From b633cc42503b28ebc742fff2eaac583dde8c0a51 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 13 Dec 2020 18:22:39 -0500 Subject: [PATCH] Fixes for 5.9 Signed-off-by: Sasha Levin --- ...ing-don-t-assume-non-current-task-is.patch | 96 ++++ ...sure-the-qcom_scm-driver-has-finishe.patch | 94 ++++ ...om-clear-the-warnings-caused-by-empt.patch | 111 ++++ ...ip-assign-a-fixed-index-to-mmc-devic.patch | 43 ++ ...ip-remove-system-power-controller-fr.patch | 36 ++ ...ip-reorder-led-triggers-from-mmc-dev.patch | 48 ++ ...-disable-the-aconnect-for-jetson-tx2.patch | 56 ++ ..._rt5640-fix-hp-pavilion-x2-detachabl.patch | 99 ++++ ...der-fragmentation-for-needed_headroo.patch | 45 ++ ...-always-reallocate-the-fragmentation.patch | 53 ++ ...v-reserve-needed_-room-for-fragments.patch | 93 ++++ ...r-return-value-in-build_btf_type_tab.patch | 37 ++ ...locations-when-adding-and-removing-q.patch | 71 +++ ...p-splat-when-enabling-and-disabling-.patch | 281 ++++++++++ ...an-c_can_power_up-fix-error-handling.patch | 66 +++ ...d-kvaser_pciefd_open-fix-error-handl.patch | 40 ++ ...dev_setup-add-support-for-bosch-mcan.patch | 38 ++ ...5x_can_probe-fix-error-path-remove-e.patch | 63 +++ ...000_err-don-t-count-arbitration-lose.patch | 40 ++ ...n4i_can_err-don-t-count-arbitration-.patch | 41 ++ ...d-on-common_clk-to-fix-compile-tests.patch | 41 ++ ...cx565akm-fix-race-condition-in-probe.patch | 74 +++ ...id-uninitialized-use-of-endpoint-id-.patch | 41 ++ ...udi-fix-missing-code-in-ecc-handling.patch | 35 ++ .../ibmvnic-avoid-memset-null-scrq-msgs.patch | 59 +++ ...delay-next-reset-if-hard-reset-fails.patch | 43 ++ ...handle-inconsistent-login-with-reset.patch | 39 ++ ...vnic-reduce-wait-for-completion-time.patch | 55 ++ ...nd_login-should-check-for-crq-errors.patch | 89 ++++ ...-tx-timeout-reset-while-in-resetting.patch | 42 ++ ...ic-stop-free_all_rwi-on-failed-reset.patch | 74 +++ queue-5.9/ibmvnic-track-pending-login.patch | 89 ++++ queue-5.9/intel_idle-build-fix.patch | 69 +++ ...intel_idle-fix-intel_idle-vs-tracing.patch | 97 ++++ ...m-msm8916-remove-rpm-ids-from-non-rp.patch | 75 +++ ...m-qcs404-remove-gpu-and-display-rpm-.patch | 45 ++ ...e-memory-leak-in-ip_vs_control_net_i.patch | 111 ++++ ...ts-unconditionally-save-restore-the-.patch | 99 ++++ ...kernel-panic-in-case-of-assert-durin.patch | 42 ++ ...ert-values-of-no_160-device-config-e.patch | 42 ++ ...ifi-pcie-limit-memory-read-spin-time.patch | 94 ++++ ...-set-ltr-to-avoid-completion-timeout.patch | 79 +++ ...max-he-max-a-mpdu-according-to-he-ca.patch | 101 ++++ ...ap-return-value-when-vma-is-merged-a.patch | 86 +++ .../net-broadcom-cnic-requires-mmu.patch | 50 ++ ...id-taking-multiple-skbuff-references.patch | 132 +++++ ...ix-a-warning-on-x86_pmu_stop-with-la.patch | 54 ++ ...rrect-clearing-of-tca_drv_sel-bit-in.patch | 48 ++ ...r-wmi-add-automatic-keyboard-backgro.patch | 38 ++ ...el-vbtn-support-for-tablet-mode-on-h.patch | 42 ++ ...nkpad_acpi-add-bat1-is-primary-batte.patch | 47 ++ ...nkpad_acpi-add-p1-gen3-second-fan-su.patch | 36 ++ ...nkpad_acpi-do-not-report-sw_tablet_m.patch | 66 +++ ...nkpad_acpi-whitelist-p15-firmware-fo.patch | 36 ++ ...chscreen_dmi-add-info-for-the-irbis-.patch | 63 +++ ...chscreen_dmi-add-info-for-the-predia.patch | 67 +++ ...hash-isa-v3.0-tlbiel-instruction-gen.patch | 38 ++ ...c-drop-me200-addition-to-build-flags.patch | 51 ++ queue-5.9/s390-fix-irq-state-tracing.patch | 115 ++++ ...mples-ftrace-mark-my_tramp-12-global.patch | 74 +++ ...ed-idle-fix-arch_cpu_idle-vs-tracing.patch | 490 ++++++++++++++++++ ...sc-fix-error-return-in-storvsc_probe.patch | 40 ++ ...xpected-values-from-ufshcd_read_desc.patch | 89 ++++ ...re-clk-scaling-happens-only-when-hba.patch | 57 ++ queue-5.9/series | 71 +++ ...t-the-cpumask-through-cpumask_of-cpu.patch | 110 ++++ ...-fix-fspi-panic-by-unexpected-interr.patch | 57 ++ ...-fix-to-check-the-write-failure-corr.patch | 88 ++++ ...-ohci-omap-fix-descriptor-conversion.patch | 68 +++ ...dpa-mlx5-fix-vdpa-vhost-dependencies.patch | 70 +++ ...age-pinning-leakage-in-error-path-re.patch | 184 +++++++ ...export-s390-symbols-for-zlib-modules.patch | 61 +++ 72 files changed, 5414 insertions(+) create mode 100644 queue-5.9/arc-stack-unwinding-don-t-assume-non-current-task-is.patch create mode 100644 queue-5.9/arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch create mode 100644 queue-5.9/arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch create mode 100644 queue-5.9/arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch create mode 100644 queue-5.9/arm64-dts-rockchip-remove-system-power-controller-fr.patch create mode 100644 queue-5.9/arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch create mode 100644 queue-5.9/arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch create mode 100644 queue-5.9/asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch create mode 100644 queue-5.9/batman-adv-consider-fragmentation-for-needed_headroo.patch create mode 100644 queue-5.9/batman-adv-don-t-always-reallocate-the-fragmentation.patch create mode 100644 queue-5.9/batman-adv-reserve-needed_-room-for-fragments.patch create mode 100644 queue-5.9/bpftool-fix-error-return-value-in-build_btf_type_tab.patch create mode 100644 queue-5.9/btrfs-do-nofs-allocations-when-adding-and-removing-q.patch create mode 100644 queue-5.9/btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch create mode 100644 queue-5.9/can-c_can-c_can_power_up-fix-error-handling.patch create mode 100644 queue-5.9/can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch create mode 100644 queue-5.9/can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch create mode 100644 queue-5.9/can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch create mode 100644 queue-5.9/can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch create mode 100644 queue-5.9/can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch create mode 100644 queue-5.9/drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch create mode 100644 queue-5.9/drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch create mode 100644 queue-5.9/drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch create mode 100644 queue-5.9/habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch create mode 100644 queue-5.9/ibmvnic-avoid-memset-null-scrq-msgs.patch create mode 100644 queue-5.9/ibmvnic-delay-next-reset-if-hard-reset-fails.patch create mode 100644 queue-5.9/ibmvnic-handle-inconsistent-login-with-reset.patch create mode 100644 queue-5.9/ibmvnic-reduce-wait-for-completion-time.patch create mode 100644 queue-5.9/ibmvnic-send_login-should-check-for-crq-errors.patch create mode 100644 queue-5.9/ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch create mode 100644 queue-5.9/ibmvnic-stop-free_all_rwi-on-failed-reset.patch create mode 100644 queue-5.9/ibmvnic-track-pending-login.patch create mode 100644 queue-5.9/intel_idle-build-fix.patch create mode 100644 queue-5.9/intel_idle-fix-intel_idle-vs-tracing.patch create mode 100644 queue-5.9/interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch create mode 100644 queue-5.9/interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch create mode 100644 queue-5.9/ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch create mode 100644 queue-5.9/irqchip-gic-v3-its-unconditionally-save-restore-the-.patch create mode 100644 queue-5.9/iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch create mode 100644 queue-5.9/iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch create mode 100644 queue-5.9/iwlwifi-pcie-limit-memory-read-spin-time.patch create mode 100644 queue-5.9/iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch create mode 100644 queue-5.9/iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch create mode 100644 queue-5.9/mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch create mode 100644 queue-5.9/net-broadcom-cnic-requires-mmu.patch create mode 100644 queue-5.9/net-xsk-avoid-taking-multiple-skbuff-references.patch create mode 100644 queue-5.9/perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch create mode 100644 queue-5.9/phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch create mode 100644 queue-5.9/platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch create mode 100644 queue-5.9/platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch create mode 100644 queue-5.9/platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch create mode 100644 queue-5.9/platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch create mode 100644 queue-5.9/platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch create mode 100644 queue-5.9/platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch create mode 100644 queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch create mode 100644 queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-predia.patch create mode 100644 queue-5.9/powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch create mode 100644 queue-5.9/powerpc-drop-me200-addition-to-build-flags.patch create mode 100644 queue-5.9/s390-fix-irq-state-tracing.patch create mode 100644 queue-5.9/samples-ftrace-mark-my_tramp-12-global.patch create mode 100644 queue-5.9/sched-idle-fix-arch_cpu_idle-vs-tracing.patch create mode 100644 queue-5.9/scsi-storvsc-fix-error-return-in-storvsc_probe.patch create mode 100644 queue-5.9/scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch create mode 100644 queue-5.9/scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch create mode 100644 queue-5.9/soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch create mode 100644 queue-5.9/spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch create mode 100644 queue-5.9/tools-bootconfig-fix-to-check-the-write-failure-corr.patch create mode 100644 queue-5.9/usb-ohci-omap-fix-descriptor-conversion.patch create mode 100644 queue-5.9/vdpa-mlx5-fix-vdpa-vhost-dependencies.patch create mode 100644 queue-5.9/vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch create mode 100644 queue-5.9/zlib-export-s390-symbols-for-zlib-modules.patch diff --git a/queue-5.9/arc-stack-unwinding-don-t-assume-non-current-task-is.patch b/queue-5.9/arc-stack-unwinding-don-t-assume-non-current-task-is.patch new file mode 100644 index 00000000000..238eba2f9d2 --- /dev/null +++ b/queue-5.9/arc-stack-unwinding-don-t-assume-non-current-task-is.patch @@ -0,0 +1,96 @@ +From bace1fcd6a8a2859c4beedfe5b12c5c0c839278f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 16:59:27 -0800 +Subject: ARC: stack unwinding: don't assume non-current task is sleeping + +From: Vineet Gupta + +[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ] + +To start stack unwinding (SP, PC and BLINK) are needed. When the +explicit execution context (pt_regs etc) is not available, unwinder +assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK +from kernel mode stack. + +But this assumption is not true, specially in a SMP system, when top +runs on 1 core, there may be active running processes on all cores. + +So when unwinding non courrent tasks, ensure they are NOT running. + +And while at it, handle the self unwinding case explicitly. + +This came out of investigation of a customer reported hang with +rcutorture+top + +Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31 +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/stacktrace.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c +index b23986f984509..b2557f581ea8c 100644 +--- a/arch/arc/kernel/stacktrace.c ++++ b/arch/arc/kernel/stacktrace.c +@@ -38,15 +38,15 @@ + + #ifdef CONFIG_ARC_DW2_UNWIND + +-static void seed_unwind_frame_info(struct task_struct *tsk, +- struct pt_regs *regs, +- struct unwind_frame_info *frame_info) ++static int ++seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs, ++ struct unwind_frame_info *frame_info) + { + /* + * synchronous unwinding (e.g. dump_stack) + * - uses current values of SP and friends + */ +- if (tsk == NULL && regs == NULL) { ++ if (regs == NULL && (tsk == NULL || tsk == current)) { + unsigned long fp, sp, blink, ret; + frame_info->task = current; + +@@ -65,11 +65,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk, + frame_info->call_frame = 0; + } else if (regs == NULL) { + /* +- * Asynchronous unwinding of sleeping task +- * - Gets SP etc from task's pt_regs (saved bottom of kernel +- * mode stack of task) ++ * Asynchronous unwinding of a likely sleeping task ++ * - first ensure it is actually sleeping ++ * - if so, it will be in __switch_to, kernel mode SP of task ++ * is safe-kept and BLINK at a well known location in there + */ + ++ if (tsk->state == TASK_RUNNING) ++ return -1; ++ + frame_info->task = tsk; + + frame_info->regs.r27 = TSK_K_FP(tsk); +@@ -103,6 +107,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk, + frame_info->regs.r63 = regs->ret; + frame_info->call_frame = 0; + } ++ ++ return 0; + } + + #endif +@@ -116,7 +122,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs, + unsigned int address; + struct unwind_frame_info frame_info; + +- seed_unwind_frame_info(tsk, regs, &frame_info); ++ if (seed_unwind_frame_info(tsk, regs, &frame_info)) ++ return 0; + + while (1) { + address = UNW_PC(&frame_info); +-- +2.27.0 + diff --git a/queue-5.9/arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch b/queue-5.9/arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch new file mode 100644 index 00000000000..265c680365a --- /dev/null +++ b/queue-5.9/arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch @@ -0,0 +1,94 @@ +From 77fa6601450d4af29ba843320039ba9aaac7d1d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 22:05:19 +0000 +Subject: arm-smmu-qcom: Ensure the qcom_scm driver has finished probing + +From: John Stultz + +[ Upstream commit 72b55c96f3a5ae6e486c20b5dacf5114060ed042 ] + +Robin Murphy pointed out that if the arm-smmu driver probes before +the qcom_scm driver, we may call qcom_scm_qsmmu500_wait_safe_toggle() +before the __scm is initialized. + +Now, getting this to happen is a bit contrived, as in my efforts it +required enabling asynchronous probing for both drivers, moving the +firmware dts node to the end of the dtsi file, as well as forcing a +long delay in the qcom_scm_probe function. + +With those tweaks we ran into the following crash: +[ 2.631040] arm-smmu 15000000.iommu: Stage-1: 48-bit VA -> 48-bit IPA +[ 2.633372] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +... +[ 2.633402] [0000000000000000] user address but active_mm is swapper +[ 2.633409] Internal error: Oops: 96000005 [#1] PREEMPT SMP +[ 2.633415] Modules linked in: +[ 2.633427] CPU: 5 PID: 117 Comm: kworker/u16:2 Tainted: G W 5.10.0-rc1-mainline-00025-g272a618fc36-dirty #3971 +[ 2.633430] Hardware name: Thundercomm Dragonboard 845c (DT) +[ 2.633448] Workqueue: events_unbound async_run_entry_fn +[ 2.633456] pstate: 80c00005 (Nzcv daif +PAN +UAO -TCO BTYPE=--) +[ 2.633465] pc : qcom_scm_qsmmu500_wait_safe_toggle+0x78/0xb0 +[ 2.633473] lr : qcom_smmu500_reset+0x58/0x78 +[ 2.633476] sp : ffffffc0105a3b60 +... +[ 2.633567] Call trace: +[ 2.633572] qcom_scm_qsmmu500_wait_safe_toggle+0x78/0xb0 +[ 2.633576] qcom_smmu500_reset+0x58/0x78 +[ 2.633581] arm_smmu_device_reset+0x194/0x270 +[ 2.633585] arm_smmu_device_probe+0xc94/0xeb8 +[ 2.633592] platform_drv_probe+0x58/0xa8 +[ 2.633597] really_probe+0xec/0x398 +[ 2.633601] driver_probe_device+0x5c/0xb8 +[ 2.633606] __driver_attach_async_helper+0x64/0x88 +[ 2.633610] async_run_entry_fn+0x4c/0x118 +[ 2.633617] process_one_work+0x20c/0x4b0 +[ 2.633621] worker_thread+0x48/0x460 +[ 2.633628] kthread+0x14c/0x158 +[ 2.633634] ret_from_fork+0x10/0x18 +[ 2.633642] Code: a9034fa0 d0007f73 29107fa0 91342273 (f9400020) + +To avoid this, this patch adds a check on qcom_scm_is_available() in +the qcom_smmu_impl_init() function, returning -EPROBE_DEFER if its +not ready. + +This allows the driver to try to probe again later after qcom_scm has +finished probing. + +Reported-by: Robin Murphy +Signed-off-by: John Stultz +Reviewed-by: Robin Murphy +Cc: Robin Murphy +Cc: Will Deacon +Cc: Andy Gross +Cc: Maulik Shah +Cc: Bjorn Andersson +Cc: Saravana Kannan +Cc: Marc Zyngier +Cc: Lina Iyer +Cc: iommu@lists.linux-foundation.org +Cc: linux-arm-msm +Link: https://lore.kernel.org/r/20201112220520.48159-1-john.stultz@linaro.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +index be4318044f96c..702fbaa6c9ada 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +@@ -69,6 +69,10 @@ struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu) + { + struct qcom_smmu *qsmmu; + ++ /* Check to make sure qcom_scm has finished probing */ ++ if (!qcom_scm_is_available()) ++ return ERR_PTR(-EPROBE_DEFER); ++ + qsmmu = devm_kzalloc(smmu->dev, sizeof(*qsmmu), GFP_KERNEL); + if (!qsmmu) + return ERR_PTR(-ENOMEM); +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch b/queue-5.9/arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch new file mode 100644 index 00000000000..5997663d899 --- /dev/null +++ b/queue-5.9/arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch @@ -0,0 +1,111 @@ +From 5bac1a6a1135acd54e375cce5d12be8069934937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 17:08:32 +0800 +Subject: arm64: dts: broadcom: clear the warnings caused by empty dma-ranges + +From: Zhen Lei + +[ Upstream commit 2013a4b684b6eb614ee5c9a3c07b0ae6f5ca96d9 ] + +The scripts/dtc/checks.c requires that the node have empty "dma-ranges" +property must have the same "#address-cells" and "#size-cells" values as +the parent node. Otherwise, the following warnings is reported: + +arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning \ +(dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but \ +its #address-cells (1) differs from / (2) +arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning \ +(dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but \ +its #size-cells (1) differs from / (2) + +Arnd Bergmann figured out why it's necessary: +Also note that the #address-cells=<1> means that any device under +this bus is assumed to only support 32-bit addressing, and DMA will +have to go through a slow swiotlb in the absence of an IOMMU. + +Suggested-by: Arnd Bergmann +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20201016090833.1892-2-thunder.leizhen@huawei.com' +Acked-by: Florian Fainelli +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + .../dts/broadcom/stingray/stingray-usb.dtsi | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi +index 55259f973b5a9..aef8f2b00778d 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi +@@ -5,20 +5,20 @@ + usb { + compatible = "simple-bus"; + dma-ranges; +- #address-cells = <1>; +- #size-cells = <1>; +- ranges = <0x0 0x0 0x68500000 0x00400000>; ++ #address-cells = <2>; ++ #size-cells = <2>; ++ ranges = <0x0 0x0 0x0 0x68500000 0x0 0x00400000>; + + usbphy0: usb-phy@0 { + compatible = "brcm,sr-usb-combo-phy"; +- reg = <0x00000000 0x100>; ++ reg = <0x0 0x00000000 0x0 0x100>; + #phy-cells = <1>; + status = "disabled"; + }; + + xhci0: usb@1000 { + compatible = "generic-xhci"; +- reg = <0x00001000 0x1000>; ++ reg = <0x0 0x00001000 0x0 0x1000>; + interrupts = ; + phys = <&usbphy0 1>, <&usbphy0 0>; + phy-names = "phy0", "phy1"; +@@ -28,7 +28,7 @@ + + bdc0: usb@2000 { + compatible = "brcm,bdc-v0.16"; +- reg = <0x00002000 0x1000>; ++ reg = <0x0 0x00002000 0x0 0x1000>; + interrupts = ; + phys = <&usbphy0 0>, <&usbphy0 1>; + phy-names = "phy0", "phy1"; +@@ -38,21 +38,21 @@ + + usbphy1: usb-phy@10000 { + compatible = "brcm,sr-usb-combo-phy"; +- reg = <0x00010000 0x100>; ++ reg = <0x0 0x00010000 0x0 0x100>; + #phy-cells = <1>; + status = "disabled"; + }; + + usbphy2: usb-phy@20000 { + compatible = "brcm,sr-usb-hs-phy"; +- reg = <0x00020000 0x100>; ++ reg = <0x0 0x00020000 0x0 0x100>; + #phy-cells = <0>; + status = "disabled"; + }; + + xhci1: usb@11000 { + compatible = "generic-xhci"; +- reg = <0x00011000 0x1000>; ++ reg = <0x0 0x00011000 0x0 0x1000>; + interrupts = ; + phys = <&usbphy1 1>, <&usbphy2>, <&usbphy1 0>; + phy-names = "phy0", "phy1", "phy2"; +@@ -62,7 +62,7 @@ + + bdc1: usb@21000 { + compatible = "brcm,bdc-v0.16"; +- reg = <0x00021000 0x1000>; ++ reg = <0x0 0x00021000 0x0 0x1000>; + interrupts = ; + phys = <&usbphy2>; + phy-names = "phy0"; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch b/queue-5.9/arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch new file mode 100644 index 00000000000..732350e0326 --- /dev/null +++ b/queue-5.9/arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch @@ -0,0 +1,43 @@ +From eeddc64913fdec6191aa70143d945e01bf3e2b48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 17:23:55 +0100 +Subject: arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 + boards. + +From: Markus Reichl + +[ Upstream commit 0011c6d182774fc781fb9e115ebe8baa356029ae ] + +Recently introduced async probe on mmc devices can shuffle block IDs. +Pin them to fixed values to ease booting in environments where UUIDs +are not practical. Use newly introduced aliases for mmcblk devices from [1]. + +[1] +https://patchwork.kernel.org/patch/11747669/ + +Signed-off-by: Markus Reichl +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20201104162356.1251-1-m.reichl@fivetechno.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index ada724b12f014..7a9a7aca86c6a 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -29,6 +29,9 @@ + i2c6 = &i2c6; + i2c7 = &i2c7; + i2c8 = &i2c8; ++ mmc0 = &sdio0; ++ mmc1 = &sdmmc; ++ mmc2 = &sdhci; + serial0 = &uart0; + serial1 = &uart1; + serial2 = &uart2; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-rockchip-remove-system-power-controller-fr.patch b/queue-5.9/arm64-dts-rockchip-remove-system-power-controller-fr.patch new file mode 100644 index 00000000000..9a1f852c542 --- /dev/null +++ b/queue-5.9/arm64-dts-rockchip-remove-system-power-controller-fr.patch @@ -0,0 +1,36 @@ +From 1d7d7ff59238b7cd712d03e3677fc70a75f48e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 20:16:29 +0200 +Subject: arm64: dts: rockchip: Remove system-power-controller from pmic on + Odroid Go Advance + +From: Maciej Matuszczyk + +[ Upstream commit 01fe332800d0d2f94337b45c1973f4cf28ae6195 ] + +This fixes a poweroff issue when this is supposed to happen +via PSCI. + +Signed-off-by: Maciej Matuszczyk +Link: https://lore.kernel.org/r/20201023181629.119727-1-maccraft123mc@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts b/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts +index 35bd6b904b9c7..3376810385193 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts +@@ -243,7 +243,6 @@ + interrupts = ; + pinctrl-names = "default"; + pinctrl-0 = <&pmic_int>; +- rockchip,system-power-controller; + wakeup-source; + #clock-cells = <1>; + clock-output-names = "rk808-clkout1", "xin32k"; +-- +2.27.0 + diff --git a/queue-5.9/arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch b/queue-5.9/arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch new file mode 100644 index 00000000000..12b0e4f4024 --- /dev/null +++ b/queue-5.9/arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch @@ -0,0 +1,48 @@ +From adf7bf75f95470420af58d11197da4a866228798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 20:29:31 +0100 +Subject: arm64: dts: rockchip: Reorder LED triggers from mmc devices on + rk3399-roc-pc. + +From: Markus Reichl + +[ Upstream commit 7327c8b98e2e14c47021eea14d1ab268086a6408 ] + +After patch [1] SD-card becomes mmc1 and eMMC becomes mmc2. +Correct trigger of LEDs accordingly. + +[1] +https://patchwork.kernel.org/patch/11881427 + +Signed-off-by: Markus Reichl +Link: https://lore.kernel.org/r/20201104192933.1001-1-m.reichl@fivetechno.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi +index b85ec31cd2835..78ef0037ad4b5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi +@@ -74,14 +74,14 @@ + label = "red:diy"; + gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>; + default-state = "off"; +- linux,default-trigger = "mmc1"; ++ linux,default-trigger = "mmc2"; + }; + + yellow_led: led-2 { + label = "yellow:yellow-led"; + gpios = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>; + default-state = "off"; +- linux,default-trigger = "mmc0"; ++ linux,default-trigger = "mmc1"; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.9/arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch b/queue-5.9/arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch new file mode 100644 index 00000000000..fd6ada7d130 --- /dev/null +++ b/queue-5.9/arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch @@ -0,0 +1,56 @@ +From 6ad4b7b07502704548df4311339ec60c8874afa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 16:20:26 +0000 +Subject: arm64: tegra: Disable the ACONNECT for Jetson TX2 + +From: Jon Hunter + +[ Upstream commit fb319496935b7475a863a00c76895e8bb3216704 ] + +Commit ff4c371d2bc0 ("arm64: defconfig: Build ADMA and ACONNECT driver") +enable the Tegra ADMA and ACONNECT drivers and this is causing resume +from system suspend to fail on Jetson TX2. Resume is failing because the +ACONNECT driver is being resumed before the BPMP driver, and the ACONNECT +driver is attempting to power on a power-domain that is provided by the +BPMP. While a proper fix for the resume sequencing problem is identified, +disable the ACONNECT for Jetson TX2 temporarily to avoid breaking system +suspend. + +Please note that ACONNECT driver is used by the Audio Processing Engine +(APE) on Tegra, but because there is no mainline support for APE on +Jetson TX2 currently, disabling the ACONNECT does not disable any useful +feature at the moment. + +Signed-off-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +index 802b8c52489ac..b5a23643db978 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +@@ -10,18 +10,6 @@ + model = "NVIDIA Jetson TX2 Developer Kit"; + compatible = "nvidia,p2771-0000", "nvidia,tegra186"; + +- aconnect { +- status = "okay"; +- +- dma-controller@2930000 { +- status = "okay"; +- }; +- +- interrupt-controller@2a40000 { +- status = "okay"; +- }; +- }; +- + i2c@3160000 { + power-monitor@42 { + compatible = "ti,ina3221"; +-- +2.27.0 + diff --git a/queue-5.9/asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch b/queue-5.9/asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch new file mode 100644 index 00000000000..afbdfc78244 --- /dev/null +++ b/queue-5.9/asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch @@ -0,0 +1,99 @@ +From 282453005d442d5fde7e0f319c58bf2a207998c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 13:15:15 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 Detachable quirks + +From: Hans de Goede + +[ Upstream commit fbdae7d6d04d2db36c687723920f612e93b2cbda ] + +The HP Pavilion x2 Detachable line comes in many variants: + +1. Bay Trail SoC + AXP288 PMIC, Micro-USB charging (10-k010nz, ...) + DMI_SYS_VENDOR: "Hewlett-Packard" + DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable PC 10" + DMI_BOARD_NAME: "8021" + +2. Bay Trail SoC + AXP288 PMIC, Type-C charging (10-n000nd, 10-n010nl, ...) + DMI_SYS_VENDOR: "Hewlett-Packard" + DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable" + DMI_BOARD_NAME: "815D" + +3. Cherry Trail SoC + AXP288 PMIC, Type-C charging (10-n101ng, ...) + DMI_SYS_VENDOR: "HP" + DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable" + DMI_BOARD_NAME: "813E" + +4. Cherry Trail SoC + TI PMIC, Type-C charging (10-p002nd, 10-p018wm, ...) + DMI_SYS_VENDOR: "HP" + DMI_PRODUCT_NAME: "HP x2 Detachable 10-p0XX" + DMI_BOARD_NAME: "827C" + +5. Cherry Trail SoC + TI PMIC, Type-C charging (x2-210-g2, ...) + DMI_SYS_VENDOR: "HP" + DMI_PRODUCT_NAME: "HP x2 210 G2" + DMI_BOARD_NAME: "82F4" + +Variant 1 needs the exact same quirk as variant 2, so relax the DMI check +for the existing quirk a bit so that it matches both variant 1 and 2 +(note the other variants will still not match). + +Variant 2 already has an existing quirk (which now also matches variant 1) + +Variant 3 uses a cx2072x codec, so is not applicable here. + +Variant 4 almost works with the defaults, but it also needs a quirk to +fix jack-detection, add a new quirk for this. + +Variant 5 does use a RT5640 codec (based on old dmesg output), but was +otherwise not tested, keep using the defaults for this variant. + +Fixes: ec8e8418ff7d ("ASoC: Intel: bytcr_rt5640: Add quirks for various devices") +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20201118121515.11441-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index fc202747ba837..b956e1675132a 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -521,10 +521,10 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + .driver_data = (void *)(BYT_RT5640_IN1_MAP | + BYT_RT5640_MCLK_EN), + }, +- { /* HP Pavilion x2 10-n000nd */ ++ { /* HP Pavilion x2 10-k0XX, 10-n0XX */ + .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), + }, + .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | + BYT_RT5640_JD_SRC_JD2_IN4N | +@@ -533,6 +533,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* HP Pavilion x2 10-p0XX */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD1_IN4P | ++ BYT_RT5640_OVCD_TH_1500UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* HP Stream 7 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.27.0 + diff --git a/queue-5.9/batman-adv-consider-fragmentation-for-needed_headroo.patch b/queue-5.9/batman-adv-consider-fragmentation-for-needed_headroo.patch new file mode 100644 index 00000000000..9becad0158f --- /dev/null +++ b/queue-5.9/batman-adv-consider-fragmentation-for-needed_headroo.patch @@ -0,0 +1,45 @@ +From c8cf511824480f337a76cbfba0da4a7d67a2dda3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:15:06 +0100 +Subject: batman-adv: Consider fragmentation for needed_headroom +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Eckelmann + +[ Upstream commit 4ca23e2c2074465bff55ea14221175fecdf63c5f ] + +If a batman-adv packets has to be fragmented, then the original batman-adv +packet header is not stripped away. Instead, only a new header is added in +front of the packet after it was split. + +This size must be considered to avoid cost intensive reallocations during +the transmission through the various device layers. + +Fixes: 7bca68c7844b ("batman-adv: Add lower layer needed_(head|tail)room to own ones") +Reported-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/hard-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index fa06b51c0144d..d72c183919b44 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -554,6 +554,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface) + needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN); + needed_headroom += batadv_max_header_len(); + ++ /* fragmentation headers don't strip the unicast/... header */ ++ needed_headroom += sizeof(struct batadv_frag_packet); ++ + soft_iface->needed_headroom = needed_headroom; + soft_iface->needed_tailroom = lower_tailroom; + } +-- +2.27.0 + diff --git a/queue-5.9/batman-adv-don-t-always-reallocate-the-fragmentation.patch b/queue-5.9/batman-adv-don-t-always-reallocate-the-fragmentation.patch new file mode 100644 index 00000000000..7a9502c0ce9 --- /dev/null +++ b/queue-5.9/batman-adv-don-t-always-reallocate-the-fragmentation.patch @@ -0,0 +1,53 @@ +From b4c5149c50b671712242cb27f5fd8f634cee1675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:24:49 +0100 +Subject: batman-adv: Don't always reallocate the fragmentation skb head + +From: Sven Eckelmann + +[ Upstream commit 992b03b88e36254e26e9a4977ab948683e21bd9f ] + +When a packet is fragmented by batman-adv, the original batman-adv header +is not modified. Only a new fragmentation is inserted between the original +one and the ethernet header. The code must therefore make sure that it has +a writable region of this size in the skbuff head. + +But it is not useful to always reallocate the skbuff by this size even when +there would be more than enough headroom still in the skb. The reallocation +is just to costly during in this codepath. + +Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/fragmentation.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index dbd913bac9dd1..b7169c4147f55 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -527,13 +527,14 @@ int batadv_frag_send_packet(struct sk_buff *skb, + frag_header.no++; + } + +- /* Make room for the fragment header. */ +- if (batadv_skb_head_push(skb, header_size) < 0 || +- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) { +- ret = -ENOMEM; ++ /* make sure that there is at least enough head for the fragmentation ++ * and ethernet headers ++ */ ++ ret = skb_cow_head(skb, ETH_HLEN + header_size); ++ if (ret < 0) + goto put_primary_if; +- } + ++ skb_push(skb, header_size); + memcpy(skb->data, &frag_header, header_size); + + /* Send the last fragment */ +-- +2.27.0 + diff --git a/queue-5.9/batman-adv-reserve-needed_-room-for-fragments.patch b/queue-5.9/batman-adv-reserve-needed_-room-for-fragments.patch new file mode 100644 index 00000000000..851a6f5a98a --- /dev/null +++ b/queue-5.9/batman-adv-reserve-needed_-room-for-fragments.patch @@ -0,0 +1,93 @@ +From 80083c79bc21c3e238c543573723581b1a137bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 13:16:43 +0100 +Subject: batman-adv: Reserve needed_*room for fragments + +From: Sven Eckelmann + +[ Upstream commit c5cbfc87558168ef4c3c27ce36eba6b83391db19 ] + +The batadv net_device is trying to propagate the needed_headroom and +needed_tailroom from the lower devices. This is needed to avoid cost +intensive reallocations using pskb_expand_head during the transmission. + +But the fragmentation code split the skb's without adding extra room at the +end/beginning of the various fragments. This reduced the performance of +transmissions over complex scenarios (batadv on vxlan on wireguard) because +the lower devices had to perform the reallocations at least once. + +Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/fragmentation.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index 9fdbe30681537..dbd913bac9dd1 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -391,6 +391,7 @@ out: + + /** + * batadv_frag_create() - create a fragment from skb ++ * @net_dev: outgoing device for fragment + * @skb: skb to create fragment from + * @frag_head: header to use in new fragment + * @fragment_size: size of new fragment +@@ -401,22 +402,25 @@ out: + * + * Return: the new fragment, NULL on error. + */ +-static struct sk_buff *batadv_frag_create(struct sk_buff *skb, ++static struct sk_buff *batadv_frag_create(struct net_device *net_dev, ++ struct sk_buff *skb, + struct batadv_frag_packet *frag_head, + unsigned int fragment_size) + { ++ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev); ++ unsigned int tailroom = net_dev->needed_tailroom; + struct sk_buff *skb_fragment; + unsigned int header_size = sizeof(*frag_head); + unsigned int mtu = fragment_size + header_size; + +- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN); ++ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom); + if (!skb_fragment) + goto err; + + skb_fragment->priority = skb->priority; + + /* Eat the last mtu-bytes of the skb */ +- skb_reserve(skb_fragment, header_size + ETH_HLEN); ++ skb_reserve(skb_fragment, ll_reserved + header_size); + skb_split(skb, skb_fragment, skb->len - fragment_size); + + /* Add the header */ +@@ -439,11 +443,12 @@ int batadv_frag_send_packet(struct sk_buff *skb, + struct batadv_orig_node *orig_node, + struct batadv_neigh_node *neigh_node) + { ++ struct net_device *net_dev = neigh_node->if_incoming->net_dev; + struct batadv_priv *bat_priv; + struct batadv_hard_iface *primary_if = NULL; + struct batadv_frag_packet frag_header; + struct sk_buff *skb_fragment; +- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu; ++ unsigned int mtu = net_dev->mtu; + unsigned int header_size = sizeof(frag_header); + unsigned int max_fragment_size, num_fragments; + int ret; +@@ -503,7 +508,7 @@ int batadv_frag_send_packet(struct sk_buff *skb, + goto put_primary_if; + } + +- skb_fragment = batadv_frag_create(skb, &frag_header, ++ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header, + max_fragment_size); + if (!skb_fragment) { + ret = -ENOMEM; +-- +2.27.0 + diff --git a/queue-5.9/bpftool-fix-error-return-value-in-build_btf_type_tab.patch b/queue-5.9/bpftool-fix-error-return-value-in-build_btf_type_tab.patch new file mode 100644 index 00000000000..37adc8b338d --- /dev/null +++ b/queue-5.9/bpftool-fix-error-return-value-in-build_btf_type_tab.patch @@ -0,0 +1,37 @@ +From 5b3ec815d2a348d3c7808441cdde5f985be7af2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 18:41:00 +0800 +Subject: bpftool: Fix error return value in build_btf_type_table + +From: Zhen Lei + +[ Upstream commit 68878a5c5b852d17f5827ce8a0f6fbd8b4cdfada ] + +An appropriate return value should be set on the failed path. + +Fixes: 4d374ba0bf30 ("tools: bpftool: implement "bpftool btf show|list"") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20201124104100.491-1-thunder.leizhen@huawei.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/btf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c +index 8ab142ff5eac5..2afb7d5b1aca2 100644 +--- a/tools/bpf/bpftool/btf.c ++++ b/tools/bpf/bpftool/btf.c +@@ -693,6 +693,7 @@ build_btf_type_table(struct btf_attach_table *tab, enum bpf_obj_type type, + obj_node = calloc(1, sizeof(*obj_node)); + if (!obj_node) { + p_err("failed to allocate memory: %s", strerror(errno)); ++ err = -ENOMEM; + goto err_free; + } + +-- +2.27.0 + diff --git a/queue-5.9/btrfs-do-nofs-allocations-when-adding-and-removing-q.patch b/queue-5.9/btrfs-do-nofs-allocations-when-adding-and-removing-q.patch new file mode 100644 index 00000000000..0dec5b8431f --- /dev/null +++ b/queue-5.9/btrfs-do-nofs-allocations-when-adding-and-removing-q.patch @@ -0,0 +1,71 @@ +From 16407b465d29f678d91a5f75fb36565735e33559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 18:30:54 +0000 +Subject: btrfs: do nofs allocations when adding and removing qgroup relations + +From: Filipe Manana + +[ Upstream commit 7aa6d359845a9dbf7ad90b0b1b6347ef4764621f ] + +When adding or removing a qgroup relation we are doing a GFP_KERNEL +allocation which is not safe because we are holding a transaction +handle open and that can make us deadlock if the allocator needs to +recurse into the filesystem. So just surround those calls with a +nofs context. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 9205a88f2a881..15c38803576ce 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include "ctree.h" + #include "transaction.h" +@@ -1324,13 +1325,17 @@ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, + struct btrfs_qgroup *member; + struct btrfs_qgroup_list *list; + struct ulist *tmp; ++ unsigned int nofs_flag; + int ret = 0; + + /* Check the level of src and dst first */ + if (btrfs_qgroup_level(src) >= btrfs_qgroup_level(dst)) + return -EINVAL; + ++ /* We hold a transaction handle open, must do a NOFS allocation. */ ++ nofs_flag = memalloc_nofs_save(); + tmp = ulist_alloc(GFP_KERNEL); ++ memalloc_nofs_restore(nofs_flag); + if (!tmp) + return -ENOMEM; + +@@ -1387,10 +1392,14 @@ static int __del_qgroup_relation(struct btrfs_trans_handle *trans, u64 src, + struct btrfs_qgroup_list *list; + struct ulist *tmp; + bool found = false; ++ unsigned int nofs_flag; + int ret = 0; + int ret2; + ++ /* We hold a transaction handle open, must do a NOFS allocation. */ ++ nofs_flag = memalloc_nofs_save(); + tmp = ulist_alloc(GFP_KERNEL); ++ memalloc_nofs_restore(nofs_flag); + if (!tmp) + return -ENOMEM; + +-- +2.27.0 + diff --git a/queue-5.9/btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch b/queue-5.9/btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch new file mode 100644 index 00000000000..613fc901842 --- /dev/null +++ b/queue-5.9/btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch @@ -0,0 +1,281 @@ +From a06b85bca42d520e9bd6c17ef9f174cf43780a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 18:31:02 +0000 +Subject: btrfs: fix lockdep splat when enabling and disabling qgroups + +From: Filipe Manana + +[ Upstream commit a855fbe69229078cd8aecd8974fb996a5ca651e6 ] + +When running test case btrfs/017 from fstests, lockdep reported the +following splat: + + [ 1297.067385] ====================================================== + [ 1297.067708] WARNING: possible circular locking dependency detected + [ 1297.068022] 5.10.0-rc4-btrfs-next-73 #1 Not tainted + [ 1297.068322] ------------------------------------------------------ + [ 1297.068629] btrfs/189080 is trying to acquire lock: + [ 1297.068929] ffff9f2725731690 (sb_internal#2){.+.+}-{0:0}, at: btrfs_quota_enable+0xaf/0xa70 [btrfs] + [ 1297.069274] + but task is already holding lock: + [ 1297.069868] ffff9f2702b61a08 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_quota_enable+0x3b/0xa70 [btrfs] + [ 1297.070219] + which lock already depends on the new lock. + + [ 1297.071131] + the existing dependency chain (in reverse order) is: + [ 1297.071721] + -> #1 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}: + [ 1297.072375] lock_acquire+0xd8/0x490 + [ 1297.072710] __mutex_lock+0xa3/0xb30 + [ 1297.073061] btrfs_qgroup_inherit+0x59/0x6a0 [btrfs] + [ 1297.073421] create_subvol+0x194/0x990 [btrfs] + [ 1297.073780] btrfs_mksubvol+0x3fb/0x4a0 [btrfs] + [ 1297.074133] __btrfs_ioctl_snap_create+0x119/0x1a0 [btrfs] + [ 1297.074498] btrfs_ioctl_snap_create+0x58/0x80 [btrfs] + [ 1297.074872] btrfs_ioctl+0x1a90/0x36f0 [btrfs] + [ 1297.075245] __x64_sys_ioctl+0x83/0xb0 + [ 1297.075617] do_syscall_64+0x33/0x80 + [ 1297.075993] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + [ 1297.076380] + -> #0 (sb_internal#2){.+.+}-{0:0}: + [ 1297.077166] check_prev_add+0x91/0xc60 + [ 1297.077572] __lock_acquire+0x1740/0x3110 + [ 1297.077984] lock_acquire+0xd8/0x490 + [ 1297.078411] start_transaction+0x3c5/0x760 [btrfs] + [ 1297.078853] btrfs_quota_enable+0xaf/0xa70 [btrfs] + [ 1297.079323] btrfs_ioctl+0x2c60/0x36f0 [btrfs] + [ 1297.079789] __x64_sys_ioctl+0x83/0xb0 + [ 1297.080232] do_syscall_64+0x33/0x80 + [ 1297.080680] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + [ 1297.081139] + other info that might help us debug this: + + [ 1297.082536] Possible unsafe locking scenario: + + [ 1297.083510] CPU0 CPU1 + [ 1297.084005] ---- ---- + [ 1297.084500] lock(&fs_info->qgroup_ioctl_lock); + [ 1297.084994] lock(sb_internal#2); + [ 1297.085485] lock(&fs_info->qgroup_ioctl_lock); + [ 1297.085974] lock(sb_internal#2); + [ 1297.086454] + *** DEADLOCK *** + [ 1297.087880] 3 locks held by btrfs/189080: + [ 1297.088324] #0: ffff9f2725731470 (sb_writers#14){.+.+}-{0:0}, at: btrfs_ioctl+0xa73/0x36f0 [btrfs] + [ 1297.088799] #1: ffff9f2702b60cc0 (&fs_info->subvol_sem){++++}-{3:3}, at: btrfs_ioctl+0x1f4d/0x36f0 [btrfs] + [ 1297.089284] #2: ffff9f2702b61a08 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_quota_enable+0x3b/0xa70 [btrfs] + [ 1297.089771] + stack backtrace: + [ 1297.090662] CPU: 5 PID: 189080 Comm: btrfs Not tainted 5.10.0-rc4-btrfs-next-73 #1 + [ 1297.091132] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + [ 1297.092123] Call Trace: + [ 1297.092629] dump_stack+0x8d/0xb5 + [ 1297.093115] check_noncircular+0xff/0x110 + [ 1297.093596] check_prev_add+0x91/0xc60 + [ 1297.094076] ? kvm_clock_read+0x14/0x30 + [ 1297.094553] ? kvm_sched_clock_read+0x5/0x10 + [ 1297.095029] __lock_acquire+0x1740/0x3110 + [ 1297.095510] lock_acquire+0xd8/0x490 + [ 1297.095993] ? btrfs_quota_enable+0xaf/0xa70 [btrfs] + [ 1297.096476] start_transaction+0x3c5/0x760 [btrfs] + [ 1297.096962] ? btrfs_quota_enable+0xaf/0xa70 [btrfs] + [ 1297.097451] btrfs_quota_enable+0xaf/0xa70 [btrfs] + [ 1297.097941] ? btrfs_ioctl+0x1f4d/0x36f0 [btrfs] + [ 1297.098429] btrfs_ioctl+0x2c60/0x36f0 [btrfs] + [ 1297.098904] ? do_user_addr_fault+0x20c/0x430 + [ 1297.099382] ? kvm_clock_read+0x14/0x30 + [ 1297.099854] ? kvm_sched_clock_read+0x5/0x10 + [ 1297.100328] ? sched_clock+0x5/0x10 + [ 1297.100801] ? sched_clock_cpu+0x12/0x180 + [ 1297.101272] ? __x64_sys_ioctl+0x83/0xb0 + [ 1297.101739] __x64_sys_ioctl+0x83/0xb0 + [ 1297.102207] do_syscall_64+0x33/0x80 + [ 1297.102673] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + [ 1297.103148] RIP: 0033:0x7f773ff65d87 + +This is because during the quota enable ioctl we lock first the mutex +qgroup_ioctl_lock and then start a transaction, and starting a transaction +acquires a fs freeze semaphore (at the VFS level). However, every other +code path, except for the quota disable ioctl path, we do the opposite: +we start a transaction and then lock the mutex. + +So fix this by making the quota enable and disable paths to start the +transaction without having the mutex locked, and then, after starting the +transaction, lock the mutex and check if some other task already enabled +or disabled the quotas, bailing with success if that was the case. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ctree.h | 5 ++++- + fs/btrfs/qgroup.c | 57 ++++++++++++++++++++++++++++++++++++++++------- + 2 files changed, 53 insertions(+), 9 deletions(-) + +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 2f5ab8c47f506..c2e38516a931d 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -869,7 +869,10 @@ struct btrfs_fs_info { + */ + struct ulist *qgroup_ulist; + +- /* protect user change for quota operations */ ++ /* ++ * Protect user change for quota operations. If a transaction is needed, ++ * it must be started before locking this lock. ++ */ + struct mutex qgroup_ioctl_lock; + + /* list of dirty qgroups to be written at next commit */ +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 15c38803576ce..e6786f5d8457f 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -937,6 +937,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + struct btrfs_key found_key; + struct btrfs_qgroup *qgroup = NULL; + struct btrfs_trans_handle *trans = NULL; ++ struct ulist *ulist = NULL; + int ret = 0; + int slot; + +@@ -944,8 +945,8 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + if (fs_info->quota_root) + goto out; + +- fs_info->qgroup_ulist = ulist_alloc(GFP_KERNEL); +- if (!fs_info->qgroup_ulist) { ++ ulist = ulist_alloc(GFP_KERNEL); ++ if (!ulist) { + ret = -ENOMEM; + goto out; + } +@@ -953,6 +954,22 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + ret = btrfs_sysfs_add_qgroups(fs_info); + if (ret < 0) + goto out; ++ ++ /* ++ * Unlock qgroup_ioctl_lock before starting the transaction. This is to ++ * avoid lock acquisition inversion problems (reported by lockdep) between ++ * qgroup_ioctl_lock and the vfs freeze semaphores, acquired when we ++ * start a transaction. ++ * After we started the transaction lock qgroup_ioctl_lock again and ++ * check if someone else created the quota root in the meanwhile. If so, ++ * just return success and release the transaction handle. ++ * ++ * Also we don't need to worry about someone else calling ++ * btrfs_sysfs_add_qgroups() after we unlock and getting an error because ++ * that function returns 0 (success) when the sysfs entries already exist. ++ */ ++ mutex_unlock(&fs_info->qgroup_ioctl_lock); ++ + /* + * 1 for quota root item + * 1 for BTRFS_QGROUP_STATUS item +@@ -962,12 +979,20 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + * would be a lot of overkill. + */ + trans = btrfs_start_transaction(tree_root, 2); ++ ++ mutex_lock(&fs_info->qgroup_ioctl_lock); + if (IS_ERR(trans)) { + ret = PTR_ERR(trans); + trans = NULL; + goto out; + } + ++ if (fs_info->quota_root) ++ goto out; ++ ++ fs_info->qgroup_ulist = ulist; ++ ulist = NULL; ++ + /* + * initially create the quota tree + */ +@@ -1125,11 +1150,14 @@ out: + if (ret) { + ulist_free(fs_info->qgroup_ulist); + fs_info->qgroup_ulist = NULL; +- if (trans) +- btrfs_end_transaction(trans); + btrfs_sysfs_del_qgroups(fs_info); + } + mutex_unlock(&fs_info->qgroup_ioctl_lock); ++ if (ret && trans) ++ btrfs_end_transaction(trans); ++ else if (trans) ++ ret = btrfs_end_transaction(trans); ++ ulist_free(ulist); + return ret; + } + +@@ -1142,19 +1170,29 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + mutex_lock(&fs_info->qgroup_ioctl_lock); + if (!fs_info->quota_root) + goto out; ++ mutex_unlock(&fs_info->qgroup_ioctl_lock); + + /* + * 1 For the root item + * + * We should also reserve enough items for the quota tree deletion in + * btrfs_clean_quota_tree but this is not done. ++ * ++ * Also, we must always start a transaction without holding the mutex ++ * qgroup_ioctl_lock, see btrfs_quota_enable(). + */ + trans = btrfs_start_transaction(fs_info->tree_root, 1); ++ ++ mutex_lock(&fs_info->qgroup_ioctl_lock); + if (IS_ERR(trans)) { + ret = PTR_ERR(trans); ++ trans = NULL; + goto out; + } + ++ if (!fs_info->quota_root) ++ goto out; ++ + clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); + btrfs_qgroup_wait_for_completion(fs_info, false); + spin_lock(&fs_info->qgroup_lock); +@@ -1168,13 +1206,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + ret = btrfs_clean_quota_tree(trans, quota_root); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto end_trans; ++ goto out; + } + + ret = btrfs_del_root(trans, "a_root->root_key); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto end_trans; ++ goto out; + } + + list_del("a_root->dirty_list); +@@ -1186,10 +1224,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + + btrfs_put_root(quota_root); + +-end_trans: +- ret = btrfs_end_transaction(trans); + out: + mutex_unlock(&fs_info->qgroup_ioctl_lock); ++ if (ret && trans) ++ btrfs_end_transaction(trans); ++ else if (trans) ++ ret = btrfs_end_transaction(trans); ++ + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.9/can-c_can-c_can_power_up-fix-error-handling.patch b/queue-5.9/can-c_can-c_can_power_up-fix-error-handling.patch new file mode 100644 index 00000000000..4419a7fcd41 --- /dev/null +++ b/queue-5.9/can-c_can-c_can_power_up-fix-error-handling.patch @@ -0,0 +1,66 @@ +From af9057ce5b04ac291f7aa733e0f98b8f5909dbc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 21:39:21 +0800 +Subject: can: c_can: c_can_power_up(): fix error handling + +From: Zhang Qilong + +[ Upstream commit 44cef0c0ffbd8d61143712ce874be68a273b7884 ] + +In the error handling in c_can_power_up(), there are two bugs: + +1) c_can_pm_runtime_get_sync() will increase usage counter if device is not + empty. Forgetting to call c_can_pm_runtime_put_sync() will result in a + reference leak here. + +2) c_can_reset_ram() operation will set start bit when enable is true. We + should clear it in the error handling. + +We fix it by adding c_can_pm_runtime_put_sync() for 1), and +c_can_reset_ram(enable is false) for 2) in the error handling. + +Fixes: 8212003260c60 ("can: c_can: Add d_can suspend resume support") +Fixes: 52cde85acc23f ("can: c_can: Add d_can raminit support") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201128133922.3276973-2-zhangqilong3@huawei.com +[mkl: return "0" instead of "ret"] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 8e9f5620c9a21..095505fa09de3 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -1304,12 +1304,22 @@ int c_can_power_up(struct net_device *dev) + time_after(time_out, jiffies)) + cpu_relax(); + +- if (time_after(jiffies, time_out)) +- return -ETIMEDOUT; ++ if (time_after(jiffies, time_out)) { ++ ret = -ETIMEDOUT; ++ goto err_out; ++ } + + ret = c_can_start(dev); +- if (!ret) +- c_can_irq_control(priv, true); ++ if (ret) ++ goto err_out; ++ ++ c_can_irq_control(priv, true); ++ ++ return 0; ++ ++err_out: ++ c_can_reset_ram(priv, false); ++ c_can_pm_runtime_put_sync(priv); + + return ret; + } +-- +2.27.0 + diff --git a/queue-5.9/can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch b/queue-5.9/can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch new file mode 100644 index 00000000000..d7f492f7d7c --- /dev/null +++ b/queue-5.9/can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch @@ -0,0 +1,40 @@ +From eb581ded4261f6724f3b578827ce09e2588231ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 21:39:22 +0800 +Subject: can: kvaser_pciefd: kvaser_pciefd_open(): fix error handling + +From: Zhang Qilong + +[ Upstream commit 13a84cf37a4cf1155a41684236c2314eb40cd65c ] + +If kvaser_pciefd_bus_on() failed, we should call close_candev() to avoid +reference leak. + +Fixes: 26ad340e582d3 ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201128133922.3276973-3-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/kvaser_pciefd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c +index 72acd1ba162d2..43151dd6cb1c3 100644 +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -692,8 +692,10 @@ static int kvaser_pciefd_open(struct net_device *netdev) + return err; + + err = kvaser_pciefd_bus_on(can); +- if (err) ++ if (err) { ++ close_candev(netdev); + return err; ++ } + + return 0; + } +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch b/queue-5.9/can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch new file mode 100644 index 00000000000..10e0c93339a --- /dev/null +++ b/queue-5.9/can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch @@ -0,0 +1,38 @@ +From 0f493c2d930d4048b507fe7e3c7e1ce044059815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 10:21:42 +0530 +Subject: can: m_can: m_can_dev_setup(): add support for bosch mcan version + 3.3.0 + +From: Pankaj Sharma + +[ Upstream commit 5c7d55bded77da6db7c5d249610e3a2eed730b3c ] + +Add support for mcan bit timing and control mode according to bosch mcan IP +version 3.3.0. The mcan version read from the Core Release field of CREL +register would be 33. Accordingly the properties are to be set for mcan v3.3.0 + +Signed-off-by: Pankaj Sharma +Link: https://lore.kernel.org/r/1606366302-5520-1-git-send-email-pankj.sharma@samsung.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index d4030abad935d..61a93b1920379 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1385,6 +1385,8 @@ static int m_can_dev_setup(struct m_can_classdev *m_can_dev) + &m_can_data_bittiming_const_31X; + break; + case 32: ++ case 33: ++ /* Support both MCAN version v3.2.x and v3.3.0 */ + m_can_dev->can.bittiming_const = m_can_dev->bit_timing ? + m_can_dev->bit_timing : &m_can_bittiming_const_31X; + +-- +2.27.0 + diff --git a/queue-5.9/can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch b/queue-5.9/can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch new file mode 100644 index 00000000000..f0229cc36f7 --- /dev/null +++ b/queue-5.9/can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch @@ -0,0 +1,63 @@ +From 54b42b08d6cf869c4f79445e5f7747d949f4b7f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 16:17:11 +0100 +Subject: can: m_can: tcan4x5x_can_probe(): fix error path: remove erroneous + clk_disable_unprepare() + +From: Marc Kleine-Budde + +[ Upstream commit ad1f5e826d91d6c27ecd36a607ad7c7f4d0b0733 ] + +The clocks mcan_class->cclk and mcan_class->hclk are not prepared by any call +during tcan4x5x_can_probe(), so remove erroneous clk_disable_unprepare() on +them. + +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Link: http://lore.kernel.org/r/20201130114252.215334-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/tcan4x5x.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c +index e5d7d85e0b6d1..7347ab39c5b65 100644 +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -489,18 +489,18 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + spi->bits_per_word = 32; + ret = spi_setup(spi); + if (ret) +- goto out_clk; ++ goto out_m_can_class_free_dev; + + priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus, + &spi->dev, &tcan4x5x_regmap); + if (IS_ERR(priv->regmap)) { + ret = PTR_ERR(priv->regmap); +- goto out_clk; ++ goto out_m_can_class_free_dev; + } + + ret = tcan4x5x_power_enable(priv->power, 1); + if (ret) +- goto out_clk; ++ goto out_m_can_class_free_dev; + + ret = tcan4x5x_parse_config(mcan_class); + if (ret) +@@ -519,11 +519,6 @@ static int tcan4x5x_can_probe(struct spi_device *spi) + + out_power: + tcan4x5x_power_enable(priv->power, 0); +-out_clk: +- if (!IS_ERR(mcan_class->cclk)) { +- clk_disable_unprepare(mcan_class->cclk); +- clk_disable_unprepare(mcan_class->hclk); +- } + out_m_can_class_free_dev: + m_can_class_free_dev(mcan_class->net); + dev_err(&spi->dev, "Probe failed, err=%d\n", ret); +-- +2.27.0 + diff --git a/queue-5.9/can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch b/queue-5.9/can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch new file mode 100644 index 00000000000..aa0366d39e8 --- /dev/null +++ b/queue-5.9/can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch @@ -0,0 +1,40 @@ +From 1f1c5c0721e5a6560487648e4eb5958830b89af0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 10:59:38 +0100 +Subject: can: sja1000: sja1000_err(): don't count arbitration lose as an error + +From: Jeroen Hofstee + +[ Upstream commit bd0ccb92efb09c7da5b55162b283b42a93539ed7 ] + +Losing arbitration is normal in a CAN-bus network, it means that a higher +priority frame is being send and the pending message will be retried later. +Hence most driver only increment arbitration_lost, but the sja1000 driver also +incremeants tx_error, causing errors to be reported on a normal functioning +CAN-bus. So stop counting them as errors. + +Fixes: 8935f57e68c4 ("can: sja1000: fix network statistics update") +Signed-off-by: Jeroen Hofstee +Link: https://lore.kernel.org/r/20201127095941.21609-1-jhofstee@victronenergy.com +[mkl: split into two seperate patches] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/sja1000/sja1000.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c +index 9f107798f904b..25a4d7d0b3498 100644 +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -474,7 +474,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + netdev_dbg(dev, "arbitration lost interrupt\n"); + alc = priv->read_reg(priv, SJA1000_ALC); + priv->can.can_stats.arbitration_lost++; +- stats->tx_errors++; + cf->can_id |= CAN_ERR_LOSTARB; + cf->data[0] = alc & 0x1f; + } +-- +2.27.0 + diff --git a/queue-5.9/can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch b/queue-5.9/can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch new file mode 100644 index 00000000000..b36dfd8dd8e --- /dev/null +++ b/queue-5.9/can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch @@ -0,0 +1,41 @@ +From 4a89d74fdc639e50d66fb58196839cadc9c475ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 10:59:38 +0100 +Subject: can: sun4i_can: sun4i_can_err(): don't count arbitration lose as an + error + +From: Jeroen Hofstee + +[ Upstream commit c2d095eff797813461a426b97242e3ffc50e4134 ] + +Losing arbitration is normal in a CAN-bus network, it means that a higher +priority frame is being send and the pending message will be retried later. +Hence most driver only increment arbitration_lost, but the sun4i driver also +incremeants tx_error, causing errors to be reported on a normal functioning +CAN-bus. So stop counting them as errors. + +Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module") +Signed-off-by: Jeroen Hofstee +Link: https://lore.kernel.org/r/20201127095941.21609-1-jhofstee@victronenergy.com +[mkl: split into two seperate patches] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/sun4i_can.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index e2c6cf4b2228f..b3f2f4fe5ee04 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -604,7 +604,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + netdev_dbg(dev, "arbitration lost interrupt\n"); + alc = readl(priv->base + SUN4I_REG_STA_ADDR); + priv->can.can_stats.arbitration_lost++; +- stats->tx_errors++; + if (likely(skb)) { + cf->can_id |= CAN_ERR_LOSTARB; + cf->data[0] = (alc >> 8) & 0x1f; +-- +2.27.0 + diff --git a/queue-5.9/drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch b/queue-5.9/drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch new file mode 100644 index 00000000000..2cbc35c59de --- /dev/null +++ b/queue-5.9/drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch @@ -0,0 +1,41 @@ +From 002f324b86f304d8137a22c1ccecad11343802d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 18:53:00 +0100 +Subject: drm/exynos: depend on COMMON_CLK to fix compile tests + +From: Krzysztof Kozlowski + +[ Upstream commit e2d3d2e904ad3d381753798dcd5cae03e3c47242 ] + +The Exynos DRM uses Common Clock Framework thus it cannot be built on +platforms without it (e.g. compile test on MIPS with RALINK and +SOC_RT305X): + + /usr/bin/mips-linux-gnu-ld: drivers/gpu/drm/exynos/exynos_mixer.o: in function `mixer_bind': + exynos_mixer.c:(.text+0x958): undefined reference to `clk_set_parent' + +Reported-by: kernel test robot +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig +index 6417f374b923a..951d5f708e92b 100644 +--- a/drivers/gpu/drm/exynos/Kconfig ++++ b/drivers/gpu/drm/exynos/Kconfig +@@ -1,7 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0-only + config DRM_EXYNOS + tristate "DRM Support for Samsung SoC Exynos Series" +- depends on OF && DRM && (ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || ARCH_MULTIPLATFORM || COMPILE_TEST) ++ depends on OF && DRM && COMMON_CLK ++ depends on ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || ARCH_MULTIPLATFORM || COMPILE_TEST + depends on MMU + select DRM_KMS_HELPER + select VIDEOMODE_HELPERS +-- +2.27.0 + diff --git a/queue-5.9/drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch b/queue-5.9/drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch new file mode 100644 index 00000000000..043553914c5 --- /dev/null +++ b/queue-5.9/drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch @@ -0,0 +1,74 @@ +From 817a55352e50cbbdd3295469cd87e92cb38127cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 21:04:29 +0100 +Subject: drm/panel: sony-acx565akm: Fix race condition in probe + +From: Sebastian Reichel + +[ Upstream commit 7c4bada12d320d8648ba3ede6f9b6f9e10f1126a ] + +The probe routine acquires the reset GPIO using GPIOD_OUT_LOW. Directly +afterwards it calls acx565akm_detect(), which sets the GPIO value to +HIGH. If the bootloader initialized the GPIO to HIGH before the probe +routine was called, there is only a very short time period of a few +instructions where the reset signal is LOW. Exact time depends on +compiler optimizations, kernel configuration and alignment of the stars, +but I expect it to be always way less than 10us. There are no public +datasheets for the panel, but acx565akm_power_on() has a comment with +timings and reset period should be at least 10us. So this potentially +brings the panel into a half-reset state. + +The result is, that panel may not work after boot and can get into a +working state by re-enabling it (e.g. by blanking + unblanking), since +that does a clean reset cycle. This bug has recently been hit by Ivaylo +Dimitrov, but there are some older reports which are probably the same +bug. At least Tony Lindgren, Peter Ujfalusi and Jarkko Nikula have +experienced it in 2017 describing the blank/unblank procedure as +possible workaround. + +Note, that the bug really goes back in time. It has originally been +introduced in the predecessor of the omapfb driver in commit 3c45d05be382 +("OMAPDSS: acx565akm panel: handle gpios in panel driver") in 2012. +That driver eventually got replaced by a newer one, which had the bug +from the beginning in commit 84192742d9c2 ("OMAPDSS: Add Sony ACX565AKM +panel driver") and still exists in fbdev world. That driver has later +been copied to omapdrm and then was used as a basis for this driver. +Last but not least the omapdrm specific driver has been removed in +commit 45f16c82db7e ("drm/omap: displays: Remove unused panel drivers"). + +Reported-by: Jarkko Nikula +Reported-by: Peter Ujfalusi +Reported-by: Tony Lindgren +Reported-by: Aaro Koskinen +Reported-by: Ivaylo Dimitrov +Cc: Merlijn Wajer +Cc: Laurent Pinchart +Cc: Tomi Valkeinen +Fixes: 1c8fc3f0c5d2 ("drm/panel: Add driver for the Sony ACX565AKM panel") +Signed-off-by: Sebastian Reichel +Tested-by: Ivaylo Dimitrov +Tested-by: Aaro Koskinen +Tested-by: Jarkko Nikula +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20201127200429.129868-1-sebastian.reichel@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-sony-acx565akm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-sony-acx565akm.c b/drivers/gpu/drm/panel/panel-sony-acx565akm.c +index fc6a7e451abef..304267f7849ac 100644 +--- a/drivers/gpu/drm/panel/panel-sony-acx565akm.c ++++ b/drivers/gpu/drm/panel/panel-sony-acx565akm.c +@@ -629,7 +629,7 @@ static int acx565akm_probe(struct spi_device *spi) + lcd->spi = spi; + mutex_init(&lcd->mutex); + +- lcd->reset_gpio = devm_gpiod_get(&spi->dev, "reset", GPIOD_OUT_LOW); ++ lcd->reset_gpio = devm_gpiod_get(&spi->dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(lcd->reset_gpio)) { + dev_err(&spi->dev, "failed to get reset GPIO\n"); + return PTR_ERR(lcd->reset_gpio); +-- +2.27.0 + diff --git a/queue-5.9/drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch b/queue-5.9/drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch new file mode 100644 index 00000000000..5d7f44a2836 --- /dev/null +++ b/queue-5.9/drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch @@ -0,0 +1,41 @@ +From 3302cc98d0625e8542eb29b17787e7d7af0ba7e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 21:04:30 +0100 +Subject: drm/rockchip: Avoid uninitialized use of endpoint id in LVDS + +From: Paul Kocialkowski + +[ Upstream commit aec9fe892812ed10d0bffcf309d2a8fc380d8ce6 ] + +In the Rockchip DRM LVDS component driver, the endpoint id provided to +drm_of_find_panel_or_bridge is grabbed from the endpoint's reg property. + +However, the property may be missing in the case of a single endpoint. +Initialize the endpoint_id variable to 0 to avoid using an +uninitialized variable in that case. + +Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20201110200430.1713467-1-paul.kocialkowski@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_lvds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c +index 63f967902c2d8..a29912f3b997e 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c ++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c +@@ -544,7 +544,7 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master, + struct device_node *port, *endpoint; + int ret = 0, child_count = 0; + const char *name; +- u32 endpoint_id; ++ u32 endpoint_id = 0; + + lvds->drm_dev = drm_dev; + port = of_graph_get_port_by_id(dev->of_node, 1); +-- +2.27.0 + diff --git a/queue-5.9/habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch b/queue-5.9/habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch new file mode 100644 index 00000000000..aca57f7e16a --- /dev/null +++ b/queue-5.9/habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch @@ -0,0 +1,35 @@ +From 04ba0de81bb5937edfba2ff254974bd2a137deec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 14:35:35 +0200 +Subject: habanalabs/gaudi: fix missing code in ECC handling + +From: Oded Gabbay + +[ Upstream commit 652b44453ea953d3157f02a7f17e18e329952649 ] + +There is missing statement and missing "break;" in the ECC handling +code in gaudi.c +This will cause a wrong behavior upon certain ECC interrupts. + +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index 2e55890ad6a61..8da1720357a26 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -5416,6 +5416,8 @@ static void gaudi_handle_ecc_event(struct hl_device *hdev, u16 event_type, + params.num_memories = 33; + params.derr = true; + params.disable_clock_gating = true; ++ extract_info_from_fw = false; ++ break; + default: + return; + } +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-avoid-memset-null-scrq-msgs.patch b/queue-5.9/ibmvnic-avoid-memset-null-scrq-msgs.patch new file mode 100644 index 00000000000..8a4b132759c --- /dev/null +++ b/queue-5.9/ibmvnic-avoid-memset-null-scrq-msgs.patch @@ -0,0 +1,59 @@ +From 0e3d0acbfeddb078962819fba9768f868c3e6a61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:26 -0600 +Subject: ibmvnic: avoid memset null scrq msgs + +From: Dany Madden + +[ Upstream commit 9281cf2d584083a450fd65fd27cc5f0e692f6e30 ] + +scrq->msgs could be NULL during device reset, causing Linux to crash. +So, check before memset scrq->msgs. + +Fixes: c8b2ad0a4a901 ("ibmvnic: Sanitize entire SCRQ buffer on reset") +Signed-off-by: Dany Madden +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 32fc0266d99b1..f892cb4a08f4e 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2857,15 +2857,26 @@ static int reset_one_sub_crq_queue(struct ibmvnic_adapter *adapter, + { + int rc; + ++ if (!scrq) { ++ netdev_dbg(adapter->netdev, ++ "Invalid scrq reset. irq (%d) or msgs (%p).\n", ++ scrq->irq, scrq->msgs); ++ return -EINVAL; ++ } ++ + if (scrq->irq) { + free_irq(scrq->irq, scrq); + irq_dispose_mapping(scrq->irq); + scrq->irq = 0; + } +- +- memset(scrq->msgs, 0, 4 * PAGE_SIZE); +- atomic_set(&scrq->used, 0); +- scrq->cur = 0; ++ if (scrq->msgs) { ++ memset(scrq->msgs, 0, 4 * PAGE_SIZE); ++ atomic_set(&scrq->used, 0); ++ scrq->cur = 0; ++ } else { ++ netdev_dbg(adapter->netdev, "Invalid scrq reset\n"); ++ return -EINVAL; ++ } + + rc = h_reg_sub_crq(adapter->vdev->unit_address, scrq->msg_token, + 4 * PAGE_SIZE, &scrq->crq_num, &scrq->hw_irq); +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-delay-next-reset-if-hard-reset-fails.patch b/queue-5.9/ibmvnic-delay-next-reset-if-hard-reset-fails.patch new file mode 100644 index 00000000000..9c336da0f6c --- /dev/null +++ b/queue-5.9/ibmvnic-delay-next-reset-if-hard-reset-fails.patch @@ -0,0 +1,43 @@ +From aa56b0dcf8791465b743e841d38eca6faf438319 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:28 -0600 +Subject: ibmvnic: delay next reset if hard reset fails + +From: Sukadev Bhattiprolu + +[ Upstream commit f15fde9d47b887b406f5e76490d601cfc26643c9 ] + +If auto-priority failover is enabled, the backing device needs time +to settle if hard resetting fails for any reason. Add a delay of 60 +seconds before retrying the hard-reset. + +Fixes: 2770a7984db5 ("ibmvnic: Introduce hard reset recovery") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index f892cb4a08f4e..006670f318bf1 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2243,6 +2243,14 @@ static void __ibmvnic_reset(struct work_struct *work) + rc = do_hard_reset(adapter, rwi, reset_state); + rtnl_unlock(); + } ++ if (rc) { ++ /* give backing device time to settle down */ ++ netdev_dbg(adapter->netdev, ++ "[S:%d] Hard reset failed, waiting 60 secs\n", ++ adapter->state); ++ set_current_state(TASK_UNINTERRUPTIBLE); ++ schedule_timeout(60 * HZ); ++ } + } else if (!(rwi->reset_reason == VNIC_RESET_FATAL && + adapter->from_passive_init)) { + rc = do_reset(adapter, rwi, reset_state); +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-handle-inconsistent-login-with-reset.patch b/queue-5.9/ibmvnic-handle-inconsistent-login-with-reset.patch new file mode 100644 index 00000000000..9544cb50453 --- /dev/null +++ b/queue-5.9/ibmvnic-handle-inconsistent-login-with-reset.patch @@ -0,0 +1,39 @@ +From c73e1201d426b0e8715986897d20e19dc802b557 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:24 -0600 +Subject: ibmvnic: handle inconsistent login with reset + +From: Dany Madden + +[ Upstream commit 31d6b4036098f6b59bcfa20375626b500c7d7417 ] + +Inconsistent login with the vnicserver is causing the device to be +removed. This does not give the device a chance to recover from error +state. This patch schedules a FATAL reset instead to bring the adapter +up. + +Fixes: 032c5e82847a2 ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Dany Madden +Signed-off-by: Lijun Pan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 3654be5772c85..85c54c061ed91 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4400,7 +4400,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq, + adapter->req_rx_add_queues != + be32_to_cpu(login_rsp->num_rxadd_subcrqs))) { + dev_err(dev, "FATAL: Inconsistent login and login rsp\n"); +- ibmvnic_remove(adapter->vdev); ++ ibmvnic_reset(adapter, VNIC_RESET_FATAL); + return -EIO; + } + release_login_buffer(adapter); +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-reduce-wait-for-completion-time.patch b/queue-5.9/ibmvnic-reduce-wait-for-completion-time.patch new file mode 100644 index 00000000000..dc8d5d326f5 --- /dev/null +++ b/queue-5.9/ibmvnic-reduce-wait-for-completion-time.patch @@ -0,0 +1,55 @@ +From 1c8228830fe340ef030477b67302858bab027d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:32 -0600 +Subject: ibmvnic: reduce wait for completion time + +From: Dany Madden + +[ Upstream commit 98c41f04a67abf5e7f7191d55d286e905d1430ef ] + +Reduce the wait time for Command Response Queue response from 30 seconds +to 20 seconds, as recommended by VIOS and Power Hypervisor teams. + +Fixes: bd0b672313941 ("ibmvnic: Move login and queue negotiation into ibmvnic_open") +Fixes: 53da09e92910f ("ibmvnic: Add set_link_state routine for setting adapter link state") +Signed-off-by: Dany Madden +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index de25d1860f16f..a1556673300a0 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -846,7 +846,7 @@ static void release_napi(struct ibmvnic_adapter *adapter) + static int ibmvnic_login(struct net_device *netdev) + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- unsigned long timeout = msecs_to_jiffies(30000); ++ unsigned long timeout = msecs_to_jiffies(20000); + int retry_count = 0; + int retries = 10; + bool retry; +@@ -950,7 +950,7 @@ static void release_resources(struct ibmvnic_adapter *adapter) + static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state) + { + struct net_device *netdev = adapter->netdev; +- unsigned long timeout = msecs_to_jiffies(30000); ++ unsigned long timeout = msecs_to_jiffies(20000); + union ibmvnic_crq crq; + bool resend; + int rc; +@@ -5081,7 +5081,7 @@ map_failed: + static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter) + { + struct device *dev = &adapter->vdev->dev; +- unsigned long timeout = msecs_to_jiffies(30000); ++ unsigned long timeout = msecs_to_jiffies(20000); + u64 old_num_rx_queues, old_num_tx_queues; + int rc; + +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-send_login-should-check-for-crq-errors.patch b/queue-5.9/ibmvnic-send_login-should-check-for-crq-errors.patch new file mode 100644 index 00000000000..03c24870514 --- /dev/null +++ b/queue-5.9/ibmvnic-send_login-should-check-for-crq-errors.patch @@ -0,0 +1,89 @@ +From 6aea5b02662c463358a7de7c881bb99d2c15cbd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:30 -0600 +Subject: ibmvnic: send_login should check for crq errors + +From: Dany Madden + +[ Upstream commit c98d9cc4170da7e16a1012563d0f9fbe1c7cfe27 ] + +send_login() does not check for the result of ibmvnic_send_crq() of the +login request. This results in the driver needlessly retrying the login +10 times even when CRQ is no longer active. Check the return code and +give up in case of errors in sending the CRQ. + +The only time we want to retry is if we get a PARITALSUCCESS response +from the partner. + +Fixes: 032c5e82847a2 ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Dany Madden +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 9aa63b8b44368..de25d1860f16f 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -862,10 +862,8 @@ static int ibmvnic_login(struct net_device *netdev) + adapter->init_done_rc = 0; + reinit_completion(&adapter->init_done); + rc = send_login(adapter); +- if (rc) { +- netdev_warn(netdev, "Unable to login\n"); ++ if (rc) + return rc; +- } + + if (!wait_for_completion_timeout(&adapter->init_done, + timeout)) { +@@ -3731,15 +3729,16 @@ static int send_login(struct ibmvnic_adapter *adapter) + struct ibmvnic_login_rsp_buffer *login_rsp_buffer; + struct ibmvnic_login_buffer *login_buffer; + struct device *dev = &adapter->vdev->dev; ++ struct vnic_login_client_data *vlcd; + dma_addr_t rsp_buffer_token; + dma_addr_t buffer_token; + size_t rsp_buffer_size; + union ibmvnic_crq crq; ++ int client_data_len; + size_t buffer_size; + __be64 *tx_list_p; + __be64 *rx_list_p; +- int client_data_len; +- struct vnic_login_client_data *vlcd; ++ int rc; + int i; + + if (!adapter->tx_scrq || !adapter->rx_scrq) { +@@ -3845,16 +3844,23 @@ static int send_login(struct ibmvnic_adapter *adapter) + crq.login.len = cpu_to_be32(buffer_size); + + adapter->login_pending = true; +- ibmvnic_send_crq(adapter, &crq); ++ rc = ibmvnic_send_crq(adapter, &crq); ++ if (rc) { ++ adapter->login_pending = false; ++ netdev_err(adapter->netdev, "Failed to send login, rc=%d\n", rc); ++ goto buf_rsp_map_failed; ++ } + + return 0; + + buf_rsp_map_failed: + kfree(login_rsp_buffer); ++ adapter->login_rsp_buf = NULL; + buf_rsp_alloc_failed: + dma_unmap_single(dev, buffer_token, buffer_size, DMA_TO_DEVICE); + buf_map_failed: + kfree(login_buffer); ++ adapter->login_buf = NULL; + buf_alloc_failed: + return -1; + } +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch b/queue-5.9/ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch new file mode 100644 index 00000000000..0e3f4bd5915 --- /dev/null +++ b/queue-5.9/ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch @@ -0,0 +1,42 @@ +From 24be147ae15940da8ab9d209d9f59b3f885125a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 16:40:13 -0600 +Subject: ibmvnic: skip tx timeout reset while in resetting + +From: Lijun Pan + +[ Upstream commit 855a631a4c11458a9cef1ab79c1530436aa95fae ] + +Sometimes it takes longer than 5 seconds (watchdog timeout) to complete +failover, migration, and other resets. In stead of scheduling another +timeout reset, we wait for the current one to complete. + +Suggested-by: Brian King +Signed-off-by: Lijun Pan +Reviewed-by: Dany Madden +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index a1556673300a0..68aa9930d8187 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2358,6 +2358,12 @@ static void ibmvnic_tx_timeout(struct net_device *dev, unsigned int txqueue) + { + struct ibmvnic_adapter *adapter = netdev_priv(dev); + ++ if (test_bit(0, &adapter->resetting)) { ++ netdev_err(adapter->netdev, ++ "Adapter is resetting, skip timeout reset\n"); ++ return; ++ } ++ + ibmvnic_reset(adapter, VNIC_RESET_TIMEOUT); + } + +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-stop-free_all_rwi-on-failed-reset.patch b/queue-5.9/ibmvnic-stop-free_all_rwi-on-failed-reset.patch new file mode 100644 index 00000000000..c936714e7a1 --- /dev/null +++ b/queue-5.9/ibmvnic-stop-free_all_rwi-on-failed-reset.patch @@ -0,0 +1,74 @@ +From d71bb35530e5152185927317255cea3633350399 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:25 -0600 +Subject: ibmvnic: stop free_all_rwi on failed reset + +From: Dany Madden + +[ Upstream commit 18f141bf97d42f65abfdf17fd93fb3a0dac100e7 ] + +When ibmvnic fails to reset, it breaks out of the reset loop and frees +all of the remaining resets from the workqueue. Doing so prevents the +adapter from recovering if no reset is scheduled after that. Instead, +have the driver continue to process resets on the workqueue. + +Remove the no longer need free_all_rwi(). + +Fixes: ed651a10875f1 ("ibmvnic: Updated reset handling") +Signed-off-by: Dany Madden +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 22 +++------------------- + 1 file changed, 3 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 85c54c061ed91..32fc0266d99b1 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2186,17 +2186,6 @@ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter) + return rwi; + } + +-static void free_all_rwi(struct ibmvnic_adapter *adapter) +-{ +- struct ibmvnic_rwi *rwi; +- +- rwi = get_next_rwi(adapter); +- while (rwi) { +- kfree(rwi); +- rwi = get_next_rwi(adapter); +- } +-} +- + static void __ibmvnic_reset(struct work_struct *work) + { + struct ibmvnic_rwi *rwi; +@@ -2265,9 +2254,9 @@ static void __ibmvnic_reset(struct work_struct *work) + else + adapter->state = reset_state; + rc = 0; +- } else if (rc && rc != IBMVNIC_INIT_FAILED && +- !adapter->force_reset_recovery) +- break; ++ } ++ if (rc) ++ netdev_dbg(adapter->netdev, "Reset failed, rc=%d\n", rc); + + rwi = get_next_rwi(adapter); + +@@ -2281,11 +2270,6 @@ static void __ibmvnic_reset(struct work_struct *work) + complete(&adapter->reset_done); + } + +- if (rc) { +- netdev_dbg(adapter->netdev, "Reset failed\n"); +- free_all_rwi(adapter); +- } +- + clear_bit_unlock(0, &adapter->resetting); + } + +-- +2.27.0 + diff --git a/queue-5.9/ibmvnic-track-pending-login.patch b/queue-5.9/ibmvnic-track-pending-login.patch new file mode 100644 index 00000000000..f2f7a1e1d5e --- /dev/null +++ b/queue-5.9/ibmvnic-track-pending-login.patch @@ -0,0 +1,89 @@ +From 1e305a0b0eb41dc770f2aeb5eff22e054bcc349a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:29 -0600 +Subject: ibmvnic: track pending login + +From: Sukadev Bhattiprolu + +[ Upstream commit 76cdc5c5d99ce4856ad0ac38facc33b52fa64f77 ] + +If after ibmvnic sends a LOGIN it gets a FAILOVER, it is possible that +the worker thread will start reset process and free the login response +buffer before it gets a (now stale) LOGIN_RSP. The ibmvnic tasklet will +then try to access the login response buffer and crash. + +Have ibmvnic track pending logins and discard any stale login responses. + +Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 17 +++++++++++++++++ + drivers/net/ethernet/ibm/ibmvnic.h | 1 + + 2 files changed, 18 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 006670f318bf1..9aa63b8b44368 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -3843,6 +3843,8 @@ static int send_login(struct ibmvnic_adapter *adapter) + crq.login.cmd = LOGIN; + crq.login.ioba = cpu_to_be32(buffer_token); + crq.login.len = cpu_to_be32(buffer_size); ++ ++ adapter->login_pending = true; + ibmvnic_send_crq(adapter, &crq); + + return 0; +@@ -4374,6 +4376,15 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq, + struct ibmvnic_login_buffer *login = adapter->login_buf; + int i; + ++ /* CHECK: Test/set of login_pending does not need to be atomic ++ * because only ibmvnic_tasklet tests/clears this. ++ */ ++ if (!adapter->login_pending) { ++ netdev_warn(netdev, "Ignoring unexpected login response\n"); ++ return 0; ++ } ++ adapter->login_pending = false; ++ + dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz, + DMA_TO_DEVICE); + dma_unmap_single(dev, adapter->login_rsp_buf_token, +@@ -4721,6 +4732,11 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + case IBMVNIC_CRQ_INIT: + dev_info(dev, "Partner initialized\n"); + adapter->from_passive_init = true; ++ /* Discard any stale login responses from prev reset. ++ * CHECK: should we clear even on INIT_COMPLETE? ++ */ ++ adapter->login_pending = false; ++ + if (!completion_done(&adapter->init_done)) { + complete(&adapter->init_done); + adapter->init_done_rc = -EIO; +@@ -5188,6 +5204,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + dev_set_drvdata(&dev->dev, netdev); + adapter->vdev = dev; + adapter->netdev = netdev; ++ adapter->login_pending = false; + + ether_addr_copy(adapter->mac_addr, mac_addr_p); + ether_addr_copy(netdev->dev_addr, adapter->mac_addr); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index 31d604fc7bde7..77f43cbdb6dc4 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -1084,6 +1084,7 @@ struct ibmvnic_adapter { + struct delayed_work ibmvnic_delayed_reset; + unsigned long resetting; + bool napi_enabled, from_passive_init; ++ bool login_pending; + + bool failover_pending; + bool force_reset_recovery; +-- +2.27.0 + diff --git a/queue-5.9/intel_idle-build-fix.patch b/queue-5.9/intel_idle-build-fix.patch new file mode 100644 index 00000000000..0abbccb04d9 --- /dev/null +++ b/queue-5.9/intel_idle-build-fix.patch @@ -0,0 +1,69 @@ +From be39bc7040f611ecb040ef3548153cb321dceb45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 12:54:34 +0100 +Subject: intel_idle: Build fix + +From: Peter Zijlstra + +[ Upstream commit 4d916140bf28ff027997144ea1bb4299e1536f87 ] + +Because CONFIG_ soup. + +Fixes: 6e1d2bc675bd ("intel_idle: Fix intel_idle() vs tracing") +Reported-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201130115402.GO3040@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + drivers/idle/intel_idle.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index cc6d1b12388e1..3a1617a3e5bf7 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -1136,6 +1136,20 @@ static bool __init intel_idle_max_cstate_reached(int cstate) + return false; + } + ++static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state) ++{ ++ unsigned long eax = flg2MWAIT(state->flags); ++ ++ if (boot_cpu_has(X86_FEATURE_ARAT)) ++ return false; ++ ++ /* ++ * Switch over to one-shot tick broadcast if the target C-state ++ * is deeper than C1. ++ */ ++ return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK); ++} ++ + #ifdef CONFIG_ACPI_PROCESSOR_CSTATE + #include + +@@ -1206,20 +1220,6 @@ static bool __init intel_idle_acpi_cst_extract(void) + return false; + } + +-static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state) +-{ +- unsigned long eax = flg2MWAIT(state->flags); +- +- if (boot_cpu_has(X86_FEATURE_ARAT)) +- return false; +- +- /* +- * Switch over to one-shot tick broadcast if the target C-state +- * is deeper than C1. +- */ +- return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK); +-} +- + static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv) + { + int cstate, limit = min_t(int, CPUIDLE_STATE_MAX, acpi_state_table.count); +-- +2.27.0 + diff --git a/queue-5.9/intel_idle-fix-intel_idle-vs-tracing.patch b/queue-5.9/intel_idle-fix-intel_idle-vs-tracing.patch new file mode 100644 index 00000000000..62bcb98af40 --- /dev/null +++ b/queue-5.9/intel_idle-fix-intel_idle-vs-tracing.patch @@ -0,0 +1,97 @@ +From ac278af3b0306b43d407017d210b5f838085b147 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 11:28:35 +0100 +Subject: intel_idle: Fix intel_idle() vs tracing + +From: Peter Zijlstra + +[ Upstream commit 6e1d2bc675bd57640f5658a4a657ae488db4c204 ] + +cpuidle->enter() callbacks should not call into tracing because RCU +has already been disabled. Instead of doing the broadcast thing +itself, simply advertise to the cpuidle core that those states stop +the timer. + +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Rafael J. Wysocki +Link: https://lkml.kernel.org/r/20201123143510.GR3021@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + drivers/idle/intel_idle.c | 37 ++++++++++++++++++++----------------- + 1 file changed, 20 insertions(+), 17 deletions(-) + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index d09b807e1c3a1..cc6d1b12388e1 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -122,26 +122,9 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev, + struct cpuidle_state *state = &drv->states[index]; + unsigned long eax = flg2MWAIT(state->flags); + unsigned long ecx = 1; /* break on interrupt flag */ +- bool tick; +- +- if (!static_cpu_has(X86_FEATURE_ARAT)) { +- /* +- * Switch over to one-shot tick broadcast if the target C-state +- * is deeper than C1. +- */ +- if ((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK) { +- tick = true; +- tick_broadcast_enter(); +- } else { +- tick = false; +- } +- } + + mwait_idle_with_hints(eax, ecx); + +- if (!static_cpu_has(X86_FEATURE_ARAT) && tick) +- tick_broadcast_exit(); +- + return index; + } + +@@ -1223,6 +1206,20 @@ static bool __init intel_idle_acpi_cst_extract(void) + return false; + } + ++static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state) ++{ ++ unsigned long eax = flg2MWAIT(state->flags); ++ ++ if (boot_cpu_has(X86_FEATURE_ARAT)) ++ return false; ++ ++ /* ++ * Switch over to one-shot tick broadcast if the target C-state ++ * is deeper than C1. ++ */ ++ return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK); ++} ++ + static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv) + { + int cstate, limit = min_t(int, CPUIDLE_STATE_MAX, acpi_state_table.count); +@@ -1265,6 +1262,9 @@ static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv) + if (disabled_states_mask & BIT(cstate)) + state->flags |= CPUIDLE_FLAG_OFF; + ++ if (intel_idle_state_needs_timer_stop(state)) ++ state->flags |= CPUIDLE_FLAG_TIMER_STOP; ++ + state->enter = intel_idle; + state->enter_s2idle = intel_idle_s2idle; + } +@@ -1503,6 +1503,9 @@ static void __init intel_idle_init_cstates_icpu(struct cpuidle_driver *drv) + !(cpuidle_state_table[cstate].flags & CPUIDLE_FLAG_ALWAYS_ENABLE))) + drv->states[drv->state_count].flags |= CPUIDLE_FLAG_OFF; + ++ if (intel_idle_state_needs_timer_stop(&drv->states[drv->state_count])) ++ drv->states[drv->state_count].flags |= CPUIDLE_FLAG_TIMER_STOP; ++ + drv->state_count++; + } + +-- +2.27.0 + diff --git a/queue-5.9/interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch b/queue-5.9/interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch new file mode 100644 index 00000000000..120e598dab2 --- /dev/null +++ b/queue-5.9/interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch @@ -0,0 +1,75 @@ +From 368290bdeaa0a6394bafb15c4e647605b6426caa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 12:51:40 +0200 +Subject: interconnect: qcom: msm8916: Remove rpm-ids from non-RPM nodes + +From: Georgi Djakov + +[ Upstream commit c497f9322af947204c28292be6f20dd2d97483dd ] + +Some nodes are incorrectly marked as RPM-controlled (they have RPM +master and slave ids assigned), but are actually controlled by the +application CPU instead. The RPM complains when we send requests for +resources that it can't control. Let's fix this by replacing the IDs, +with the default "-1" in which case no requests are sent. + +Reviewed-by: Mike Tipton +Link: https://lore.kernel.org/r/20201112105140.10092-1-georgi.djakov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/msm8916.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/interconnect/qcom/msm8916.c b/drivers/interconnect/qcom/msm8916.c +index 42c6c55816626..e8371d40ab8d8 100644 +--- a/drivers/interconnect/qcom/msm8916.c ++++ b/drivers/interconnect/qcom/msm8916.c +@@ -182,7 +182,7 @@ DEFINE_QNODE(mas_pcnoc_sdcc_1, MSM8916_MASTER_SDCC_1, 8, -1, -1, MSM8916_PNOC_IN + DEFINE_QNODE(mas_pcnoc_sdcc_2, MSM8916_MASTER_SDCC_2, 8, -1, -1, MSM8916_PNOC_INT_1); + DEFINE_QNODE(mas_qdss_bam, MSM8916_MASTER_QDSS_BAM, 8, -1, -1, MSM8916_SNOC_QDSS_INT); + DEFINE_QNODE(mas_qdss_etr, MSM8916_MASTER_QDSS_ETR, 8, -1, -1, MSM8916_SNOC_QDSS_INT); +-DEFINE_QNODE(mas_snoc_cfg, MSM8916_MASTER_SNOC_CFG, 4, 20, -1, MSM8916_SNOC_QDSS_INT); ++DEFINE_QNODE(mas_snoc_cfg, MSM8916_MASTER_SNOC_CFG, 4, -1, -1, MSM8916_SNOC_QDSS_INT); + DEFINE_QNODE(mas_spdm, MSM8916_MASTER_SPDM, 4, -1, -1, MSM8916_PNOC_MAS_0); + DEFINE_QNODE(mas_tcu0, MSM8916_MASTER_TCU0, 8, -1, -1, MSM8916_SLAVE_EBI_CH0, MSM8916_BIMC_SNOC_MAS, MSM8916_SLAVE_AMPSS_L2); + DEFINE_QNODE(mas_tcu1, MSM8916_MASTER_TCU1, 8, -1, -1, MSM8916_SLAVE_EBI_CH0, MSM8916_BIMC_SNOC_MAS, MSM8916_SLAVE_AMPSS_L2); +@@ -208,14 +208,14 @@ DEFINE_QNODE(pcnoc_snoc_mas, MSM8916_PNOC_SNOC_MAS, 8, 29, -1, MSM8916_PNOC_SNOC + DEFINE_QNODE(pcnoc_snoc_slv, MSM8916_PNOC_SNOC_SLV, 8, -1, 45, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC, MSM8916_SNOC_INT_1); + DEFINE_QNODE(qdss_int, MSM8916_SNOC_QDSS_INT, 8, -1, -1, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC); + DEFINE_QNODE(slv_apps_l2, MSM8916_SLAVE_AMPSS_L2, 8, -1, -1, 0); +-DEFINE_QNODE(slv_apss, MSM8916_SLAVE_APSS, 4, -1, 20, 0); ++DEFINE_QNODE(slv_apss, MSM8916_SLAVE_APSS, 4, -1, -1, 0); + DEFINE_QNODE(slv_audio, MSM8916_SLAVE_LPASS, 4, -1, -1, 0); + DEFINE_QNODE(slv_bimc_cfg, MSM8916_SLAVE_BIMC_CFG, 4, -1, -1, 0); + DEFINE_QNODE(slv_blsp_1, MSM8916_SLAVE_BLSP_1, 4, -1, -1, 0); + DEFINE_QNODE(slv_boot_rom, MSM8916_SLAVE_BOOT_ROM, 4, -1, -1, 0); + DEFINE_QNODE(slv_camera_cfg, MSM8916_SLAVE_CAMERA_CFG, 4, -1, -1, 0); +-DEFINE_QNODE(slv_cats_0, MSM8916_SLAVE_CATS_128, 16, -1, 106, 0); +-DEFINE_QNODE(slv_cats_1, MSM8916_SLAVE_OCMEM_64, 8, -1, 107, 0); ++DEFINE_QNODE(slv_cats_0, MSM8916_SLAVE_CATS_128, 16, -1, -1, 0); ++DEFINE_QNODE(slv_cats_1, MSM8916_SLAVE_OCMEM_64, 8, -1, -1, 0); + DEFINE_QNODE(slv_clk_ctl, MSM8916_SLAVE_CLK_CTL, 4, -1, -1, 0); + DEFINE_QNODE(slv_crypto_0_cfg, MSM8916_SLAVE_CRYPTO_0_CFG, 4, -1, -1, 0); + DEFINE_QNODE(slv_dehr_cfg, MSM8916_SLAVE_DEHR_CFG, 4, -1, -1, 0); +@@ -239,7 +239,7 @@ DEFINE_QNODE(slv_sdcc_2, MSM8916_SLAVE_SDCC_2, 4, -1, -1, 0); + DEFINE_QNODE(slv_security, MSM8916_SLAVE_SECURITY, 4, -1, -1, 0); + DEFINE_QNODE(slv_snoc_cfg, MSM8916_SLAVE_SNOC_CFG, 4, -1, -1, 0); + DEFINE_QNODE(slv_spdm, MSM8916_SLAVE_SPDM, 4, -1, -1, 0); +-DEFINE_QNODE(slv_srvc_snoc, MSM8916_SLAVE_SRVC_SNOC, 8, -1, 29, 0); ++DEFINE_QNODE(slv_srvc_snoc, MSM8916_SLAVE_SRVC_SNOC, 8, -1, -1, 0); + DEFINE_QNODE(slv_tcsr, MSM8916_SLAVE_TCSR, 4, -1, -1, 0); + DEFINE_QNODE(slv_tlmm, MSM8916_SLAVE_TLMM, 4, -1, -1, 0); + DEFINE_QNODE(slv_usb_hs, MSM8916_SLAVE_USB_HS, 4, -1, -1, 0); +@@ -249,7 +249,7 @@ DEFINE_QNODE(snoc_bimc_0_slv, MSM8916_SNOC_BIMC_0_SLV, 8, -1, 24, MSM8916_SLAVE_ + DEFINE_QNODE(snoc_bimc_1_mas, MSM8916_SNOC_BIMC_1_MAS, 16, -1, -1, MSM8916_SNOC_BIMC_1_SLV); + DEFINE_QNODE(snoc_bimc_1_slv, MSM8916_SNOC_BIMC_1_SLV, 8, -1, -1, MSM8916_SLAVE_EBI_CH0); + DEFINE_QNODE(snoc_int_0, MSM8916_SNOC_INT_0, 8, 99, 130, MSM8916_SLAVE_QDSS_STM, MSM8916_SLAVE_IMEM, MSM8916_SNOC_PNOC_MAS); +-DEFINE_QNODE(snoc_int_1, MSM8916_SNOC_INT_1, 8, 100, 131, MSM8916_SLAVE_APSS, MSM8916_SLAVE_CATS_128, MSM8916_SLAVE_OCMEM_64); ++DEFINE_QNODE(snoc_int_1, MSM8916_SNOC_INT_1, 8, -1, -1, MSM8916_SLAVE_APSS, MSM8916_SLAVE_CATS_128, MSM8916_SLAVE_OCMEM_64); + DEFINE_QNODE(snoc_int_bimc, MSM8916_SNOC_INT_BIMC, 8, 101, 132, MSM8916_SNOC_BIMC_0_MAS); + DEFINE_QNODE(snoc_pcnoc_mas, MSM8916_SNOC_PNOC_MAS, 8, -1, -1, MSM8916_SNOC_PNOC_SLV); + DEFINE_QNODE(snoc_pcnoc_slv, MSM8916_SNOC_PNOC_SLV, 8, -1, -1, MSM8916_PNOC_INT_0); +-- +2.27.0 + diff --git a/queue-5.9/interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch b/queue-5.9/interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch new file mode 100644 index 00000000000..45436088419 --- /dev/null +++ b/queue-5.9/interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch @@ -0,0 +1,45 @@ +From 95e9274e508cb41398c58b997084dc8b515af0e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 13:10:44 +0200 +Subject: interconnect: qcom: qcs404: Remove GPU and display RPM IDs + +From: Georgi Djakov + +[ Upstream commit 7ab1e9117607485df977bb6e271be5c5ad649a4c ] + +The following errors are noticed during boot on a QCS404 board: +[ 2.926647] qcom_icc_rpm_smd_send mas 6 error -6 +[ 2.934573] qcom_icc_rpm_smd_send mas 8 error -6 + +These errors show when we try to configure the GPU and display nodes. +Since these particular nodes aren't supported on RPM and are purely +local, we should just change their mas_rpm_id to -1 to avoid any +requests being sent for these master IDs. + +Reviewed-by: Mike Tipton +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20201118111044.26056-1-georgi.djakov@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/qcs404.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/interconnect/qcom/qcs404.c b/drivers/interconnect/qcom/qcs404.c +index d4769a5ea182e..9820709b43dbd 100644 +--- a/drivers/interconnect/qcom/qcs404.c ++++ b/drivers/interconnect/qcom/qcs404.c +@@ -157,8 +157,8 @@ struct qcom_icc_desc { + } + + DEFINE_QNODE(mas_apps_proc, QCS404_MASTER_AMPSS_M0, 8, 0, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); +-DEFINE_QNODE(mas_oxili, QCS404_MASTER_GRAPHICS_3D, 8, 6, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); +-DEFINE_QNODE(mas_mdp, QCS404_MASTER_MDP_PORT0, 8, 8, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); ++DEFINE_QNODE(mas_oxili, QCS404_MASTER_GRAPHICS_3D, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); ++DEFINE_QNODE(mas_mdp, QCS404_MASTER_MDP_PORT0, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); + DEFINE_QNODE(mas_snoc_bimc_1, QCS404_SNOC_BIMC_1_MAS, 8, 76, -1, QCS404_SLAVE_EBI_CH0); + DEFINE_QNODE(mas_tcu_0, QCS404_MASTER_TCU_0, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV); + DEFINE_QNODE(mas_spdm, QCS404_MASTER_SPDM, 4, -1, -1, QCS404_PNOC_INT_3); +-- +2.27.0 + diff --git a/queue-5.9/ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch b/queue-5.9/ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch new file mode 100644 index 00000000000..38ffd69ddab --- /dev/null +++ b/queue-5.9/ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch @@ -0,0 +1,111 @@ +From 120241689027d797012dfec2e58ce30f3e7dd144 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 16:07:49 +0800 +Subject: ipvs: fix possible memory leak in ip_vs_control_net_init + +From: Wang Hai + +[ Upstream commit 4bc3c8dc9f5f1eff0d3bfa59491383ac11308b6b ] + +kmemleak report a memory leak as follows: + +BUG: memory leak +unreferenced object 0xffff8880759ea000 (size 256): +backtrace: +[<00000000c0bf2deb>] kmem_cache_zalloc include/linux/slab.h:656 [inline] +[<00000000c0bf2deb>] __proc_create+0x23d/0x7d0 fs/proc/generic.c:421 +[<000000009d718d02>] proc_create_reg+0x8e/0x140 fs/proc/generic.c:535 +[<0000000097bbfc4f>] proc_create_net_data+0x8c/0x1b0 fs/proc/proc_net.c:126 +[<00000000652480fc>] ip_vs_control_net_init+0x308/0x13a0 net/netfilter/ipvs/ip_vs_ctl.c:4169 +[<000000004c927ebe>] __ip_vs_init+0x211/0x400 net/netfilter/ipvs/ip_vs_core.c:2429 +[<00000000aa6b72d9>] ops_init+0xa8/0x3c0 net/core/net_namespace.c:151 +[<00000000153fd114>] setup_net+0x2de/0x7e0 net/core/net_namespace.c:341 +[<00000000be4e4f07>] copy_net_ns+0x27d/0x530 net/core/net_namespace.c:482 +[<00000000f1c23ec9>] create_new_namespaces+0x382/0xa30 kernel/nsproxy.c:110 +[<00000000098a5757>] copy_namespaces+0x2e6/0x3b0 kernel/nsproxy.c:179 +[<0000000026ce39e9>] copy_process+0x220a/0x5f00 kernel/fork.c:2072 +[<00000000b71f4efe>] _do_fork+0xc7/0xda0 kernel/fork.c:2428 +[<000000002974ee96>] __do_sys_clone3+0x18a/0x280 kernel/fork.c:2703 +[<0000000062ac0a4d>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 +[<0000000093f1ce2c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +In the error path of ip_vs_control_net_init(), remove_proc_entry() needs +to be called to remove the added proc entry, otherwise a memory leak +will occur. + +Also, add some '#ifdef CONFIG_PROC_FS' because proc_create_net* return NULL +when PROC is not used. + +Fixes: b17fc9963f83 ("IPVS: netns, ip_vs_stats and its procfs") +Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ctl.c | 31 +++++++++++++++++++++++++------ + 1 file changed, 25 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 8dbfd84322a88..f6b284a9c480e 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -4167,12 +4167,18 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs) + + spin_lock_init(&ipvs->tot_stats.lock); + +- proc_create_net("ip_vs", 0, ipvs->net->proc_net, &ip_vs_info_seq_ops, +- sizeof(struct ip_vs_iter)); +- proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net, +- ip_vs_stats_show, NULL); +- proc_create_net_single("ip_vs_stats_percpu", 0, ipvs->net->proc_net, +- ip_vs_stats_percpu_show, NULL); ++#ifdef CONFIG_PROC_FS ++ if (!proc_create_net("ip_vs", 0, ipvs->net->proc_net, ++ &ip_vs_info_seq_ops, sizeof(struct ip_vs_iter))) ++ goto err_vs; ++ if (!proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net, ++ ip_vs_stats_show, NULL)) ++ goto err_stats; ++ if (!proc_create_net_single("ip_vs_stats_percpu", 0, ++ ipvs->net->proc_net, ++ ip_vs_stats_percpu_show, NULL)) ++ goto err_percpu; ++#endif + + if (ip_vs_control_net_init_sysctl(ipvs)) + goto err; +@@ -4180,6 +4186,17 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs) + return 0; + + err: ++#ifdef CONFIG_PROC_FS ++ remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net); ++ ++err_percpu: ++ remove_proc_entry("ip_vs_stats", ipvs->net->proc_net); ++ ++err_stats: ++ remove_proc_entry("ip_vs", ipvs->net->proc_net); ++ ++err_vs: ++#endif + free_percpu(ipvs->tot_stats.cpustats); + return -ENOMEM; + } +@@ -4188,9 +4205,11 @@ void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs) + { + ip_vs_trash_cleanup(ipvs); + ip_vs_control_net_cleanup_sysctl(ipvs); ++#ifdef CONFIG_PROC_FS + remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net); + remove_proc_entry("ip_vs_stats", ipvs->net->proc_net); + remove_proc_entry("ip_vs", ipvs->net->proc_net); ++#endif + free_percpu(ipvs->tot_stats.cpustats); + } + +-- +2.27.0 + diff --git a/queue-5.9/irqchip-gic-v3-its-unconditionally-save-restore-the-.patch b/queue-5.9/irqchip-gic-v3-its-unconditionally-save-restore-the-.patch new file mode 100644 index 00000000000..18aca6200c7 --- /dev/null +++ b/queue-5.9/irqchip-gic-v3-its-unconditionally-save-restore-the-.patch @@ -0,0 +1,99 @@ +From 2f47c5539ccdeb4e13f2ea71cfc0ea4547b3ac77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 10:42:26 +0000 +Subject: irqchip/gic-v3-its: Unconditionally save/restore the ITS state on + suspend + +From: Xu Qiang + +[ Upstream commit 74cde1a53368aed4f2b4b54bf7030437f64a534b ] + +On systems without HW-based collections (i.e. anything except GIC-500), +we rely on firmware to perform the ITS save/restore. This doesn't +really work, as although FW can properly save everything, it cannot +fully restore the state of the command queue (the read-side is reset +to the head of the queue). This results in the ITS consuming previously +processed commands, potentially corrupting the state. + +Instead, let's always save the ITS state on suspend, disabling it in the +process, and restore the full state on resume. This saves us from broken +FW as long as it doesn't enable the ITS by itself (for which we can't do +anything). + +This amounts to simply dropping the ITS_FLAGS_SAVE_SUSPEND_STATE. + +Signed-off-by: Xu Qiang +[maz: added warning on resume, rewrote commit message] +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20201107104226.14282-1-xuqiang36@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-its.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 548de7538632a..51b8743fdda03 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -42,7 +42,6 @@ + #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) + #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) + #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) +-#define ITS_FLAGS_SAVE_SUSPEND_STATE (1ULL << 3) + + #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) + #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) +@@ -4735,9 +4734,6 @@ static int its_save_disable(void) + list_for_each_entry(its, &its_nodes, entry) { + void __iomem *base; + +- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) +- continue; +- + base = its->base; + its->ctlr_save = readl_relaxed(base + GITS_CTLR); + err = its_force_quiescent(base); +@@ -4756,9 +4752,6 @@ err: + list_for_each_entry_continue_reverse(its, &its_nodes, entry) { + void __iomem *base; + +- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) +- continue; +- + base = its->base; + writel_relaxed(its->ctlr_save, base + GITS_CTLR); + } +@@ -4778,9 +4771,6 @@ static void its_restore_enable(void) + void __iomem *base; + int i; + +- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) +- continue; +- + base = its->base; + + /* +@@ -4788,7 +4778,10 @@ static void its_restore_enable(void) + * don't restore it since writing to CBASER or BASER + * registers is undefined according to the GIC v3 ITS + * Specification. ++ * ++ * Firmware resuming with the ITS enabled is terminally broken. + */ ++ WARN_ON(readl_relaxed(base + GITS_CTLR) & GITS_CTLR_ENABLE); + ret = its_force_quiescent(base); + if (ret) { + pr_err("ITS@%pa: failed to quiesce on resume: %d\n", +@@ -5068,9 +5061,6 @@ static int __init its_probe_one(struct resource *res, + ctlr |= GITS_CTLR_ImDe; + writel_relaxed(ctlr, its->base + GITS_CTLR); + +- if (GITS_TYPER_HCC(typer)) +- its->flags |= ITS_FLAGS_SAVE_SUSPEND_STATE; +- + err = its_init_domain(handle, its); + if (err) + goto out_free_tables; +-- +2.27.0 + diff --git a/queue-5.9/iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch b/queue-5.9/iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch new file mode 100644 index 00000000000..dd1c67e9f80 --- /dev/null +++ b/queue-5.9/iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch @@ -0,0 +1,42 @@ +From 6af1e7e698532a66e19b7bf4ceade07646e0f41f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 10:50:11 +0200 +Subject: iwlwifi: mvm: fix kernel panic in case of assert during CSA + +From: Sara Sharon + +[ Upstream commit fe56d05ee6c87f6a1a8c7267affd92c9438249cc ] + +During CSA, we briefly nullify the phy context, in __iwl_mvm_unassign_vif_chanctx. +In case we have a FW assert right after it, it remains NULL though. +We end up running into endless loop due to mac80211 trying repeatedly to +move us to ASSOC state, and we keep returning -EINVAL. Later down the road +we hit a kernel panic. + +Detect and avoid this endless loop. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d64de2c17bff.Iedd0d2afa20a2aacba5259a5cae31cb3a119a4eb@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 34362dc0d4612..f2d65e8384105 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -3057,7 +3057,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw, + + /* this would be a mac80211 bug ... but don't crash */ + if (WARN_ON_ONCE(!mvmvif->phy_ctxt)) +- return -EINVAL; ++ return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL; + + /* + * If we are in a STA removal flow and in DQA mode: +-- +2.27.0 + diff --git a/queue-5.9/iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch b/queue-5.9/iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch new file mode 100644 index 00000000000..e5dad549560 --- /dev/null +++ b/queue-5.9/iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch @@ -0,0 +1,42 @@ +From 3e0b22900cb8c22e93c13a749e1c3ed7ab0b2f69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 14:41:50 +0200 +Subject: iwlwifi: pcie: invert values of NO_160 device config entries + +From: Luca Coelho + +[ Upstream commit 568d3434178b00274615190a19d29c3d235b4e6d ] + +The NO_160 flag specifies if the device doesn't have 160 MHz support, +but we errorneously assumed the opposite. If the flag was set, we +were considering that 160 MHz was supported, but it's actually the +opposite. Fix it by inverting the bits, i.e. NO_160 is 0x1 and 160 +is 0x0. + +Fixes: d6f2134a3831 ("iwlwifi: add mac/rf types and 160MHz to the device tables") +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201202143859.375bec857ccb.I83884286b688965293e9810381808039bd7eedae@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-config.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index e27c13263a232..44abe44c04632 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -488,8 +488,8 @@ struct iwl_cfg { + #define IWL_CFG_RF_ID_HR 0x7 + #define IWL_CFG_RF_ID_HR1 0x4 + +-#define IWL_CFG_NO_160 0x0 +-#define IWL_CFG_160 0x1 ++#define IWL_CFG_NO_160 0x1 ++#define IWL_CFG_160 0x0 + + #define IWL_CFG_CORES_BT 0x0 + #define IWL_CFG_CORES_BT_GNSS 0x5 +-- +2.27.0 + diff --git a/queue-5.9/iwlwifi-pcie-limit-memory-read-spin-time.patch b/queue-5.9/iwlwifi-pcie-limit-memory-read-spin-time.patch new file mode 100644 index 00000000000..174c9679d3c --- /dev/null +++ b/queue-5.9/iwlwifi-pcie-limit-memory-read-spin-time.patch @@ -0,0 +1,94 @@ +From 945a6dd7c194c1b755f5b2745adf8ede923ec21f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 16:51:03 +0300 +Subject: iwlwifi: pcie: limit memory read spin time + +From: Johannes Berg + +[ Upstream commit 04516706bb99889986ddfa3a769ed50d2dc7ac13 ] + +When we read device memory, we lock a spinlock, write the address we +want to read from the device and then spin in a loop reading the data +in 32-bit quantities from another register. + +As the description makes clear, this is rather inefficient, incurring +a PCIe bus transaction for every read. In a typical device today, we +want to read 786k SMEM if it crashes, leading to 192k register reads. +Occasionally, we've seen the whole loop take over 20 seconds and then +triggering the soft lockup detector. + +Clearly, it is unreasonable to spin here for such extended periods of +time. + +To fix this, break the loop down into an outer and an inner loop, and +break out of the inner loop if more than half a second elapsed. To +avoid too much overhead, check for that only every 128 reads, though +there's no particular reason for that number. Then, unlock and relock +to obtain NIC access again, reprogram the start address and continue. + +This will keep (interrupt) latencies on the CPU down to a reasonable +time. + +Signed-off-by: Johannes Berg +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201022165103.45878a7e49aa.I3b9b9c5a10002915072312ce75b68ed5b3dc6e14@changeid +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++++++++++++----- + 1 file changed, 27 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index e5160d6208688..6393e895f95c6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2155,18 +2155,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr, + void *buf, int dwords) + { + unsigned long flags; +- int offs, ret = 0; ++ int offs = 0; + u32 *vals = buf; + +- if (iwl_trans_grab_nic_access(trans, &flags)) { +- iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr); +- for (offs = 0; offs < dwords; offs++) +- vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT); +- iwl_trans_release_nic_access(trans, &flags); +- } else { +- ret = -EBUSY; ++ while (offs < dwords) { ++ /* limit the time we spin here under lock to 1/2s */ ++ ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC); ++ ++ if (iwl_trans_grab_nic_access(trans, &flags)) { ++ iwl_write32(trans, HBUS_TARG_MEM_RADDR, ++ addr + 4 * offs); ++ ++ while (offs < dwords) { ++ vals[offs] = iwl_read32(trans, ++ HBUS_TARG_MEM_RDAT); ++ offs++; ++ ++ /* calling ktime_get is expensive so ++ * do it once in 128 reads ++ */ ++ if (offs % 128 == 0 && ktime_after(ktime_get(), ++ timeout)) ++ break; ++ } ++ iwl_trans_release_nic_access(trans, &flags); ++ } else { ++ return -EBUSY; ++ } + } +- return ret; ++ ++ return 0; + } + + static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr, +-- +2.27.0 + diff --git a/queue-5.9/iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch b/queue-5.9/iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch new file mode 100644 index 00000000000..5158cc11a47 --- /dev/null +++ b/queue-5.9/iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch @@ -0,0 +1,79 @@ +From 4d95bb9aa3050a83b3773b57b7275a5b33ef3f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 10:50:10 +0200 +Subject: iwlwifi: pcie: set LTR to avoid completion timeout + +From: Johannes Berg + +[ Upstream commit edb625208d84aef179e3f16590c1c582fc5fdae6 ] + +On some platforms, the preset values aren't correct and then we may +get a completion timeout in the firmware. Change the LTR configuration +to avoid that. The firmware will do some more complex reinit of this +later, but for the boot process we use ~250usec. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d83d591c05ba.I42885c9fb500bc08b9a4c07c4ff3d436cc7a3c84@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 10 ++++++++++ + .../intel/iwlwifi/pcie/ctxt-info-gen3.c | 20 +++++++++++++++++++ + 2 files changed, 30 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h +index cb9e8e189a1a4..1d48c7d7fffd4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h +@@ -147,6 +147,16 @@ + #define CSR_MAC_SHADOW_REG_CTL2 (CSR_BASE + 0x0AC) + #define CSR_MAC_SHADOW_REG_CTL2_RX_WAKE 0xFFFF + ++/* LTR control (since IWL_DEVICE_FAMILY_22000) */ ++#define CSR_LTR_LONG_VAL_AD (CSR_BASE + 0x0D4) ++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ 0x80000000 ++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE 0x1c000000 ++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL 0x03ff0000 ++#define CSR_LTR_LONG_VAL_AD_SNOOP_REQ 0x00008000 ++#define CSR_LTR_LONG_VAL_AD_SNOOP_SCALE 0x00001c00 ++#define CSR_LTR_LONG_VAL_AD_SNOOP_VAL 0x000003ff ++#define CSR_LTR_LONG_VAL_AD_SCALE_USEC 2 ++ + /* GIO Chicken Bits (PCI Express bus link power management) */ + #define CSR_GIO_CHICKEN_BITS (CSR_BASE+0x100) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +index 1ab1366004159..0fc2a6e49f9ee 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c +@@ -252,6 +252,26 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, + + iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL, + CSR_AUTO_FUNC_BOOT_ENA); ++ ++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) { ++ /* ++ * The firmware initializes this again later (to a smaller ++ * value), but for the boot process initialize the LTR to ++ * ~250 usec. ++ */ ++ u32 val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ | ++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC, ++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) | ++ u32_encode_bits(250, ++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) | ++ CSR_LTR_LONG_VAL_AD_SNOOP_REQ | ++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC, ++ CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) | ++ u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL); ++ ++ iwl_write32(trans, CSR_LTR_LONG_VAL_AD, val); ++ } ++ + if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210) + iwl_write_umac_prph(trans, UREG_CPU_INIT_RUN, 1); + else +-- +2.27.0 + diff --git a/queue-5.9/iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch b/queue-5.9/iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch new file mode 100644 index 00000000000..f9190d76692 --- /dev/null +++ b/queue-5.9/iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch @@ -0,0 +1,101 @@ +From ed43675efaba3bab1b093afcbe7f4947418a86b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 10:50:06 +0200 +Subject: iwlwifi: sta: set max HE max A-MPDU according to HE capa + +From: Mordechay Goodstein + +[ Upstream commit c8a2e7a29702fe4626b7aa81149b7b7164e20606 ] + +Currently, our max tpt is limited to max HT A-MPDU for LB, +and max VHT A-MPDU for HB. Configure HE exponent value correctly to +achieve HE max A-MPDU, both on LB and HB. + +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201107104557.4486852ebb56.I9eb0d028e31f183597fb90120e7d4ca87e0dd6cb@changeid +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/fw/api/sta.h | 10 +++++----- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 18 ++++++++++++++++++ + 2 files changed, 23 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h b/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h +index c010e6febbf47..6a071b3c8118c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h +@@ -5,10 +5,9 @@ + * + * GPL LICENSE SUMMARY + * +- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2012-2014, 2018 - 2020 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -28,10 +27,9 @@ + * + * BSD LICENSE + * +- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2012-2014, 2018 - 2020 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -128,7 +126,9 @@ enum iwl_sta_flags { + STA_FLG_MAX_AGG_SIZE_256K = (5 << STA_FLG_MAX_AGG_SIZE_SHIFT), + STA_FLG_MAX_AGG_SIZE_512K = (6 << STA_FLG_MAX_AGG_SIZE_SHIFT), + STA_FLG_MAX_AGG_SIZE_1024K = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT), +- STA_FLG_MAX_AGG_SIZE_MSK = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT), ++ STA_FLG_MAX_AGG_SIZE_2M = (8 << STA_FLG_MAX_AGG_SIZE_SHIFT), ++ STA_FLG_MAX_AGG_SIZE_4M = (9 << STA_FLG_MAX_AGG_SIZE_SHIFT), ++ STA_FLG_MAX_AGG_SIZE_MSK = (0xf << STA_FLG_MAX_AGG_SIZE_SHIFT), + + STA_FLG_AGG_MPDU_DENS_SHIFT = 23, + STA_FLG_AGG_MPDU_DENS_2US = (4 << STA_FLG_AGG_MPDU_DENS_SHIFT), +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 9e124755a3cee..2158fd2eff736 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -196,6 +196,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + mpdu_dens = sta->ht_cap.ampdu_density; + } + ++ + if (sta->vht_cap.vht_supported) { + agg_size = sta->vht_cap.cap & + IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK; +@@ -205,6 +206,23 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + agg_size = sta->ht_cap.ampdu_factor; + } + ++ /* D6.0 10.12.2 A-MPDU length limit rules ++ * A STA indicates the maximum length of the A-MPDU preEOF padding ++ * that it can receive in an HE PPDU in the Maximum A-MPDU Length ++ * Exponent field in its HT Capabilities, VHT Capabilities, ++ * and HE 6 GHz Band Capabilities elements (if present) and the ++ * Maximum AMPDU Length Exponent Extension field in its HE ++ * Capabilities element ++ */ ++ if (sta->he_cap.has_he) ++ agg_size += u8_get_bits(sta->he_cap.he_cap_elem.mac_cap_info[3], ++ IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK); ++ ++ /* Limit to max A-MPDU supported by FW */ ++ if (agg_size > (STA_FLG_MAX_AGG_SIZE_4M >> STA_FLG_MAX_AGG_SIZE_SHIFT)) ++ agg_size = (STA_FLG_MAX_AGG_SIZE_4M >> ++ STA_FLG_MAX_AGG_SIZE_SHIFT); ++ + add_sta_cmd.station_flags |= + cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT); + add_sta_cmd.station_flags |= +-- +2.27.0 + diff --git a/queue-5.9/mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch b/queue-5.9/mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch new file mode 100644 index 00000000000..6e59e7bd092 --- /dev/null +++ b/queue-5.9/mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch @@ -0,0 +1,86 @@ +From aa3bde419f7c6da26b03125be1bc336ac604d9c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 22:15:15 -0800 +Subject: mm/mmap.c: fix mmap return value when vma is merged after call_mmap() + +From: Liu Zixian + +[ Upstream commit 309d08d9b3a3659ab3f239d27d4e38b670b08fc9 ] + +On success, mmap should return the begin address of newly mapped area, +but patch "mm: mmap: merge vma after call_mmap() if possible" set +vm_start of newly merged vma to return value addr. Users of mmap will +get wrong address if vma is merged after call_mmap(). We fix this by +moving the assignment to addr before merging vma. + +We have a driver which changes vm_flags, and this bug is found by our +testcases. + +Fixes: d70cec898324 ("mm: mmap: merge vma after call_mmap() if possible") +Signed-off-by: Liu Zixian +Signed-off-by: Andrew Morton +Reviewed-by: Jason Gunthorpe +Reviewed-by: David Hildenbrand +Cc: Miaohe Lin +Cc: Hongxiang Lou +Cc: Hu Shiyuan +Cc: Matthew Wilcox +Link: https://lkml.kernel.org/r/20201203085350.22624-1-liuzixian4@huawei.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/mmap.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/mm/mmap.c b/mm/mmap.c +index 7a8987aa69962..c85a2875a9625 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1774,6 +1774,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr, + if (error) + goto unmap_and_free_vma; + ++ /* Can addr have changed?? ++ * ++ * Answer: Yes, several device drivers can do it in their ++ * f_op->mmap method. -DaveM ++ * Bug: If addr is changed, prev, rb_link, rb_parent should ++ * be updated for vma_link() ++ */ ++ WARN_ON_ONCE(addr != vma->vm_start); ++ ++ addr = vma->vm_start; ++ + /* If vm_flags changed after call_mmap(), we should try merge vma again + * as we may succeed this time. + */ +@@ -1788,25 +1799,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr, + fput(vma->vm_file); + vm_area_free(vma); + vma = merge; +- /* Update vm_flags and possible addr to pick up the change. We don't +- * warn here if addr changed as the vma is not linked by vma_link(). +- */ +- addr = vma->vm_start; ++ /* Update vm_flags to pick up the change. */ + vm_flags = vma->vm_flags; + goto unmap_writable; + } + } + +- /* Can addr have changed?? +- * +- * Answer: Yes, several device drivers can do it in their +- * f_op->mmap method. -DaveM +- * Bug: If addr is changed, prev, rb_link, rb_parent should +- * be updated for vma_link() +- */ +- WARN_ON_ONCE(addr != vma->vm_start); +- +- addr = vma->vm_start; + vm_flags = vma->vm_flags; + } else if (vm_flags & VM_SHARED) { + error = shmem_zero_setup(vma); +-- +2.27.0 + diff --git a/queue-5.9/net-broadcom-cnic-requires-mmu.patch b/queue-5.9/net-broadcom-cnic-requires-mmu.patch new file mode 100644 index 00000000000..52c7e513c2d --- /dev/null +++ b/queue-5.9/net-broadcom-cnic-requires-mmu.patch @@ -0,0 +1,50 @@ +From db4e87c0d86d4dec0640372779843e6ce9804bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 23:08:43 -0800 +Subject: net: broadcom CNIC: requires MMU + +From: Randy Dunlap + +[ Upstream commit 14483cbf040fcb38113497161088a1ce8ce5d713 ] + +The CNIC kconfig symbol selects UIO and UIO depends on MMU. +Since 'select' does not follow dependency chains, add the same MMU +dependency to CNIC. + +Quietens this kconfig warning: + +WARNING: unmet direct dependencies detected for UIO + Depends on [n]: MMU [=n] + Selected by [m]: + - CNIC [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) + +Fixes: adfc5217e9db ("broadcom: Move the Broadcom drivers") +Signed-off-by: Randy Dunlap +Cc: Jeff Kirsher +Cc: Rasesh Mody +Cc: GR-Linux-NIC-Dev@marvell.com +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/r/20201129070843.3859-1-rdunlap@infradead.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig +index 7fb42f388d591..7b79528d6eed2 100644 +--- a/drivers/net/ethernet/broadcom/Kconfig ++++ b/drivers/net/ethernet/broadcom/Kconfig +@@ -88,6 +88,7 @@ config BNX2 + config CNIC + tristate "QLogic CNIC support" + depends on PCI && (IPV6 || IPV6=n) ++ depends on MMU + select BNX2 + select UIO + help +-- +2.27.0 + diff --git a/queue-5.9/net-xsk-avoid-taking-multiple-skbuff-references.patch b/queue-5.9/net-xsk-avoid-taking-multiple-skbuff-references.patch new file mode 100644 index 00000000000..5b0d2ef8322 --- /dev/null +++ b/queue-5.9/net-xsk-avoid-taking-multiple-skbuff-references.patch @@ -0,0 +1,132 @@ +From d9f7e40fd01c66a9a089469c58bae9303a05c786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 18:56:00 +0100 +Subject: net, xsk: Avoid taking multiple skbuff references +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 36ccdf85829a7dd6936dba5d02fa50138471f0d3 ] + +Commit 642e450b6b59 ("xsk: Do not discard packet when NETDEV_TX_BUSY") +addressed the problem that packets were discarded from the Tx AF_XDP +ring, when the driver returned NETDEV_TX_BUSY. Part of the fix was +bumping the skbuff reference count, so that the buffer would not be +freed by dev_direct_xmit(). A reference count larger than one means +that the skbuff is "shared", which is not the case. + +If the "shared" skbuff is sent to the generic XDP receive path, +netif_receive_generic_xdp(), and pskb_expand_head() is entered the +BUG_ON(skb_shared(skb)) will trigger. + +This patch adds a variant to dev_direct_xmit(), __dev_direct_xmit(), +where a user can select the skbuff free policy. This allows AF_XDP to +avoid bumping the reference count, but still keep the NETDEV_TX_BUSY +behavior. + +Fixes: 642e450b6b59 ("xsk: Do not discard packet when NETDEV_TX_BUSY") +Reported-by: Yonghong Song +Signed-off-by: Björn Töpel +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20201123175600.146255-1-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 14 +++++++++++++- + net/core/dev.c | 8 ++------ + net/xdp/xsk.c | 8 +------- + 3 files changed, 16 insertions(+), 14 deletions(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 8fbdfae2c8c02..edc5fbd07c1ca 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2778,9 +2778,21 @@ u16 dev_pick_tx_zero(struct net_device *dev, struct sk_buff *skb, + struct net_device *sb_dev); + u16 dev_pick_tx_cpu_id(struct net_device *dev, struct sk_buff *skb, + struct net_device *sb_dev); ++ + int dev_queue_xmit(struct sk_buff *skb); + int dev_queue_xmit_accel(struct sk_buff *skb, struct net_device *sb_dev); +-int dev_direct_xmit(struct sk_buff *skb, u16 queue_id); ++int __dev_direct_xmit(struct sk_buff *skb, u16 queue_id); ++ ++static inline int dev_direct_xmit(struct sk_buff *skb, u16 queue_id) ++{ ++ int ret; ++ ++ ret = __dev_direct_xmit(skb, queue_id); ++ if (!dev_xmit_complete(ret)) ++ kfree_skb(skb); ++ return ret; ++} ++ + int register_netdevice(struct net_device *dev); + void unregister_netdevice_queue(struct net_device *dev, struct list_head *head); + void unregister_netdevice_many(struct list_head *head); +diff --git a/net/core/dev.c b/net/core/dev.c +index 010de57488ce7..4a6241c0534d2 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4176,7 +4176,7 @@ int dev_queue_xmit_accel(struct sk_buff *skb, struct net_device *sb_dev) + } + EXPORT_SYMBOL(dev_queue_xmit_accel); + +-int dev_direct_xmit(struct sk_buff *skb, u16 queue_id) ++int __dev_direct_xmit(struct sk_buff *skb, u16 queue_id) + { + struct net_device *dev = skb->dev; + struct sk_buff *orig_skb = skb; +@@ -4205,17 +4205,13 @@ int dev_direct_xmit(struct sk_buff *skb, u16 queue_id) + dev_xmit_recursion_dec(); + + local_bh_enable(); +- +- if (!dev_xmit_complete(ret)) +- kfree_skb(skb); +- + return ret; + drop: + atomic_long_inc(&dev->tx_dropped); + kfree_skb_list(skb); + return NET_XMIT_DROP; + } +-EXPORT_SYMBOL(dev_direct_xmit); ++EXPORT_SYMBOL(__dev_direct_xmit); + + /************************************************************************* + * Receiver routines +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 6c5e09e7440a9..a1ec2c8fa70a9 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -377,11 +377,7 @@ static int xsk_generic_xmit(struct sock *sk) + skb_shinfo(skb)->destructor_arg = (void *)(long)desc.addr; + skb->destructor = xsk_destruct_skb; + +- /* Hinder dev_direct_xmit from freeing the packet and +- * therefore completing it in the destructor +- */ +- refcount_inc(&skb->users); +- err = dev_direct_xmit(skb, xs->queue_id); ++ err = __dev_direct_xmit(skb, xs->queue_id); + if (err == NETDEV_TX_BUSY) { + /* Tell user-space to retry the send */ + skb->destructor = sock_wfree; +@@ -395,12 +391,10 @@ static int xsk_generic_xmit(struct sock *sk) + /* Ignore NET_XMIT_CN as packet might have been sent */ + if (err == NET_XMIT_DROP) { + /* SKB completed but not sent */ +- kfree_skb(skb); + err = -EBUSY; + goto out; + } + +- consume_skb(skb); + sent_frame = true; + } + +-- +2.27.0 + diff --git a/queue-5.9/perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch b/queue-5.9/perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch new file mode 100644 index 00000000000..aaed89c56d5 --- /dev/null +++ b/queue-5.9/perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch @@ -0,0 +1,54 @@ +From 7885adbc5a6deaa1e8e67165f6ee2caeb49615eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 20:09:21 +0900 +Subject: perf/x86/intel: Fix a warning on x86_pmu_stop() with large PEBS + +From: Namhyung Kim + +[ Upstream commit 5debf02131227d39988e44adf5090fb796fa8466 ] + +The commit 3966c3feca3f ("x86/perf/amd: Remove need to check "running" +bit in NMI handler") introduced this. It seems x86_pmu_stop can be +called recursively (like when it losts some samples) like below: + + x86_pmu_stop + intel_pmu_disable_event (x86_pmu_disable) + intel_pmu_pebs_disable + intel_pmu_drain_pebs_nhm (x86_pmu_drain_pebs_buffer) + x86_pmu_stop + +While commit 35d1ce6bec13 ("perf/x86/intel/ds: Fix x86_pmu_stop +warning for large PEBS") fixed it for the normal cases, there's +another path to call x86_pmu_stop() recursively when a PEBS error was +detected (like two or more counters overflowed at the same time). + +Like in the Kan's previous fix, we can skip the interrupt accounting +for large PEBS, so check the iregs which is set for PMI only. + +Fixes: 3966c3feca3f ("x86/perf/amd: Remove need to check "running" bit in NMI handler") +Reported-by: John Sperbeck +Suggested-by: Peter Zijlstra +Signed-off-by: Namhyung Kim +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201126110922.317681-1-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/ds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 404315df1e167..4c84b87904930 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -1937,7 +1937,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs) + if (error[bit]) { + perf_log_lost_samples(event, error[bit]); + +- if (perf_event_account_interrupt(event)) ++ if (iregs && perf_event_account_interrupt(event)) + x86_pmu_stop(event, 0); + } + +-- +2.27.0 + diff --git a/queue-5.9/phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch b/queue-5.9/phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch new file mode 100644 index 00000000000..693b7d95f04 --- /dev/null +++ b/queue-5.9/phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch @@ -0,0 +1,48 @@ +From 57263dd850887b3a0a196939b289a4b33132fb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 15:01:15 -0400 +Subject: phy: usb: Fix incorrect clearing of tca_drv_sel bit in SETUP reg for + 7211 + +From: Al Cooper + +[ Upstream commit 209c805835b29495cf66cc705b206da8f4a68e6e ] + +The 7211a0 has a tca_drv_sel bit in the USB SETUP register that +should never be enabled. This feature is only used if there is a +USB Type-C PHY, and the 7211 does not have one. If the bit is +enabled, the VBUS signal will never be asserted. In the 7211a0, +the bit was incorrectly defaulted to on so the driver had to clear +the bit. In the 7211c0 the state was inverted so the driver should +no longer clear the bit. This hasn't been a problem because all +current 7211 boards don't use the VBUS signal, but there are some +future customer boards that may use it. + +Signed-off-by: Al Cooper +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201002190115.48017-1-alcooperx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +index 456dc4a100c20..e63457e145c71 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +@@ -270,11 +270,6 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params) + reg |= params->mode << USB_PHY_UTMI_CTL_1_PHY_MODE_SHIFT; + brcm_usb_writel(reg, usb_phy + USB_PHY_UTMI_CTL_1); + +- /* Fix the incorrect default */ +- reg = brcm_usb_readl(ctrl + USB_CTRL_SETUP); +- reg &= ~USB_CTRL_SETUP_tca_drv_sel_MASK; +- brcm_usb_writel(reg, ctrl + USB_CTRL_SETUP); +- + usb_init_common(params); + + /* +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch b/queue-5.9/platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch new file mode 100644 index 00000000000..eb06dae506e --- /dev/null +++ b/queue-5.9/platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch @@ -0,0 +1,38 @@ +From 55c03eb61b7b19389c440e253a22bc4723b99222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 02:14:23 +0200 +Subject: platform/x86: acer-wmi: add automatic keyboard background light + toggle key as KEY_LIGHTS_TOGGLE + +From: Timo Witte + +[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ] + +Got a dmesg message on my AMD Renoir based Acer laptop: +"acer_wmi: Unknown key number - 0x84" when toggling keyboard +background light + +Signed-off-by: Timo Witte +Reviewed-by: "Lee, Chun-Yi" +Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 49f4b73be513f..5592a929b5935 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -111,6 +111,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = { + {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */ + {KE_IGNORE, 0x81, {KEY_SLEEP} }, + {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */ ++ {KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */ + {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} }, + {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} }, + {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} }, +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch b/queue-5.9/platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch new file mode 100644 index 00000000000..6921bd52821 --- /dev/null +++ b/queue-5.9/platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch @@ -0,0 +1,42 @@ +From aa9f0adf4dce90fdaa8ef4e2a8717cd07d22795e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 15:16:52 +0200 +Subject: platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 + x360 PC + +From: Max Verevkin + +[ Upstream commit 8b205d3e1bf52ab31cdd5c55f87c87a227793d84 ] + +The Pavilion 13 x360 PC has a chassis-type which does not indicate it is +a convertible, while it is actually a convertible. Add it to the +dmi_switches_allow_list. + +Signed-off-by: Max Verevkin +Link: https://lore.kernel.org/r/20201124131652.11165-1-me@maxverevkin.tk +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel-vbtn.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index f5901b0b07cd8..0419c8001fe33 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -206,6 +206,12 @@ static const struct dmi_system_id dmi_switches_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"), ++ }, ++ }, + {} /* Array terminator */ + }; + +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch b/queue-5.9/platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch new file mode 100644 index 00000000000..382617bb073 --- /dev/null +++ b/queue-5.9/platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch @@ -0,0 +1,47 @@ +From 0793c319c87ae6a9fcf5bbf3d98ce5254f883efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 11:35:50 +0100 +Subject: platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for + Thinkpad Yoga 11e 4th gen + +From: Hans de Goede + +[ Upstream commit c986a7024916c92a775fc8d853fba3cae1d5fde4 ] + +The Thinkpad Yoga 11e 4th gen with the N3450 / Celeron CPU only has +one battery which is named BAT1 instead of the expected BAT0, add a +quirk for this. This fixes not being able to set the charging tresholds +on this model; and this alsoe fixes the following errors in dmesg: + +ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error +thinkpad_acpi: Error probing battery 2 +battery: extension failed to load: ThinkPad Battery Extension +battery: extension unregistered: ThinkPad Battery Extension + +Note that the added quirk is for the "R0K" BIOS versions which are +used on the Thinkpad Yoga 11e 4th gen's with a Celeron CPU, there +is a separate "R0L" BIOS for the i3/i5 based versions. This may also +need the same quirk, but if that really is necessary is unknown. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20201109103550.16265-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index cd7e782791c71..c7e9c0d29ed93 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -9704,6 +9704,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = { + TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */ + TPACPI_Q_LNV3('R', '0', 'C', true), /* Thinkpad 13 */ + TPACPI_Q_LNV3('R', '0', 'J', true), /* Thinkpad 13 gen 2 */ ++ TPACPI_Q_LNV3('R', '0', 'K', true), /* Thinkpad 11e gen 4 celeron BIOS */ + }; + + static int __init tpacpi_battery_init(struct ibm_init_struct *ibm) +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch b/queue-5.9/platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch new file mode 100644 index 00000000000..45ad7f06fe4 --- /dev/null +++ b/queue-5.9/platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch @@ -0,0 +1,36 @@ +From 0f4236b64d307b35c7ebdb02185ea6017dfde437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:25:56 +0300 +Subject: platform/x86: thinkpad_acpi: add P1 gen3 second fan support + +From: Iakov 'Jake' Kirilenko + +[ Upstream commit 15d89c9f6f4a186ade7aefbe77e7ede9746b6c47 ] + +Tested on my P1 gen3, works fine with `thinkfan`. Since thinkpad_acpi fan +control is off by default, it is safe to add 2nd fan control for brave +overclockers + +Signed-off-by: Iakov 'Jake' Kirilenko +Link: https://lore.kernel.org/r/20201105152556.34073-1-jake.kirilenko@gmail.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 017f090a90f68..4a5bb86d341ee 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -8769,6 +8769,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_Q_LNV3('N', '2', 'C', TPACPI_FAN_2CTL), /* P52 / P72 */ + TPACPI_Q_LNV3('N', '2', 'E', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (1st gen) */ + TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */ ++ TPACPI_Q_LNV3('N', '2', 'V', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (3nd gen) */ + }; + + static int __init fan_init(struct ibm_init_struct *iibm) +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch b/queue-5.9/platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch new file mode 100644 index 00000000000..6fafb6bb6d9 --- /dev/null +++ b/queue-5.9/platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch @@ -0,0 +1,66 @@ +From 7ab3d71eba8f1c0edcd70eb52b7c358b67666a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 15:01:30 +0100 +Subject: platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e + +From: Hans de Goede + +[ Upstream commit f2eae1888cf22590c38764b8fa3c989c0283870e ] + +The Yoga 11e series has 2 accelerometers described by a BOSC0200 ACPI node. +This setup relies on a Windows service which reads both accelerometers and +then calculates the angle between the 2 halves to determine laptop / tent / +tablet mode and then reports the calculated mode back to the EC by calling +special ACPI methods on the BOSC0200 node. + +The bmc150 iio driver does not support this (it involves double +calculations requiring sqrt and arccos so this really needs to be done +in userspace), as a result of this on the Yoga 11e the thinkpad_acpi +code always reports SW_TABLET_MODE=0, starting with GNOME 3.38 reporting +SW_TABLET_MODE=0 causes GNOME to: + +1. Not show the onscreen keyboard when a text-input field is focussed + with the touchscreen. +2. Disable accelerometer based auto display-rotation. + +This makes sense when in laptop-mode but not when in tablet-mode. But +since for the Yoga 11e the thinkpad_acpi code always reports +SW_TABLET_MODE=0, GNOME does not know when the device is in tablet-mode. + +Stop reporting the broken (always 0) SW_TABLET_MODE on Yoga 11e models +to fix this. + +Note there are plans for userspace to support 360 degree hinges style +2-in-1s with 2 accelerometers and figure out the mode by itself, see: +https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/issues/216 + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20201106140130.46820-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 4a5bb86d341ee..cd7e782791c71 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3214,7 +3214,14 @@ static int hotkey_init_tablet_mode(void) + + in_tablet_mode = hotkey_gmms_get_tablet_mode(res, + &has_tablet_mode); +- if (has_tablet_mode) ++ /* ++ * The Yoga 11e series has 2 accelerometers described by a ++ * BOSC0200 ACPI node. This setup relies on a Windows service ++ * which calls special ACPI methods on this node to report ++ * the laptop/tent/tablet mode to the EC. The bmc150 iio driver ++ * does not support this, so skip the hotkey on these models. ++ */ ++ if (has_tablet_mode && !acpi_dev_present("BOSC0200", "1", -1)) + tp_features.hotkey_tablet = TP_HOTKEY_TABLET_USES_GMMS; + type = "GMMS"; + } else if (acpi_evalf(hkey_handle, &res, "MHKG", "qd")) { +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch b/queue-5.9/platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch new file mode 100644 index 00000000000..cc6faf67ead --- /dev/null +++ b/queue-5.9/platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch @@ -0,0 +1,36 @@ +From ea217ea5e4da8bf898a338df8f58b0baf4557397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 18:04:16 -0600 +Subject: platform/x86: thinkpad_acpi: Whitelist P15 firmware for dual fan + control + +From: Matthias Maier + +[ Upstream commit 80a8c3185f5047dc7438ed226b72385bf93b4071 ] + +This commit enables dual fan control for the following new Lenovo +models: P15, P15v. + +Signed-off-by: Matthias Maier +Link: https://lore.kernel.org/r/20201126000416.2459645-2-tamiko-ibm-acpi-devel@43-1.org +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index c7e9c0d29ed93..55a94a2dc562e 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -8777,6 +8777,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_Q_LNV3('N', '2', 'E', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (1st gen) */ + TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */ + TPACPI_Q_LNV3('N', '2', 'V', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (3nd gen) */ ++ TPACPI_Q_LNV3('N', '3', '0', TPACPI_FAN_2CTL), /* P15 (1st gen) / P15v (1st gen) */ + }; + + static int __init fan_init(struct ibm_init_struct *iibm) +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch b/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch new file mode 100644 index 00000000000..73bd2bb33dc --- /dev/null +++ b/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch @@ -0,0 +1,63 @@ +From bdcc72d85db8c5f6d1403937194494b1ea31cf71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 12:04:54 +0100 +Subject: platform/x86: touchscreen_dmi: Add info for the Irbis TW118 tablet + +From: Hans de Goede + +[ Upstream commit c9aa128080cbce92f8715a9328f88d8ca3134279 ] + +Add touchscreen info for the Irbis TW118 tablet. + +Reported-and-tested-by: russianneuromancer +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20201124110454.114286-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 26cbf7cc8129c..5783139d0a119 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -295,6 +295,21 @@ static const struct ts_dmi_data irbis_tw90_data = { + .properties = irbis_tw90_props, + }; + ++static const struct property_entry irbis_tw118_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 20), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 30), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1960), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1510), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-irbis-tw118.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ { } ++}; ++ ++static const struct ts_dmi_data irbis_tw118_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = irbis_tw118_props, ++}; ++ + static const struct property_entry itworks_tw891_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-x", 1), + PROPERTY_ENTRY_U32("touchscreen-min-y", 5), +@@ -953,6 +968,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "TW90"), + }, + }, ++ { ++ /* Irbis TW118 */ ++ .driver_data = (void *)&irbis_tw118_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "IRBIS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TW118"), ++ }, ++ }, + { + /* I.T.Works TW891 */ + .driver_data = (void *)&itworks_tw891_data, +-- +2.27.0 + diff --git a/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-predia.patch b/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-predia.patch new file mode 100644 index 00000000000..834fc5c5b9d --- /dev/null +++ b/queue-5.9/platform-x86-touchscreen_dmi-add-info-for-the-predia.patch @@ -0,0 +1,67 @@ +From a341e7821ece23230f94a7eee096ecfe837927f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 21:49:49 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for the Predia Basic tablet + +From: Hans de Goede + +[ Upstream commit 0f511edc6ac12f1ccf1c6c2d4412f5ed7ba426a6 ] + +Add touchscreen info for the Predia Basic tablet. + +Signed-off-by: Hans de Goede +Acked-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20201015194949.50566-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 27 ++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index dda60f89c9512..26cbf7cc8129c 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -623,6 +623,23 @@ static const struct ts_dmi_data pov_mobii_wintab_p1006w_v10_data = { + .properties = pov_mobii_wintab_p1006w_v10_props, + }; + ++static const struct property_entry predia_basic_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 3), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 10), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1728), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1144), ++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl3680-predia-basic.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ PROPERTY_ENTRY_BOOL("silead,home-button"), ++ { } ++}; ++ ++static const struct ts_dmi_data predia_basic_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = predia_basic_props, ++}; ++ + static const struct property_entry schneider_sct101ctm_props[] = { + PROPERTY_ENTRY_U32("touchscreen-size-x", 1715), + PROPERTY_ENTRY_U32("touchscreen-size-y", 1140), +@@ -1109,6 +1126,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BIOS_DATE, "10/24/2014"), + }, + }, ++ { ++ /* Predia Basic tablet) */ ++ .driver_data = (void *)&predia_basic_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"), ++ /* Above matches are too generic, add bios-version match */ ++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"), ++ }, ++ }, + { + /* Point of View mobii wintab p800w (v2.1) */ + .driver_data = (void *)&pov_mobii_wintab_p800w_v21_data, +-- +2.27.0 + diff --git a/queue-5.9/powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch b/queue-5.9/powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch new file mode 100644 index 00000000000..6f4a353a8c4 --- /dev/null +++ b/queue-5.9/powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch @@ -0,0 +1,38 @@ +From 0694d1a107f7a2f422565ccb2705fa6032514f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 20:25:27 +1000 +Subject: powerpc/64s: Fix hash ISA v3.0 TLBIEL instruction generation + +From: Nicholas Piggin + +[ Upstream commit 5844cc25fd121074de7895181a2fa1ce100a0fdd ] + +A typo has the R field of the instruction assigned by lucky dip a la +register allocator. + +Fixes: d4748276ae14c ("powerpc/64s: Improve local TLB flush for boot and MCE on POWER9") +Signed-off-by: Nicholas Piggin +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201126102530.691335-2-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/hash_native.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/book3s64/hash_native.c b/arch/powerpc/mm/book3s64/hash_native.c +index cf20e5229ce1f..562094863e915 100644 +--- a/arch/powerpc/mm/book3s64/hash_native.c ++++ b/arch/powerpc/mm/book3s64/hash_native.c +@@ -68,7 +68,7 @@ static __always_inline void tlbiel_hash_set_isa300(unsigned int set, unsigned in + rs = ((unsigned long)pid << PPC_BITLSHIFT(31)); + + asm volatile(PPC_TLBIEL(%0, %1, %2, %3, %4) +- : : "r"(rb), "r"(rs), "i"(ric), "i"(prs), "r"(r) ++ : : "r"(rb), "r"(rs), "i"(ric), "i"(prs), "i"(r) + : "memory"); + } + +-- +2.27.0 + diff --git a/queue-5.9/powerpc-drop-me200-addition-to-build-flags.patch b/queue-5.9/powerpc-drop-me200-addition-to-build-flags.patch new file mode 100644 index 00000000000..41bfecb46ef --- /dev/null +++ b/queue-5.9/powerpc-drop-me200-addition-to-build-flags.patch @@ -0,0 +1,51 @@ +From 82dbe74f90afc90855f8acf35f249376d06d3554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 23:09:13 +1100 +Subject: powerpc: Drop -me200 addition to build flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit e02152ba2810f7c88cb54e71cda096268dfa9241 ] + +Currently a build with CONFIG_E200=y will fail with: + + Error: invalid switch -me200 + Error: unrecognized option -me200 + +Upstream binutils has never supported an -me200 option. Presumably it +was supported at some point by either a fork or Freescale internal +binutils. + +We can't support code that we can't even build test, so drop the +addition of -me200 to the build flags, so we can at least build with +CONFIG_E200=y. + +Reported-by: Németh Márton +Reported-by: kernel test robot +Signed-off-by: Michael Ellerman +Reviewed-by: Nick Desaulniers +Acked-by: Scott Wood +Link: https://lore.kernel.org/r/20201116120913.165317-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 3e8da9cf2eb9d..e6643d5699fef 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -249,7 +249,6 @@ KBUILD_CFLAGS += $(call cc-option,-mno-string) + cpu-as-$(CONFIG_40x) += -Wa,-m405 + cpu-as-$(CONFIG_44x) += -Wa,-m440 + cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec) +-cpu-as-$(CONFIG_E200) += -Wa,-me200 + cpu-as-$(CONFIG_E500) += -Wa,-me500 + + # When using '-many -mpower4' gas will first try and find a matching power4 +-- +2.27.0 + diff --git a/queue-5.9/s390-fix-irq-state-tracing.patch b/queue-5.9/s390-fix-irq-state-tracing.patch new file mode 100644 index 00000000000..a150c7da7b8 --- /dev/null +++ b/queue-5.9/s390-fix-irq-state-tracing.patch @@ -0,0 +1,115 @@ +From 618aaa35db3007da11f258c7c20f00621f7cd9da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 11:46:01 +0100 +Subject: s390: fix irq state tracing + +From: Heiko Carstens + +[ Upstream commit b1cae1f84a0f609a34ebcaa087fbecef32f69882 ] + +With commit 58c644ba512c ("sched/idle: Fix arch_cpu_idle() vs +tracing") common code calls arch_cpu_idle() with a lockdep state that +tells irqs are on. + +This doesn't work very well for s390: psw_idle() will enable interrupts +to wait for an interrupt. As soon as an interrupt occurs the interrupt +handler will verify if the old context was psw_idle(). If that is the +case the interrupt enablement bits in the old program status word will +be cleared. + +A subsequent test in both the external as well as the io interrupt +handler checks if in the old context interrupts were enabled. Due to +the above patching of the old program status word it is assumed the +old context had interrupts disabled, and therefore a call to +TRACE_IRQS_OFF (aka trace_hardirqs_off_caller) is skipped. Which in +turn makes lockdep incorrectly "think" that interrupts are enabled +within the interrupt handler. + +Fix this by unconditionally calling TRACE_IRQS_OFF when entering +interrupt handlers. Also call unconditionally TRACE_IRQS_ON when +leaving interrupts handlers. + +This leaves the special psw_idle() case, which now returns with +interrupts disabled, but has an "irqs on" lockdep state. So callers of +psw_idle() must adjust the state on their own, if required. This is +currently only __udelay_disabled(). + +Fixes: 58c644ba512c ("sched/idle: Fix arch_cpu_idle() vs tracing") +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/entry.S | 15 --------------- + arch/s390/lib/delay.c | 5 ++--- + 2 files changed, 2 insertions(+), 18 deletions(-) + +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index ca55db0823534..dd5cb6204335d 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -765,12 +765,7 @@ ENTRY(io_int_handler) + xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) + TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ + jo .Lio_restore +-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS) +- tmhh %r8,0x300 +- jz 1f + TRACE_IRQS_OFF +-1: +-#endif + xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + .Lio_loop: + lgr %r2,%r11 # pass pointer to pt_regs +@@ -793,12 +788,7 @@ ENTRY(io_int_handler) + TSTMSK __LC_CPU_FLAGS,_CIF_WORK + jnz .Lio_work + .Lio_restore: +-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS) +- tm __PT_PSW(%r11),3 +- jno 0f + TRACE_IRQS_ON +-0: +-#endif + lg %r14,__LC_VDSO_PER_CPU + mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) + tm __PT_PSW+1(%r11),0x01 # returning to user ? +@@ -980,12 +970,7 @@ ENTRY(ext_int_handler) + xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) + TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ + jo .Lio_restore +-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS) +- tmhh %r8,0x300 +- jz 1f + TRACE_IRQS_OFF +-1: +-#endif + xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + lgr %r2,%r11 # pass pointer to pt_regs + lghi %r3,EXT_INTERRUPT +diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c +index daca7bad66de3..8c0c68e7770ea 100644 +--- a/arch/s390/lib/delay.c ++++ b/arch/s390/lib/delay.c +@@ -33,7 +33,7 @@ EXPORT_SYMBOL(__delay); + + static void __udelay_disabled(unsigned long long usecs) + { +- unsigned long cr0, cr0_new, psw_mask, flags; ++ unsigned long cr0, cr0_new, psw_mask; + struct s390_idle_data idle; + u64 end; + +@@ -45,9 +45,8 @@ static void __udelay_disabled(unsigned long long usecs) + psw_mask = __extract_psw() | PSW_MASK_EXT | PSW_MASK_WAIT; + set_clock_comparator(end); + set_cpu_flag(CIF_IGNORE_IRQ); +- local_irq_save(flags); + psw_idle(&idle, psw_mask); +- local_irq_restore(flags); ++ trace_hardirqs_off(); + clear_cpu_flag(CIF_IGNORE_IRQ); + set_clock_comparator(S390_lowcore.clock_comparator); + __ctl_load(cr0, 0, 0); +-- +2.27.0 + diff --git a/queue-5.9/samples-ftrace-mark-my_tramp-12-global.patch b/queue-5.9/samples-ftrace-mark-my_tramp-12-global.patch new file mode 100644 index 00000000000..2cc42dd95d5 --- /dev/null +++ b/queue-5.9/samples-ftrace-mark-my_tramp-12-global.patch @@ -0,0 +1,74 @@ +From dc0d0596553d6c685c893c1e8d9ab2e883e5b90d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 10:34:14 -0800 +Subject: samples/ftrace: Mark my_tramp[12]? global + +From: Sami Tolvanen + +[ Upstream commit 983df5f2699f83f78643b19d3399b160d1e64f5b ] + +my_tramp[12]? are declared as global functions in C, but they are not +marked global in the inline assembly definition. This mismatch confuses +Clang's Control-Flow Integrity checking. Fix the definitions by adding +.globl. + +Link: https://lkml.kernel.org/r/20201113183414.1446671-1-samitolvanen@google.com + +Fixes: 9d907f1ae80b8 ("ftrace/samples: Add a sample module that implements modify_ftrace_direct()") +Reviewed-by: Kees Cook +Signed-off-by: Sami Tolvanen +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + samples/ftrace/ftrace-direct-modify.c | 2 ++ + samples/ftrace/ftrace-direct-too.c | 1 + + samples/ftrace/ftrace-direct.c | 1 + + 3 files changed, 4 insertions(+) + +diff --git a/samples/ftrace/ftrace-direct-modify.c b/samples/ftrace/ftrace-direct-modify.c +index c13a5bc5095be..5b9a09957c6e0 100644 +--- a/samples/ftrace/ftrace-direct-modify.c ++++ b/samples/ftrace/ftrace-direct-modify.c +@@ -21,6 +21,7 @@ static unsigned long my_ip = (unsigned long)schedule; + asm ( + " .pushsection .text, \"ax\", @progbits\n" + " .type my_tramp1, @function\n" ++" .globl my_tramp1\n" + " my_tramp1:" + " pushq %rbp\n" + " movq %rsp, %rbp\n" +@@ -29,6 +30,7 @@ asm ( + " .size my_tramp1, .-my_tramp1\n" + " ret\n" + " .type my_tramp2, @function\n" ++" .globl my_tramp2\n" + " my_tramp2:" + " pushq %rbp\n" + " movq %rsp, %rbp\n" +diff --git a/samples/ftrace/ftrace-direct-too.c b/samples/ftrace/ftrace-direct-too.c +index d5c5022be6642..3f0079c9bd6fa 100644 +--- a/samples/ftrace/ftrace-direct-too.c ++++ b/samples/ftrace/ftrace-direct-too.c +@@ -16,6 +16,7 @@ extern void my_tramp(void *); + asm ( + " .pushsection .text, \"ax\", @progbits\n" + " .type my_tramp, @function\n" ++" .globl my_tramp\n" + " my_tramp:" + " pushq %rbp\n" + " movq %rsp, %rbp\n" +diff --git a/samples/ftrace/ftrace-direct.c b/samples/ftrace/ftrace-direct.c +index 63ca06d42c803..a2729d1ef17f5 100644 +--- a/samples/ftrace/ftrace-direct.c ++++ b/samples/ftrace/ftrace-direct.c +@@ -14,6 +14,7 @@ extern void my_tramp(void *); + asm ( + " .pushsection .text, \"ax\", @progbits\n" + " .type my_tramp, @function\n" ++" .globl my_tramp\n" + " my_tramp:" + " pushq %rbp\n" + " movq %rsp, %rbp\n" +-- +2.27.0 + diff --git a/queue-5.9/sched-idle-fix-arch_cpu_idle-vs-tracing.patch b/queue-5.9/sched-idle-fix-arch_cpu_idle-vs-tracing.patch new file mode 100644 index 00000000000..625b6a29983 --- /dev/null +++ b/queue-5.9/sched-idle-fix-arch_cpu_idle-vs-tracing.patch @@ -0,0 +1,490 @@ +From 4f72b83a2b1be58453eab77c509d93b584136f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 11:50:35 +0100 +Subject: sched/idle: Fix arch_cpu_idle() vs tracing + +From: Peter Zijlstra + +[ Upstream commit 58c644ba512cfbc2e39b758dd979edd1d6d00e27 ] + +We call arch_cpu_idle() with RCU disabled, but then use +local_irq_{en,dis}able(), which invokes tracing, which relies on RCU. + +Switch all arch_cpu_idle() implementations to use +raw_local_irq_{en,dis}able() and carefully manage the +lockdep,rcu,tracing state like we do in entry. + +(XXX: we really should change arch_cpu_idle() to not return with +interrupts enabled) + +Reported-by: Sven Schnelle +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Mark Rutland +Tested-by: Mark Rutland +Link: https://lkml.kernel.org/r/20201120114925.594122626@infradead.org +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/process.c | 2 +- + arch/arm/kernel/process.c | 2 +- + arch/arm64/kernel/process.c | 2 +- + arch/csky/kernel/process.c | 2 +- + arch/h8300/kernel/process.c | 2 +- + arch/hexagon/kernel/process.c | 2 +- + arch/ia64/kernel/process.c | 2 +- + arch/microblaze/kernel/process.c | 2 +- + arch/mips/kernel/idle.c | 12 ++++++------ + arch/nios2/kernel/process.c | 2 +- + arch/openrisc/kernel/process.c | 2 +- + arch/parisc/kernel/process.c | 2 +- + arch/powerpc/kernel/idle.c | 4 ++-- + arch/riscv/kernel/process.c | 2 +- + arch/s390/kernel/idle.c | 6 +++--- + arch/sh/kernel/idle.c | 2 +- + arch/sparc/kernel/leon_pmc.c | 4 ++-- + arch/sparc/kernel/process_32.c | 2 +- + arch/sparc/kernel/process_64.c | 4 ++-- + arch/um/kernel/process.c | 2 +- + arch/x86/include/asm/mwait.h | 2 -- + arch/x86/kernel/process.c | 12 +++++++----- + kernel/sched/idle.c | 28 +++++++++++++++++++++++++++- + 23 files changed, 64 insertions(+), 38 deletions(-) + +diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c +index 7462a79110024..4c7b0414a3ff3 100644 +--- a/arch/alpha/kernel/process.c ++++ b/arch/alpha/kernel/process.c +@@ -57,7 +57,7 @@ EXPORT_SYMBOL(pm_power_off); + void arch_cpu_idle(void) + { + wtint(0); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + void arch_cpu_idle_dead(void) +diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c +index 8e6ace03e960b..9f199b1e83839 100644 +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -71,7 +71,7 @@ void arch_cpu_idle(void) + arm_pm_idle(); + else + cpu_do_idle(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + void arch_cpu_idle_prepare(void) +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 2da5f3f9d345f..f7c42a7d09b66 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -124,7 +124,7 @@ void arch_cpu_idle(void) + * tricks + */ + cpu_do_idle(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + #ifdef CONFIG_HOTPLUG_CPU +diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c +index f730869e21eed..69af6bc87e647 100644 +--- a/arch/csky/kernel/process.c ++++ b/arch/csky/kernel/process.c +@@ -102,6 +102,6 @@ void arch_cpu_idle(void) + #ifdef CONFIG_CPU_PM_STOP + asm volatile("stop\n"); + #endif +- local_irq_enable(); ++ raw_local_irq_enable(); + } + #endif +diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c +index 83ce3caf73139..a2961c7b2332c 100644 +--- a/arch/h8300/kernel/process.c ++++ b/arch/h8300/kernel/process.c +@@ -57,7 +57,7 @@ asmlinkage void ret_from_kernel_thread(void); + */ + void arch_cpu_idle(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + __asm__("sleep"); + } + +diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c +index dfd322c5ce83a..20962601a1b47 100644 +--- a/arch/hexagon/kernel/process.c ++++ b/arch/hexagon/kernel/process.c +@@ -44,7 +44,7 @@ void arch_cpu_idle(void) + { + __vmwait(); + /* interrupts wake us up, but irqs are still disabled */ +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* +diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c +index f19cb97c00987..1b2769260688d 100644 +--- a/arch/ia64/kernel/process.c ++++ b/arch/ia64/kernel/process.c +@@ -252,7 +252,7 @@ void arch_cpu_idle(void) + if (mark_idle) + (*mark_idle)(1); + +- safe_halt(); ++ raw_safe_halt(); + + if (mark_idle) + (*mark_idle)(0); +diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c +index a9e46e525cd0a..f99860771ff48 100644 +--- a/arch/microblaze/kernel/process.c ++++ b/arch/microblaze/kernel/process.c +@@ -149,5 +149,5 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *fpregs) + + void arch_cpu_idle(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + } +diff --git a/arch/mips/kernel/idle.c b/arch/mips/kernel/idle.c +index 5bc3b04693c7d..18e69ebf5691d 100644 +--- a/arch/mips/kernel/idle.c ++++ b/arch/mips/kernel/idle.c +@@ -33,19 +33,19 @@ static void __cpuidle r3081_wait(void) + { + unsigned long cfg = read_c0_conf(); + write_c0_conf(cfg | R30XX_CONF_HALT); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + static void __cpuidle r39xx_wait(void) + { + if (!need_resched()) + write_c0_conf(read_c0_conf() | TX39_CONF_HALT); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + void __cpuidle r4k_wait(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + __r4k_wait(); + } + +@@ -64,7 +64,7 @@ void __cpuidle r4k_wait_irqoff(void) + " .set arch=r4000 \n" + " wait \n" + " .set pop \n"); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* +@@ -84,7 +84,7 @@ static void __cpuidle rm7k_wait_irqoff(void) + " wait \n" + " mtc0 $1, $12 # stalls until W stage \n" + " .set pop \n"); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* +@@ -257,7 +257,7 @@ void arch_cpu_idle(void) + if (cpu_wait) + cpu_wait(); + else +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + #ifdef CONFIG_CPU_IDLE +diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c +index 88a4ec03edab4..f5cc55a88d310 100644 +--- a/arch/nios2/kernel/process.c ++++ b/arch/nios2/kernel/process.c +@@ -33,7 +33,7 @@ EXPORT_SYMBOL(pm_power_off); + + void arch_cpu_idle(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index 0ff391f00334c..3c98728cce249 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -79,7 +79,7 @@ void machine_power_off(void) + */ + void arch_cpu_idle(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + if (mfspr(SPR_UPR) & SPR_UPR_PMP) + mtspr(SPR_PMR, mfspr(SPR_PMR) | SPR_PMR_DME); + } +diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c +index f196d96e2f9f5..a92a23d6acd93 100644 +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -169,7 +169,7 @@ void __cpuidle arch_cpu_idle_dead(void) + + void __cpuidle arch_cpu_idle(void) + { +- local_irq_enable(); ++ raw_local_irq_enable(); + + /* nop on real hardware, qemu will idle sleep. */ + asm volatile("or %%r10,%%r10,%%r10\n":::); +diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c +index 422e31d2f5a2b..8df35f1329a42 100644 +--- a/arch/powerpc/kernel/idle.c ++++ b/arch/powerpc/kernel/idle.c +@@ -60,9 +60,9 @@ void arch_cpu_idle(void) + * interrupts enabled, some don't. + */ + if (irqs_disabled()) +- local_irq_enable(); ++ raw_local_irq_enable(); + } else { +- local_irq_enable(); ++ raw_local_irq_enable(); + /* + * Go into low thread priority and possibly + * low power mode. +diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c +index 2b97c493427c9..308e1d95ecbf0 100644 +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -36,7 +36,7 @@ extern asmlinkage void ret_from_kernel_thread(void); + void arch_cpu_idle(void) + { + wait_for_interrupt(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + void show_regs(struct pt_regs *regs) +diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c +index f7f1e64e0d980..2b85096964f84 100644 +--- a/arch/s390/kernel/idle.c ++++ b/arch/s390/kernel/idle.c +@@ -33,10 +33,10 @@ void enabled_wait(void) + PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK; + clear_cpu_flag(CIF_NOHZ_DELAY); + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + /* Call the assembler magic in entry.S */ + psw_idle(idle, psw_mask); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + /* Account time spent with enabled wait psw loaded as idle time. */ + raw_write_seqcount_begin(&idle->seqcount); +@@ -123,7 +123,7 @@ void arch_cpu_idle_enter(void) + void arch_cpu_idle(void) + { + enabled_wait(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + void arch_cpu_idle_exit(void) +diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c +index 0dc0f52f9bb8d..f59814983bd59 100644 +--- a/arch/sh/kernel/idle.c ++++ b/arch/sh/kernel/idle.c +@@ -22,7 +22,7 @@ static void (*sh_idle)(void); + void default_idle(void) + { + set_bl_bit(); +- local_irq_enable(); ++ raw_local_irq_enable(); + /* Isn't this racy ? */ + cpu_sleep(); + clear_bl_bit(); +diff --git a/arch/sparc/kernel/leon_pmc.c b/arch/sparc/kernel/leon_pmc.c +index 065e2d4b72908..396f46bca52eb 100644 +--- a/arch/sparc/kernel/leon_pmc.c ++++ b/arch/sparc/kernel/leon_pmc.c +@@ -50,7 +50,7 @@ static void pmc_leon_idle_fixup(void) + register unsigned int address = (unsigned int)leon3_irqctrl_regs; + + /* Interrupts need to be enabled to not hang the CPU */ +- local_irq_enable(); ++ raw_local_irq_enable(); + + __asm__ __volatile__ ( + "wr %%g0, %%asr19\n" +@@ -66,7 +66,7 @@ static void pmc_leon_idle_fixup(void) + static void pmc_leon_idle(void) + { + /* Interrupts need to be enabled to not hang the CPU */ +- local_irq_enable(); ++ raw_local_irq_enable(); + + /* For systems without power-down, this will be no-op */ + __asm__ __volatile__ ("wr %g0, %asr19\n\t"); +diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c +index adfcaeab3ddc5..a023637359154 100644 +--- a/arch/sparc/kernel/process_32.c ++++ b/arch/sparc/kernel/process_32.c +@@ -74,7 +74,7 @@ void arch_cpu_idle(void) + { + if (sparc_idle) + (*sparc_idle)(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* XXX cli/sti -> local_irq_xxx here, check this works once SMP is fixed. */ +diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c +index a75093b993f9a..6f8c7822fc065 100644 +--- a/arch/sparc/kernel/process_64.c ++++ b/arch/sparc/kernel/process_64.c +@@ -62,11 +62,11 @@ void arch_cpu_idle(void) + { + if (tlb_type != hypervisor) { + touch_nmi_watchdog(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } else { + unsigned long pstate; + +- local_irq_enable(); ++ raw_local_irq_enable(); + + /* The sun4v sleeping code requires that we have PSTATE.IE cleared over + * the cpu sleep hypervisor call. +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 26b5e243d3fc0..495f101792b3d 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -217,7 +217,7 @@ void arch_cpu_idle(void) + { + cpu_tasks[current_thread_info()->cpu].pid = os_getpid(); + um_idle_sleep(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + int __cant_sleep(void) { +diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h +index e039a933aca3c..29dd27b5a339d 100644 +--- a/arch/x86/include/asm/mwait.h ++++ b/arch/x86/include/asm/mwait.h +@@ -88,8 +88,6 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx, + + static inline void __sti_mwait(unsigned long eax, unsigned long ecx) + { +- trace_hardirqs_on(); +- + mds_idle_clear_cpu_buffers(); + /* "mwait %eax, %ecx;" */ + asm volatile("sti; .byte 0x0f, 0x01, 0xc9;" +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index ba4593a913fab..145a7ac0c19aa 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -685,7 +685,7 @@ void arch_cpu_idle(void) + */ + void __cpuidle default_idle(void) + { +- safe_halt(); ++ raw_safe_halt(); + } + #if defined(CONFIG_APM_MODULE) || defined(CONFIG_HALTPOLL_CPUIDLE_MODULE) + EXPORT_SYMBOL(default_idle); +@@ -736,6 +736,8 @@ void stop_this_cpu(void *dummy) + /* + * AMD Erratum 400 aware idle routine. We handle it the same way as C3 power + * states (local apic timer and TSC stop). ++ * ++ * XXX this function is completely buggered vs RCU and tracing. + */ + static void amd_e400_idle(void) + { +@@ -757,9 +759,9 @@ static void amd_e400_idle(void) + * The switch back from broadcast mode needs to be called with + * interrupts disabled. + */ +- local_irq_disable(); ++ raw_local_irq_disable(); + tick_broadcast_exit(); +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /* +@@ -801,9 +803,9 @@ static __cpuidle void mwait_idle(void) + if (!need_resched()) + __sti_mwait(0, 0); + else +- local_irq_enable(); ++ raw_local_irq_enable(); + } else { +- local_irq_enable(); ++ raw_local_irq_enable(); + } + __current_clr_polling(); + } +diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c +index f324dc36fc43d..dee807ffad11b 100644 +--- a/kernel/sched/idle.c ++++ b/kernel/sched/idle.c +@@ -78,7 +78,7 @@ void __weak arch_cpu_idle_dead(void) { } + void __weak arch_cpu_idle(void) + { + cpu_idle_force_poll = 1; +- local_irq_enable(); ++ raw_local_irq_enable(); + } + + /** +@@ -94,9 +94,35 @@ void __cpuidle default_idle_call(void) + + trace_cpu_idle(1, smp_processor_id()); + stop_critical_timings(); ++ ++ /* ++ * arch_cpu_idle() is supposed to enable IRQs, however ++ * we can't do that because of RCU and tracing. ++ * ++ * Trace IRQs enable here, then switch off RCU, and have ++ * arch_cpu_idle() use raw_local_irq_enable(). Note that ++ * rcu_idle_enter() relies on lockdep IRQ state, so switch that ++ * last -- this is very similar to the entry code. ++ */ ++ trace_hardirqs_on_prepare(); ++ lockdep_hardirqs_on_prepare(_THIS_IP_); + rcu_idle_enter(); ++ lockdep_hardirqs_on(_THIS_IP_); ++ + arch_cpu_idle(); ++ ++ /* ++ * OK, so IRQs are enabled here, but RCU needs them disabled to ++ * turn itself back on.. funny thing is that disabling IRQs ++ * will cause tracing, which needs RCU. Jump through hoops to ++ * make it 'work'. ++ */ ++ raw_local_irq_disable(); ++ lockdep_hardirqs_off(_THIS_IP_); + rcu_idle_exit(); ++ lockdep_hardirqs_on(_THIS_IP_); ++ raw_local_irq_enable(); ++ + start_critical_timings(); + trace_cpu_idle(PWR_EVENT_EXIT, smp_processor_id()); + } +-- +2.27.0 + diff --git a/queue-5.9/scsi-storvsc-fix-error-return-in-storvsc_probe.patch b/queue-5.9/scsi-storvsc-fix-error-return-in-storvsc_probe.patch new file mode 100644 index 00000000000..bf557036c71 --- /dev/null +++ b/queue-5.9/scsi-storvsc-fix-error-return-in-storvsc_probe.patch @@ -0,0 +1,40 @@ +From 189a5fce19c937db73870077ecc5e50201ef7df6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 11:02:06 +0800 +Subject: scsi: storvsc: Fix error return in storvsc_probe() + +From: Jing Xiangfeng + +[ Upstream commit 6112ff4e8f393e7e297dff04eff0987f94d37fa1 ] + +Return -ENOMEM from the error handling case instead of 0. + +Link: https://lore.kernel.org/r/20201127030206.104616-1-jingxiangfeng@huawei.com +Fixes: 436ad9413353 ("scsi: storvsc: Allow only one remove lun work item to be issued per lun") +Reviewed-by: Michael Kelley +Signed-off-by: Jing Xiangfeng +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 8f5f5dc863a4a..719f9ae6c97ae 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1952,8 +1952,10 @@ static int storvsc_probe(struct hv_device *device, + alloc_ordered_workqueue("storvsc_error_wq_%d", + WQ_MEM_RECLAIM, + host->host_no); +- if (!host_dev->handle_error_wq) ++ if (!host_dev->handle_error_wq) { ++ ret = -ENOMEM; + goto err_out2; ++ } + INIT_WORK(&host_dev->host_scan_work, storvsc_host_scan); + /* Register the HBA and start the scsi bus scan */ + ret = scsi_add_host(host, &device->device); +-- +2.27.0 + diff --git a/queue-5.9/scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch b/queue-5.9/scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch new file mode 100644 index 00000000000..43aecdb2345 --- /dev/null +++ b/queue-5.9/scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch @@ -0,0 +1,89 @@ +From 5bb5d3a7a3dceaaec0f6df178c3577b23676c0e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 22:59:00 -0700 +Subject: scsi: ufs: Fix unexpected values from ufshcd_read_desc_param() + +From: Can Guo + +[ Upstream commit 1699f980d87fb678a669490462cf0b9517c1fb47 ] + +WB-related sysfs entries can be accessed even when an UFS device does not +support the feature. The descriptors which are not supported by the UFS +device may be wrongly reported when they are accessed from their +corrsponding sysfs entries. Fix it by adding a sanity check of parameter +offset against the actual decriptor length. + +Link: https://lore.kernel.org/r/1603346348-14149-1-git-send-email-cang@codeaurora.org +Reviewed-by: Asutosh Das +Acked-by: Daejun Park +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 9dd32bb0ff2be..cbcdd79a1f76f 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -3163,13 +3163,19 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, + /* Get the length of descriptor */ + ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len); + if (!buff_len) { +- dev_err(hba->dev, "%s: Failed to get desc length", __func__); ++ dev_err(hba->dev, "%s: Failed to get desc length\n", __func__); ++ return -EINVAL; ++ } ++ ++ if (param_offset >= buff_len) { ++ dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN 0x%x, length 0x%x\n", ++ __func__, param_offset, desc_id, buff_len); + return -EINVAL; + } + + /* Check whether we need temp memory */ + if (param_offset != 0 || param_size < buff_len) { +- desc_buf = kmalloc(buff_len, GFP_KERNEL); ++ desc_buf = kzalloc(buff_len, GFP_KERNEL); + if (!desc_buf) + return -ENOMEM; + } else { +@@ -3183,14 +3189,14 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, + desc_buf, &buff_len); + + if (ret) { +- dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d", ++ dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d\n", + __func__, desc_id, desc_index, param_offset, ret); + goto out; + } + + /* Sanity check */ + if (desc_buf[QUERY_DESC_DESC_TYPE_OFFSET] != desc_id) { +- dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header", ++ dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header\n", + __func__, desc_buf[QUERY_DESC_DESC_TYPE_OFFSET]); + ret = -EINVAL; + goto out; +@@ -3200,12 +3206,12 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, + buff_len = desc_buf[QUERY_DESC_LENGTH_OFFSET]; + ufshcd_update_desc_length(hba, desc_id, desc_index, buff_len); + +- /* Check wherher we will not copy more data, than available */ +- if (is_kmalloc && (param_offset + param_size) > buff_len) +- param_size = buff_len - param_offset; +- +- if (is_kmalloc) ++ if (is_kmalloc) { ++ /* Make sure we don't copy more data than available */ ++ if (param_offset + param_size > buff_len) ++ param_size = buff_len - param_offset; + memcpy(param_read_buf, &desc_buf[param_offset], param_size); ++ } + out: + if (is_kmalloc) + kfree(desc_buf); +-- +2.27.0 + diff --git a/queue-5.9/scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch b/queue-5.9/scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch new file mode 100644 index 00000000000..fa9dca234d7 --- /dev/null +++ b/queue-5.9/scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch @@ -0,0 +1,57 @@ +From 74ad187a521c6c9cb8750d26bb8e08363254e633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 00:09:04 -0700 +Subject: scsi: ufs: Make sure clk scaling happens only when HBA is runtime + ACTIVE + +From: Can Guo + +[ Upstream commit 73cc291c270248567245f084dcdf5078069af6b5 ] + +If someone plays with the UFS clk scaling devfreq governor through sysfs, +ufshcd_devfreq_scale may be called even when HBA is not runtime ACTIVE. +This can lead to unexpected error. We cannot just protect it by calling +pm_runtime_get_sync() because that may cause a race condition since HBA +runtime suspend ops need to suspend clk scaling. To fix this call +pm_runtime_get_noresume() and check HBA's runtime status. Only proceed if +HBA is runtime ACTIVE, otherwise just bail. + +governor_store + devfreq_performance_handler + update_devfreq + devfreq_set_target + ufshcd_devfreq_target + ufshcd_devfreq_scale + +Link: https://lore.kernel.org/r/1600758548-28576-1-git-send-email-cang@codeaurora.org +Reviewed-by: Stanley Chu +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index cbcdd79a1f76f..18326eb772aeb 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1279,8 +1279,15 @@ static int ufshcd_devfreq_target(struct device *dev, + } + spin_unlock_irqrestore(hba->host->host_lock, irq_flags); + ++ pm_runtime_get_noresume(hba->dev); ++ if (!pm_runtime_active(hba->dev)) { ++ pm_runtime_put_noidle(hba->dev); ++ ret = -EAGAIN; ++ goto out; ++ } + start = ktime_get(); + ret = ufshcd_devfreq_scale(hba, scale_up); ++ pm_runtime_put(hba->dev); + + trace_ufshcd_profile_clk_scaling(dev_name(hba->dev), + (scale_up ? "up" : "down"), +-- +2.27.0 + diff --git a/queue-5.9/series b/queue-5.9/series index d4c63438ce9..aecec48d80f 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -2,3 +2,74 @@ kbuild-do-not-emit-debug-info-for-assembly-with-llvm_ias-1.patch mm-zsmalloc.c-drop-zsmalloc_pgtable_mapping.patch kprobes-remove-nmi-context-check.patch kprobes-tell-lockdep-about-kprobe-nesting.patch +asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch +tools-bootconfig-fix-to-check-the-write-failure-corr.patch +net-xsk-avoid-taking-multiple-skbuff-references.patch +bpftool-fix-error-return-value-in-build_btf_type_tab.patch +vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch +powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch +batman-adv-consider-fragmentation-for-needed_headroo.patch +batman-adv-reserve-needed_-room-for-fragments.patch +batman-adv-don-t-always-reallocate-the-fragmentation.patch +ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch +ibmvnic-handle-inconsistent-login-with-reset.patch +ibmvnic-stop-free_all_rwi-on-failed-reset.patch +ibmvnic-avoid-memset-null-scrq-msgs.patch +ibmvnic-delay-next-reset-if-hard-reset-fails.patch +ibmvnic-track-pending-login.patch +ibmvnic-send_login-should-check-for-crq-errors.patch +ibmvnic-reduce-wait-for-completion-time.patch +drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch +drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch +can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch +can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch +can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch +can-c_can-c_can_power_up-fix-error-handling.patch +can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch +samples-ftrace-mark-my_tramp-12-global.patch +scsi-storvsc-fix-error-return-in-storvsc_probe.patch +net-broadcom-cnic-requires-mmu.patch +vdpa-mlx5-fix-vdpa-vhost-dependencies.patch +iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch +perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch +usb-ohci-omap-fix-descriptor-conversion.patch +zlib-export-s390-symbols-for-zlib-modules.patch +mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch +phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch +arm64-dts-rockchip-remove-system-power-controller-fr.patch +iwlwifi-pcie-limit-memory-read-spin-time.patch +arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch +arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch +iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch +iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch +iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch +powerpc-drop-me200-addition-to-build-flags.patch +arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch +arc-stack-unwinding-don-t-assume-non-current-task-is.patch +scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch +scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch +interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch +interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch +ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch +irqchip-gic-v3-its-unconditionally-save-restore-the-.patch +drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch +spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch +arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch +habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch +btrfs-do-nofs-allocations-when-adding-and-removing-q.patch +btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch +soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch +sched-idle-fix-arch_cpu_idle-vs-tracing.patch +intel_idle-fix-intel_idle-vs-tracing.patch +arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch +platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch +platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch +platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch +platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch +platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch +platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch +platform-x86-touchscreen_dmi-add-info-for-the-predia.patch +platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch +can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch +s390-fix-irq-state-tracing.patch +intel_idle-build-fix.patch diff --git a/queue-5.9/soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch b/queue-5.9/soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch new file mode 100644 index 00000000000..d85862a600d --- /dev/null +++ b/queue-5.9/soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch @@ -0,0 +1,110 @@ +From 3f1bfbf4e63c6231c1e0596bb617f508ba4c016e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 10:18:32 +0800 +Subject: soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) + +From: Hao Si + +[ Upstream commit 2663b3388551230cbc4606a40fabf3331ceb59e4 ] + +The local variable 'cpumask_t mask' is in the stack memory, and its address +is assigned to 'desc->affinity' in 'irq_set_affinity_hint()'. +But the memory area where this variable is located is at risk of being +modified. + +During LTP testing, the following error was generated: + +Unable to handle kernel paging request at virtual address ffff000012e9b790 +Mem abort info: + ESR = 0x96000007 + Exception class = DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000007 + CM = 0, WnR = 0 +swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000075ac5e07 +[ffff000012e9b790] pgd=00000027dbffe003, pud=00000027dbffd003, +pmd=00000027b6d61003, pte=0000000000000000 +Internal error: Oops: 96000007 [#1] PREEMPT SMP +Modules linked in: xt_conntrack +Process read_all (pid: 20171, stack limit = 0x0000000044ea4095) +CPU: 14 PID: 20171 Comm: read_all Tainted: G B W +Hardware name: NXP Layerscape LX2160ARDB (DT) +pstate: 80000085 (Nzcv daIf -PAN -UAO) +pc : irq_affinity_hint_proc_show+0x54/0xb0 +lr : irq_affinity_hint_proc_show+0x4c/0xb0 +sp : ffff00001138bc10 +x29: ffff00001138bc10 x28: 0000ffffd131d1e0 +x27: 00000000007000c0 x26: ffff8025b9480dc0 +x25: ffff8025b9480da8 x24: 00000000000003ff +x23: ffff8027334f8300 x22: ffff80272e97d000 +x21: ffff80272e97d0b0 x20: ffff8025b9480d80 +x19: ffff000009a49000 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000040 +x11: 0000000000000000 x10: ffff802735b79b88 +x9 : 0000000000000000 x8 : 0000000000000000 +x7 : ffff000009a49848 x6 : 0000000000000003 +x5 : 0000000000000000 x4 : ffff000008157d6c +x3 : ffff00001138bc10 x2 : ffff000012e9b790 +x1 : 0000000000000000 x0 : 0000000000000000 +Call trace: + irq_affinity_hint_proc_show+0x54/0xb0 + seq_read+0x1b0/0x440 + proc_reg_read+0x80/0xd8 + __vfs_read+0x60/0x178 + vfs_read+0x94/0x150 + ksys_read+0x74/0xf0 + __arm64_sys_read+0x24/0x30 + el0_svc_common.constprop.0+0xd8/0x1a0 + el0_svc_handler+0x34/0x88 + el0_svc+0x10/0x14 +Code: f9001bbf 943e0732 f94066c2 b4000062 (f9400041) +---[ end trace b495bdcb0b3b732b ]--- +Kernel panic - not syncing: Fatal exception +SMP: stopping secondary CPUs +SMP: failed to stop secondary CPUs 0,2-4,6,8,11,13-15 +Kernel Offset: disabled +CPU features: 0x0,21006008 +Memory Limit: none +---[ end Kernel panic - not syncing: Fatal exception ]--- + +Fix it by using 'cpumask_of(cpu)' to get the cpumask. + +Signed-off-by: Hao Si +Signed-off-by: Lin Chen +Signed-off-by: Yi Wang +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/dpio/dpio-driver.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c +index 7b642c330977f..7f397b4ad878d 100644 +--- a/drivers/soc/fsl/dpio/dpio-driver.c ++++ b/drivers/soc/fsl/dpio/dpio-driver.c +@@ -95,7 +95,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu) + { + int error; + struct fsl_mc_device_irq *irq; +- cpumask_t mask; + + irq = dpio_dev->irqs[0]; + error = devm_request_irq(&dpio_dev->dev, +@@ -112,9 +111,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu) + } + + /* set the affinity hint */ +- cpumask_clear(&mask); +- cpumask_set_cpu(cpu, &mask); +- if (irq_set_affinity_hint(irq->msi_desc->irq, &mask)) ++ if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu))) + dev_err(&dpio_dev->dev, + "irq_set_affinity failed irq %d cpu %d\n", + irq->msi_desc->irq, cpu); +-- +2.27.0 + diff --git a/queue-5.9/spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch b/queue-5.9/spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch new file mode 100644 index 00000000000..7f7917b15e7 --- /dev/null +++ b/queue-5.9/spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch @@ -0,0 +1,57 @@ +From cadf779754bbb936694297ef9d393e84a26a6d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 10:57:15 +0800 +Subject: spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts + +From: Ran Wang + +[ Upstream commit 71d80563b0760a411cd90a3680536f5d887fff6b ] + +Given the case that bootloader(such as UEFI)'s FSPI driver might not +handle all interrupts before loading kernel, those legacy interrupts +would assert immidiately once kernel's FSPI driver enable them. Further, +if it was FSPI_INTR_IPCMDDONE, the irq handler nxp_fspi_irq_handler() +would call complete(&f->c) to notify others. However, f->c might not be +initialized yet at that time, then cause kernel panic. + +Of cause, we should fix this issue within bootloader. But it would be +better to have this pacth to make dirver more robust (by clearing all +interrupt status bits before enabling interrupts). + +Suggested-by: Han Xu +Signed-off-by: Ran Wang +Link: https://lore.kernel.org/r/20201123025715.14635-1-ran.wang_1@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-nxp-fspi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c +index 1ccda82da2063..158e09470898b 100644 +--- a/drivers/spi/spi-nxp-fspi.c ++++ b/drivers/spi/spi-nxp-fspi.c +@@ -991,6 +991,7 @@ static int nxp_fspi_probe(struct platform_device *pdev) + struct resource *res; + struct nxp_fspi *f; + int ret; ++ u32 reg; + + ctlr = spi_alloc_master(&pdev->dev, sizeof(*f)); + if (!ctlr) +@@ -1017,6 +1018,12 @@ static int nxp_fspi_probe(struct platform_device *pdev) + goto err_put_ctrl; + } + ++ /* Clear potential interrupts */ ++ reg = fspi_readl(f, f->iobase + FSPI_INTR); ++ if (reg) ++ fspi_writel(f, reg, f->iobase + FSPI_INTR); ++ ++ + /* find the resources - controller memory mapped space */ + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fspi_mmap"); + if (!res) { +-- +2.27.0 + diff --git a/queue-5.9/tools-bootconfig-fix-to-check-the-write-failure-corr.patch b/queue-5.9/tools-bootconfig-fix-to-check-the-write-failure-corr.patch new file mode 100644 index 00000000000..c0f4997b9fd --- /dev/null +++ b/queue-5.9/tools-bootconfig-fix-to-check-the-write-failure-corr.patch @@ -0,0 +1,88 @@ +From 35dec46128568a08832b2fb138819dcf089161e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 14:53:31 +0900 +Subject: tools/bootconfig: Fix to check the write failure correctly + +From: Masami Hiramatsu + +[ Upstream commit a995e6bc0524450adfd6181dfdcd9d0520cfaba5 ] + +Fix to check the write(2) failure including partial write +correctly and try to rollback the partial write, because +if there is no BOOTCONFIG_MAGIC string, we can not remove it. + +Link: https://lkml.kernel.org/r/160576521135.320071.3883101436675969998.stgit@devnote2 + +Fixes: 85c46b78da58 ("bootconfig: Add bootconfig magic word for indicating bootconfig explicitly") +Suggested-by: Linus Torvalds +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + tools/bootconfig/main.c | 30 ++++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c +index e0878f5f74b1b..ffd6a358925da 100644 +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -274,6 +274,7 @@ static void show_xbc_error(const char *data, const char *msg, int pos) + + int apply_xbc(const char *path, const char *xbc_path) + { ++ struct stat stat; + u32 size, csum; + char *buf, *data; + int ret, fd; +@@ -330,16 +331,26 @@ int apply_xbc(const char *path, const char *xbc_path) + return fd; + } + /* TODO: Ensure the @path is initramfs/initrd image */ ++ if (fstat(fd, &stat) < 0) { ++ pr_err("Failed to get the size of %s\n", path); ++ goto out; ++ } + ret = write(fd, data, size + 8); +- if (ret < 0) { ++ if (ret < size + 8) { ++ if (ret < 0) ++ ret = -errno; + pr_err("Failed to apply a boot config: %d\n", ret); +- goto out; ++ if (ret < 0) ++ goto out; ++ goto out_rollback; + } + /* Write a magic word of the bootconfig */ + ret = write(fd, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN); +- if (ret < 0) { ++ if (ret < BOOTCONFIG_MAGIC_LEN) { ++ if (ret < 0) ++ ret = -errno; + pr_err("Failed to apply a boot config magic: %d\n", ret); +- goto out; ++ goto out_rollback; + } + ret = 0; + out: +@@ -347,6 +358,17 @@ out: + free(data); + + return ret; ++ ++out_rollback: ++ /* Map the partial write to -ENOSPC */ ++ if (ret >= 0) ++ ret = -ENOSPC; ++ if (ftruncate(fd, stat.st_size) < 0) { ++ ret = -errno; ++ pr_err("Failed to rollback the write error: %d\n", ret); ++ pr_err("The initrd %s may be corrupted. Recommend to rebuild.\n", path); ++ } ++ goto out; + } + + int usage(void) +-- +2.27.0 + diff --git a/queue-5.9/usb-ohci-omap-fix-descriptor-conversion.patch b/queue-5.9/usb-ohci-omap-fix-descriptor-conversion.patch new file mode 100644 index 00000000000..1787b6ee5db --- /dev/null +++ b/queue-5.9/usb-ohci-omap-fix-descriptor-conversion.patch @@ -0,0 +1,68 @@ +From 80dfb03ba864b7e51be54758016a899d622a75cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 09:30:33 +0100 +Subject: usb: ohci-omap: Fix descriptor conversion + +From: Linus Walleij + +[ Upstream commit 45c5775460f32ed8cdb7c16986ae1a2c254346b3 ] + +There were a bunch of issues with the patch converting the +OMAP1 OSK board to use descriptors for controlling the USB +host: + +- The chip label was incorrect +- The GPIO offset was off-by-one +- The code should use sleeping accessors + +This patch tries to fix all issues at the same time. + +Cc: Aaro Koskinen +Reported-by: Aaro Koskinen +Fixes: 15d157e87443 ("usb: ohci-omap: Convert to use GPIO descriptors") +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20201130083033.29435-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/board-osk.c | 2 +- + drivers/usb/host/ohci-omap.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mach-omap1/board-osk.c b/arch/arm/mach-omap1/board-osk.c +index 144b9caa935c4..a720259099edf 100644 +--- a/arch/arm/mach-omap1/board-osk.c ++++ b/arch/arm/mach-omap1/board-osk.c +@@ -288,7 +288,7 @@ static struct gpiod_lookup_table osk_usb_gpio_table = { + .dev_id = "ohci", + .table = { + /* Power GPIO on the I2C-attached TPS65010 */ +- GPIO_LOOKUP("i2c-tps65010", 1, "power", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("tps65010", 0, "power", GPIO_ACTIVE_HIGH), + GPIO_LOOKUP(OMAP_GPIO_LABEL, 9, "overcurrent", + GPIO_ACTIVE_HIGH), + }, +diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c +index 9ccdf2c216b51..6374501ba1390 100644 +--- a/drivers/usb/host/ohci-omap.c ++++ b/drivers/usb/host/ohci-omap.c +@@ -91,14 +91,14 @@ static int omap_ohci_transceiver_power(struct ohci_omap_priv *priv, int on) + | ((1 << 5/*usb1*/) | (1 << 3/*usb2*/)), + INNOVATOR_FPGA_CAM_USB_CONTROL); + else if (priv->power) +- gpiod_set_value(priv->power, 0); ++ gpiod_set_value_cansleep(priv->power, 0); + } else { + if (machine_is_omap_innovator() && cpu_is_omap1510()) + __raw_writeb(__raw_readb(INNOVATOR_FPGA_CAM_USB_CONTROL) + & ~((1 << 5/*usb1*/) | (1 << 3/*usb2*/)), + INNOVATOR_FPGA_CAM_USB_CONTROL); + else if (priv->power) +- gpiod_set_value(priv->power, 1); ++ gpiod_set_value_cansleep(priv->power, 1); + } + + return 0; +-- +2.27.0 + diff --git a/queue-5.9/vdpa-mlx5-fix-vdpa-vhost-dependencies.patch b/queue-5.9/vdpa-mlx5-fix-vdpa-vhost-dependencies.patch new file mode 100644 index 00000000000..3bccefac845 --- /dev/null +++ b/queue-5.9/vdpa-mlx5-fix-vdpa-vhost-dependencies.patch @@ -0,0 +1,70 @@ +From 6a2d9bf8640b9e7a683469577df9c9d3d0b099a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 13:39:05 -0800 +Subject: vdpa: mlx5: fix vdpa/vhost dependencies + +From: Randy Dunlap + +[ Upstream commit 98701a2a861fa87a5055cf2809758e8725e8b146 ] + +drivers/vdpa/mlx5/ uses vhost_iotlb*() interfaces, so select +VHOST_IOTLB to make them be built. + +However, if VHOST_IOTLB is the only VHOST symbol that is +set/enabled, the object file still won't be built because +drivers/Makefile won't descend into drivers/vhost/ to build it, +so make drivers/Makefile build the needed binary whenever +VHOST_IOTLB is set, like it does for VHOST_RING. + +Fixes these build errors: +ERROR: modpost: "vhost_iotlb_itree_next" [drivers/vdpa/mlx5/mlx5_vdpa.ko] undefined! +ERROR: modpost: "vhost_iotlb_itree_first" [drivers/vdpa/mlx5/mlx5_vdpa.ko] undefined! + +Fixes: 29064bfdabd5 ("vdpa/mlx5: Add support library for mlx5 VDPA implementation") +Fixes: aff90770e54c ("vdpa/mlx5: Fix dependency on MLX5_CORE") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Eli Cohen +Cc: Parav Pandit +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: virtualization@lists.linux-foundation.org +Cc: Saeed Mahameed +Cc: Leon Romanovsky +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/r/20201128213905.27409-1-rdunlap@infradead.org +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/Makefile | 1 + + drivers/vdpa/Kconfig | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/Makefile b/drivers/Makefile +index c0cd1b9075e3d..5762280377186 100644 +--- a/drivers/Makefile ++++ b/drivers/Makefile +@@ -145,6 +145,7 @@ obj-$(CONFIG_OF) += of/ + obj-$(CONFIG_SSB) += ssb/ + obj-$(CONFIG_BCMA) += bcma/ + obj-$(CONFIG_VHOST_RING) += vhost/ ++obj-$(CONFIG_VHOST_IOTLB) += vhost/ + obj-$(CONFIG_VHOST) += vhost/ + obj-$(CONFIG_VLYNQ) += vlynq/ + obj-$(CONFIG_GREYBUS) += greybus/ +diff --git a/drivers/vdpa/Kconfig b/drivers/vdpa/Kconfig +index 358f6048dd3ce..6caf539091e55 100644 +--- a/drivers/vdpa/Kconfig ++++ b/drivers/vdpa/Kconfig +@@ -32,6 +32,7 @@ config IFCVF + + config MLX5_VDPA + bool ++ select VHOST_IOTLB + help + Support library for Mellanox VDPA drivers. Provides code that is + common for all types of VDPA drivers. The following drivers are planned: +-- +2.27.0 + diff --git a/queue-5.9/vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch b/queue-5.9/vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch new file mode 100644 index 00000000000..6cf09b8c3b4 --- /dev/null +++ b/queue-5.9/vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch @@ -0,0 +1,184 @@ +From 7c342fd2254cdfce8804445a40a20116566656a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:26:33 -0500 +Subject: vhost-vdpa: fix page pinning leakage in error path (rework) + +From: Si-Wei Liu + +[ Upstream commit ad89653f79f1882d55d9df76c9b2b94f008c4e27 ] + +Pinned pages are not properly accounted particularly when +mapping error occurs on IOTLB update. Clean up dangling +pinned pages for the error path. + +The memory usage for bookkeeping pinned pages is reverted +to what it was before: only one single free page is needed. +This helps reduce the host memory demand for VM with a large +amount of memory, or in the situation where host is running +short of free memory. + +Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") +Signed-off-by: Si-Wei Liu +Link: https://lore.kernel.org/r/1604618793-4681-1-git-send-email-si-wei.liu@oracle.com +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 80 ++++++++++++++++++++++++++++++++++---------- + 1 file changed, 62 insertions(+), 18 deletions(-) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 676175bd9a679..eed604fe4d215 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -567,6 +567,8 @@ static int vhost_vdpa_map(struct vhost_vdpa *v, + + if (r) + vhost_iotlb_del_range(dev->iotlb, iova, iova + size - 1); ++ else ++ atomic64_add(size >> PAGE_SHIFT, &dev->mm->pinned_vm); + + return r; + } +@@ -598,14 +600,16 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, + unsigned long list_size = PAGE_SIZE / sizeof(struct page *); + unsigned int gup_flags = FOLL_LONGTERM; + unsigned long npages, cur_base, map_pfn, last_pfn = 0; +- unsigned long locked, lock_limit, pinned, i; ++ unsigned long lock_limit, sz2pin, nchunks, i; + u64 iova = msg->iova; ++ long pinned; + int ret = 0; + + if (vhost_iotlb_itree_first(iotlb, msg->iova, + msg->iova + msg->size - 1)) + return -EEXIST; + ++ /* Limit the use of memory for bookkeeping */ + page_list = (struct page **) __get_free_page(GFP_KERNEL); + if (!page_list) + return -ENOMEM; +@@ -614,52 +618,75 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, + gup_flags |= FOLL_WRITE; + + npages = PAGE_ALIGN(msg->size + (iova & ~PAGE_MASK)) >> PAGE_SHIFT; +- if (!npages) +- return -EINVAL; ++ if (!npages) { ++ ret = -EINVAL; ++ goto free; ++ } + + mmap_read_lock(dev->mm); + +- locked = atomic64_add_return(npages, &dev->mm->pinned_vm); + lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- +- if (locked > lock_limit) { ++ if (npages + atomic64_read(&dev->mm->pinned_vm) > lock_limit) { + ret = -ENOMEM; +- goto out; ++ goto unlock; + } + + cur_base = msg->uaddr & PAGE_MASK; + iova &= PAGE_MASK; ++ nchunks = 0; + + while (npages) { +- pinned = min_t(unsigned long, npages, list_size); +- ret = pin_user_pages(cur_base, pinned, +- gup_flags, page_list, NULL); +- if (ret != pinned) ++ sz2pin = min_t(unsigned long, npages, list_size); ++ pinned = pin_user_pages(cur_base, sz2pin, ++ gup_flags, page_list, NULL); ++ if (sz2pin != pinned) { ++ if (pinned < 0) { ++ ret = pinned; ++ } else { ++ unpin_user_pages(page_list, pinned); ++ ret = -ENOMEM; ++ } + goto out; ++ } ++ nchunks++; + + if (!last_pfn) + map_pfn = page_to_pfn(page_list[0]); + +- for (i = 0; i < ret; i++) { ++ for (i = 0; i < pinned; i++) { + unsigned long this_pfn = page_to_pfn(page_list[i]); + u64 csize; + + if (last_pfn && (this_pfn != last_pfn + 1)) { + /* Pin a contiguous chunk of memory */ + csize = (last_pfn - map_pfn + 1) << PAGE_SHIFT; +- if (vhost_vdpa_map(v, iova, csize, +- map_pfn << PAGE_SHIFT, +- msg->perm)) ++ ret = vhost_vdpa_map(v, iova, csize, ++ map_pfn << PAGE_SHIFT, ++ msg->perm); ++ if (ret) { ++ /* ++ * Unpin the pages that are left unmapped ++ * from this point on in the current ++ * page_list. The remaining outstanding ++ * ones which may stride across several ++ * chunks will be covered in the common ++ * error path subsequently. ++ */ ++ unpin_user_pages(&page_list[i], ++ pinned - i); + goto out; ++ } ++ + map_pfn = this_pfn; + iova += csize; ++ nchunks = 0; + } + + last_pfn = this_pfn; + } + +- cur_base += ret << PAGE_SHIFT; +- npages -= ret; ++ cur_base += pinned << PAGE_SHIFT; ++ npages -= pinned; + } + + /* Pin the rest chunk */ +@@ -667,10 +694,27 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, + map_pfn << PAGE_SHIFT, msg->perm); + out: + if (ret) { ++ if (nchunks) { ++ unsigned long pfn; ++ ++ /* ++ * Unpin the outstanding pages which are yet to be ++ * mapped but haven't due to vdpa_map() or ++ * pin_user_pages() failure. ++ * ++ * Mapped pages are accounted in vdpa_map(), hence ++ * the corresponding unpinning will be handled by ++ * vdpa_unmap(). ++ */ ++ WARN_ON(!last_pfn); ++ for (pfn = map_pfn; pfn <= last_pfn; pfn++) ++ unpin_user_page(pfn_to_page(pfn)); ++ } + vhost_vdpa_unmap(v, msg->iova, msg->size); +- atomic64_sub(npages, &dev->mm->pinned_vm); + } ++unlock: + mmap_read_unlock(dev->mm); ++free: + free_page((unsigned long)page_list); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.9/zlib-export-s390-symbols-for-zlib-modules.patch b/queue-5.9/zlib-export-s390-symbols-for-zlib-modules.patch new file mode 100644 index 00000000000..38cdeaf7c06 --- /dev/null +++ b/queue-5.9/zlib-export-s390-symbols-for-zlib-modules.patch @@ -0,0 +1,61 @@ +From b6a70749fa81e1cc30dfa77823b8122797d61581 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 22:14:38 -0800 +Subject: zlib: export S390 symbols for zlib modules + +From: Randy Dunlap + +[ Upstream commit 11fb479ff5d9872ddff02dd533c16d60372c86b2 ] + +Fix build errors when ZLIB_INFLATE=m and ZLIB_DEFLATE=m and ZLIB_DFLTCC=y +by exporting the 2 needed symbols in dfltcc_inflate.c. + +Fixes these build errors: + + ERROR: modpost: "dfltcc_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined! + ERROR: modpost: "dfltcc_can_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined! + +Fixes: 126196100063 ("lib/zlib: add s390 hardware support for kernel zlib_inflate") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Andrew Morton +Acked-by: Ilya Leoshkevich +Cc: Mikhail Zaslonko +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Christian Borntraeger +Link: https://lkml.kernel.org/r/20201123191712.4882-1-rdunlap@infradead.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/zlib_dfltcc/dfltcc_inflate.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/zlib_dfltcc/dfltcc_inflate.c b/lib/zlib_dfltcc/dfltcc_inflate.c +index aa9ef23474df0..db107016d29b3 100644 +--- a/lib/zlib_dfltcc/dfltcc_inflate.c ++++ b/lib/zlib_dfltcc/dfltcc_inflate.c +@@ -4,6 +4,7 @@ + #include "dfltcc_util.h" + #include "dfltcc.h" + #include ++#include + #include + + /* +@@ -29,6 +30,7 @@ int dfltcc_can_inflate( + return is_bit_set(dfltcc_state->af.fns, DFLTCC_XPND) && + is_bit_set(dfltcc_state->af.fmts, DFLTCC_FMT0); + } ++EXPORT_SYMBOL(dfltcc_can_inflate); + + static int dfltcc_was_inflate_used( + z_streamp strm +@@ -147,3 +149,4 @@ dfltcc_inflate_action dfltcc_inflate( + return (cc == DFLTCC_CC_OP1_TOO_SHORT || cc == DFLTCC_CC_OP2_TOO_SHORT) ? + DFLTCC_INFLATE_BREAK : DFLTCC_INFLATE_CONTINUE; + } ++EXPORT_SYMBOL(dfltcc_inflate); +-- +2.27.0 + -- 2.47.3