++ b/drivers/usb/gadget/legacy/webcam.c +@@ -125,6 +125,7 @@ static const struct uvc_processing_unit_descriptor uvc_processing = { + .bmControls[0] = 1, + .bmControls[1] = 0, + .iProcessing = 0, ++ .bmVideoStandards = 0, + }; + + static const struct uvc_output_terminal_descriptor uvc_output_terminal = { +diff --git a/include/uapi/linux/usb/video.h b/include/uapi/linux/usb/video.h +index d854cb19c42c..bfdae12cdacf 100644 +--- a/include/uapi/linux/usb/video.h ++++ b/include/uapi/linux/usb/video.h +@@ -302,9 +302,10 @@ struct uvc_processing_unit_descriptor { + __u8 bControlSize; + __u8 bmControls[2]; + __u8 iProcessing; ++ __u8 bmVideoStandards; + } __attribute__((__packed__)); + +-#define UVC_DT_PROCESSING_UNIT_SIZE(n) (9+(n)) ++#define UVC_DT_PROCESSING_UNIT_SIZE(n) (10+(n)) + + /* 3.7.2.6. Extension Unit Descriptor */ + struct uvc_extension_unit_descriptor { +-- +2.30.2 + diff --git a/queue-5.10/usb-xhci-fix-port-minor-revision.patch b/queue-5.10/usb-xhci-fix-port-minor-revision.patch new file mode 100644 index 00000000000..f315e2eefc2 --- /dev/null +++ b/queue-5.10/usb-xhci-fix-port-minor-revision.patch @@ -0,0 +1,51 @@ +From 6ea2372486b5f315e803c21604bb7ffc2254a41a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 19:43:21 -0800 +Subject: usb: xhci: Fix port minor revision + +From: Thinh Nguyen + +[ Upstream commit 64364bc912c01b33bba6c22e3ccb849bfca96398 ] + +Some hosts incorrectly use sub-minor version for minor version (i.e. +0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 for bcdUSB 0x310). +Currently the xHCI driver works around this by just checking for minor +revision > 0x01 for USB 3.1 everywhere. With the addition of USB 3.2, +checking this gets a bit cumbersome. Since there is no USB release with +bcdUSB 0x301 to 0x309, we can assume that sub-minor version 01 to 09 is +incorrect. Let's try to fix this and use the minor revision that matches +with the USB/xHCI spec to help with the version checking within the +driver. + +Acked-by: Mathias Nyman +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/ed330e95a19dc367819c5b4d78bf7a541c35aa0a.1615432770.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 138ba4528dd3..1ad0ac8c8209 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2143,6 +2143,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, + + if (major_revision == 0x03) { + rhub = &xhci->usb3_rhub; ++ /* ++ * Some hosts incorrectly use sub-minor version for minor ++ * version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 ++ * for bcdUSB 0x310). Since there is no USB release with sub ++ * minor version 0x301 to 0x309, we can assume that they are ++ * incorrect and fix it here. ++ */ ++ if (minor_revision > 0x00 && minor_revision < 0x10) ++ minor_revision <<= 4; + } else if (major_revision <= 0x02) { + rhub = &xhci->usb2_rhub; + } else { +-- +2.30.2 + diff --git a/queue-5.10/usb-xhci-mtk-support-quirk-to-disable-usb2-lpm.patch b/queue-5.10/usb-xhci-mtk-support-quirk-to-disable-usb2-lpm.patch new file mode 100644 index 00000000000..29fa12f4254 --- /dev/null +++ b/queue-5.10/usb-xhci-mtk-support-quirk-to-disable-usb2-lpm.patch @@ -0,0 +1,58 @@ +From 11ea2c5bdc54e6023c57cc3bd38360811de50193 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 17:05:53 +0800 +Subject: usb: xhci-mtk: support quirk to disable usb2 lpm + +From: Chunfeng Yun + +[ Upstream commit bee1f89aad2a51cd3339571bc8eadbb0dc88a683 ] + +The xHCI driver support usb2 HW LPM by default, here add support +XHCI_HW_LPM_DISABLE quirk, then we can disable usb2 lpm when +need it. + +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1617181553-3503-4-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mtk.c | 3 +++ + drivers/usb/host/xhci-mtk.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c +index 2f27dc0d9c6b..1c331577fca9 100644 +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -397,6 +397,8 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + if (mtk->lpm_support) + xhci->quirks |= XHCI_LPM_SUPPORT; ++ if (mtk->u2_lpm_disable) ++ xhci->quirks |= XHCI_HW_LPM_DISABLE; + + /* + * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream, +@@ -469,6 +471,7 @@ static int xhci_mtk_probe(struct platform_device *pdev) + return ret; + + mtk->lpm_support = of_property_read_bool(node, "usb3-lpm-capable"); ++ mtk->u2_lpm_disable = of_property_read_bool(node, "usb2-lpm-disable"); + /* optional property, ignore the error if it does not exist */ + of_property_read_u32(node, "mediatek,u3p-dis-msk", + &mtk->u3p_dis_msk); +diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h +index cbb09dfea62e..080109012b9a 100644 +--- a/drivers/usb/host/xhci-mtk.h ++++ b/drivers/usb/host/xhci-mtk.h +@@ -150,6 +150,7 @@ struct xhci_hcd_mtk { + struct phy **phys; + int num_phys; + bool lpm_support; ++ bool u2_lpm_disable; + /* usb remote wakeup */ + bool uwk_en; + struct regmap *uwk; +-- +2.30.2 + diff --git a/queue-5.10/x86-boot-add-clang_flags-to-compressed-kbuild_cflags.patch b/queue-5.10/x86-boot-add-clang_flags-to-compressed-kbuild_cflags.patch new file mode 100644 index 00000000000..bba0f9c4197 --- /dev/null +++ b/queue-5.10/x86-boot-add-clang_flags-to-compressed-kbuild_cflags.patch @@ -0,0 +1,47 @@ +From a25428e5208a3e67d934b259abd1ff80bce50569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 17:04:34 -0700 +Subject: x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS + +From: Nathan Chancellor + +[ Upstream commit d5cbd80e302dfea59726c44c56ab7957f822409f ] + +When cross compiling x86 on an ARM machine with clang, there are several +errors along the lines of: + + arch/x86/include/asm/string_64.h:27:10: error: invalid output constraint '=&c' in asm + +This happens because the compressed boot Makefile reassigns KBUILD_CFLAGS +and drops the clang flags that set the target architecture ('--target=') +and the path to the GNU cross tools ('--prefix='), meaning that the host +architecture is targeted. + +These flags are available as $(CLANG_FLAGS) from the main Makefile so +add them to the compressed boot folder's KBUILD_CFLAGS so that cross +compiling works as expected. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Borislav Petkov +Acked-by: Ard Biesheuvel +Link: https://lkml.kernel.org/r/20210326000435.4785-3-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index 40b8fd375d52..6004047d25fd 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -46,6 +46,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS + # Disable relocation relaxation in case the link is not PIE. + KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no) + KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h ++KBUILD_CFLAGS += $(CLANG_FLAGS) + + # sev-es.c indirectly inludes inat-table.h which is generated during + # compilation and stored in $(objtree). Add the directory to the includes so +-- +2.30.2 + diff --git a/queue-5.10/x86-boot-compressed-64-check-sev-encryption-in-the-3.patch b/queue-5.10/x86-boot-compressed-64-check-sev-encryption-in-the-3.patch new file mode 100644 index 00000000000..f69272161d6 --- /dev/null +++ b/queue-5.10/x86-boot-compressed-64-check-sev-encryption-in-the-3.patch @@ -0,0 +1,137 @@ +From 16ea59ed120b63c47ea695b88acbf92d28bf2cab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 13:38:23 +0100 +Subject: x86/boot/compressed/64: Check SEV encryption in the 32-bit boot-path + +From: Joerg Roedel + +[ Upstream commit fef81c86262879d4b1176ef51a834c15b805ebb9 ] + +Check whether the hypervisor reported the correct C-bit when running +as an SEV guest. Using a wrong C-bit position could be used to leak +sensitive data from the guest to the hypervisor. + +Signed-off-by: Joerg Roedel +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210312123824.306-8-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/head_64.S | 83 ++++++++++++++++++++++++++++++ + 1 file changed, 83 insertions(+) + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 017de6cc87dc..042c1a41ca58 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -172,11 +172,21 @@ SYM_FUNC_START(startup_32) + */ + call get_sev_encryption_bit + xorl %edx, %edx ++#ifdef CONFIG_AMD_MEM_ENCRYPT + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ ++ /* ++ * Mark SEV as active in sev_status so that startup32_check_sev_cbit() ++ * will do a check. The sev_status memory will be fully initialized ++ * with the contents of MSR_AMD_SEV_STATUS later in ++ * set_sev_encryption_mask(). For now it is sufficient to know that SEV ++ * is active. ++ */ ++ movl $1, rva(sev_status)(%ebp) + 1: ++#endif + + /* Initialize Page tables to 0 */ + leal rva(pgtable)(%ebx), %edi +@@ -261,6 +271,9 @@ SYM_FUNC_START(startup_32) + movl %esi, %edx + 1: + #endif ++ /* Check if the C-bit position is correct when SEV is active */ ++ call startup32_check_sev_cbit ++ + pushl $__KERNEL_CS + pushl %eax + +@@ -786,6 +799,76 @@ SYM_DATA_START_LOCAL(loaded_image_proto) + SYM_DATA_END(loaded_image_proto) + #endif + ++/* ++ * Check for the correct C-bit position when the startup_32 boot-path is used. ++ * ++ * The check makes use of the fact that all memory is encrypted when paging is ++ * disabled. The function creates 64 bits of random data using the RDRAND ++ * instruction. RDRAND is mandatory for SEV guests, so always available. If the ++ * hypervisor violates that the kernel will crash right here. ++ * ++ * The 64 bits of random data are stored to a memory location and at the same ++ * time kept in the %eax and %ebx registers. Since encryption is always active ++ * when paging is off the random data will be stored encrypted in main memory. ++ * ++ * Then paging is enabled. When the C-bit position is correct all memory is ++ * still mapped encrypted and comparing the register values with memory will ++ * succeed. An incorrect C-bit position will map all memory unencrypted, so that ++ * the compare will use the encrypted random data and fail. ++ */ ++SYM_FUNC_START(startup32_check_sev_cbit) ++#ifdef CONFIG_AMD_MEM_ENCRYPT ++ pushl %eax ++ pushl %ebx ++ pushl %ecx ++ pushl %edx ++ ++ /* Check for non-zero sev_status */ ++ movl rva(sev_status)(%ebp), %eax ++ testl %eax, %eax ++ jz 4f ++ ++ /* ++ * Get two 32-bit random values - Don't bail out if RDRAND fails ++ * because it is better to prevent forward progress if no random value ++ * can be gathered. ++ */ ++1: rdrand %eax ++ jnc 1b ++2: rdrand %ebx ++ jnc 2b ++ ++ /* Store to memory and keep it in the registers */ ++ movl %eax, rva(sev_check_data)(%ebp) ++ movl %ebx, rva(sev_check_data+4)(%ebp) ++ ++ /* Enable paging to see if encryption is active */ ++ movl %cr0, %edx /* Backup %cr0 in %edx */ ++ movl $(X86_CR0_PG | X86_CR0_PE), %ecx /* Enable Paging and Protected mode */ ++ movl %ecx, %cr0 ++ ++ cmpl %eax, rva(sev_check_data)(%ebp) ++ jne 3f ++ cmpl %ebx, rva(sev_check_data+4)(%ebp) ++ jne 3f ++ ++ movl %edx, %cr0 /* Restore previous %cr0 */ ++ ++ jmp 4f ++ ++3: /* Check failed - hlt the machine */ ++ hlt ++ jmp 3b ++ ++4: ++ popl %edx ++ popl %ecx ++ popl %ebx ++ popl %eax ++#endif ++ ret ++SYM_FUNC_END(startup32_check_sev_cbit) ++ + /* + * Stack and heap for uncompression + */ +-- +2.30.2 + diff --git a/queue-5.10/x86-build-propagate-clang_flags-to-realmode_flags.patch b/queue-5.10/x86-build-propagate-clang_flags-to-realmode_flags.patch new file mode 100644 index 00000000000..0757749ff72 --- /dev/null +++ b/queue-5.10/x86-build-propagate-clang_flags-to-realmode_flags.patch @@ -0,0 +1,66 @@ +From 7644b7f7775b038b00cf3eed5aef81e4890034e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 17:04:33 -0700 +Subject: x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Millikin + +[ Upstream commit 8abe7fc26ad8f28bfdf78adbed56acd1fa93f82d ] + +When cross-compiling with Clang, the `$(CLANG_FLAGS)' variable +contains additional flags needed to build C and assembly sources +for the target platform. Normally this variable is automatically +included in `$(KBUILD_CFLAGS)' via the top-level Makefile. + +The x86 real-mode makefile builds `$(REALMODE_CFLAGS)' from a +plain assignment and therefore drops the Clang flags. This causes +Clang to not recognize x86-specific assembler directives: + +  arch/x86/realmode/rm/header.S:36:1: error: unknown directive +  .type real_mode_header STT_OBJECT ; .size real_mode_header, .-real_mode_header +  ^ + +Explicit propagation of `$(CLANG_FLAGS)' to `$(REALMODE_CFLAGS)', +which is inherited by real-mode make rules, fixes cross-compilation +with Clang for x86 targets. + +Relevant flags: + +* `--target' sets the target architecture when cross-compiling. This +  flag must be set for both compilation and assembly (`KBUILD_AFLAGS') +  to support architecture-specific assembler directives. + +* `-no-integrated-as' tells clang to assemble with GNU Assembler +  instead of its built-in LLVM assembler. This flag is set by default +  unless `LLVM_IAS=1' is set, because the LLVM assembler can't yet +  parse certain GNU extensions. + +Signed-off-by: John Millikin +Signed-off-by: Nathan Chancellor +Signed-off-by: Borislav Petkov +Acked-by: Ard Biesheuvel +Tested-by: Sedat Dilek +Link: https://lkml.kernel.org/r/20210326000435.4785-2-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 9c86f2dc16b1..8ed757d06f77 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -40,6 +40,7 @@ REALMODE_CFLAGS += -ffreestanding + REALMODE_CFLAGS += -fno-stack-protector + REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member) + REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4)) ++REALMODE_CFLAGS += $(CLANG_FLAGS) + export REALMODE_CFLAGS + + # BITS is used as extension for files which are available in a 32 bit +-- +2.30.2 + diff --git a/queue-5.10/x86-sev-do-not-require-hypervisor-cpuid-bit-for-sev-.patch b/queue-5.10/x86-sev-do-not-require-hypervisor-cpuid-bit-for-sev-.patch new file mode 100644 index 00000000000..4e7e2eabcc2 --- /dev/null +++ b/queue-5.10/x86-sev-do-not-require-hypervisor-cpuid-bit-for-sev-.patch @@ -0,0 +1,154 @@ +From 186977912bde14f91f254f2992aea7d8385b4871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 13:38:18 +0100 +Subject: x86/sev: Do not require Hypervisor CPUID bit for SEV guests + +From: Joerg Roedel + +[ Upstream commit eab696d8e8b9c9d600be6fad8dd8dfdfaca6ca7c ] + +A malicious hypervisor could disable the CPUID intercept for an SEV or +SEV-ES guest and trick it into the no-SEV boot path, where it could +potentially reveal secrets. This is not an issue for SEV-SNP guests, +as the CPUID intercept can't be disabled for those. + +Remove the Hypervisor CPUID bit check from the SEV detection code to +protect against this kind of attack and add a Hypervisor bit equals zero +check to the SME detection path to prevent non-encrypted guests from +trying to enable SME. + +This handles the following cases: + + 1) SEV(-ES) guest where CPUID intercept is disabled. The guest + will still see leaf 0x8000001f and the SEV bit. It can + retrieve the C-bit and boot normally. + + 2) Non-encrypted guests with intercepted CPUID will check + the SEV_STATUS MSR and find it 0 and will try to enable SME. + This will fail when the guest finds MSR_K8_SYSCFG to be zero, + as it is emulated by KVM. But we can't rely on that, as there + might be other hypervisors which return this MSR with bit + 23 set. The Hypervisor bit check will prevent that the guest + tries to enable SME in this case. + + 3) Non-encrypted guests on SEV capable hosts with CPUID intercept + disabled (by a malicious hypervisor) will try to boot into + the SME path. This will fail, but it is also not considered + a problem because non-encrypted guests have no protection + against the hypervisor anyway. + + [ bp: s/non-SEV/non-encrypted/g ] + +Signed-off-by: Joerg Roedel +Signed-off-by: Borislav Petkov +Acked-by: Tom Lendacky +Link: https://lkml.kernel.org/r/20210312123824.306-3-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/mem_encrypt.S | 6 ----- + arch/x86/kernel/sev-es-shared.c | 6 +---- + arch/x86/mm/mem_encrypt_identity.c | 35 ++++++++++++++------------ + 3 files changed, 20 insertions(+), 27 deletions(-) + +diff --git a/arch/x86/boot/compressed/mem_encrypt.S b/arch/x86/boot/compressed/mem_encrypt.S +index aa561795efd1..a6dea4e8a082 100644 +--- a/arch/x86/boot/compressed/mem_encrypt.S ++++ b/arch/x86/boot/compressed/mem_encrypt.S +@@ -23,12 +23,6 @@ SYM_FUNC_START(get_sev_encryption_bit) + push %ecx + push %edx + +- /* Check if running under a hypervisor */ +- movl $1, %eax +- cpuid +- bt $31, %ecx /* Check the hypervisor bit */ +- jnc .Lno_sev +- + movl $0x80000000, %eax /* CPUID to check the highest leaf */ + cpuid + cmpl $0x8000001f, %eax /* See if 0x8000001f is available */ +diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c +index cdc04d091242..387b71669818 100644 +--- a/arch/x86/kernel/sev-es-shared.c ++++ b/arch/x86/kernel/sev-es-shared.c +@@ -186,7 +186,6 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code) + * make it accessible to the hypervisor. + * + * In particular, check for: +- * - Hypervisor CPUID bit + * - Availability of CPUID leaf 0x8000001f + * - SEV CPUID bit. + * +@@ -194,10 +193,7 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code) + * can't be checked here. + */ + +- if ((fn == 1 && !(regs->cx & BIT(31)))) +- /* Hypervisor bit */ +- goto fail; +- else if (fn == 0x80000000 && (regs->ax < 0x8000001f)) ++ if (fn == 0x80000000 && (regs->ax < 0x8000001f)) + /* SEV leaf check */ + goto fail; + else if ((fn == 0x8000001f && !(regs->ax & BIT(1)))) +diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c +index 6c5eb6f3f14f..a19374d26101 100644 +--- a/arch/x86/mm/mem_encrypt_identity.c ++++ b/arch/x86/mm/mem_encrypt_identity.c +@@ -503,14 +503,10 @@ void __init sme_enable(struct boot_params *bp) + + #define AMD_SME_BIT BIT(0) + #define AMD_SEV_BIT BIT(1) +- /* +- * Set the feature mask (SME or SEV) based on whether we are +- * running under a hypervisor. +- */ +- eax = 1; +- ecx = 0; +- native_cpuid(&eax, &ebx, &ecx, &edx); +- feature_mask = (ecx & BIT(31)) ? AMD_SEV_BIT : AMD_SME_BIT; ++ ++ /* Check the SEV MSR whether SEV or SME is enabled */ ++ sev_status = __rdmsr(MSR_AMD64_SEV); ++ feature_mask = (sev_status & MSR_AMD64_SEV_ENABLED) ? AMD_SEV_BIT : AMD_SME_BIT; + + /* + * Check for the SME/SEV feature: +@@ -530,19 +526,26 @@ void __init sme_enable(struct boot_params *bp) + + /* Check if memory encryption is enabled */ + if (feature_mask == AMD_SME_BIT) { ++ /* ++ * No SME if Hypervisor bit is set. This check is here to ++ * prevent a guest from trying to enable SME. For running as a ++ * KVM guest the MSR_K8_SYSCFG will be sufficient, but there ++ * might be other hypervisors which emulate that MSR as non-zero ++ * or even pass it through to the guest. ++ * A malicious hypervisor can still trick a guest into this ++ * path, but there is no way to protect against that. ++ */ ++ eax = 1; ++ ecx = 0; ++ native_cpuid(&eax, &ebx, &ecx, &edx); ++ if (ecx & BIT(31)) ++ return; ++ + /* For SME, check the SYSCFG MSR */ + msr = __rdmsr(MSR_K8_SYSCFG); + if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT)) + return; + } else { +- /* For SEV, check the SEV MSR */ +- msr = __rdmsr(MSR_AMD64_SEV); +- if (!(msr & MSR_AMD64_SEV_ENABLED)) +- return; +- +- /* Save SEV_STATUS to avoid reading MSR again */ +- sev_status = msr; +- + /* SEV state cannot be controlled by a command line option */ + sme_me_mask = me_mask; + sev_enabled = true; +-- +2.30.2 + diff --git a/queue-5.10/xhci-check-control-context-is-valid-before-dereferen.patch b/queue-5.10/xhci-check-control-context-is-valid-before-dereferen.patch new file mode 100644 index 00000000000..3905e64c2ef --- /dev/null +++ b/queue-5.10/xhci-check-control-context-is-valid-before-dereferen.patch @@ -0,0 +1,42 @@ +From 46d08fa12edc80f7abe086713cc9b916ad40c6bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 10:02:06 +0300 +Subject: xhci: check control context is valid before dereferencing it. + +From: Mathias Nyman + +[ Upstream commit 597899d2f7c5619c87185ee7953d004bd37fd0eb ] + +Don't dereference ctrl_ctx before checking it's valid. +Issue reported by Klockwork + +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210406070208.3406266-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index c449de6164b1..384076e169f4 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3227,6 +3227,14 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd, + + /* config ep command clears toggle if add and drop ep flags are set */ + ctrl_ctx = xhci_get_input_control_ctx(cfg_cmd->in_ctx); ++ if (!ctrl_ctx) { ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_free_command(xhci, cfg_cmd); ++ xhci_warn(xhci, "%s: Could not get input context, bad type.\n", ++ __func__); ++ goto cleanup; ++ } ++ + xhci_setup_input_ctx_for_config_ep(xhci, cfg_cmd->in_ctx, vdev->out_ctx, + ctrl_ctx, ep_flag, ep_flag); + xhci_endpoint_copy(xhci, cfg_cmd->in_ctx, vdev->out_ctx, ep_index); +-- +2.30.2 + diff --git a/queue-5.10/xhci-check-port-array-allocation-was-successful-befo.patch b/queue-5.10/xhci-check-port-array-allocation-was-successful-befo.patch new file mode 100644 index 00000000000..4140621bbf8 --- /dev/null +++ b/queue-5.10/xhci-check-port-array-allocation-was-successful-befo.patch @@ -0,0 +1,38 @@ +From d2adea00f41a6836ffa6e38b26a43f67b72c0d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 10:02:05 +0300 +Subject: xhci: check port array allocation was successful before dereferencing + it + +From: Mathias Nyman + +[ Upstream commit 8a157d2ff104d2849c58226a1fd02365d7d60150 ] + +return if rhub->ports is null after rhub->ports = kcalloc_node() +Klockwork reported issue + +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210406070208.3406266-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 1ad0ac8c8209..8ce043e6ed87 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2263,6 +2263,9 @@ static void xhci_create_rhub_port_array(struct xhci_hcd *xhci, + return; + rhub->ports = kcalloc_node(rhub->num_ports, sizeof(*rhub->ports), + flags, dev_to_node(dev)); ++ if (!rhub->ports) ++ return; ++ + for (i = 0; i < HCS_MAX_PORTS(xhci->hcs_params1); i++) { + if (xhci->hw_ports[i].rhub != rhub || + xhci->hw_ports[i].hcd_portnum == DUPLICATE_ENTRY) +-- +2.30.2 + diff --git a/queue-5.10/xhci-fix-potential-array-out-of-bounds-with-several-.patch b/queue-5.10/xhci-fix-potential-array-out-of-bounds-with-several-.patch new file mode 100644 index 00000000000..1060829b753 --- /dev/null +++ b/queue-5.10/xhci-fix-potential-array-out-of-bounds-with-several-.patch @@ -0,0 +1,54 @@ +From 9ea8cf6b19b27d1b65ea2502f49c40c227103d19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 10:02:07 +0300 +Subject: xhci: fix potential array out of bounds with several interrupters + +From: Mathias Nyman + +[ Upstream commit 286fd02fd54b6acab65809549cf5fb3f2a886696 ] + +The Max Interrupters supported by the controller is given in a 10bit +wide bitfield, but the driver uses a fixed 128 size array to index these +interrupters. + +Klockwork reports a possible array out of bounds case which in theory +is possible. In practice this hasn't been hit as a common number of Max +Interrupters for new controllers is 8, not even close to 128. + +This needs to be fixed anyway + +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210406070208.3406266-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 384076e169f4..dbe5553872ff 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -228,6 +228,7 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) + struct device *dev = xhci_to_hcd(xhci)->self.sysdev; + int err, i; + u64 val; ++ u32 intrs; + + /* + * Some Renesas controllers get into a weird state if they are +@@ -266,7 +267,10 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci) + if (upper_32_bits(val)) + xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring); + +- for (i = 0; i < HCS_MAX_INTRS(xhci->hcs_params1); i++) { ++ intrs = min_t(u32, HCS_MAX_INTRS(xhci->hcs_params1), ++ ARRAY_SIZE(xhci->run_regs->ir_set)); ++ ++ for (i = 0; i < intrs; i++) { + struct xhci_intr_reg __iomem *ir; + + ir = &xhci->run_regs->ir_set[i]; +-- +2.30.2 + -- 2.47.3