From: Greg Kroah-Hartman Date: Mon, 25 Jan 2021 14:34:12 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.171~21 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=563d4464016e0392322e6c1a22b8396eed909d2a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch counter-ti-eqep-remove-floor.patch driver-core-extend-device_is_dependent.patch driver-core-fix-device-link-device-name-collision.patch drivers-core-free-dma_range_map-when-driver-probe-failed.patch drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch ehci-fix-ehci-host-controller-initialization-sequence.patch iio-ad5504-fix-setting-power-down-state.patch iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch intel_th-pci-add-alder-lake-p-support.patch io_uring-fix-short-read-retries-for-non-reg-files.patch io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch irqchip-mips-cpu-set-ipi-domain-parent-chip.patch mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch mm-fix-numa-stats-for-thp-migration.patch mm-memcg-fix-memcg-file_dirty-numa-stat.patch mm-memcg-slab-optimize-objcg-stock-draining.patch powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch stm-class-fix-module-init-return-on-allocation-failure.patch usb-bdc-make-bdc-pci-driver-depend-on-broken.patch usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch usb-cdns3-imx-fix-writing-read-only-memory-issue.patch usb-ehci-fix-an-interrupt-calltrace-error.patch usb-gadget-aspeed-fix-stop-dma-register-setting.patch usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch usb-udc-core-use-lock-when-write-to-soft_connect.patch x86-mmx-use-kfpu_387-for-mmx-string-operations.patch x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch xhci-tegra-delay-for-disabling-lfps-detector.patch --- diff --git a/queue-5.10/cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch b/queue-5.10/cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch new file mode 100644 index 00000000000..f2e9797ff38 --- /dev/null +++ b/queue-5.10/cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch @@ -0,0 +1,59 @@ +From 214a5ea081e77346e4963dd6d20c5539ff8b6ae6 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Thu, 21 Jan 2021 08:22:48 +1000 +Subject: cifs: do not fail __smb_send_rqst if non-fatal signals are pending + +From: Ronnie Sahlberg + +commit 214a5ea081e77346e4963dd6d20c5539ff8b6ae6 upstream. + +RHBZ 1848178 + +The original intent of returning an error in this function +in the patch: + "CIFS: Mask off signals when sending SMB packets" +was to avoid interrupting packet send in the middle of +sending the data (and thus breaking an SMB connection), +but we also don't want to fail the request for non-fatal +signals even before we have had a chance to try to +send it (the reported problem could be reproduced e.g. +by exiting a child process when the parent process was in +the midst of calling futimens to update a file's timestamps). + +In addition, since the signal may remain pending when we enter the +sending loop, we may end up not sending the whole packet before +TCP buffers become full. In this case the code returns -EINTR +but what we need here is to return -ERESTARTSYS instead to +allow system calls to be restarted. + +Fixes: b30c74c73c78 ("CIFS: Mask off signals when sending SMB packets") +Cc: stable@vger.kernel.org # v5.1+ +Signed-off-by: Ronnie Sahlberg +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/transport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -338,7 +338,7 @@ __smb_send_rqst(struct TCP_Server_Info * + if (ssocket == NULL) + return -EAGAIN; + +- if (signal_pending(current)) { ++ if (fatal_signal_pending(current)) { + cifs_dbg(FYI, "signal pending before send request\n"); + return -ERESTARTSYS; + } +@@ -429,7 +429,7 @@ unmask: + + if (signal_pending(current) && (total_len != send_length)) { + cifs_dbg(FYI, "signal is pending after attempt to send\n"); +- rc = -EINTR; ++ rc = -ERESTARTSYS; + } + + /* uncork it */ diff --git a/queue-5.10/counter-ti-eqep-remove-floor.patch b/queue-5.10/counter-ti-eqep-remove-floor.patch new file mode 100644 index 00000000000..f51a0db8e86 --- /dev/null +++ b/queue-5.10/counter-ti-eqep-remove-floor.patch @@ -0,0 +1,76 @@ +From 49a9565a7a7ce168e3e6482fb24e62d12f72ab81 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Sun, 13 Dec 2020 18:09:27 -0600 +Subject: counter:ti-eqep: remove floor + +From: David Lechner + +commit 49a9565a7a7ce168e3e6482fb24e62d12f72ab81 upstream. + +The hardware doesn't support this. QPOSINIT is an initialization value +that is triggered by other things. When the counter overflows, it +always wraps around to zero. + +Fixes: f213729f6796 "counter: new TI eQEP driver" +Signed-off-by: David Lechner +Acked-by: William Breathitt Gray +Link: https://lore.kernel.org/r/20201214000927.1793062-1-david@lechnology.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/counter/ti-eqep.c | 35 ----------------------------------- + 1 file changed, 35 deletions(-) + +--- a/drivers/counter/ti-eqep.c ++++ b/drivers/counter/ti-eqep.c +@@ -235,36 +235,6 @@ static ssize_t ti_eqep_position_ceiling_ + return len; + } + +-static ssize_t ti_eqep_position_floor_read(struct counter_device *counter, +- struct counter_count *count, +- void *ext_priv, char *buf) +-{ +- struct ti_eqep_cnt *priv = counter->priv; +- u32 qposinit; +- +- regmap_read(priv->regmap32, QPOSINIT, &qposinit); +- +- return sprintf(buf, "%u\n", qposinit); +-} +- +-static ssize_t ti_eqep_position_floor_write(struct counter_device *counter, +- struct counter_count *count, +- void *ext_priv, const char *buf, +- size_t len) +-{ +- struct ti_eqep_cnt *priv = counter->priv; +- int err; +- u32 res; +- +- err = kstrtouint(buf, 0, &res); +- if (err < 0) +- return err; +- +- regmap_write(priv->regmap32, QPOSINIT, res); +- +- return len; +-} +- + static ssize_t ti_eqep_position_enable_read(struct counter_device *counter, + struct counter_count *count, + void *ext_priv, char *buf) +@@ -302,11 +272,6 @@ static struct counter_count_ext ti_eqep_ + .write = ti_eqep_position_ceiling_write, + }, + { +- .name = "floor", +- .read = ti_eqep_position_floor_read, +- .write = ti_eqep_position_floor_write, +- }, +- { + .name = "enable", + .read = ti_eqep_position_enable_read, + .write = ti_eqep_position_enable_write, diff --git a/queue-5.10/driver-core-extend-device_is_dependent.patch b/queue-5.10/driver-core-extend-device_is_dependent.patch new file mode 100644 index 00000000000..f6334a22a98 --- /dev/null +++ b/queue-5.10/driver-core-extend-device_is_dependent.patch @@ -0,0 +1,66 @@ +From 3d1cf435e201d1fd63e4346b141881aed086effd Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Fri, 15 Jan 2021 19:30:51 +0100 +Subject: driver core: Extend device_is_dependent() + +From: Rafael J. Wysocki + +commit 3d1cf435e201d1fd63e4346b141881aed086effd upstream. + +If the device passed as the target (second argument) to +device_is_dependent() is not completely registered (that is, it has +been initialized, but not added yet), but the parent pointer of it +is set, it may be missing from the list of the parent's children +and device_for_each_child() called by device_is_dependent() cannot +be relied on to catch that dependency. + +For this reason, modify device_is_dependent() to check the ancestors +of the target device by following its parent pointer in addition to +the device_for_each_child() walk. + +Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support") +Reported-by: Stephan Gerhold +Tested-by: Stephan Gerhold +Reviewed-by: Saravana Kannan +Signed-off-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/17705994.d592GUb2YH@kreacher +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/core.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -115,6 +115,16 @@ int device_links_read_lock_held(void) + #endif + #endif /* !CONFIG_SRCU */ + ++static bool device_is_ancestor(struct device *dev, struct device *target) ++{ ++ while (target->parent) { ++ target = target->parent; ++ if (dev == target) ++ return true; ++ } ++ return false; ++} ++ + /** + * device_is_dependent - Check if one device depends on another one + * @dev: Device to check dependencies for. +@@ -128,7 +138,12 @@ int device_is_dependent(struct device *d + struct device_link *link; + int ret; + +- if (dev == target) ++ /* ++ * The "ancestors" check is needed to catch the case when the target ++ * device has not been completely initialized yet and it is still ++ * missing from the list of children of its parent device. ++ */ ++ if (dev == target || device_is_ancestor(dev, target)) + return 1; + + ret = device_for_each_child(dev, target, device_is_dependent); diff --git a/queue-5.10/driver-core-fix-device-link-device-name-collision.patch b/queue-5.10/driver-core-fix-device-link-device-name-collision.patch new file mode 100644 index 00000000000..fcdfd9fd64b --- /dev/null +++ b/queue-5.10/driver-core-fix-device-link-device-name-collision.patch @@ -0,0 +1,177 @@ +From e020ff611ba9be54e959e6b548038f8a020da1c9 Mon Sep 17 00:00:00 2001 +From: Saravana Kannan +Date: Sun, 10 Jan 2021 09:54:07 -0800 +Subject: driver core: Fix device link device name collision + +From: Saravana Kannan + +commit e020ff611ba9be54e959e6b548038f8a020da1c9 upstream. + +The device link device's name was of the form: +-- + +This can cause name collision as reported here [1] as device names are +not globally unique. Since device names have to be unique within the +bus/class, add the bus/class name as a prefix to the device names used to +construct the device link device name. + +So the devuce link device's name will be of the form: +:--: + +[1] - https://lore.kernel.org/lkml/20201229033440.32142-1-michael@walle.cc/ + +Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs") +Cc: stable@vger.kernel.org +Reported-by: Michael Walle +Tested-by: Michael Walle +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20210110175408.1465657-1-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/ABI/testing/sysfs-class-devlink | 4 +-- + Documentation/ABI/testing/sysfs-devices-consumer | 5 ++-- + Documentation/ABI/testing/sysfs-devices-supplier | 5 ++-- + drivers/base/core.c | 27 ++++++++++++----------- + include/linux/device.h | 12 ++++++++++ + 5 files changed, 35 insertions(+), 18 deletions(-) + +--- a/Documentation/ABI/testing/sysfs-class-devlink ++++ b/Documentation/ABI/testing/sysfs-class-devlink +@@ -5,8 +5,8 @@ Description: + Provide a place in sysfs for the device link objects in the + kernel at any given time. The name of a device link directory, + denoted as ... above, is of the form -- +- where is the supplier device name and is +- the consumer device name. ++ where is the supplier bus:device name and ++ is the consumer bus:device name. + + What: /sys/class/devlink/.../auto_remove_on + Date: May 2020 +--- a/Documentation/ABI/testing/sysfs-devices-consumer ++++ b/Documentation/ABI/testing/sysfs-devices-consumer +@@ -4,5 +4,6 @@ Contact: Saravana Kannan are symlinks to device + links where this device is the supplier. denotes the +- name of the consumer in that device link. There can be zero or +- more of these symlinks for a given device. ++ name of the consumer in that device link and is of the form ++ bus:device name. There can be zero or more of these symlinks ++ for a given device. +--- a/Documentation/ABI/testing/sysfs-devices-supplier ++++ b/Documentation/ABI/testing/sysfs-devices-supplier +@@ -4,5 +4,6 @@ Contact: Saravana Kannan are symlinks to device + links where this device is the consumer. denotes the +- name of the supplier in that device link. There can be zero or +- more of these symlinks for a given device. ++ name of the supplier in that device link and is of the form ++ bus:device name. There can be zero or more of these symlinks ++ for a given device. +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -363,7 +363,9 @@ static int devlink_add_symlinks(struct d + struct device *con = link->consumer; + char *buf; + +- len = max(strlen(dev_name(sup)), strlen(dev_name(con))); ++ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)), ++ strlen(dev_bus_name(con)) + strlen(dev_name(con))); ++ len += strlen(":"); + len += strlen("supplier:") + 1; + buf = kzalloc(len, GFP_KERNEL); + if (!buf) +@@ -377,12 +379,12 @@ static int devlink_add_symlinks(struct d + if (ret) + goto err_con; + +- snprintf(buf, len, "consumer:%s", dev_name(con)); ++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con)); + ret = sysfs_create_link(&sup->kobj, &link->link_dev.kobj, buf); + if (ret) + goto err_con_dev; + +- snprintf(buf, len, "supplier:%s", dev_name(sup)); ++ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup)); + ret = sysfs_create_link(&con->kobj, &link->link_dev.kobj, buf); + if (ret) + goto err_sup_dev; +@@ -390,7 +392,7 @@ static int devlink_add_symlinks(struct d + goto out; + + err_sup_dev: +- snprintf(buf, len, "consumer:%s", dev_name(con)); ++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con)); + sysfs_remove_link(&sup->kobj, buf); + err_con_dev: + sysfs_remove_link(&link->link_dev.kobj, "consumer"); +@@ -413,7 +415,9 @@ static void devlink_remove_symlinks(stru + sysfs_remove_link(&link->link_dev.kobj, "consumer"); + sysfs_remove_link(&link->link_dev.kobj, "supplier"); + +- len = max(strlen(dev_name(sup)), strlen(dev_name(con))); ++ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)), ++ strlen(dev_bus_name(con)) + strlen(dev_name(con))); ++ len += strlen(":"); + len += strlen("supplier:") + 1; + buf = kzalloc(len, GFP_KERNEL); + if (!buf) { +@@ -421,9 +425,9 @@ static void devlink_remove_symlinks(stru + return; + } + +- snprintf(buf, len, "supplier:%s", dev_name(sup)); ++ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup)); + sysfs_remove_link(&con->kobj, buf); +- snprintf(buf, len, "consumer:%s", dev_name(con)); ++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con)); + sysfs_remove_link(&sup->kobj, buf); + kfree(buf); + } +@@ -633,8 +637,9 @@ struct device_link *device_link_add(stru + + link->link_dev.class = &devlink_class; + device_set_pm_not_required(&link->link_dev); +- dev_set_name(&link->link_dev, "%s--%s", +- dev_name(supplier), dev_name(consumer)); ++ dev_set_name(&link->link_dev, "%s:%s--%s:%s", ++ dev_bus_name(supplier), dev_name(supplier), ++ dev_bus_name(consumer), dev_name(consumer)); + if (device_register(&link->link_dev)) { + put_device(consumer); + put_device(supplier); +@@ -1652,9 +1657,7 @@ const char *dev_driver_string(const stru + * never change once they are set, so they don't need special care. + */ + drv = READ_ONCE(dev->driver); +- return drv ? drv->name : +- (dev->bus ? dev->bus->name : +- (dev->class ? dev->class->name : "")); ++ return drv ? drv->name : dev_bus_name(dev); + } + EXPORT_SYMBOL(dev_driver_string); + +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -615,6 +615,18 @@ static inline const char *dev_name(const + return kobject_name(&dev->kobj); + } + ++/** ++ * dev_bus_name - Return a device's bus/class name, if at all possible ++ * @dev: struct device to get the bus/class name of ++ * ++ * Will return the name of the bus/class the device is attached to. If it is ++ * not attached to a bus/class, an empty string will be returned. ++ */ ++static inline const char *dev_bus_name(const struct device *dev) ++{ ++ return dev->bus ? dev->bus->name : (dev->class ? dev->class->name : ""); ++} ++ + __printf(2, 3) int dev_set_name(struct device *dev, const char *name, ...); + + #ifdef CONFIG_NUMA diff --git a/queue-5.10/drivers-core-free-dma_range_map-when-driver-probe-failed.patch b/queue-5.10/drivers-core-free-dma_range_map-when-driver-probe-failed.patch new file mode 100644 index 00000000000..0303dac3edc --- /dev/null +++ b/queue-5.10/drivers-core-free-dma_range_map-when-driver-probe-failed.patch @@ -0,0 +1,45 @@ +From d0243bbd5dd3ebbd49dafa8b56bb911d971131d0 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Tue, 5 Jan 2021 15:09:27 +0800 +Subject: drivers core: Free dma_range_map when driver probe failed + +From: Meng Li + +commit d0243bbd5dd3ebbd49dafa8b56bb911d971131d0 upstream. + +There will be memory leak if driver probe failed. Trace as below: + backtrace: + [<000000002415258f>] kmemleak_alloc+0x3c/0x50 + [<00000000f447ebe4>] __kmalloc+0x208/0x530 + [<0000000048bc7b3a>] of_dma_get_range+0xe4/0x1b0 + [<0000000041e39065>] of_dma_configure_id+0x58/0x27c + [<000000006356866a>] platform_dma_configure+0x2c/0x40 + ...... + [<000000000afcf9b5>] ret_from_fork+0x10/0x3c + +This issue is introduced by commit e0d072782c73("dma-mapping: +introduce DMA range map, supplanting dma_pfn_offset "). It doesn't +free dma_range_map when driver probe failed and cause above +memory leak. So, add code to free it in error path. + +Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset ") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Link: https://lore.kernel.org/r/20210105070927.14968-1-Meng.Li@windriver.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -612,6 +612,8 @@ dev_groups_failed: + else if (drv->remove) + drv->remove(dev); + probe_failed: ++ kfree(dev->dma_range_map); ++ dev->dma_range_map = NULL; + if (dev->bus) + blocking_notifier_call_chain(&dev->bus->p->bus_notifier, + BUS_NOTIFY_DRIVER_NOT_BOUND, dev); diff --git a/queue-5.10/drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch b/queue-5.10/drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch new file mode 100644 index 00000000000..fcf18a30cfb --- /dev/null +++ b/queue-5.10/drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch @@ -0,0 +1,41 @@ +From cf5b1385d748b2f91b0c05bb301fcaf9bdbad385 Mon Sep 17 00:00:00 2001 +From: Slaveyko Slaveykov +Date: Wed, 16 Dec 2020 13:57:20 +0200 +Subject: drivers: iio: temperature: Add delay after the addressed reset command in mlx90632.c + +From: Slaveyko Slaveykov + +commit cf5b1385d748b2f91b0c05bb301fcaf9bdbad385 upstream. + +After an I2C reset command, the mlx90632 needs some time before +responding to other I2C commands. Without that delay, there is a chance +that the I2C command(s) after the reset will not be accepted. + +Signed-off-by: Slaveyko Slaveykov +Reviewed-by: Andy Shevchenko +Reviewed-by: Crt Mori +Fixes: e02472f74a81 ("iio:temperature:mlx90632: Adding extended calibration option") +Link: https://lore.kernel.org/r/20201216115720.12404-2-sis@melexis.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/temperature/mlx90632.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/iio/temperature/mlx90632.c ++++ b/drivers/iio/temperature/mlx90632.c +@@ -248,6 +248,12 @@ static int mlx90632_set_meas_type(struct + if (ret < 0) + return ret; + ++ /* ++ * Give the mlx90632 some time to reset properly before sending a new I2C command ++ * if this is not done, the following I2C command(s) will not be accepted. ++ */ ++ usleep_range(150, 200); ++ + ret = regmap_write_bits(regmap, MLX90632_REG_CONTROL, + (MLX90632_CFG_MTYP_MASK | MLX90632_CFG_PWR_MASK), + (MLX90632_MTYP_STATUS(type) | MLX90632_PWR_STATUS_HALT)); diff --git a/queue-5.10/drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch b/queue-5.10/drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch new file mode 100644 index 00000000000..0c37f154bae --- /dev/null +++ b/queue-5.10/drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch @@ -0,0 +1,88 @@ +From 1c4995b0a576d24bb7ead991fb037c8b47ab6e32 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 18 Jan 2021 17:43:55 +0200 +Subject: drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting YCbCr 4:4:4 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 1c4995b0a576d24bb7ead991fb037c8b47ab6e32 upstream. + +Let's not enable the 4:4:4->4:2:0 conversion bit in the DFP unless we're +actually outputting YCbCr 4:4:4. It would appear some protocol +converters blindy consult this bit even when the source is outputting +RGB, resulting in a visual mess. + +Cc: stable@vger.kernel.org +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2914 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20210111164111.13302-1-ville.syrjala@linux.intel.com +Fixes: 181567aa9f0d ("drm/i915: Do YCbCr 444->420 conversion via DP protocol converters") +Reviewed-by: Jani Nikula +(cherry picked from commit 3170a21f7059c4660c469f59bf529f372a57da5f) +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20210118154355.24453-1-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- + drivers/gpu/drm/i915/display/intel_dp.c | 9 +++++---- + drivers/gpu/drm/i915/display/intel_dp.h | 3 ++- + 3 files changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -3470,7 +3470,7 @@ static void hsw_ddi_pre_enable_dp(struct + intel_ddi_init_dp_buf_reg(encoder); + if (!is_mst) + intel_dp_set_power(intel_dp, DP_SET_POWER_D0); +- intel_dp_configure_protocol_converter(intel_dp); ++ intel_dp_configure_protocol_converter(intel_dp, crtc_state); + intel_dp_sink_set_decompression_state(intel_dp, crtc_state, + true); + intel_dp_sink_set_fec_ready(intel_dp, crtc_state); +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -3856,7 +3856,8 @@ static void intel_dp_enable_port(struct + intel_de_posting_read(dev_priv, intel_dp->output_reg); + } + +-void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp) ++void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp, ++ const struct intel_crtc_state *crtc_state) + { + struct drm_i915_private *i915 = dp_to_i915(intel_dp); + u8 tmp; +@@ -3875,8 +3876,8 @@ void intel_dp_configure_protocol_convert + drm_dbg_kms(&i915->drm, "Failed to set protocol converter HDMI mode to %s\n", + enableddisabled(intel_dp->has_hdmi_sink)); + +- tmp = intel_dp->dfp.ycbcr_444_to_420 ? +- DP_CONVERSION_TO_YCBCR420_ENABLE : 0; ++ tmp = crtc_state->output_format == INTEL_OUTPUT_FORMAT_YCBCR444 && ++ intel_dp->dfp.ycbcr_444_to_420 ? DP_CONVERSION_TO_YCBCR420_ENABLE : 0; + + if (drm_dp_dpcd_writeb(&intel_dp->aux, + DP_PROTOCOL_CONVERTER_CONTROL_1, tmp) != 1) +@@ -3930,7 +3931,7 @@ static void intel_enable_dp(struct intel + } + + intel_dp_set_power(intel_dp, DP_SET_POWER_D0); +- intel_dp_configure_protocol_converter(intel_dp); ++ intel_dp_configure_protocol_converter(intel_dp, pipe_config); + intel_dp_start_link_train(intel_dp); + intel_dp_stop_link_train(intel_dp); + +--- a/drivers/gpu/drm/i915/display/intel_dp.h ++++ b/drivers/gpu/drm/i915/display/intel_dp.h +@@ -51,7 +51,8 @@ int intel_dp_get_link_train_fallback_val + int intel_dp_retrain_link(struct intel_encoder *encoder, + struct drm_modeset_acquire_ctx *ctx); + void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode); +-void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp); ++void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp, ++ const struct intel_crtc_state *crtc_state); + void intel_dp_sink_set_decompression_state(struct intel_dp *intel_dp, + const struct intel_crtc_state *crtc_state, + bool enable); diff --git a/queue-5.10/drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch b/queue-5.10/drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch new file mode 100644 index 00000000000..8bde63e21fc --- /dev/null +++ b/queue-5.10/drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch @@ -0,0 +1,167 @@ +From 0e634efd858e0e9331ea037e1a142e34a446e9e3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 16 Oct 2020 22:48:00 +0300 +Subject: drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 0e634efd858e0e9331ea037e1a142e34a446e9e3 upstream. + +Rename intel_dp_sink_dpms() to intel_dp_set_power() +so one doesn't always have to convert from the DPMS +enum values to the actual DP D-states. + +Also when dealing with a branch device this has nothing to +do with any sink, so the old name was nonsense anyway. +Also adjust the debug message accordingly, and pimp it +with the standard encoder id+name thing. + +Trivial bits done with cocci: +@@ +expression DP; +@@ +( +- intel_dp_sink_dpms(DP, DRM_MODE_DPMS_OFF) ++ intel_dp_set_power(DP, DP_SET_POWER_D3) +| +- intel_dp_sink_dpms(DP, DRM_MODE_DPMS_ON) ++ intel_dp_set_power(DP, DP_SET_POWER_D0) +) + +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20201016194800.25581-2-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/display/intel_ddi.c | 6 +++--- + drivers/gpu/drm/i915/display/intel_dp.c | 24 ++++++++++++------------ + drivers/gpu/drm/i915/display/intel_dp.h | 2 +- + drivers/gpu/drm/i915/display/intel_dp_mst.c | 2 +- + 4 files changed, 17 insertions(+), 17 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -3387,7 +3387,7 @@ static void tgl_ddi_pre_enable_dp(struct + intel_ddi_init_dp_buf_reg(encoder); + + if (!is_mst) +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0); + + intel_dp_sink_set_decompression_state(intel_dp, crtc_state, true); + /* +@@ -3469,7 +3469,7 @@ static void hsw_ddi_pre_enable_dp(struct + + intel_ddi_init_dp_buf_reg(encoder); + if (!is_mst) +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0); + intel_dp_configure_protocol_converter(intel_dp); + intel_dp_sink_set_decompression_state(intel_dp, crtc_state, + true); +@@ -3647,7 +3647,7 @@ static void intel_ddi_post_disable_dp(st + * Power down sink before disabling the port, otherwise we end + * up getting interrupts from the sink on detecting link loss. + */ +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D3); + + if (INTEL_GEN(dev_priv) >= 12) { + if (is_mst) { +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -3496,22 +3496,22 @@ void intel_dp_sink_set_decompression_sta + enable ? "enable" : "disable"); + } + +-/* If the sink supports it, try to set the power state appropriately */ +-void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode) ++/* If the device supports it, try to set the power state appropriately */ ++void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode) + { +- struct drm_i915_private *i915 = dp_to_i915(intel_dp); ++ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base; ++ struct drm_i915_private *i915 = to_i915(encoder->base.dev); + int ret, i; + + /* Should have a valid DPCD by this point */ + if (intel_dp->dpcd[DP_DPCD_REV] < 0x11) + return; + +- if (mode != DRM_MODE_DPMS_ON) { ++ if (mode != DP_SET_POWER_D0) { + if (downstream_hpd_needs_d0(intel_dp)) + return; + +- ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, +- DP_SET_POWER_D3); ++ ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, mode); + } else { + struct intel_lspcon *lspcon = dp_to_lspcon(intel_dp); + +@@ -3520,8 +3520,7 @@ void intel_dp_sink_dpms(struct intel_dp + * time to wake up. + */ + for (i = 0; i < 3; i++) { +- ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, +- DP_SET_POWER_D0); ++ ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, mode); + if (ret == 1) + break; + msleep(1); +@@ -3532,8 +3531,9 @@ void intel_dp_sink_dpms(struct intel_dp + } + + if (ret != 1) +- drm_dbg_kms(&i915->drm, "failed to %s sink power state\n", +- mode == DRM_MODE_DPMS_ON ? "enable" : "disable"); ++ drm_dbg_kms(&i915->drm, "[ENCODER:%d:%s] Set power to %s failed\n", ++ encoder->base.base.id, encoder->base.name, ++ mode == DP_SET_POWER_D0 ? "D0" : "D3"); + } + + static bool cpt_dp_port_selected(struct drm_i915_private *dev_priv, +@@ -3707,7 +3707,7 @@ static void intel_disable_dp(struct inte + * ensure that we have vdd while we switch off the panel. */ + intel_edp_panel_vdd_on(intel_dp); + intel_edp_backlight_off(old_conn_state); +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D3); + intel_edp_panel_off(intel_dp); + } + +@@ -3929,7 +3929,7 @@ static void intel_enable_dp(struct intel + lane_mask); + } + +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0); + intel_dp_configure_protocol_converter(intel_dp); + intel_dp_start_link_train(intel_dp); + intel_dp_stop_link_train(intel_dp); +--- a/drivers/gpu/drm/i915/display/intel_dp.h ++++ b/drivers/gpu/drm/i915/display/intel_dp.h +@@ -50,7 +50,7 @@ int intel_dp_get_link_train_fallback_val + int link_rate, u8 lane_count); + int intel_dp_retrain_link(struct intel_encoder *encoder, + struct drm_modeset_acquire_ctx *ctx); +-void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode); ++void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode); + void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp); + void intel_dp_sink_set_decompression_state(struct intel_dp *intel_dp, + const struct intel_crtc_state *crtc_state, +--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c +@@ -488,7 +488,7 @@ static void intel_mst_pre_enable_dp(stru + intel_dp->active_mst_links); + + if (first_mst_stream) +- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON); ++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0); + + drm_dp_send_power_updown_phy(&intel_dp->mst_mgr, connector->port, true); + diff --git a/queue-5.10/ehci-fix-ehci-host-controller-initialization-sequence.patch b/queue-5.10/ehci-fix-ehci-host-controller-initialization-sequence.patch new file mode 100644 index 00000000000..eb87f8f4981 --- /dev/null +++ b/queue-5.10/ehci-fix-ehci-host-controller-initialization-sequence.patch @@ -0,0 +1,60 @@ +From 280a9045bb18833db921b316a5527d2b565e9f2e Mon Sep 17 00:00:00 2001 +From: Eugene Korenevsky +Date: Sun, 10 Jan 2021 20:36:09 +0300 +Subject: ehci: fix EHCI host controller initialization sequence + +From: Eugene Korenevsky + +commit 280a9045bb18833db921b316a5527d2b565e9f2e upstream. + +According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever +USBCMD.RS=1. + +However, it is a good practice to wait some time after setting USBCMD.RS +(approximately 100ms) until USBSTS.HCHalted become zero. + +Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs +(see BugLink). + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211095 +Acked-by: Alan Stern +Signed-off-by: Eugene Korenevsky +Cc: stable +Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -574,6 +574,7 @@ static int ehci_run (struct usb_hcd *hcd + struct ehci_hcd *ehci = hcd_to_ehci (hcd); + u32 temp; + u32 hcc_params; ++ int rc; + + hcd->uses_new_polling = 1; + +@@ -629,9 +630,20 @@ static int ehci_run (struct usb_hcd *hcd + down_write(&ehci_cf_port_reset_rwsem); + ehci->rh_state = EHCI_RH_RUNNING; + ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag); ++ ++ /* Wait until HC become operational */ + ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ + msleep(5); ++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000); ++ + up_write(&ehci_cf_port_reset_rwsem); ++ ++ if (rc) { ++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n", ++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc); ++ return rc; ++ } ++ + ehci->last_periodic_enable = ktime_get_real(); + + temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase)); diff --git a/queue-5.10/iio-ad5504-fix-setting-power-down-state.patch b/queue-5.10/iio-ad5504-fix-setting-power-down-state.patch new file mode 100644 index 00000000000..9dbb5a0fff7 --- /dev/null +++ b/queue-5.10/iio-ad5504-fix-setting-power-down-state.patch @@ -0,0 +1,42 @@ +From efd597b2839a9895e8a98fcb0b76d2f545802cd4 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Wed, 9 Dec 2020 11:46:49 +0100 +Subject: iio: ad5504: Fix setting power-down state + +From: Lars-Peter Clausen + +commit efd597b2839a9895e8a98fcb0b76d2f545802cd4 upstream. + +The power-down mask of the ad5504 is actually a power-up mask. Meaning if +a bit is set the corresponding channel is powered up and if it is not set +the channel is powered down. + +The driver currently has this the wrong way around, resulting in the +channel being powered up when requested to be powered down and vice versa. + +Fixes: 3bbbf150ffde ("staging:iio:dac:ad5504: Use strtobool for boolean values") +Signed-off-by: Lars-Peter Clausen +Acked-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dac/ad5504.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/dac/ad5504.c ++++ b/drivers/iio/dac/ad5504.c +@@ -187,9 +187,9 @@ static ssize_t ad5504_write_dac_powerdow + return ret; + + if (pwr_down) +- st->pwr_down_mask |= (1 << chan->channel); +- else + st->pwr_down_mask &= ~(1 << chan->channel); ++ else ++ st->pwr_down_mask |= (1 << chan->channel); + + ret = ad5504_spi_write(st, AD5504_ADDR_CTRL, + AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) | diff --git a/queue-5.10/iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch b/queue-5.10/iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch new file mode 100644 index 00000000000..14fdff82224 --- /dev/null +++ b/queue-5.10/iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch @@ -0,0 +1,44 @@ +From 7e6d9788aa02333a4353058816d52b9a90aae0d3 Mon Sep 17 00:00:00 2001 +From: Alexandru Ardelean +Date: Thu, 3 Dec 2020 09:26:50 +0200 +Subject: iio: adc: ti_am335x_adc: remove omitted iio_kfifo_free() + +From: Alexandru Ardelean + +commit 7e6d9788aa02333a4353058816d52b9a90aae0d3 upstream. + +When the conversion was done to use devm_iio_kfifo_allocate(), a call to +iio_kfifo_free() was omitted (to be removed). +This change removes it. + +Fixes: 3c5308058899 ("iio: adc: ti_am335x_adc: alloc kfifo & IRQ via devm_ functions") +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20201203072650.24128-1-alexandru.ardelean@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ti_am335x_adc.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -397,16 +397,12 @@ static int tiadc_iio_buffered_hardware_s + ret = devm_request_threaded_irq(dev, irq, pollfunc_th, pollfunc_bh, + flags, indio_dev->name, indio_dev); + if (ret) +- goto error_kfifo_free; ++ return ret; + + indio_dev->setup_ops = setup_ops; + indio_dev->modes |= INDIO_BUFFER_SOFTWARE; + + return 0; +- +-error_kfifo_free: +- iio_kfifo_free(indio_dev->buffer); +- return ret; + } + + static const char * const chan_name_ain[] = { diff --git a/queue-5.10/iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch b/queue-5.10/iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch new file mode 100644 index 00000000000..71751688074 --- /dev/null +++ b/queue-5.10/iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch @@ -0,0 +1,98 @@ +From 40c48fb79b9798954691f24b8ece1d3a7eb1b353 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Tue, 8 Dec 2020 15:36:40 +0100 +Subject: iio: common: st_sensors: fix possible infinite loop in st_sensors_irq_thread + +From: Lorenzo Bianconi + +commit 40c48fb79b9798954691f24b8ece1d3a7eb1b353 upstream. + +Return a boolean value in st_sensors_new_samples_available routine in +order to avoid an infinite loop in st_sensors_irq_thread if +stat_drdy.addr is not defined or stat_drdy read fails + +Fixes: 90efe05562921 ("iio: st_sensors: harden interrupt handling") +Reported-by: Jonathan Cameron +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/c9ec69ed349e7200c779fd7a5bf04c1aaa2817aa.1607438132.git.lorenzo@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/st_sensors/st_sensors_trigger.c | 31 +++++++++++---------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c ++++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c +@@ -23,35 +23,31 @@ + * @sdata: Sensor data. + * + * returns: +- * 0 - no new samples available +- * 1 - new samples available +- * negative - error or unknown ++ * false - no new samples available or read error ++ * true - new samples available + */ +-static int st_sensors_new_samples_available(struct iio_dev *indio_dev, +- struct st_sensor_data *sdata) ++static bool st_sensors_new_samples_available(struct iio_dev *indio_dev, ++ struct st_sensor_data *sdata) + { + int ret, status; + + /* How would I know if I can't check it? */ + if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) +- return -EINVAL; ++ return true; + + /* No scan mask, no interrupt */ + if (!indio_dev->active_scan_mask) +- return 0; ++ return false; + + ret = regmap_read(sdata->regmap, + sdata->sensor_settings->drdy_irq.stat_drdy.addr, + &status); + if (ret < 0) { + dev_err(sdata->dev, "error checking samples available\n"); +- return ret; ++ return false; + } + +- if (status & sdata->sensor_settings->drdy_irq.stat_drdy.mask) +- return 1; +- +- return 0; ++ return !!(status & sdata->sensor_settings->drdy_irq.stat_drdy.mask); + } + + /** +@@ -180,9 +176,15 @@ int st_sensors_allocate_trigger(struct i + + /* Tell the interrupt handler that we're dealing with edges */ + if (irq_trig == IRQF_TRIGGER_FALLING || +- irq_trig == IRQF_TRIGGER_RISING) ++ irq_trig == IRQF_TRIGGER_RISING) { ++ if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) { ++ dev_err(&indio_dev->dev, ++ "edge IRQ not supported w/o stat register.\n"); ++ err = -EOPNOTSUPP; ++ goto iio_trigger_free; ++ } + sdata->edge_irq = true; +- else ++ } else { + /* + * If we're not using edges (i.e. level interrupts) we + * just mask off the IRQ, handle one interrupt, then +@@ -190,6 +192,7 @@ int st_sensors_allocate_trigger(struct i + * interrupt handler top half again and start over. + */ + irq_trig |= IRQF_ONESHOT; ++ } + + /* + * If the interrupt pin is Open Drain, by definition this diff --git a/queue-5.10/intel_th-pci-add-alder-lake-p-support.patch b/queue-5.10/intel_th-pci-add-alder-lake-p-support.patch new file mode 100644 index 00000000000..19eee2a281d --- /dev/null +++ b/queue-5.10/intel_th-pci-add-alder-lake-p-support.patch @@ -0,0 +1,34 @@ +From cb5c681ab9037e25fcca20689c82cf034566d610 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Fri, 15 Jan 2021 22:59:17 +0300 +Subject: intel_th: pci: Add Alder Lake-P support + +From: Alexander Shishkin + +commit cb5c681ab9037e25fcca20689c82cf034566d610 upstream. + +This adds support for the Trace Hub in Alder Lake-P. + +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20210115195917.3184-3-alexander.shishkin@linux.intel.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -269,6 +269,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Alder Lake-P */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x51a6), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Alder Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.10/io_uring-fix-short-read-retries-for-non-reg-files.patch b/queue-5.10/io_uring-fix-short-read-retries-for-non-reg-files.patch new file mode 100644 index 00000000000..13edcc42131 --- /dev/null +++ b/queue-5.10/io_uring-fix-short-read-retries-for-non-reg-files.patch @@ -0,0 +1,35 @@ +From 9a173346bd9e16ab19c7addb8862d95a5cea9feb Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Thu, 21 Jan 2021 12:01:08 +0000 +Subject: io_uring: fix short read retries for non-reg files + +From: Pavel Begunkov + +commit 9a173346bd9e16ab19c7addb8862d95a5cea9feb upstream. + +Sockets and other non-regular files may actually expect short reads to +happen, don't retry reads for them. Because non-reg files don't set +FMODE_BUF_RASYNC and so it won't do second/retry do_read, we can filter +out those cases after first do_read() attempt with ret>0. + +Cc: stable@vger.kernel.org # 5.9+ +Suggested-by: Jens Axboe +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3461,7 +3461,7 @@ static int io_read(struct io_kiocb *req, + + /* read it all, or we did blocking attempt. no retry. */ + if (!iov_iter_count(iter) || !force_nonblock || +- (req->file->f_flags & O_NONBLOCK)) ++ (req->file->f_flags & O_NONBLOCK) || !(req->flags & REQ_F_ISREG)) + goto done; + + io_size -= ret; diff --git a/queue-5.10/io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch b/queue-5.10/io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch new file mode 100644 index 00000000000..4fa3f3bb0bb --- /dev/null +++ b/queue-5.10/io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch @@ -0,0 +1,112 @@ +From 607ec89ed18f49ca59689572659b9c0076f1991f Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Tue, 19 Jan 2021 10:10:54 -0700 +Subject: io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state + +From: Jens Axboe + +commit 607ec89ed18f49ca59689572659b9c0076f1991f upstream. + +IORING_OP_CLOSE is special in terms of cancelation, since it has an +intermediate state where we've removed the file descriptor but hasn't +closed the file yet. For that reason, it's currently marked with +IO_WQ_WORK_NO_CANCEL to prevent cancelation. This ensures that the op +is always run even if canceled, to prevent leaving us with a live file +but an fd that is gone. However, with SQPOLL, since a cancel request +doesn't carry any resources on behalf of the request being canceled, if +we cancel before any of the close op has been run, we can end up with +io-wq not having the ->files assigned. This can result in the following +oops reported by Joseph: + +BUG: kernel NULL pointer dereference, address: 00000000000000d8 +PGD 800000010b76f067 P4D 800000010b76f067 PUD 10b462067 PMD 0 +Oops: 0000 [#1] SMP PTI +CPU: 1 PID: 1788 Comm: io_uring-sq Not tainted 5.11.0-rc4 #1 +Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 +RIP: 0010:__lock_acquire+0x19d/0x18c0 +Code: 00 00 8b 1d fd 56 dd 08 85 db 0f 85 43 05 00 00 48 c7 c6 98 7b 95 82 48 c7 c7 57 96 93 82 e8 9a bc f5 ff 0f 0b e9 2b 05 00 00 <48> 81 3f c0 ca 67 8a b8 00 00 00 00 41 0f 45 c0 89 04 24 e9 81 fe +RSP: 0018:ffffc90001933828 EFLAGS: 00010002 +RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000d8 +RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: ffff888106e8a140 R15: 00000000000000d8 +FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000000000d8 CR3: 0000000106efa004 CR4: 00000000003706e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + lock_acquire+0x31a/0x440 + ? close_fd_get_file+0x39/0x160 + ? __lock_acquire+0x647/0x18c0 + _raw_spin_lock+0x2c/0x40 + ? close_fd_get_file+0x39/0x160 + close_fd_get_file+0x39/0x160 + io_issue_sqe+0x1334/0x14e0 + ? lock_acquire+0x31a/0x440 + ? __io_free_req+0xcf/0x2e0 + ? __io_free_req+0x175/0x2e0 + ? find_held_lock+0x28/0xb0 + ? io_wq_submit_work+0x7f/0x240 + io_wq_submit_work+0x7f/0x240 + io_wq_cancel_cb+0x161/0x580 + ? io_wqe_wake_worker+0x114/0x360 + ? io_uring_get_socket+0x40/0x40 + io_async_find_and_cancel+0x3b/0x140 + io_issue_sqe+0xbe1/0x14e0 + ? __lock_acquire+0x647/0x18c0 + ? __io_queue_sqe+0x10b/0x5f0 + __io_queue_sqe+0x10b/0x5f0 + ? io_req_prep+0xdb/0x1150 + ? mark_held_locks+0x6d/0xb0 + ? mark_held_locks+0x6d/0xb0 + ? io_queue_sqe+0x235/0x4b0 + io_queue_sqe+0x235/0x4b0 + io_submit_sqes+0xd7e/0x12a0 + ? _raw_spin_unlock_irq+0x24/0x30 + ? io_sq_thread+0x3ae/0x940 + io_sq_thread+0x207/0x940 + ? do_wait_intr_irq+0xc0/0xc0 + ? __ia32_sys_io_uring_enter+0x650/0x650 + kthread+0x134/0x180 + ? kthread_create_worker_on_cpu+0x90/0x90 + ret_from_fork+0x1f/0x30 + +Fix this by moving the IO_WQ_WORK_NO_CANCEL until _after_ we've modified +the fdtable. Canceling before this point is totally fine, and running +it in the io-wq context _after_ that point is also fine. + +For 5.12, we'll handle this internally and get rid of the no-cancel +flag, as IORING_OP_CLOSE is the only user of it. + +Cc: stable@vger.kernel.org +Fixes: b5dba59e0cf7 ("io_uring: add support for IORING_OP_CLOSE") +Reported-by: "Abaci " +Reviewed-and-tested-by: Joseph Qi +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4250,7 +4250,6 @@ static int io_close_prep(struct io_kiocb + * io_wq_work.flags, so initialize io_wq_work firstly. + */ + io_req_init_async(req); +- req->work.flags |= IO_WQ_WORK_NO_CANCEL; + + if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL))) + return -EINVAL; +@@ -4283,6 +4282,8 @@ static int io_close(struct io_kiocb *req + + /* if the file has a flush method, be safe and punt to async */ + if (close->put_file->f_op->flush && force_nonblock) { ++ /* not safe to cancel at this point */ ++ req->work.flags |= IO_WQ_WORK_NO_CANCEL; + /* was never set, but play safe */ + req->flags &= ~REQ_F_NOWAIT; + /* avoid grabbing files - we don't need the files */ diff --git a/queue-5.10/io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch b/queue-5.10/io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch new file mode 100644 index 00000000000..1b4e199d54a --- /dev/null +++ b/queue-5.10/io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch @@ -0,0 +1,42 @@ +From c93cc9e16d88e0f5ea95d2d65d58a8a4dab258bc Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Sat, 16 Jan 2021 11:52:11 -0700 +Subject: io_uring: iopoll requests should also wake task ->in_idle state + +From: Jens Axboe + +commit c93cc9e16d88e0f5ea95d2d65d58a8a4dab258bc upstream. + +If we're freeing/finishing iopoll requests, ensure we check if the task +is in idling in terms of cancelation. Otherwise we could end up waiting +forever in __io_uring_task_cancel() if the task has active iopoll +requests that need cancelation. + +Cc: stable@vger.kernel.org # 5.9+ +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -2167,6 +2167,8 @@ static void io_req_free_batch_finish(str + struct io_uring_task *tctx = rb->task->io_uring; + + percpu_counter_sub(&tctx->inflight, rb->task_refs); ++ if (atomic_read(&tctx->in_idle)) ++ wake_up(&tctx->wait); + put_task_struct_many(rb->task, rb->task_refs); + rb->task = NULL; + } +@@ -2186,6 +2188,8 @@ static void io_req_free_batch(struct req + struct io_uring_task *tctx = rb->task->io_uring; + + percpu_counter_sub(&tctx->inflight, rb->task_refs); ++ if (atomic_read(&tctx->in_idle)) ++ wake_up(&tctx->wait); + put_task_struct_many(rb->task, rb->task_refs); + } + rb->task = req->task; diff --git a/queue-5.10/irqchip-mips-cpu-set-ipi-domain-parent-chip.patch b/queue-5.10/irqchip-mips-cpu-set-ipi-domain-parent-chip.patch new file mode 100644 index 00000000000..129bdbeee18 --- /dev/null +++ b/queue-5.10/irqchip-mips-cpu-set-ipi-domain-parent-chip.patch @@ -0,0 +1,47 @@ +From 599b3063adf4bf041a87a69244ee36aded0d878f Mon Sep 17 00:00:00 2001 +From: Mathias Kresin +Date: Thu, 7 Jan 2021 22:36:03 +0100 +Subject: irqchip/mips-cpu: Set IPI domain parent chip + +From: Mathias Kresin + +commit 599b3063adf4bf041a87a69244ee36aded0d878f upstream. + +Since commit 55567976629e ("genirq/irqdomain: Allow partial trimming of +irq_data hierarchy") the irq_data chain is valided. + +The irq_domain_trim_hierarchy() function doesn't consider the irq + ipi +domain hierarchy as valid, since the ipi domain has the irq domain set +as parent, but the parent domain has no chip set. Hence the boot ends in +a kernel panic. + +Set the chip for the parent domain as it is done in the mips gic irq +driver, to have a valid irq_data chain. + +Fixes: 3838a547fda2 ("irqchip: mips-cpu: Introduce IPI IRQ domain support") +Cc: # v5.10+ +Signed-off-by: Mathias Kresin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210107213603.1637781-1-dev@kresin.me +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-mips-cpu.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/irqchip/irq-mips-cpu.c ++++ b/drivers/irqchip/irq-mips-cpu.c +@@ -197,6 +197,13 @@ static int mips_cpu_ipi_alloc(struct irq + if (ret) + return ret; + ++ ret = irq_domain_set_hwirq_and_chip(domain->parent, virq + i, hwirq, ++ &mips_mt_cpu_irq_controller, ++ NULL); ++ ++ if (ret) ++ return ret; ++ + ret = irq_set_irq_type(virq + i, IRQ_TYPE_LEVEL_HIGH); + if (ret) + return ret; diff --git a/queue-5.10/mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch b/queue-5.10/mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch new file mode 100644 index 00000000000..41c71376511 --- /dev/null +++ b/queue-5.10/mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch @@ -0,0 +1,192 @@ +From d3921cb8be29ce5668c64e23ffdaeec5f8c69399 Mon Sep 17 00:00:00 2001 +From: Mike Rapoport +Date: Sat, 23 Jan 2021 21:01:02 -0800 +Subject: mm: fix initialization of struct page for holes in memory layout + +From: Mike Rapoport + +commit d3921cb8be29ce5668c64e23ffdaeec5f8c69399 upstream. + +There could be struct pages that are not backed by actual physical +memory. This can happen when the actual memory bank is not a multiple +of SECTION_SIZE or when an architecture does not register memory holes +reserved by the firmware as memblock.memory. + +Such pages are currently initialized using init_unavailable_mem() +function that iterates through PFNs in holes in memblock.memory and if +there is a struct page corresponding to a PFN, the fields if this page +are set to default values and the page is marked as Reserved. + +init_unavailable_mem() does not take into account zone and node the page +belongs to and sets both zone and node links in struct page to zero. + +On a system that has firmware reserved holes in a zone above ZONE_DMA, +for instance in a configuration below: + + # grep -A1 E820 /proc/iomem + 7a17b000-7a216fff : Unknown E820 type + 7a217000-7bffffff : System RAM + +unset zone link in struct page will trigger + + VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page); + +because there are pages in both ZONE_DMA32 and ZONE_DMA (unset zone link +in struct page) in the same pageblock. + +Update init_unavailable_mem() to use zone constraints defined by an +architecture to properly setup the zone link and use node ID of the +adjacent range in memblock.memory to set the node link. + +Link: https://lkml.kernel.org/r/20210111194017.22696-3-rppt@kernel.org +Fixes: 73a6e474cb37 ("mm: memmap_init: iterate over memblock regions rather that check each PFN") +Signed-off-by: Mike Rapoport +Reported-by: Andrea Arcangeli +Cc: Andrea Arcangeli +Cc: Baoquan He +Cc: Borislav Petkov +Cc: David Hildenbrand +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Mel Gorman +Cc: Michal Hocko +Cc: Qian Cai +Cc: Thomas Gleixner +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 84 +++++++++++++++++++++++++++++++++----------------------- + 1 file changed, 50 insertions(+), 34 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7003,23 +7003,26 @@ void __init free_area_init_memoryless_no + * Initialize all valid struct pages in the range [spfn, epfn) and mark them + * PageReserved(). Return the number of struct pages that were initialized. + */ +-static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn) ++static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn, ++ int zone, int nid) + { +- unsigned long pfn; ++ unsigned long pfn, zone_spfn, zone_epfn; + u64 pgcnt = 0; + ++ zone_spfn = arch_zone_lowest_possible_pfn[zone]; ++ zone_epfn = arch_zone_highest_possible_pfn[zone]; ++ ++ spfn = clamp(spfn, zone_spfn, zone_epfn); ++ epfn = clamp(epfn, zone_spfn, zone_epfn); ++ + for (pfn = spfn; pfn < epfn; pfn++) { + if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) { + pfn = ALIGN_DOWN(pfn, pageblock_nr_pages) + + pageblock_nr_pages - 1; + continue; + } +- /* +- * Use a fake node/zone (0) for now. Some of these pages +- * (in memblock.reserved but not in memblock.memory) will +- * get re-initialized via reserve_bootmem_region() later. +- */ +- __init_single_page(pfn_to_page(pfn), pfn, 0, 0); ++ ++ __init_single_page(pfn_to_page(pfn), pfn, zone, nid); + __SetPageReserved(pfn_to_page(pfn)); + pgcnt++; + } +@@ -7028,51 +7031,64 @@ static u64 __init init_unavailable_range + } + + /* +- * Only struct pages that are backed by physical memory are zeroed and +- * initialized by going through __init_single_page(). But, there are some +- * struct pages which are reserved in memblock allocator and their fields +- * may be accessed (for example page_to_pfn() on some configuration accesses +- * flags). We must explicitly initialize those struct pages. ++ * Only struct pages that correspond to ranges defined by memblock.memory ++ * are zeroed and initialized by going through __init_single_page() during ++ * memmap_init(). + * +- * This function also addresses a similar issue where struct pages are left +- * uninitialized because the physical address range is not covered by +- * memblock.memory or memblock.reserved. That could happen when memblock +- * layout is manually configured via memmap=, or when the highest physical +- * address (max_pfn) does not end on a section boundary. ++ * But, there could be struct pages that correspond to holes in ++ * memblock.memory. This can happen because of the following reasons: ++ * - phyiscal memory bank size is not necessarily the exact multiple of the ++ * arbitrary section size ++ * - early reserved memory may not be listed in memblock.memory ++ * - memory layouts defined with memmap= kernel parameter may not align ++ * nicely with memmap sections ++ * ++ * Explicitly initialize those struct pages so that: ++ * - PG_Reserved is set ++ * - zone link is set accorging to the architecture constrains ++ * - node is set to node id of the next populated region except for the ++ * trailing hole where last node id is used + */ +-static void __init init_unavailable_mem(void) ++static void __init init_zone_unavailable_mem(int zone) + { +- phys_addr_t start, end; +- u64 i, pgcnt; +- phys_addr_t next = 0; ++ unsigned long start, end; ++ int i, nid; ++ u64 pgcnt; ++ unsigned long next = 0; + + /* +- * Loop through unavailable ranges not covered by memblock.memory. ++ * Loop through holes in memblock.memory and initialize struct ++ * pages corresponding to these holes + */ + pgcnt = 0; +- for_each_mem_range(i, &start, &end) { ++ for_each_mem_pfn_range(i, MAX_NUMNODES, &start, &end, &nid) { + if (next < start) +- pgcnt += init_unavailable_range(PFN_DOWN(next), +- PFN_UP(start)); ++ pgcnt += init_unavailable_range(next, start, zone, nid); + next = end; + } + + /* +- * Early sections always have a fully populated memmap for the whole +- * section - see pfn_valid(). If the last section has holes at the +- * end and that section is marked "online", the memmap will be +- * considered initialized. Make sure that memmap has a well defined +- * state. ++ * Last section may surpass the actual end of memory (e.g. we can ++ * have 1Gb section and 512Mb of RAM pouplated). ++ * Make sure that memmap has a well defined state in this case. + */ +- pgcnt += init_unavailable_range(PFN_DOWN(next), +- round_up(max_pfn, PAGES_PER_SECTION)); ++ end = round_up(max_pfn, PAGES_PER_SECTION); ++ pgcnt += init_unavailable_range(next, end, zone, nid); + + /* + * Struct pages that do not have backing memory. This could be because + * firmware is using some of this memory, or for some other reasons. + */ + if (pgcnt) +- pr_info("Zeroed struct page in unavailable ranges: %lld pages", pgcnt); ++ pr_info("Zone %s: zeroed struct page in unavailable ranges: %lld pages", zone_names[zone], pgcnt); ++} ++ ++static void __init init_unavailable_mem(void) ++{ ++ int zone; ++ ++ for (zone = 0; zone < ZONE_MOVABLE; zone++) ++ init_zone_unavailable_mem(zone); + } + #else + static inline void __init init_unavailable_mem(void) diff --git a/queue-5.10/mm-fix-numa-stats-for-thp-migration.patch b/queue-5.10/mm-fix-numa-stats-for-thp-migration.patch new file mode 100644 index 00000000000..d0798a75b9d --- /dev/null +++ b/queue-5.10/mm-fix-numa-stats-for-thp-migration.patch @@ -0,0 +1,97 @@ +From 5c447d274f3746fbed6e695e7b9a2d7bd8b31b71 Mon Sep 17 00:00:00 2001 +From: Shakeel Butt +Date: Sat, 23 Jan 2021 21:01:15 -0800 +Subject: mm: fix numa stats for thp migration + +From: Shakeel Butt + +commit 5c447d274f3746fbed6e695e7b9a2d7bd8b31b71 upstream. + +Currently the kernel is not correctly updating the numa stats for +NR_FILE_PAGES and NR_SHMEM on THP migration. Fix that. + +For NR_FILE_DIRTY and NR_ZONE_WRITE_PENDING, although at the moment +there is no need to handle THP migration as kernel still does not have +write support for file THP but to be more future proof, this patch adds +the THP support for those stats as well. + +Link: https://lkml.kernel.org/r/20210108155813.2914586-2-shakeelb@google.com +Fixes: e71769ae52609 ("mm: enable thp migration for shmem thp") +Signed-off-by: Shakeel Butt +Acked-by: Yang Shi +Reviewed-by: Roman Gushchin +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Muchun Song +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/migrate.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -406,6 +406,7 @@ int migrate_page_move_mapping(struct add + struct zone *oldzone, *newzone; + int dirty; + int expected_count = expected_page_refs(mapping, page) + extra_count; ++ int nr = thp_nr_pages(page); + + if (!mapping) { + /* Anonymous page without mapping */ +@@ -441,7 +442,7 @@ int migrate_page_move_mapping(struct add + */ + newpage->index = page->index; + newpage->mapping = page->mapping; +- page_ref_add(newpage, thp_nr_pages(page)); /* add cache reference */ ++ page_ref_add(newpage, nr); /* add cache reference */ + if (PageSwapBacked(page)) { + __SetPageSwapBacked(newpage); + if (PageSwapCache(page)) { +@@ -463,7 +464,7 @@ int migrate_page_move_mapping(struct add + if (PageTransHuge(page)) { + int i; + +- for (i = 1; i < HPAGE_PMD_NR; i++) { ++ for (i = 1; i < nr; i++) { + xas_next(&xas); + xas_store(&xas, newpage); + } +@@ -474,7 +475,7 @@ int migrate_page_move_mapping(struct add + * to one less reference. + * We know this isn't the last reference. + */ +- page_ref_unfreeze(page, expected_count - thp_nr_pages(page)); ++ page_ref_unfreeze(page, expected_count - nr); + + xas_unlock(&xas); + /* Leave irq disabled to prevent preemption while updating stats */ +@@ -497,17 +498,17 @@ int migrate_page_move_mapping(struct add + old_lruvec = mem_cgroup_lruvec(memcg, oldzone->zone_pgdat); + new_lruvec = mem_cgroup_lruvec(memcg, newzone->zone_pgdat); + +- __dec_lruvec_state(old_lruvec, NR_FILE_PAGES); +- __inc_lruvec_state(new_lruvec, NR_FILE_PAGES); ++ __mod_lruvec_state(old_lruvec, NR_FILE_PAGES, -nr); ++ __mod_lruvec_state(new_lruvec, NR_FILE_PAGES, nr); + if (PageSwapBacked(page) && !PageSwapCache(page)) { +- __dec_lruvec_state(old_lruvec, NR_SHMEM); +- __inc_lruvec_state(new_lruvec, NR_SHMEM); ++ __mod_lruvec_state(old_lruvec, NR_SHMEM, -nr); ++ __mod_lruvec_state(new_lruvec, NR_SHMEM, nr); + } + if (dirty && mapping_can_writeback(mapping)) { +- __dec_lruvec_state(old_lruvec, NR_FILE_DIRTY); +- __dec_zone_state(oldzone, NR_ZONE_WRITE_PENDING); +- __inc_lruvec_state(new_lruvec, NR_FILE_DIRTY); +- __inc_zone_state(newzone, NR_ZONE_WRITE_PENDING); ++ __mod_lruvec_state(old_lruvec, NR_FILE_DIRTY, -nr); ++ __mod_zone_page_state(oldzone, NR_ZONE_WRITE_PENDING, -nr); ++ __mod_lruvec_state(new_lruvec, NR_FILE_DIRTY, nr); ++ __mod_zone_page_state(newzone, NR_ZONE_WRITE_PENDING, nr); + } + } + local_irq_enable(); diff --git a/queue-5.10/mm-memcg-fix-memcg-file_dirty-numa-stat.patch b/queue-5.10/mm-memcg-fix-memcg-file_dirty-numa-stat.patch new file mode 100644 index 00000000000..453634e88c0 --- /dev/null +++ b/queue-5.10/mm-memcg-fix-memcg-file_dirty-numa-stat.patch @@ -0,0 +1,49 @@ +From 8a8792f600abacd7e1b9bb667759dca1c153f64c Mon Sep 17 00:00:00 2001 +From: Shakeel Butt +Date: Sat, 23 Jan 2021 21:01:11 -0800 +Subject: mm: memcg: fix memcg file_dirty numa stat + +From: Shakeel Butt + +commit 8a8792f600abacd7e1b9bb667759dca1c153f64c upstream. + +The kernel updates the per-node NR_FILE_DIRTY stats on page migration +but not the memcg numa stats. + +That was not an issue until recently the commit 5f9a4f4a7096 ("mm: +memcontrol: add the missing numa_stat interface for cgroup v2") exposed +numa stats for the memcg. + +So fix the file_dirty per-memcg numa stat. + +Link: https://lkml.kernel.org/r/20210108155813.2914586-1-shakeelb@google.com +Fixes: 5f9a4f4a7096 ("mm: memcontrol: add the missing numa_stat interface for cgroup v2") +Signed-off-by: Shakeel Butt +Reviewed-by: Muchun Song +Acked-by: Yang Shi +Reviewed-by: Roman Gushchin +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/migrate.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -504,9 +504,9 @@ int migrate_page_move_mapping(struct add + __inc_lruvec_state(new_lruvec, NR_SHMEM); + } + if (dirty && mapping_can_writeback(mapping)) { +- __dec_node_state(oldzone->zone_pgdat, NR_FILE_DIRTY); ++ __dec_lruvec_state(old_lruvec, NR_FILE_DIRTY); + __dec_zone_state(oldzone, NR_ZONE_WRITE_PENDING); +- __inc_node_state(newzone->zone_pgdat, NR_FILE_DIRTY); ++ __inc_lruvec_state(new_lruvec, NR_FILE_DIRTY); + __inc_zone_state(newzone, NR_ZONE_WRITE_PENDING); + } + } diff --git a/queue-5.10/mm-memcg-slab-optimize-objcg-stock-draining.patch b/queue-5.10/mm-memcg-slab-optimize-objcg-stock-draining.patch new file mode 100644 index 00000000000..105fabc6fae --- /dev/null +++ b/queue-5.10/mm-memcg-slab-optimize-objcg-stock-draining.patch @@ -0,0 +1,93 @@ +From 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c Mon Sep 17 00:00:00 2001 +From: Roman Gushchin +Date: Sat, 23 Jan 2021 21:01:07 -0800 +Subject: mm: memcg/slab: optimize objcg stock draining +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roman Gushchin + +commit 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c upstream. + +Imran Khan reported a 16% regression in hackbench results caused by the +commit f2fe7b09a52b ("mm: memcg/slab: charge individual slab objects +instead of pages"). The regression is noticeable in the case of a +consequent allocation of several relatively large slab objects, e.g. +skb's. As soon as the amount of stocked bytes exceeds PAGE_SIZE, +drain_obj_stock() and __memcg_kmem_uncharge() are called, and it leads +to a number of atomic operations in page_counter_uncharge(). + +The corresponding call graph is below (provided by Imran Khan): + + |__alloc_skb + | | + | |__kmalloc_reserve.isra.61 + | | | + | | |__kmalloc_node_track_caller + | | | | + | | | |slab_pre_alloc_hook.constprop.88 + | | | obj_cgroup_charge + | | | | | + | | | | |__memcg_kmem_charge + | | | | | | + | | | | | |page_counter_try_charge + | | | | | + | | | | |refill_obj_stock + | | | | | | + | | | | | |drain_obj_stock.isra.68 + | | | | | | | + | | | | | | |__memcg_kmem_uncharge + | | | | | | | | + | | | | | | | |page_counter_uncharge + | | | | | | | | | + | | | | | | | | |page_counter_cancel + | | | | + | | | | + | | | |__slab_alloc + | | | | | + | | | | |___slab_alloc + | | | | | + | | | |slab_post_alloc_hook + +Instead of directly uncharging the accounted kernel memory, it's +possible to refill the generic page-sized per-cpu stock instead. It's a +much faster operation, especially on a default hierarchy. As a bonus, +__memcg_kmem_uncharge_page() will also get faster, so the freeing of +page-sized kernel allocations (e.g. large kmallocs) will become faster. + +A similar change has been done earlier for the socket memory by the +commit 475d0487a2ad ("mm: memcontrol: use per-cpu stocks for socket +memory uncharging"). + +Link: https://lkml.kernel.org/r/20210106042239.2860107-1-guro@fb.com +Fixes: f2fe7b09a52b ("mm: memcg/slab: charge individual slab objects instead of pages") +Signed-off-by: Roman Gushchin +Reported-by: Imran Khan +Tested-by: Imran Khan +Reviewed-by: Shakeel Butt +Reviewed-by: Michal Koutn +Cc: Michal Koutný +Cc: Johannes Weiner +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3083,9 +3083,7 @@ void __memcg_kmem_uncharge(struct mem_cg + if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) + page_counter_uncharge(&memcg->kmem, nr_pages); + +- page_counter_uncharge(&memcg->memory, nr_pages); +- if (do_memsw_account()) +- page_counter_uncharge(&memcg->memsw, nr_pages); ++ refill_stock(memcg, nr_pages); + } + + /** diff --git a/queue-5.10/powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch b/queue-5.10/powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch new file mode 100644 index 00000000000..34edbd45baf --- /dev/null +++ b/queue-5.10/powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch @@ -0,0 +1,195 @@ +From 08685be7761d69914f08c3d6211c543a385a5b9c Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Mon, 11 Jan 2021 16:24:08 +1000 +Subject: powerpc/64s: fix scv entry fallback flush vs interrupt + +From: Nicholas Piggin + +commit 08685be7761d69914f08c3d6211c543a385a5b9c upstream. + +The L1D flush fallback functions are not recoverable vs interrupts, +yet the scv entry flush runs with MSR[EE]=1. This can result in a +timer (soft-NMI) or MCE or SRESET interrupt hitting here and overwriting +the EXRFI save area, which ends up corrupting userspace registers for +scv return. + +Fix this by disabling RI and EE for the scv entry fallback flush. + +Fixes: f79643787e0a0 ("powerpc/64s: flush L1D on kernel entry") +Cc: stable@vger.kernel.org # 5.9+ which also have flush L1D patch backport +Reported-by: Tulio Magno Quites Machado Filho +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210111062408.287092-1-npiggin@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/exception-64s.h | 13 +++++++++++++ + arch/powerpc/include/asm/feature-fixups.h | 10 ++++++++++ + arch/powerpc/kernel/entry_64.S | 2 +- + arch/powerpc/kernel/exceptions-64s.S | 19 +++++++++++++++++++ + arch/powerpc/kernel/vmlinux.lds.S | 7 +++++++ + arch/powerpc/lib/feature-fixups.c | 24 +++++++++++++++++++++--- + 6 files changed, 71 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/include/asm/exception-64s.h ++++ b/arch/powerpc/include/asm/exception-64s.h +@@ -63,6 +63,12 @@ + nop; \ + nop; + ++#define SCV_ENTRY_FLUSH_SLOT \ ++ SCV_ENTRY_FLUSH_FIXUP_SECTION; \ ++ nop; \ ++ nop; \ ++ nop; ++ + /* + * r10 must be free to use, r13 must be paca + */ +@@ -71,6 +77,13 @@ + ENTRY_FLUSH_SLOT + + /* ++ * r10, ctr must be free to use, r13 must be paca ++ */ ++#define SCV_INTERRUPT_TO_KERNEL \ ++ STF_ENTRY_BARRIER_SLOT; \ ++ SCV_ENTRY_FLUSH_SLOT ++ ++/* + * Macros for annotating the expected destination of (h)rfid + * + * The nop instructions allow us to insert one or more instructions to flush the +--- a/arch/powerpc/include/asm/feature-fixups.h ++++ b/arch/powerpc/include/asm/feature-fixups.h +@@ -221,6 +221,14 @@ label##3: \ + FTR_ENTRY_OFFSET 957b-958b; \ + .popsection; + ++#define SCV_ENTRY_FLUSH_FIXUP_SECTION \ ++957: \ ++ .pushsection __scv_entry_flush_fixup,"a"; \ ++ .align 2; \ ++958: \ ++ FTR_ENTRY_OFFSET 957b-958b; \ ++ .popsection; ++ + #define RFI_FLUSH_FIXUP_SECTION \ + 951: \ + .pushsection __rfi_flush_fixup,"a"; \ +@@ -254,10 +262,12 @@ label##3: \ + + extern long stf_barrier_fallback; + extern long entry_flush_fallback; ++extern long scv_entry_flush_fallback; + extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup; + extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup; + extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup; + extern long __start___entry_flush_fixup, __stop___entry_flush_fixup; ++extern long __start___scv_entry_flush_fixup, __stop___scv_entry_flush_fixup; + extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; + extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup; + extern long __start__btb_flush_fixup, __stop__btb_flush_fixup; +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -75,7 +75,7 @@ BEGIN_FTR_SECTION + bne .Ltabort_syscall + END_FTR_SECTION_IFSET(CPU_FTR_TM) + #endif +- INTERRUPT_TO_KERNEL ++ SCV_INTERRUPT_TO_KERNEL + mr r10,r1 + ld r1,PACAKSAVE(r13) + std r10,0(r1) +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -2993,6 +2993,25 @@ TRAMP_REAL_BEGIN(entry_flush_fallback) + ld r11,PACA_EXRFI+EX_R11(r13) + blr + ++/* ++ * The SCV entry flush happens with interrupts enabled, so it must disable ++ * to prevent EXRFI being clobbered by NMIs (e.g., soft_nmi_common). r10 ++ * (containing LR) does not need to be preserved here because scv entry ++ * puts 0 in the pt_regs, CTR can be clobbered for the same reason. ++ */ ++TRAMP_REAL_BEGIN(scv_entry_flush_fallback) ++ li r10,0 ++ mtmsrd r10,1 ++ lbz r10,PACAIRQHAPPENED(r13) ++ ori r10,r10,PACA_IRQ_HARD_DIS ++ stb r10,PACAIRQHAPPENED(r13) ++ std r11,PACA_EXRFI+EX_R11(r13) ++ L1D_DISPLACEMENT_FLUSH ++ ld r11,PACA_EXRFI+EX_R11(r13) ++ li r10,MSR_RI ++ mtmsrd r10,1 ++ blr ++ + TRAMP_REAL_BEGIN(rfi_flush_fallback) + SET_SCRATCH0(r13); + GET_PACA(r13); +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -146,6 +146,13 @@ SECTIONS + } + + . = ALIGN(8); ++ __scv_entry_flush_fixup : AT(ADDR(__scv_entry_flush_fixup) - LOAD_OFFSET) { ++ __start___scv_entry_flush_fixup = .; ++ *(__scv_entry_flush_fixup) ++ __stop___scv_entry_flush_fixup = .; ++ } ++ ++ . = ALIGN(8); + __stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) { + __start___stf_exit_barrier_fixup = .; + *(__stf_exit_barrier_fixup) +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -290,9 +290,6 @@ void do_entry_flush_fixups(enum l1d_flus + long *start, *end; + int i; + +- start = PTRRELOC(&__start___entry_flush_fixup); +- end = PTRRELOC(&__stop___entry_flush_fixup); +- + instrs[0] = 0x60000000; /* nop */ + instrs[1] = 0x60000000; /* nop */ + instrs[2] = 0x60000000; /* nop */ +@@ -312,6 +309,8 @@ void do_entry_flush_fixups(enum l1d_flus + if (types & L1D_FLUSH_MTTRIG) + instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */ + ++ start = PTRRELOC(&__start___entry_flush_fixup); ++ end = PTRRELOC(&__stop___entry_flush_fixup); + for (i = 0; start < end; start++, i++) { + dest = (void *)start + *start; + +@@ -328,6 +327,25 @@ void do_entry_flush_fixups(enum l1d_flus + patch_instruction((struct ppc_inst *)(dest + 2), ppc_inst(instrs[2])); + } + ++ start = PTRRELOC(&__start___scv_entry_flush_fixup); ++ end = PTRRELOC(&__stop___scv_entry_flush_fixup); ++ for (; start < end; start++, i++) { ++ dest = (void *)start + *start; ++ ++ pr_devel("patching dest %lx\n", (unsigned long)dest); ++ ++ patch_instruction((struct ppc_inst *)dest, ppc_inst(instrs[0])); ++ ++ if (types == L1D_FLUSH_FALLBACK) ++ patch_branch((struct ppc_inst *)(dest + 1), (unsigned long)&scv_entry_flush_fallback, ++ BRANCH_SET_LINK); ++ else ++ patch_instruction((struct ppc_inst *)(dest + 1), ppc_inst(instrs[1])); ++ ++ patch_instruction((struct ppc_inst *)(dest + 2), ppc_inst(instrs[2])); ++ } ++ ++ + printk(KERN_DEBUG "entry-flush: patched %d locations (%s flush)\n", i, + (types == L1D_FLUSH_NONE) ? "no" : + (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" : diff --git a/queue-5.10/proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch b/queue-5.10/proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch new file mode 100644 index 00000000000..4f660e809c0 --- /dev/null +++ b/queue-5.10/proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch @@ -0,0 +1,73 @@ +From 697edcb0e4eadc41645fe88c991fe6a206b1a08d Mon Sep 17 00:00:00 2001 +From: Xiaoming Ni +Date: Sat, 23 Jan 2021 21:02:16 -0800 +Subject: proc_sysctl: fix oops caused by incorrect command parameters + +From: Xiaoming Ni + +commit 697edcb0e4eadc41645fe88c991fe6a206b1a08d upstream. + +The process_sysctl_arg() does not check whether val is empty before +invoking strlen(val). If the command line parameter () is incorrectly +configured and val is empty, oops is triggered. + +For example: + "hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is + triggered. The call stack is as follows: + Kernel command line: .... hung_task_panic + ...... + Call trace: + __pi_strlen+0x10/0x98 + parse_args+0x278/0x344 + do_sysctl_args+0x8c/0xfc + kernel_init+0x5c/0xf4 + ret_from_fork+0x10/0x30 + +To fix it, check whether "val" is empty when "phram" is a sysctl field. +Error codes are returned in the failure branch, and error logs are +generated by parse_args(). + +Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com +Fixes: 3db978d480e2843 ("kernel/sysctl: support setting sysctl parameters from kernel command line") +Signed-off-by: Xiaoming Ni +Acked-by: Vlastimil Babka +Cc: Luis Chamberlain +Cc: Kees Cook +Cc: Iurii Zaikin +Cc: Alexey Dobriyan +Cc: Michal Hocko +Cc: Masami Hiramatsu +Cc: Heiner Kallweit +Cc: Randy Dunlap +Cc: [5.8+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_sysctl.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -1770,6 +1770,12 @@ static int process_sysctl_arg(char *para + return 0; + } + ++ if (!val) ++ return -EINVAL; ++ len = strlen(val); ++ if (len == 0) ++ return -EINVAL; ++ + /* + * To set sysctl options, we use a temporary mount of proc, look up the + * respective sys/ file and write to it. To avoid mounting it when no +@@ -1811,7 +1817,6 @@ static int process_sysctl_arg(char *para + file, param, val); + goto out; + } +- len = strlen(val); + wret = kernel_write(file, val, len, &pos); + if (wret < 0) { + err = wret; diff --git a/queue-5.10/serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch b/queue-5.10/serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch new file mode 100644 index 00000000000..ba1cf636a38 --- /dev/null +++ b/queue-5.10/serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch @@ -0,0 +1,67 @@ +From 54ca955b5a4024e2ce0f206b03adb7109bc4da26 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Wed, 23 Dec 2020 20:19:31 +0100 +Subject: serial: mvebu-uart: fix tx lost characters at power off +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +commit 54ca955b5a4024e2ce0f206b03adb7109bc4da26 upstream. + +Commit c685af1108d7 ("serial: mvebu-uart: fix tx lost characters") fixed tx +lost characters at low baud rates but started causing tx lost characters +when kernel is going to power off or reboot. + +TX_EMP tells us when transmit queue is empty therefore all characters were +transmitted. TX_RDY tells us when CPU can send a new character. + +Therefore we need to use different check prior transmitting new character +and different check after all characters were sent. + +This patch splits polling code into two functions: wait_for_xmitr() which +waits for TX_RDY and wait_for_xmite() which waits for TX_EMP. + +When rebooting A3720 platform without this patch on UART is print only: +[ 42.699� + +And with this patch on UART is full output: +[ 39.530216] reboot: Restarting system + +Fixes: c685af1108d7 ("serial: mvebu-uart: fix tx lost characters") +Signed-off-by: Pali Rohár +Cc: stable +Link: https://lore.kernel.org/r/20201223191931.18343-1-pali@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/mvebu-uart.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -648,6 +648,14 @@ static void wait_for_xmitr(struct uart_p + (val & STAT_TX_RDY(port)), 1, 10000); + } + ++static void wait_for_xmite(struct uart_port *port) ++{ ++ u32 val; ++ ++ readl_poll_timeout_atomic(port->membase + UART_STAT, val, ++ (val & STAT_TX_EMP), 1, 10000); ++} ++ + static void mvebu_uart_console_putchar(struct uart_port *port, int ch) + { + wait_for_xmitr(port); +@@ -675,7 +683,7 @@ static void mvebu_uart_console_write(str + + uart_console_write(port, s, count, mvebu_uart_console_putchar); + +- wait_for_xmitr(port); ++ wait_for_xmite(port); + + if (ier) + writel(ier, port->membase + UART_CTRL(port)); diff --git a/queue-5.10/series b/queue-5.10/series index 5fe976aded5..4e301542690 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -109,3 +109,39 @@ can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch can-peak_usb-fix-use-after-free-bugs.patch perf-evlist-fix-id-index-for-heterogeneous-systems.patch i2c-sprd-depend-on-common_clk-to-fix-compile-tests.patch +iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch +iio-ad5504-fix-setting-power-down-state.patch +drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch +iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch +counter-ti-eqep-remove-floor.patch +powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch +cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch +irqchip-mips-cpu-set-ipi-domain-parent-chip.patch +x86-mmx-use-kfpu_387-for-mmx-string-operations.patch +x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch +proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch +mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch +mm-memcg-slab-optimize-objcg-stock-draining.patch +mm-memcg-fix-memcg-file_dirty-numa-stat.patch +mm-fix-numa-stats-for-thp-migration.patch +io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch +io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch +io_uring-fix-short-read-retries-for-non-reg-files.patch +intel_th-pci-add-alder-lake-p-support.patch +stm-class-fix-module-init-return-on-allocation-failure.patch +serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch +ehci-fix-ehci-host-controller-initialization-sequence.patch +usb-ehci-fix-an-interrupt-calltrace-error.patch +usb-gadget-aspeed-fix-stop-dma-register-setting.patch +usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch +usb-udc-core-use-lock-when-write-to-soft_connect.patch +usb-bdc-make-bdc-pci-driver-depend-on-broken.patch +usb-cdns3-imx-fix-writing-read-only-memory-issue.patch +usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch +xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch +xhci-tegra-delay-for-disabling-lfps-detector.patch +drivers-core-free-dma_range_map-when-driver-probe-failed.patch +driver-core-fix-device-link-device-name-collision.patch +driver-core-extend-device_is_dependent.patch +drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch +drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch diff --git a/queue-5.10/stm-class-fix-module-init-return-on-allocation-failure.patch b/queue-5.10/stm-class-fix-module-init-return-on-allocation-failure.patch new file mode 100644 index 00000000000..6460bf24135 --- /dev/null +++ b/queue-5.10/stm-class-fix-module-init-return-on-allocation-failure.patch @@ -0,0 +1,48 @@ +From 927633a6d20af319d986f3e42c3ef9f6d7835008 Mon Sep 17 00:00:00 2001 +From: Wang Hui +Date: Fri, 15 Jan 2021 22:59:16 +0300 +Subject: stm class: Fix module init return on allocation failure + +From: Wang Hui + +commit 927633a6d20af319d986f3e42c3ef9f6d7835008 upstream. + +In stm_heartbeat_init(): return value gets reset after the first +iteration by stm_source_register_device(), so allocation failures +after that will, after a clean up, return success. Fix that. + +Fixes: 119291853038 ("stm class: Add heartbeat stm source device") +Reported-by: Hulk Robot +Signed-off-by: Wang Hui +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20210115195917.3184-2-alexander.shishkin@linux.intel.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/heartbeat.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hwtracing/stm/heartbeat.c ++++ b/drivers/hwtracing/stm/heartbeat.c +@@ -64,7 +64,7 @@ static void stm_heartbeat_unlink(struct + + static int stm_heartbeat_init(void) + { +- int i, ret = -ENOMEM; ++ int i, ret; + + if (nr_devs < 0 || nr_devs > STM_HEARTBEAT_MAX) + return -EINVAL; +@@ -72,8 +72,10 @@ static int stm_heartbeat_init(void) + for (i = 0; i < nr_devs; i++) { + stm_heartbeat[i].data.name = + kasprintf(GFP_KERNEL, "heartbeat.%d", i); +- if (!stm_heartbeat[i].data.name) ++ if (!stm_heartbeat[i].data.name) { ++ ret = -ENOMEM; + goto fail_unregister; ++ } + + stm_heartbeat[i].data.nr_chans = 1; + stm_heartbeat[i].data.link = stm_heartbeat_link; diff --git a/queue-5.10/usb-bdc-make-bdc-pci-driver-depend-on-broken.patch b/queue-5.10/usb-bdc-make-bdc-pci-driver-depend-on-broken.patch new file mode 100644 index 00000000000..18f145f5afb --- /dev/null +++ b/queue-5.10/usb-bdc-make-bdc-pci-driver-depend-on-broken.patch @@ -0,0 +1,36 @@ +From ef02684c4e67d8c35ac83083564135bc7b1d3445 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Mon, 18 Jan 2021 21:36:15 +0100 +Subject: usb: bdc: Make bdc pci driver depend on BROKEN + +From: Patrik Jakobsson + +commit ef02684c4e67d8c35ac83083564135bc7b1d3445 upstream. + +The bdc pci driver is going to be removed due to it not existing in the +wild. This patch turns off compilation of the driver so that stable +kernels can also pick up the change. This helps the out-of-tree +facetimehd webcam driver as the pci id conflicts with bdc. + +Cc: Al Cooper +Cc: +Acked-by: Felipe Balbi +Signed-off-by: Patrik Jakobsson +Link: https://lore.kernel.org/r/20210118203615.13995-1-patrik.r.jakobsson@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/bdc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/bdc/Kconfig ++++ b/drivers/usb/gadget/udc/bdc/Kconfig +@@ -17,7 +17,7 @@ if USB_BDC_UDC + comment "Platform Support" + config USB_BDC_PCI + tristate "BDC support for PCIe based platforms" +- depends on USB_PCI ++ depends on USB_PCI && BROKEN + default USB_BDC_UDC + help + Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform. diff --git a/queue-5.10/usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch b/queue-5.10/usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch new file mode 100644 index 00000000000..33c5ee6e1ef --- /dev/null +++ b/queue-5.10/usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch @@ -0,0 +1,52 @@ +From 2ef02b846ee2526249a562a66d6dcb25fcbca9d8 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 10 Dec 2020 21:31:37 +0800 +Subject: usb: cdns3: imx: fix can't create core device the second time issue + +From: Peter Chen + +commit 2ef02b846ee2526249a562a66d6dcb25fcbca9d8 upstream. + +The cdns3 core device is populated by calling of_platform_populate, +the flag OF_POPULATED is set for core device node, if this flag +is not cleared, when calling of_platform_populate the second time +after loading parent module again, the OF code will not try to create +platform device for core device. + +To fix it, it uses of_platform_depopulate to depopulate the core +device which the parent created, and the flag OF_POPULATED for +core device node will be cleared accordingly. + +Cc: +Fixes: 1e056efab993 ("usb: cdns3: add NXP imx8qm glue layer") +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/cdns3-imx.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/drivers/usb/cdns3/cdns3-imx.c ++++ b/drivers/usb/cdns3/cdns3-imx.c +@@ -218,20 +218,11 @@ err: + return ret; + } + +-static int cdns_imx_remove_core(struct device *dev, void *data) +-{ +- struct platform_device *pdev = to_platform_device(dev); +- +- platform_device_unregister(pdev); +- +- return 0; +-} +- + static int cdns_imx_remove(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + +- device_for_each_child(dev, NULL, cdns_imx_remove_core); ++ of_platform_depopulate(dev); + platform_set_drvdata(pdev, NULL); + + return 0; diff --git a/queue-5.10/usb-cdns3-imx-fix-writing-read-only-memory-issue.patch b/queue-5.10/usb-cdns3-imx-fix-writing-read-only-memory-issue.patch new file mode 100644 index 00000000000..373e7c60c4a --- /dev/null +++ b/queue-5.10/usb-cdns3-imx-fix-writing-read-only-memory-issue.patch @@ -0,0 +1,99 @@ +From 92cbdb923c17544684c2dd3be9f8636617898a44 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 10 Dec 2020 21:31:36 +0800 +Subject: usb: cdns3: imx: fix writing read-only memory issue + +From: Peter Chen + +commit 92cbdb923c17544684c2dd3be9f8636617898a44 upstream. + +The memory for struct clk_bulk_data should not be static which will be written +during the clk_bulk_get. It fixed below oops when loading cdns3-imx as module. + +[ 17.272605] Unable to handle kernel write to read-only memory at virtual address ffff8000092a5398 +[ 17.299730] Mem abort info: +[ 17.313542] unregister ISI channel: mxc_isi.4 +[ 17.324076] ESR = 0x9600004f +[ 17.344658] EC = 0x25: DABT (current EL), IL = 32 bits +[ 17.402055] SET = 0, FnV = 0 +[ 17.404321] mxs_phy 5b100000.usbphy: supply phy-3p0 not found, using dummy regulator +[ 17.405121] EA = 0, S1PTW = 0 +[ 17.405133] Data abort info: +[ 17.496231] ISV = 0, ISS = 0x0000004f +[ 17.510871] CM = 0, WnR = 1 +[ 17.533542] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081ea5000 +[ 17.545709] [ffff8000092a5398] pgd=00000008bffff003, p4d=00000008bffff003, pud=00000008bfffe003, pmd=0000000885041003, pte=006000088513b783 +[ 17.573521] Internal error: Oops: 9600004f [#1] PREEMPT SMP +[ 17.579113] Modules linked in: usbmisc_imx phy_mxs_usb phy_cadence_salvo cdns3_imx(+) tcpci imx8_media_dev(C) caam error +[ 17.590044] CPU: 2 PID: 253 Comm: systemd-udevd Tainted: G C 5.10.0-rc4-04445-g11f3c3a29d0-dirty #19 +[ 17.600488] Hardware name: Freescale i.MX8QXP MEK (DT) +[ 17.605633] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--) +[ 17.611662] pc : __clk_bulk_get+0x48/0x130 +[ 17.615786] lr : clk_bulk_get+0x18/0x20 +[ 17.619634] sp : ffff80001369b880 +[ 17.622953] x29: ffff80001369b880 x28: 0000000000000013 +[ 17.628277] x27: 0000000000000100 x26: ffff00080553b100 +[ 17.633602] x25: ffff80001229b4d8 x24: 0000000000000000 +[ 17.638928] x23: ffff000800665410 x22: 0000000000000005 +[ 17.644275] x21: ffff8000092a5390 x20: ffff000800665400 +[ 17.649605] x19: ffff000804e6f980 x18: 000000005b110000 +[ 17.654946] x17: 0000000000000000 x16: 0000000000000000 +[ 17.660274] x15: ffff800011989100 x14: 0000000000000000 +[ 17.665599] x13: ffff800013ce1000 x12: ffff800013ca1000 +[ 17.670924] x11: 000000005b110000 x10: 0000000000000000 +[ 17.676249] x9 : ffff8000106c5a30 x8 : ffff000804e6fa00 +[ 17.681575] x7 : 0000000000000000 x6 : 000000000000003f +[ 17.686901] x5 : 0000000000000040 x4 : ffff80001369b8b0 +[ 17.692228] x3 : ffff8000092a5398 x2 : ffff8000092a5390 +[ 17.697574] x1 : ffff8000092a53e8 x0 : 0000000000000004 +[ 17.702905] Call trace: +[ 17.705366] __clk_bulk_get+0x48/0x130 +[ 17.709125] clk_bulk_get+0x18/0x20 +[ 17.712620] devm_clk_bulk_get+0x58/0xb8 +[ 17.716563] cdns_imx_probe+0x84/0x1f0 [cdns3_imx] +[ 17.721363] platform_drv_probe+0x58/0xa8 +[ 17.725381] really_probe+0xec/0x4c8 +[ 17.728967] driver_probe_device+0xf4/0x160 +[ 17.733160] device_driver_attach+0x74/0x80 +[ 17.737355] __driver_attach+0xa4/0x170 +[ 17.741202] bus_for_each_dev+0x74/0xc8 +[ 17.745043] driver_attach+0x28/0x30 +[ 17.748620] bus_add_driver+0x144/0x228 +[ 17.752462] driver_register+0x68/0x118 +[ 17.756308] __platform_driver_register+0x4c/0x58 +[ 17.761022] cdns_imx_driver_init+0x24/0x1000 [cdns3_imx] +[ 17.766434] do_one_initcall+0x48/0x2c0 +[ 17.770280] do_init_module+0x5c/0x220 +[ 17.774029] load_module+0x210c/0x2858 +[ 17.777784] __do_sys_finit_module+0xb8/0x120 +[ 17.782148] __arm64_sys_finit_module+0x24/0x30 +[ 17.786691] el0_svc_common.constprop.0+0x70/0x168 +[ 17.791497] do_el0_svc+0x28/0x88 +[ 17.794822] el0_sync_handler+0x158/0x160 +[ 17.798833] el0_sync+0x140/0x180 +[ 17.802158] Code: aa0203f5 91002043 8b205021 a90153f3 (f801047f) + +Cc: +Fixes: 1e056efab993 ("usb: cdns3: add NXP imx8qm glue layer") +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/cdns3-imx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/cdns3/cdns3-imx.c ++++ b/drivers/usb/cdns3/cdns3-imx.c +@@ -184,7 +184,11 @@ static int cdns_imx_probe(struct platfor + } + + data->num_clks = ARRAY_SIZE(imx_cdns3_core_clks); +- data->clks = (struct clk_bulk_data *)imx_cdns3_core_clks; ++ data->clks = devm_kmemdup(dev, imx_cdns3_core_clks, ++ sizeof(imx_cdns3_core_clks), GFP_KERNEL); ++ if (!data->clks) ++ return -ENOMEM; ++ + ret = devm_clk_bulk_get(dev, data->num_clks, data->clks); + if (ret) + return ret; diff --git a/queue-5.10/usb-ehci-fix-an-interrupt-calltrace-error.patch b/queue-5.10/usb-ehci-fix-an-interrupt-calltrace-error.patch new file mode 100644 index 00000000000..80184df1f71 --- /dev/null +++ b/queue-5.10/usb-ehci-fix-an-interrupt-calltrace-error.patch @@ -0,0 +1,48 @@ +From 643a4df7fe3f6831d14536fd692be85f92670a52 Mon Sep 17 00:00:00 2001 +From: Longfang Liu +Date: Tue, 12 Jan 2021 09:57:27 +0800 +Subject: USB: ehci: fix an interrupt calltrace error + +From: Longfang Liu + +commit 643a4df7fe3f6831d14536fd692be85f92670a52 upstream. + +The system that use Synopsys USB host controllers goes to suspend +when using USB audio player. This causes the USB host controller +continuous send interrupt signal to system, When the number of +interrupts exceeds 100000, the system will forcibly close the +interrupts and output a calltrace error. + +When the system goes to suspend, the last interrupt is reported to +the driver. At this time, the system has set the state to suspend. +This causes the last interrupt to not be processed by the system and +not clear the interrupt flag. This uncleared interrupt flag constantly +triggers new interrupt event. This causing the driver to receive more +than 100,000 interrupts, which causes the system to forcibly close the +interrupt report and report the calltrace error. + +so, when the driver goes to sleep and changes the system state to +suspend, the interrupt flag needs to be cleared. + +Signed-off-by: Longfang Liu +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1610416647-45774-1-git-send-email-liulongfang@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hub.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -345,6 +345,9 @@ static int ehci_bus_suspend (struct usb_ + + unlink_empty_async_suspended(ehci); + ++ /* Some Synopsys controllers mistakenly leave IAA turned on */ ++ ehci_writel(ehci, STS_IAA, &ehci->regs->status); ++ + /* Any IAA cycle that started before the suspend is now invalid */ + end_iaa_cycle(ehci); + ehci_handle_start_intr_unlinks(ehci); diff --git a/queue-5.10/usb-gadget-aspeed-fix-stop-dma-register-setting.patch b/queue-5.10/usb-gadget-aspeed-fix-stop-dma-register-setting.patch new file mode 100644 index 00000000000..363552d4855 --- /dev/null +++ b/queue-5.10/usb-gadget-aspeed-fix-stop-dma-register-setting.patch @@ -0,0 +1,40 @@ +From 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 Mon Sep 17 00:00:00 2001 +From: Ryan Chen +Date: Fri, 8 Jan 2021 16:12:38 +0800 +Subject: usb: gadget: aspeed: fix stop dma register setting. + +From: Ryan Chen + +commit 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 upstream. + +The vhub engine has two dma mode, one is descriptor list, another +is single stage DMA. Each mode has different stop register setting. +Descriptor list operation (bit2) : 0 disable reset, 1: enable reset +Single mode operation (bit0) : 0 : disable, 1: enable + +Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub") +Cc: stable +Acked-by: Felipe Balbi +Acked-by: Joel Stanley +Signed-off-by: Ryan Chen +Link: https://lore.kernel.org/r/20210108081238.10199-2-ryan_chen@aspeedtech.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c ++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c +@@ -420,7 +420,10 @@ static void ast_vhub_stop_active_req(str + u32 state, reg, loops; + + /* Stop DMA activity */ +- writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT); ++ if (ep->epn.desc_mode) ++ writel(VHUB_EP_DMA_CTRL_RESET, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT); ++ else ++ writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT); + + /* Wait for it to complete */ + for (loops = 0; loops < 1000; loops++) { diff --git a/queue-5.10/usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch b/queue-5.10/usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch new file mode 100644 index 00000000000..f2c34507e7d --- /dev/null +++ b/queue-5.10/usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch @@ -0,0 +1,73 @@ +From 6e6aa61d81194c01283880950df563b1b9abec46 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 13 Jan 2021 14:45:10 -0500 +Subject: USB: gadget: dummy-hcd: Fix errors in port-reset handling + +From: Alan Stern + +commit 6e6aa61d81194c01283880950df563b1b9abec46 upstream. + +Commit c318840fb2a4 ("USB: Gadget: dummy-hcd: Fix shift-out-of-bounds +bug") messed up the way dummy-hcd handles requests to turn on the +RESET port feature (I didn't notice that the original switch case +ended with a fallthrough). The call to set_link_state() was +inadvertently removed, as was the code to set the USB_PORT_STAT_RESET +flag when the speed is USB2. + +In addition, the original code never checked whether the port was +connected before handling the port-reset request. There was a check +for the port being powered, but it was removed by that commit! In +practice this doesn't matter much because the kernel doesn't try to +reset disconnected ports, but it's still bad form. + +This patch fixes these problems by changing the fallthrough to break, +adding back in the missing set_link_state() call, setting the +port-reset status flag, adding a port-is-connected test, and removing +a redundant assignment statement. + +Fixes: c318840fb2a4 ("USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug") +CC: +Acked-by: Felipe Balbi +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20210113194510.GA1290698@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/dummy_hcd.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2266,17 +2266,20 @@ static int dummy_hub_control( + } + fallthrough; + case USB_PORT_FEAT_RESET: ++ if (!(dum_hcd->port_status & USB_PORT_STAT_CONNECTION)) ++ break; + /* if it's already enabled, disable */ + if (hcd->speed == HCD_USB3) { +- dum_hcd->port_status = 0; + dum_hcd->port_status = + (USB_SS_PORT_STAT_POWER | + USB_PORT_STAT_CONNECTION | + USB_PORT_STAT_RESET); +- } else ++ } else { + dum_hcd->port_status &= ~(USB_PORT_STAT_ENABLE + | USB_PORT_STAT_LOW_SPEED + | USB_PORT_STAT_HIGH_SPEED); ++ dum_hcd->port_status |= USB_PORT_STAT_RESET; ++ } + /* + * We want to reset device status. All but the + * Self powered feature +@@ -2288,7 +2291,8 @@ static int dummy_hub_control( + * interval? Is it still 50msec as for HS? + */ + dum_hcd->re_timeout = jiffies + msecs_to_jiffies(50); +- fallthrough; ++ set_link_state(dum_hcd); ++ break; + case USB_PORT_FEAT_C_CONNECTION: + case USB_PORT_FEAT_C_RESET: + case USB_PORT_FEAT_C_ENABLE: diff --git a/queue-5.10/usb-udc-core-use-lock-when-write-to-soft_connect.patch b/queue-5.10/usb-udc-core-use-lock-when-write-to-soft_connect.patch new file mode 100644 index 00000000000..5f90ca35889 --- /dev/null +++ b/queue-5.10/usb-udc-core-use-lock-when-write-to-soft_connect.patch @@ -0,0 +1,57 @@ +From c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 14 Jan 2021 00:09:51 -0800 +Subject: usb: udc: core: Use lock when write to soft_connect + +From: Thinh Nguyen + +commit c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 upstream. + +Use lock to guard against concurrent access for soft-connect/disconnect +operations when writing to soft_connect sysfs. + +Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") +Cc: stable@vger.kernel.org +Acked-by: Felipe Balbi +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/338ea01fbd69b1985ef58f0f59af02c805ddf189.1610611437.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/core.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1532,10 +1532,13 @@ static ssize_t soft_connect_store(struct + struct device_attribute *attr, const char *buf, size_t n) + { + struct usb_udc *udc = container_of(dev, struct usb_udc, dev); ++ ssize_t ret; + ++ mutex_lock(&udc_lock); + if (!udc->driver) { + dev_err(dev, "soft-connect without a gadget driver\n"); +- return -EOPNOTSUPP; ++ ret = -EOPNOTSUPP; ++ goto out; + } + + if (sysfs_streq(buf, "connect")) { +@@ -1546,10 +1549,14 @@ static ssize_t soft_connect_store(struct + usb_gadget_udc_stop(udc); + } else { + dev_err(dev, "unsupported command '%s'\n", buf); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + +- return n; ++ ret = n; ++out: ++ mutex_unlock(&udc_lock); ++ return ret; + } + static DEVICE_ATTR_WO(soft_connect); + diff --git a/queue-5.10/x86-mmx-use-kfpu_387-for-mmx-string-operations.patch b/queue-5.10/x86-mmx-use-kfpu_387-for-mmx-string-operations.patch new file mode 100644 index 00000000000..3949d46b413 --- /dev/null +++ b/queue-5.10/x86-mmx-use-kfpu_387-for-mmx-string-operations.patch @@ -0,0 +1,97 @@ +From 67de8dca50c027ca0fa3b62a488ee5035036a0da Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Wed, 20 Jan 2021 21:09:49 -0800 +Subject: x86/mmx: Use KFPU_387 for MMX string operations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Lutomirski + +commit 67de8dca50c027ca0fa3b62a488ee5035036a0da upstream. + +The default kernel_fpu_begin() doesn't work on systems that support XMM but +haven't yet enabled CR4.OSFXSR. This causes crashes when _mmx_memcpy() is +called too early because LDMXCSR generates #UD when the aforementioned bit +is clear. + +Fix it by using kernel_fpu_begin_mask(KFPU_387) explicitly. + +Fixes: 7ad816762f9b ("x86/fpu: Reset MXCSR to default in kernel_fpu_begin()") +Reported-by: Krzysztof Mazur +Signed-off-by: Andy Lutomirski +Signed-off-by: Borislav Petkov +Tested-by: Krzysztof Piotr Olędzki +Tested-by: Krzysztof Mazur +Cc: +Link: https://lkml.kernel.org/r/e7bf21855fe99e5f3baa27446e32623358f69e8d.1611205691.git.luto@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/lib/mmx_32.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/arch/x86/lib/mmx_32.c ++++ b/arch/x86/lib/mmx_32.c +@@ -26,6 +26,16 @@ + #include + #include + ++/* ++ * Use KFPU_387. MMX instructions are not affected by MXCSR, ++ * but both AMD and Intel documentation states that even integer MMX ++ * operations will result in #MF if an exception is pending in FCW. ++ * ++ * EMMS is not needed afterwards because, after calling kernel_fpu_end(), ++ * any subsequent user of the 387 stack will reinitialize it using ++ * KFPU_387. ++ */ ++ + void *_mmx_memcpy(void *to, const void *from, size_t len) + { + void *p; +@@ -37,7 +47,7 @@ void *_mmx_memcpy(void *to, const void * + p = to; + i = len >> 6; /* len/64 */ + +- kernel_fpu_begin(); ++ kernel_fpu_begin_mask(KFPU_387); + + __asm__ __volatile__ ( + "1: prefetch (%0)\n" /* This set is 28 bytes */ +@@ -127,7 +137,7 @@ static void fast_clear_page(void *page) + { + int i; + +- kernel_fpu_begin(); ++ kernel_fpu_begin_mask(KFPU_387); + + __asm__ __volatile__ ( + " pxor %%mm0, %%mm0\n" : : +@@ -160,7 +170,7 @@ static void fast_copy_page(void *to, voi + { + int i; + +- kernel_fpu_begin(); ++ kernel_fpu_begin_mask(KFPU_387); + + /* + * maybe the prefetch stuff can go before the expensive fnsave... +@@ -247,7 +257,7 @@ static void fast_clear_page(void *page) + { + int i; + +- kernel_fpu_begin(); ++ kernel_fpu_begin_mask(KFPU_387); + + __asm__ __volatile__ ( + " pxor %%mm0, %%mm0\n" : : +@@ -282,7 +292,7 @@ static void fast_copy_page(void *to, voi + { + int i; + +- kernel_fpu_begin(); ++ kernel_fpu_begin_mask(KFPU_387); + + __asm__ __volatile__ ( + "1: prefetch (%0)\n" diff --git a/queue-5.10/x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch b/queue-5.10/x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch new file mode 100644 index 00000000000..e538977da6b --- /dev/null +++ b/queue-5.10/x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch @@ -0,0 +1,103 @@ +From bde9cfa3afe4324ec251e4af80ebf9b7afaf7afe Mon Sep 17 00:00:00 2001 +From: Mike Rapoport +Date: Sat, 23 Jan 2021 21:00:57 -0800 +Subject: x86/setup: don't remove E820_TYPE_RAM for pfn 0 + +From: Mike Rapoport + +commit bde9cfa3afe4324ec251e4af80ebf9b7afaf7afe upstream. + +Patch series "mm: fix initialization of struct page for holes in memory layout", v3. + +Commit 73a6e474cb37 ("mm: memmap_init: iterate over memblock regions +rather that check each PFN") exposed several issues with the memory map +initialization and these patches fix those issues. + +Initially there were crashes during compaction that Qian Cai reported +back in April [1]. It seemed back then that the problem was fixed, but +a few weeks ago Andrea Arcangeli hit the same bug [2] and there was an +additional discussion at [3]. + +[1] https://lore.kernel.org/lkml/8C537EB7-85EE-4DCF-943E-3CC0ED0DF56D@lca.pw +[2] https://lore.kernel.org/lkml/20201121194506.13464-1-aarcange@redhat.com +[3] https://lore.kernel.org/mm-commits/20201206005401.qKuAVgOXr%akpm@linux-foundation.org + +This patch (of 2): + +The first 4Kb of memory is a BIOS owned area and to avoid its allocation +for the kernel it was not listed in e820 tables as memory. As the result, +pfn 0 was never recognised by the generic memory management and it is not +a part of neither node 0 nor ZONE_DMA. + +If set_pfnblock_flags_mask() would be ever called for the pageblock +corresponding to the first 2Mbytes of memory, having pfn 0 outside of +ZONE_DMA would trigger + + VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page); + +Along with reserving the first 4Kb in e820 tables, several first pages are +reserved with memblock in several places during setup_arch(). These +reservations are enough to ensure the kernel does not touch the BIOS area +and it is not necessary to remove E820_TYPE_RAM for pfn 0. + +Remove the update of e820 table that changes the type of pfn 0 and move +the comment describing why it was done to trim_low_memory_range() that +reserves the beginning of the memory. + +Link: https://lkml.kernel.org/r/20210111194017.22696-2-rppt@kernel.org +Signed-off-by: Mike Rapoport +Cc: Baoquan He +Cc: Borislav Petkov +Cc: David Hildenbrand +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Mel Gorman +Cc: Michal Hocko +Cc: Qian Cai +Cc: Thomas Gleixner +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -666,17 +666,6 @@ static void __init trim_platform_memory_ + static void __init trim_bios_range(void) + { + /* +- * A special case is the first 4Kb of memory; +- * This is a BIOS owned area, not kernel ram, but generally +- * not listed as such in the E820 table. +- * +- * This typically reserves additional memory (64KiB by default) +- * since some BIOSes are known to corrupt low memory. See the +- * Kconfig help text for X86_RESERVE_LOW. +- */ +- e820__range_update(0, PAGE_SIZE, E820_TYPE_RAM, E820_TYPE_RESERVED); +- +- /* + * special case: Some BIOSes report the PC BIOS + * area (640Kb -> 1Mb) as RAM even though it is not. + * take them out. +@@ -733,6 +722,15 @@ early_param("reservelow", parse_reservel + + static void __init trim_low_memory_range(void) + { ++ /* ++ * A special case is the first 4Kb of memory; ++ * This is a BIOS owned area, not kernel ram, but generally ++ * not listed as such in the E820 table. ++ * ++ * This typically reserves additional memory (64KiB by default) ++ * since some BIOSes are known to corrupt low memory. See the ++ * Kconfig help text for X86_RESERVE_LOW. ++ */ + memblock_reserve(0, ALIGN(reserve_low, PAGE_SIZE)); + } + diff --git a/queue-5.10/xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch b/queue-5.10/xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch new file mode 100644 index 00000000000..27872e6af86 --- /dev/null +++ b/queue-5.10/xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch @@ -0,0 +1,53 @@ +From 576667bad341516edc4e18eb85acb0a2b4c9c9d9 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 15 Jan 2021 18:19:06 +0200 +Subject: xhci: make sure TRB is fully written before giving it to the controller + +From: Mathias Nyman + +commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream. + +Once the command ring doorbell is rung the xHC controller will parse all +command TRBs on the command ring that have the cycle bit set properly. + +If the driver just started writing the next command TRB to the ring when +hardware finished the previous TRB, then HW might fetch an incomplete TRB +as long as its cycle bit set correctly. + +A command TRB is 16 bytes (128 bits) long. +Driver writes the command TRB in four 32 bit chunks, with the chunk +containing the cycle bit last. This does however not guarantee that +chunks actually get written in that order. + +This was detected in stress testing when canceling URBs with several +connected USB devices. +Two consecutive "Set TR Dequeue pointer" commands got queued right +after each other, and the second one was only partially written when +the controller parsed it, causing the dequeue pointer to be set +to bogus values. This was seen as error messages: + +"Mismatch between completed Set TR Deq Ptr command & xHCI internal state" + +Solution is to add a write memory barrier before writing the cycle bit. + +Cc: +Tested-by: Ross Zwisler +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2930,6 +2930,8 @@ static void queue_trb(struct xhci_hcd *x + trb->field[0] = cpu_to_le32(field1); + trb->field[1] = cpu_to_le32(field2); + trb->field[2] = cpu_to_le32(field3); ++ /* make sure TRB is fully written before giving it to the controller */ ++ wmb(); + trb->field[3] = cpu_to_le32(field4); + + trace_xhci_queue_trb(ring, trb); diff --git a/queue-5.10/xhci-tegra-delay-for-disabling-lfps-detector.patch b/queue-5.10/xhci-tegra-delay-for-disabling-lfps-detector.patch new file mode 100644 index 00000000000..e001453fe3c --- /dev/null +++ b/queue-5.10/xhci-tegra-delay-for-disabling-lfps-detector.patch @@ -0,0 +1,47 @@ +From da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb Mon Sep 17 00:00:00 2001 +From: JC Kuo +Date: Fri, 15 Jan 2021 18:19:07 +0200 +Subject: xhci: tegra: Delay for disabling LFPS detector + +From: JC Kuo + +commit da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb upstream. + +Occasionally, we are seeing some SuperSpeed devices resumes right after +being directed to U3. This commits add 500us delay to ensure LFPS +detector is disabled before sending ACK to firmware. + +[ 16.099363] tegra-xusb 70090000.usb: entering ELPG +[ 16.104343] tegra-xusb 70090000.usb: 2-1 isn't suspended: 0x0c001203 +[ 16.114576] tegra-xusb 70090000.usb: not all ports suspended: -16 +[ 16.120789] tegra-xusb 70090000.usb: entering ELPG failed + +The register write passes through a few flop stages of 32KHz clock domain. +NVIDIA ASIC designer reviewed RTL and suggests 500us delay. + +Cc: stable@vger.kernel.org +Signed-off-by: JC Kuo +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20210115161907.2875631-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-tegra.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -623,6 +623,13 @@ static void tegra_xusb_mbox_handle(struc + enable); + if (err < 0) + break; ++ ++ /* ++ * wait 500us for LFPS detector to be disabled before ++ * sending ACK ++ */ ++ if (!enable) ++ usleep_range(500, 1000); + } + + if (err < 0) {