--- /dev/null
+From 8cc96d2f87fa1deaa2a086ff61e8b8bef4a79e0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:59:27 -0800
+Subject: ARC: stack unwinding: don't assume non-current task is sleeping
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ]
+
+To start stack unwinding (SP, PC and BLINK) are needed. When the
+explicit execution context (pt_regs etc) is not available, unwinder
+assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK
+from kernel mode stack.
+
+But this assumption is not true, specially in a SMP system, when top
+runs on 1 core, there may be active running processes on all cores.
+
+So when unwinding non courrent tasks, ensure they are NOT running.
+
+And while at it, handle the self unwinding case explicitly.
+
+This came out of investigation of a customer reported hang with
+rcutorture+top
+
+Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/stacktrace.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index b007c06efbea9..35d418cde03b5 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -41,15 +41,15 @@
+
+ #ifdef CONFIG_ARC_DW2_UNWIND
+
+-static void seed_unwind_frame_info(struct task_struct *tsk,
+- struct pt_regs *regs,
+- struct unwind_frame_info *frame_info)
++static int
++seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
++ struct unwind_frame_info *frame_info)
+ {
+ /*
+ * synchronous unwinding (e.g. dump_stack)
+ * - uses current values of SP and friends
+ */
+- if (tsk == NULL && regs == NULL) {
++ if (regs == NULL && (tsk == NULL || tsk == current)) {
+ unsigned long fp, sp, blink, ret;
+ frame_info->task = current;
+
+@@ -68,11 +68,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->call_frame = 0;
+ } else if (regs == NULL) {
+ /*
+- * Asynchronous unwinding of sleeping task
+- * - Gets SP etc from task's pt_regs (saved bottom of kernel
+- * mode stack of task)
++ * Asynchronous unwinding of a likely sleeping task
++ * - first ensure it is actually sleeping
++ * - if so, it will be in __switch_to, kernel mode SP of task
++ * is safe-kept and BLINK at a well known location in there
+ */
+
++ if (tsk->state == TASK_RUNNING)
++ return -1;
++
+ frame_info->task = tsk;
+
+ frame_info->regs.r27 = TSK_K_FP(tsk);
+@@ -106,6 +110,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->regs.r63 = regs->ret;
+ frame_info->call_frame = 0;
+ }
++
++ return 0;
+ }
+
+ #endif
+@@ -119,7 +125,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+- seed_unwind_frame_info(tsk, regs, &frame_info);
++ if (seed_unwind_frame_info(tsk, regs, &frame_info))
++ return 0;
+
+ while (1) {
+ address = UNW_PC(&frame_info);
+--
+2.27.0
+
--- /dev/null
+From 875421edc1cf28518d2d5e7e4b29d90ab3993305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:23:55 +0100
+Subject: arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399
+ boards.
+
+From: Markus Reichl <m.reichl@fivetechno.de>
+
+[ Upstream commit 0011c6d182774fc781fb9e115ebe8baa356029ae ]
+
+Recently introduced async probe on mmc devices can shuffle block IDs.
+Pin them to fixed values to ease booting in environments where UUIDs
+are not practical. Use newly introduced aliases for mmcblk devices from [1].
+
+[1]
+https://patchwork.kernel.org/patch/11747669/
+
+Signed-off-by: Markus Reichl <m.reichl@fivetechno.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20201104162356.1251-1-m.reichl@fivetechno.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index b63d9653ff559..82747048381fa 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -66,6 +66,9 @@
+ i2c6 = &i2c6;
+ i2c7 = &i2c7;
+ i2c8 = &i2c8;
++ mmc0 = &sdio0;
++ mmc1 = &sdmmc;
++ mmc2 = &sdhci;
+ serial0 = &uart0;
+ serial1 = &uart1;
+ serial2 = &uart2;
+--
+2.27.0
+
--- /dev/null
+From c102d1efc80d51a373c679dbe685e943c7392f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:50:11 +0200
+Subject: iwlwifi: mvm: fix kernel panic in case of assert during CSA
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit fe56d05ee6c87f6a1a8c7267affd92c9438249cc ]
+
+During CSA, we briefly nullify the phy context, in __iwl_mvm_unassign_vif_chanctx.
+In case we have a FW assert right after it, it remains NULL though.
+We end up running into endless loop due to mac80211 trying repeatedly to
+move us to ASSOC state, and we keep returning -EINVAL. Later down the road
+we hit a kernel panic.
+
+Detect and avoid this endless loop.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d64de2c17bff.Iedd0d2afa20a2aacba5259a5cae31cb3a119a4eb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index ec2ecdd1cc4ec..9aab9a0269548 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -2654,7 +2654,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+
+ /* this would be a mac80211 bug ... but don't crash */
+ if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
+- return -EINVAL;
++ return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL;
+
+ /*
+ * If we are in a STA removal flow and in DQA mode:
+--
+2.27.0
+
--- /dev/null
+From 74829ffdc33d79138f34143884531ba43f6a60a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 16:51:03 +0300
+Subject: iwlwifi: pcie: limit memory read spin time
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 04516706bb99889986ddfa3a769ed50d2dc7ac13 ]
+
+When we read device memory, we lock a spinlock, write the address we
+want to read from the device and then spin in a loop reading the data
+in 32-bit quantities from another register.
+
+As the description makes clear, this is rather inefficient, incurring
+a PCIe bus transaction for every read. In a typical device today, we
+want to read 786k SMEM if it crashes, leading to 192k register reads.
+Occasionally, we've seen the whole loop take over 20 seconds and then
+triggering the soft lockup detector.
+
+Clearly, it is unreasonable to spin here for such extended periods of
+time.
+
+To fix this, break the loop down into an outer and an inner loop, and
+break out of the inner loop if more than half a second elapsed. To
+avoid too much overhead, check for that only every 128 reads, though
+there's no particular reason for that number. Then, unlock and relock
+to obtain NIC access again, reprogram the start address and continue.
+
+This will keep (interrupt) latencies on the CPU down to a reasonable
+time.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201022165103.45878a7e49aa.I3b9b9c5a10002915072312ce75b68ed5b3dc6e14@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 8a074a516fb26..910edd034fe3a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1927,18 +1927,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ void *buf, int dwords)
+ {
+ unsigned long flags;
+- int offs, ret = 0;
++ int offs = 0;
+ u32 *vals = buf;
+
+- if (iwl_trans_grab_nic_access(trans, &flags)) {
+- iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
+- for (offs = 0; offs < dwords; offs++)
+- vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
+- iwl_trans_release_nic_access(trans, &flags);
+- } else {
+- ret = -EBUSY;
++ while (offs < dwords) {
++ /* limit the time we spin here under lock to 1/2s */
++ ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++
++ if (iwl_trans_grab_nic_access(trans, &flags)) {
++ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
++ addr + 4 * offs);
++
++ while (offs < dwords) {
++ vals[offs] = iwl_read32(trans,
++ HBUS_TARG_MEM_RDAT);
++ offs++;
++
++ /* calling ktime_get is expensive so
++ * do it once in 128 reads
++ */
++ if (offs % 128 == 0 && ktime_after(ktime_get(),
++ timeout))
++ break;
++ }
++ iwl_trans_release_nic_access(trans, &flags);
++ } else {
++ return -EBUSY;
++ }
+ }
+- return ret;
++
++ return 0;
+ }
+
+ static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
+--
+2.27.0
+
--- /dev/null
+From 5aaab454ee38b3e9121a0eee8d6fceb337f0ef30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 02:14:23 +0200
+Subject: platform/x86: acer-wmi: add automatic keyboard background light
+ toggle key as KEY_LIGHTS_TOGGLE
+
+From: Timo Witte <timo.witte@gmail.com>
+
+[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ]
+
+Got a dmesg message on my AMD Renoir based Acer laptop:
+"acer_wmi: Unknown key number - 0x84" when toggling keyboard
+background light
+
+Signed-off-by: Timo Witte <timo.witte@gmail.com>
+Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
+Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 1be71f956d5c2..29f6f2bbb5fff 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -124,6 +124,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
+ {KE_IGNORE, 0x81, {KEY_SLEEP} },
+ {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
++ {KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
+ {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
+ {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
+ {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
+--
+2.27.0
+
--- /dev/null
+From 304508ca1631eee45d2ba44baa4c2b0feee798b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 00:09:04 -0700
+Subject: scsi: ufs: Make sure clk scaling happens only when HBA is runtime
+ ACTIVE
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 73cc291c270248567245f084dcdf5078069af6b5 ]
+
+If someone plays with the UFS clk scaling devfreq governor through sysfs,
+ufshcd_devfreq_scale may be called even when HBA is not runtime ACTIVE.
+This can lead to unexpected error. We cannot just protect it by calling
+pm_runtime_get_sync() because that may cause a race condition since HBA
+runtime suspend ops need to suspend clk scaling. To fix this call
+pm_runtime_get_noresume() and check HBA's runtime status. Only proceed if
+HBA is runtime ACTIVE, otherwise just bail.
+
+governor_store
+ devfreq_performance_handler
+ update_devfreq
+ devfreq_set_target
+ ufshcd_devfreq_target
+ ufshcd_devfreq_scale
+
+Link: https://lore.kernel.org/r/1600758548-28576-1-git-send-email-cang@codeaurora.org
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index a3a3ee6e2a002..342e086e41991 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1215,8 +1215,15 @@ static int ufshcd_devfreq_target(struct device *dev,
+ }
+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
+
++ pm_runtime_get_noresume(hba->dev);
++ if (!pm_runtime_active(hba->dev)) {
++ pm_runtime_put_noidle(hba->dev);
++ ret = -EAGAIN;
++ goto out;
++ }
+ start = ktime_get();
+ ret = ufshcd_devfreq_scale(hba, scale_up);
++ pm_runtime_put(hba->dev);
+
+ trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
+ (scale_up ? "up" : "down"),
+--
+2.27.0
+
spi-bcm2835aux-fix-use-after-free-on-unbind.patch
spi-bcm2835aux-restore-err-assignment-in-bcm2835aux_spi_probe.patch
+iwlwifi-pcie-limit-memory-read-spin-time.patch
+arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch
+iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch
+arc-stack-unwinding-don-t-assume-non-current-task-is.patch
+scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch
+soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch
+platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch
--- /dev/null
+From 2fe2cdd3c0657a265aec89069553ec730edc19b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 10:18:32 +0800
+Subject: soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
+
+From: Hao Si <si.hao@zte.com.cn>
+
+[ Upstream commit 2663b3388551230cbc4606a40fabf3331ceb59e4 ]
+
+The local variable 'cpumask_t mask' is in the stack memory, and its address
+is assigned to 'desc->affinity' in 'irq_set_affinity_hint()'.
+But the memory area where this variable is located is at risk of being
+modified.
+
+During LTP testing, the following error was generated:
+
+Unable to handle kernel paging request at virtual address ffff000012e9b790
+Mem abort info:
+ ESR = 0x96000007
+ Exception class = DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000007
+ CM = 0, WnR = 0
+swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000075ac5e07
+[ffff000012e9b790] pgd=00000027dbffe003, pud=00000027dbffd003,
+pmd=00000027b6d61003, pte=0000000000000000
+Internal error: Oops: 96000007 [#1] PREEMPT SMP
+Modules linked in: xt_conntrack
+Process read_all (pid: 20171, stack limit = 0x0000000044ea4095)
+CPU: 14 PID: 20171 Comm: read_all Tainted: G B W
+Hardware name: NXP Layerscape LX2160ARDB (DT)
+pstate: 80000085 (Nzcv daIf -PAN -UAO)
+pc : irq_affinity_hint_proc_show+0x54/0xb0
+lr : irq_affinity_hint_proc_show+0x4c/0xb0
+sp : ffff00001138bc10
+x29: ffff00001138bc10 x28: 0000ffffd131d1e0
+x27: 00000000007000c0 x26: ffff8025b9480dc0
+x25: ffff8025b9480da8 x24: 00000000000003ff
+x23: ffff8027334f8300 x22: ffff80272e97d000
+x21: ffff80272e97d0b0 x20: ffff8025b9480d80
+x19: ffff000009a49000 x18: 0000000000000000
+x17: 0000000000000000 x16: 0000000000000000
+x15: 0000000000000000 x14: 0000000000000000
+x13: 0000000000000000 x12: 0000000000000040
+x11: 0000000000000000 x10: ffff802735b79b88
+x9 : 0000000000000000 x8 : 0000000000000000
+x7 : ffff000009a49848 x6 : 0000000000000003
+x5 : 0000000000000000 x4 : ffff000008157d6c
+x3 : ffff00001138bc10 x2 : ffff000012e9b790
+x1 : 0000000000000000 x0 : 0000000000000000
+Call trace:
+ irq_affinity_hint_proc_show+0x54/0xb0
+ seq_read+0x1b0/0x440
+ proc_reg_read+0x80/0xd8
+ __vfs_read+0x60/0x178
+ vfs_read+0x94/0x150
+ ksys_read+0x74/0xf0
+ __arm64_sys_read+0x24/0x30
+ el0_svc_common.constprop.0+0xd8/0x1a0
+ el0_svc_handler+0x34/0x88
+ el0_svc+0x10/0x14
+Code: f9001bbf 943e0732 f94066c2 b4000062 (f9400041)
+---[ end trace b495bdcb0b3b732b ]---
+Kernel panic - not syncing: Fatal exception
+SMP: stopping secondary CPUs
+SMP: failed to stop secondary CPUs 0,2-4,6,8,11,13-15
+Kernel Offset: disabled
+CPU features: 0x0,21006008
+Memory Limit: none
+---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Fix it by using 'cpumask_of(cpu)' to get the cpumask.
+
+Signed-off-by: Hao Si <si.hao@zte.com.cn>
+Signed-off-by: Lin Chen <chen.lin5@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fsl-mc/bus/dpio/dpio-driver.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c b/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
+index e36da20a2796b..e7856a9e685f4 100644
+--- a/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
++++ b/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
+@@ -77,7 +77,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ struct dpio_priv *priv;
+ int error;
+ struct fsl_mc_device_irq *irq;
+- cpumask_t mask;
+
+ priv = dev_get_drvdata(&dpio_dev->dev);
+
+@@ -96,9 +95,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ }
+
+ /* set the affinity hint */
+- cpumask_clear(&mask);
+- cpumask_set_cpu(cpu, &mask);
+- if (irq_set_affinity_hint(irq->msi_desc->irq, &mask))
++ if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu)))
+ dev_err(&dpio_dev->dev,
+ "irq_set_affinity failed irq %d cpu %d\n",
+ irq->msi_desc->irq, cpu);
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
