All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5.10 000/663] 5.10.20-rc1 review
@ 2021-03-01 16:04 Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 001/663] vmlinux.lds.h: add DWARF v5 sections Greg Kroah-Hartman
                   ` (663 more replies)
  0 siblings, 664 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, jonathanh, f.fainelli, stable

This is the start of the stable review cycle for the 5.10.20 release.
There are 663 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.20-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.10.20-rc1

Cong Wang <cong.wang@bytedance.com>
    net_sched: fix RTNL deadlock again caused by request_module()

Takeshi Misawa <jeliantsurux@gmail.com>
    net: qrtr: Fix memory leak in qrtr_tun_open

Vlad Buslov <vladbu@nvidia.com>
    net: sched: fix police ext initialization

Jason A. Donenfeld <Jason@zx2c4.com>
    wireguard: queueing: get rid of per-peer ring buffers

Jason A. Donenfeld <Jason@zx2c4.com>
    wireguard: selftests: test multiple parallel streams

Jason A. Donenfeld <Jason@zx2c4.com>
    net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending

Leon Romanovsky <leon@kernel.org>
    ipv6: silence compilation warning for non-IPV6 builds

Sumit Garg <sumit.garg@linaro.org>
    kgdb: fix to kill breakpoints on initmem after boot

Ville Syrjälä <ville.syrjala@linux.intel.com>
    drm/i915: Reject 446-480MHz HDMI clock on GLK

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: only resize metadata in preresume

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Reinitialize bitset cache before digesting a new writeset

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Use correct value size in equality function of writeset tree

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Fix bitset memory leaks

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Verify the data block size hasn't changed

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Update in-core bitset after committing the metadata

Nikos Tsironis <ntsironis@arrikto.com>
    dm era: Recover committed writeset after crash

Mikulas Patocka <mpatocka@redhat.com>
    dm writecache: fix writing beyond end of underlying device when shrinking

Mikulas Patocka <mpatocka@redhat.com>
    dm writecache: return the exact table values that were set

Mikulas Patocka <mpatocka@redhat.com>
    dm writecache: fix performance degradation in ssd mode

Jeffle Xu <jefflexu@linux.alibaba.com>
    dm table: fix zoned iterate_devices based device capability checks

Jeffle Xu <jefflexu@linux.alibaba.com>
    dm table: fix DAX iterate_devices based device capability checks

Jeffle Xu <jefflexu@linux.alibaba.com>
    dm table: fix iterate_devices based device capability checks

Mikulas Patocka <mpatocka@redhat.com>
    dm: fix deadlock when swapping to encrypted device

Andreas Gruenbacher <agruenba@redhat.com>
    gfs2: Recursive gfs2_quota_hold in gfs2_iomap_end

Andreas Gruenbacher <agruenba@redhat.com>
    gfs2: Lock imbalance on error path in gfs2_recover_one

Bob Peterson <rpeterso@redhat.com>
    gfs2: Don't skip dlm unlock if glock has an lvb

Bob Peterson <rpeterso@redhat.com>
    gfs2: fix glock confusion in function signal_our_withdraw

Masahisa Kojima <masahisa.kojima@linaro.org>
    spi: spi-synquacer: fix set_cs handling

Rasmus Villemoes <rasmus.villemoes@prevas.dk>
    spi: fsl: invert spisel_boot signal on MPC8309

Al Viro <viro@zeniv.linux.org.uk>
    sparc32: fix a user-triggerable oops in clear_user()

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: flush data when enabling checkpoint back

Chao Yu <chao@kernel.org>
    f2fs: enforce the immutable flag on open files

Chao Yu <chao@kernel.org>
    f2fs: fix out-of-repair __setattr_copy()

Huacai Chen <chenhuacai@loongson.cn>
    irqchip/loongson-pch-msi: Use bitmap_zalloc() to allocate bitmap

Johannes Berg <johannes.berg@intel.com>
    um: defer killing userspace on page table update failures

Johannes Berg <johannes.berg@intel.com>
    um: mm: check more comprehensively for stub changes

Cornelia Huck <cohuck@redhat.com>
    virtio/s390: implement virtio-ccw revision 2 correctly

Heiko Carstens <hca@linux.ibm.com>
    s390/vtime: fix inline assembly clobber list

Jens Axboe <axboe@kernel.dk>
    proc: don't allow async path resolution of /proc/thread-self components

Chen Yu <yu.c.chen@intel.com>
    cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    cpufreq: intel_pstate: Change intel_pstate_get_hwp_max() argument

Shawn Guo <shawn.guo@linaro.org>
    cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks

Viresh Kumar <viresh.kumar@linaro.org>
    thermal: cpufreq_cooling: freq_qos_update_request() returns < 0 on error

Chris Wilson <chris@chris-wilson.co.uk>
    kcmp: Support selection of SYS_kcmp without CHECKPOINT_RESTORE

Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
    zonefs: Fix file size of zones in full condition

Namjae Jeon <namjae.jeon@samsung.com>
    exfat: fix shift-out-of-bounds in exfat_fill_super()

Muchun Song <songmuchun@bytedance.com>
    printk: fix deadlock when kernel panic

Tim Harvey <tharvey@gateworks.com>
    mfd: gateworks-gsc: Fix interrupt type

Maxim Kiselev <bigunclemax@gmail.com>
    gpio: pcf857x: Fix missing first interrupt

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: me: add adler lake point LP DID

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: me: add adler lake point S DID

Tomas Winkler <tomas.winkler@intel.com>
    mei: me: emmitsburg workstation DID

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: fix transfer over dma with extended header

Subbaraman Narayanamurthy <subbaram@codeaurora.org>
    spmi: spmi-pmic-arb: Fix hw_irq overflow

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/32s: Add missing call to kuep_lock on syscall entry

Hari Bathini <hbathini@linux.ibm.com>
    powerpc/kexec_file: fix FDT size estimation for kdump kernel

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/32: Preserve cr1 in exception prolog stack check to fix build error

Shirley Her <shirley.her@bayhubtech.com>
    mmc: sdhci-pci-o2micro: Bug fix for SDR104 HW tuning failure

Frank Li <Frank.Li@nxp.com>
    mmc: sdhci-esdhc-imx: fix kernel panic when remove module

Fangrui Song <maskray@google.com>
    module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols

Subbaraman Narayanamurthy <subbaram@codeaurora.org>
    nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer

Paolo Bonzini <pbonzini@redhat.com>
    KVM: nSVM: fix running nested guests when npt=0

Vlastimil Babka <vbabka@suse.cz>
    mm, compaction: make fast_isolate_freepages() stay within zone

Dave Hansen <dave.hansen@linux.intel.com>
    mm/vmscan: restore zone_reclaim_mode ABI

Mike Kravetz <mike.kravetz@oracle.com>
    hugetlb: fix copy_huge_page_from_user contig page struct assumption

Mike Kravetz <mike.kravetz@oracle.com>
    hugetlb: fix update_and_free_page contig page struct assumption

Muchun Song <songmuchun@bytedance.com>
    mm: memcontrol: fix get_active_memcg return value

Muchun Song <songmuchun@bytedance.com>
    mm: memcontrol: fix swap undercounting in cgroup2

NeilBrown <neilb@suse.de>
    x86: fix seq_file iteration for pat/memtype.c

NeilBrown <neilb@suse.de>
    seq_file: document how per-entry resources are managed.

Pan Bian <bianpan2016@163.com>
    fs/affs: release old buffer head on error path

Pan Bian <bianpan2016@163.com>
    mtd: spi-nor: hisi-sfc: Put child node np on error path

Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
    mtd: spi-nor: core: Add erase size check for erase command initialization

Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
    mtd: spi-nor: core: Fix erase type discovery for overlaid region

Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
    mtd: spi-nor: sfdp: Fix wrong erase type bitmask for overlaid region

Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
    mtd: spi-nor: sfdp: Fix last erase region marking

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: etm4x: Handle accesses to TRCSTALLCTLR

Alexander Usyskin <alexander.usyskin@intel.com>
    watchdog: mei_wdt: request stop on unregister

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    watchdog: qcom: Remove incorrect usage of QCOM_WDT_ENABLE_IRQ

Tobias Klauser <tklauser@distanz.ch>
    riscv: Disable KSAN_SANITIZE for vDSO

Will Deacon <will@kernel.org>
    arm64: spectre: Prevent lockdep splat on v4 mitigation enable path

Shaoying Xu <shaoyi@amazon.com>
    arm64 module: set plt* section addresses to 0x0

He Zhe <zhe.he@windriver.com>
    arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing

qiuguorui1 <qiuguorui1@huawei.com>
    arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails

Isaac J. Manjarres <isaacm@codeaurora.org>
    iommu/arm-smmu-qcom: Fix mask extraction for bootloader programmed SMRs

Suzuki K Poulose <suzuki.poulose@arm.com>
    arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55

Masami Hiramatsu <mhiramat@kernel.org>
    kprobes: Fix to delay the kprobes jump optimization

Frederic Weisbecker <frederic@kernel.org>
    entry/kvm: Explicitly flush pending rcuog wakeup before last rescheduling point

Frederic Weisbecker <frederic@kernel.org>
    entry: Explicitly flush pending rcuog wakeup before last rescheduling point

Frederic Weisbecker <frederic@kernel.org>
    rcu/nocb: Trigger self-IPI on late deferred wake up before user resume

Frederic Weisbecker <frederic@kernel.org>
    rcu/nocb: Perform deferred wake up before last idle's need_resched() check

Frederic Weisbecker <frederic@kernel.org>
    rcu: Pull deferred rcuog wake up to rcu_eqs_enter() callers

Cédric Le Goater <clg@kaod.org>
    powerpc/prom: Fix "ibm,arch-vec-5-platform-support" scan

Thomas Gleixner <tglx@linutronix.de>
    x86/entry: Fix instrumentation annotation

Andy Lutomirski <luto@kernel.org>
    x86/fault: Fix AMD erratum #91 errata fixup for user code

Sean Christopherson <seanjc@google.com>
    x86/reboot: Force all cpus to exit VMX root if VMX is supported

Sean Christopherson <seanjc@google.com>
    x86/virt: Eat faults on VMXOFF in reboot flows

Sean Young <sean@mess.org>
    media: smipcie: fix interrupt handling and IR timeout

Lubomir Rintel <lkundrak@v3.sk>
    media: marvell-ccic: power up the device on mclk enable

Pavel Machek <pavel@denx.de>
    media: ipu3-cio2: Fix mbus_code processing in cio2_subdev_set_fmt()

Sean Young <sean@mess.org>
    media: ir_toy: add another IR Droid device

Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
    media: i2c: max9286: fix access to unallocated memory

Jiri Kosina <jkosina@suse.cz>
    floppy: reintroduce O_NDELAY fix

Martin Kaiser <martin@kaiser.cx>
    staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table

Amey Narkhede <ameynarkhede03@gmail.com>
    staging: gdm724x: Fix DMA from stack

Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
    staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c

Dinh Nguyen <dinguyen@kernel.org>
    arm64: dts: agilex: fix phy interface bit shift for gmac1 and gmac2

Frank Wunderlich <frank-w@public-files.de>
    dts64: mt7622: fix slow sd card access

Jiri Bohac <jbohac@suse.cz>
    pstore: Fix typo in compression option name

Sabyrzhan Tasbolatov <snovitoll@gmail.com>
    drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue

Ricky Wu <ricky_wu@realtek.com>
    misc: rtsx: init of rts522a add OCP power off when no card is present

Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
    arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)

Paul Cercueil <paul@crapouillou.net>
    seccomp: Add missing return in non-void function

Krzysztof Kozlowski <krzk@kernel.org>
    soc: samsung: exynos-asv: handle reading revision register error

Marek Szyprowski <m.szyprowski@samsung.com>
    soc: samsung: exynos-asv: don't defer early on not-supported SoCs

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - initialize need_fallback

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - handle BigEndian for cipher

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - IV register does not work on A10 and A13

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - checking sg length is not sufficient

Ard Biesheuvel <ardb@kernel.org>
    crypto: michael_mic - fix broken misalignment handling

Ard Biesheuvel <ardb@kernel.org>
    crypto: aesni - prevent misaligned buffers on the stack

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm64/sha - add missing module aliases

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915/gt: Correct surface base address for renderclear

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915/gt: Flush before changing register state

Filipe Manana <fdmanana@suse.com>
    btrfs: fix extent buffer leak on failure to copy root

Josef Bacik <josef@toxicpanda.com>
    btrfs: account for new extents being deleted in total_bytes_pinned

Josef Bacik <josef@toxicpanda.com>
    btrfs: handle space_info::total_bytes_pinned inside the delayed ref itself

Josef Bacik <josef@toxicpanda.com>
    btrfs: splice remaining dirty_bg's onto the transaction dirty bg list

Josef Bacik <josef@toxicpanda.com>
    btrfs: fix reloc root leak with 0 ref reloc roots on recovery

Josef Bacik <josef@toxicpanda.com>
    btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root

Josef Bacik <josef@toxicpanda.com>
    btrfs: add asserts for deleting backref cache nodes

Josef Bacik <josef@toxicpanda.com>
    btrfs: do not warn if we can't find the reloc root when looking up backref

Josef Bacik <josef@toxicpanda.com>
    btrfs: do not cleanup upper nodes in btrfs_backref_cleanup_node

Jarkko Sakkinen <jarkko@kernel.org>
    KEYS: trusted: Reserve TPM for seal and unseal operations

Jarkko Sakkinen <jarkko@kernel.org>
    KEYS: trusted: Fix migratable=1 failing

Jarkko Sakkinen <jarkko@kernel.org>
    KEYS: trusted: Fix incorrect handling of tpm_get_random()

James Bottomley <James.Bottomley@HansenPartnership.com>
    tpm_tis: Clean up locality release

James Bottomley <James.Bottomley@HansenPartnership.com>
    tpm_tis: Fix check_locality for correct locality acquisition

Gao Xiang <hsiangkao@redhat.com>
    erofs: initialized fields can only be observed after bit is set

Amir Goldstein <amir73il@gmail.com>
    selinux: fix inconsistency between inode_getxattr and inode_listsecurity

Takashi Iwai <tiwai@suse.de>
    ASoC: siu: Fix build error by a wrong const prefix

Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
    drm/rockchip: Require the YTR modifier for AFBC

Heiko Stuebner <heiko@sntech.de>
    drm/panel: kd35t133: allow using non-continuous dsi clock

Andrey Grodzovsky <andrey.grodzovsky@amd.com>
    drm/sched: Cancel and flush all outstanding jobs before finish.

Ville Syrjälä <ville.syrjala@linux.intel.com>
    drm/modes: Switch to 64bit maths to avoid integer overflow

Karol Herbst <kherbst@redhat.com>
    drm/nouveau/kms: handle mDP connectors

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2)

Felix Kuehling <Felix.Kuehling@amd.com>
    drm/amdkfd: Fix recursive lock warnings

Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
    drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1

Eric Bernstein <eric.bernstein@amd.com>
    drm/amd/display: Remove Assert from dcn10_get_dig_frontend

Jan Kokemüller <jan.kokemueller@gmail.com>
    drm/amd/display: Add FPU wrappers to dcn21_validate_bandwidth()

Alex Deucher <alexander.deucher@amd.com>
    Revert "drm/amd/display: Update NV1x SR latency values"

Kai Krakow <kai@kaishome.de>
    bcache: Move journal work to new flush wq

Kai Krakow <kai@kaishome.de>
    bcache: Give btree_io_wq correct semantics again

Kai Krakow <kai@kaishome.de>
    Revert "bcache: Kill btree_io_wq"

Kevin Hao <haokexin@gmail.com>
    Revert "MIPS: Octeon: Remove special handling of CONFIG_MIPS_ELF_APPENDED_DTB=y"

Nathan Chancellor <natechancellor@gmail.com>
    MIPS: VDSO: Use CLANG_FLAGS instead of filtering out '--target='

Aurelien Jarno <aurelien@aurel32.net>
    MIPS: Support binutils configured with --enable-mips-fix-loongson3-llsc=yes

Paul Cercueil <paul@crapouillou.net>
    MIPS: Ingenic: Disable HPTLB for D0 XBurst CPUs too

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup

PeiSen Hou <pshou@realtek.com>
    ALSA: hda/realtek: modify EAPD in the ALC886

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/hdmi: Drop bogus check at closing a stream

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ALSA: hda: Add another CometLake-H PCI ID

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: fireface: fix to parse sync status register of latter protocol

Mathias Kresin <dev@kresin.me>
    phy: lantiq: rcu-usb2: wait after clock enable

Dan Carpenter <dan.carpenter@oracle.com>
    USB: serial: mos7720: fix error code in mos7720_write()

Dan Carpenter <dan.carpenter@oracle.com>
    USB: serial: mos7840: fix error code in mos7840_write()

Johan Hovold <johan@kernel.org>
    USB: serial: pl2303: fix line-speed handling on newer chips

Johan Hovold <johan@kernel.org>
    USB: serial: ftdi_sio: fix FTX sub-integer prescaler

Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt

Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1

Paul Cercueil <paul@crapouillou.net>
    usb: musb: Fix runtime PM race in musb_queue_resume_work

Lech Perczak <lech.perczak@gmail.com>
    USB: serial: option: update interface mapping for ZTE P685M

James Reynolds <jr@memlen.com>
    media: mceusb: Fix potential out-of-bounds shift

Marcos Paulo de Souza <mpdesouza@suse.com>
    Input: i8042 - add ASUS Zenbook Flip to noselftest list

Dan Carpenter <dan.carpenter@oracle.com>
    Input: joydev - prevent potential read overflow in ioctl

Olivier Crête <olivier.crete@ocrete.ca>
    Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S

jeffrey.lin <jeffrey.lin@rad-ic.com>
    Input: raydium_ts_i2c - do not send zero length

Jason Gerecke <killertofu@gmail.com>
    HID: wacom: Ignore attempts to overwrite the touch_max value from HID

Filipe Laíns <lains@riseup.net>
    HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    cpufreq: ACPI: Set cpuinfo.max_freq directly if max boost is known

Qinglang Miao <miaoqinglang@huawei.com>
    ACPI: configfs: add missing check after configfs_register_default_group()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI: property: Fix fwnode string properties matching

Marcin Ślusarz <marcin.slusarz@intel.com>
    soundwire: intel: fix possible crash when no device is detected

Mikulas Patocka <mpatocka@redhat.com>
    blk-settings: align max_sectors on "logical_block_size" boundary

Bart Van Assche <bvanassche@acm.org>
    scsi: sd: Fix Opal support

Finn Thain <fthain@telegraphics.com.au>
    ide/falconide: Fix module unload

Christoph Hellwig <hch@lst.de>
    block: reopen the device in blkdev_reread_part

Johannes Thumshirn <johannes.thumshirn@wdc.com>
    scsi: sd: sd_zbc: Don't pass GFP_NOIO to kvcalloc

Randy Dunlap <rdunlap@infradead.org>
    scsi: bnx2fc: Fix Kconfig warning & CNIC build errors

Zhenzhong Duan <zhenzhong.duan@gmail.com>
    csky: Fix a size determination in gpr_get()

Josef Bacik <josef@toxicpanda.com>
    proc: use kvzalloc for our kernel buffer

Miaohe Lin <linmiaohe@huawei.com>
    mm/rmap: fix potential pte_unmap on an not mapped pte

Dan Williams <dan.j.williams@intel.com>
    mm: fix memory_failure() handling of dax-namespace metadata

Rik van Riel <riel@surriel.com>
    mm,thp,shmem: make khugepaged obey tmpfs mount flags

Mårten Lindahl <martenli@axis.com>
    i2c: exynos5: Preserve high speed master code

Maxime Ripard <maxime@cerno.tech>
    i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition

Marc Zyngier <maz@kernel.org>
    arm64: Add missing ISB after invalidating TLB in __primary_switch

Sean Christopherson <seanjc@google.com>
    KVM: x86/mmu: Expand collapsible SPTE zap for TDP MMU to ZONE_DEVICE and HugeTLB pages

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Intercept INVPCID when it's disabled to inject #UD

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4: Fixes for nfs4_bitmask_adjust()

Heiner Kallweit <hkallweit1@gmail.com>
    r8169: fix jumbo packet handling on RTL8168e

Wonhyuk Yang <vvghjk1234@gmail.com>
    mm/compaction: fix misbehaviors of fast_find_migrateblock()

Chen Wandun <chenwandun@huawei.com>
    mm/hugetlb: suppress wrong warning info when alloc gigantic page

Miaohe Lin <linmiaohe@huawei.com>
    mm/hugetlb: fix potential double free in hugetlb_register_node() error path

Miaohe Lin <linmiaohe@huawei.com>
    mm/memory.c: fix potential pte_unmap_unlock pte error

Muchun Song <songmuchun@bytedance.com>
    mm: memcontrol: fix slub memory accounting

Muchun Song <songmuchun@bytedance.com>
    mm: memcontrol: fix NR_ANON_THPS accounting in charge moving

Dan Carpenter <dan.carpenter@oracle.com>
    ocfs2: fix a use after free on error

Jason A. Donenfeld <Jason@zx2c4.com>
    wireguard: kconfig: use arm chacha even with no neon

Jason A. Donenfeld <Jason@zx2c4.com>
    wireguard: device: do not generate ICMP for non-IP packets

Taehee Yoo <ap420073@gmail.com>
    vxlan: move debug check after netdev unregister

Chen-Yu Tsai <wens@csie.org>
    PCI: rockchip: Make 'ep-gpios' DT property optional

Chuhong Yuan <hslester96@gmail.com>
    net/mlx4_core: Add missed mlx4_free_cmd_mailbox()

Song, Yoong Siang <yoong.siang.song@intel.com>
    net: stmmac: fix CBS idleslope and sendslope calculation

Henry Tieman <henry.w.tieman@intel.com>
    ice: update the number of available RSS queues

Dave Ertman <david.m.ertman@intel.com>
    ice: Fix state bits on LLDP mode switch

Brett Creeley <brett.creeley@intel.com>
    ice: Account for port VLAN in VF max packet size calculation

Dave Ertman <david.m.ertman@intel.com>
    ice: report correct max number of TCs

Alex Williamson <alex.williamson@redhat.com>
    vfio/type1: Use follow_pte()

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    pwm: iqs620a: Fix overflow and optimize calculations

Dan Carpenter <dan.carpenter@oracle.com>
    octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()

Mateusz Palczewski <mateusz.palczewski@intel.com>
    i40e: Fix add TC filter for IPv6

Andreas Oetken <andreas.oetken@siemens.com>
    nios2: fixed broken sys_clone syscall

Jann Horn <jannh@google.com>
    Take mmap lock in cacheflush syscall

Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
    i40e: Fix VFs not created

Mateusz Palczewski <mateusz.palczewski@intel.com>
    i40e: Fix addition of RX filters after enabling FW LLDP agent

Mateusz Palczewski <mateusz.palczewski@intel.com>
    i40e: Fix overwriting flow control settings during driver loading

Mateusz Palczewski <mateusz.palczewski@intel.com>
    i40e: Add zero-initialization of AQ command structures

Slawomir Laba <slawomirx.laba@intel.com>
    i40e: Fix flow for IPv6 next header (extension header)

Krzysztof Wilczyński <kw@linux.com>
    PCI: cadence: Fix DMA range mapping early return error

Russell King <rmk+kernel@armlinux.org.uk>
    PCI: pci-bridge-emul: Fix array overruns, improve safety

Shiyang Ruan <ruansy.fnst@cn.fujitsu.com>
    device-dax: Fix default return code of range_parse()

Magnum Shan <magnum.shan@unisoc.com>
    mailbox: sprd: correct definition of SPRD_OUTBOX_FIFO_FULL

Geert Uytterhoeven <geert@linux-m68k.org>
    ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it

Bard Liao <yung-chuan.liao@linux.intel.com>
    regmap: sdw: use _no_pm functions in regmap_read/write

Tzung-Bi Shih <tzungbi@google.com>
    remoteproc/mediatek: acknowledge watchdog IRQ after handled

Jonathan Marek <jonathan@marek.ca>
    misc: fastrpc: fix incorrect usage of dma_map_sgtable

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    soundwire: bus: fix confusion on device used by pm_runtime

Bard Liao <yung-chuan.liao@linux.intel.com>
    soundwire: export sdw_write/read_no_pm functions

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    soundwire: bus: use sdw_write_no_pm when setting the bus scale registers

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    soundwire: bus: use sdw_update_no_pm when initializing a device

Ahmad Fatoum <a.fatoum@pengutronix.de>
    nvmem: core: skip child nodes not matching binding

Dan Carpenter <dan.carpenter@oracle.com>
    nvmem: core: Fix a resource leak on error in nvmem_add_cells_from_of()

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: etm4x: Skip accessing TRCPDCR in save/restore

Geert Uytterhoeven <geert+renesas@glider.be>
    phy: USB_LGM_PHY should depend on X86

Theodore Ts'o <tytso@mit.edu>
    ext4: fix potential htree index checksum corruption

Max Gurtovoy <mgurtovoy@nvidia.com>
    vfio-pci/zdev: fix possible segmentation fault issue

Keqian Zhu <zhukeqian1@huawei.com>
    vfio/iommu_type1: Fix some sanity checks in detach group

Keqian Zhu <zhukeqian1@huawei.com>
    vfio/iommu_type1: Populate full dirty when detach non-pinned group

Judy Hsiao <judyhsiao@google.com>
    drm/msm/dp: trigger unplug event in msm_dp_display_disable

Eric Anholt <eric@anholt.net>
    drm/msm: Fix races managing the OOB state for timestamp vs timestamps.

Eric Anholt <eric@anholt.net>
    drm/msm: Fix race of GPU init vs timestamp power management.

Iskren Chernev <iskren.chernev@gmail.com>
    drm/msm/mdp5: Fix wait-for-commit for cmd panels

Konrad Dybcio <konrad.dybcio@somainline.org>
    drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)

Iskren Chernev <iskren.chernev@gmail.com>
    drm/msm: Fix MSM_INFO_GET_IOVA with carveout

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: hbm: call mei_set_devstate() on hbm stop response

Heiner Kallweit <hkallweit1@gmail.com>
    PCI: Align checking of syscall user config accessors

Jorgen Hansen <jhansen@vmware.com>
    VMCI: Use set_page_dirty_lock() when unregistering guest memory

Pan Bian <bianpan2016@163.com>
    PCI: xilinx-cpm: Fix reference count leak on error path

Simon South <simon@simonsouth.net>
    pwm: rockchip: Eliminate potential race condition when probing

Simon South <simon@simonsouth.net>
    pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()

Simon South <simon@simonsouth.net>
    pwm: rockchip: Enable APB clock during register access while probing

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    soundwire: cadence: fix ACK/NAK handling

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    soundwire: debugfs: use controller id instead of link_id

Marek Vasut <marek.vasut+renesas@gmail.com>
    PCI: rcar: Always allocate MSI addresses in 32bit space

Aswath Govindraju <a-govindraju@ti.com>
    misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users

Dan Carpenter <dan.carpenter@oracle.com>
    phy: cadence-torrent: Fix error code in cdns_torrent_phy_probe()

Chris Ruehl <chris.ruehl@gtsys.com.hk>
    phy: rockchip-emmc: emmc_phy_init() always return 0

Aswath Govindraju <a-govindraju@ti.com>
    misc: eeprom_93xx46: Fix module alias to enable module autoprobe

Randy Dunlap <rdunlap@infradead.org>
    ARM: 9065/1: OABI compat: fix build when EPOLL is not enabled

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: zinitix - fix return type of zinitix_init_touch()

Randy Dunlap <rdunlap@infradead.org>
    sparc: fix led.c driver when PROC_FS is not enabled

Randy Dunlap <rdunlap@infradead.org>
    sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set

Dan Carpenter <dan.carpenter@oracle.com>
    Input: elo - fix an error code in elo_connect()

Namhyung Kim <namhyung@kernel.org>
    perf test: Fix unaligned access in sample parsing test

Adrian Hunter <adrian.hunter@intel.com>
    perf intel-pt: Fix IPC with CYC threshold

Adrian Hunter <adrian.hunter@intel.com>
    perf intel-pt: Fix premature IPC

Adrian Hunter <adrian.hunter@intel.com>
    perf intel-pt: Fix missing CYC processing in PSB

Yang Jihong <yangjihong1@huawei.com>
    perf record: Fix continue profiling after draining the buffer

Dan Carpenter <dan.carpenter@oracle.com>
    Input: sur40 - fix an error code in sur40_probe()

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Do not pass a valid pointer to PTR_ERR()

Gioh Kim <gi-oh.kim@cloud.ionos.com>
    RDMA/rtrs-srv-sysfs: fix missing put_device

Gioh Kim <gi-oh.kim@cloud.ionos.com>
    RDMA/rtrs-srv: fix memory leak by missing kobject free

Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
    RDMA/rtrs: Only allow addition of path to an already established session

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Fix stack-out-of-bounds

Avihai Horon <avihaih@nvidia.com>
    RDMA/ucma: Fix use-after-free bug in ucma_create_uevent

Lang Cheng <chenglang@huawei.com>
    RDMA/hns: Fixes missing error code of CMDQ

Jeff Layton <jlayton@kernel.org>
    ceph: fix flush_snap logic after putting caps

Chuck Lever <chuck.lever@oracle.com>
    svcrdma: Hold private mutex while invoking rdma_accept()

J. Bruce Fields <bfields@redhat.com>
    nfsd: register pernet ops last, unregister first

Nicholas Fraser <nfraser@codeweavers.com>
    perf symbols: Fix return value when loading PE DSO

John Ogness <john.ogness@linutronix.de>
    printk: avoid prb_first_valid_seq() where possible

Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
    spi: Skip zero-length transfers in spi_transfer_one_message()

Kees Cook <keescook@chromium.org>
    spi: dw: Avoid stack content exposure

Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
    regulator: bd718x7, bd71828, Fix dvs voltage levels

Dmitry Safonov <0x7f454c46@gmail.com>
    perf symbols: Use (long) for iterator for bfd symbols

Tom Zanussi <zanussi@kernel.org>
    selftests/ftrace: Update synthetic event syntax errors

Ryan Chen <ryan_chen@aspeedtech.com>
    clk: aspeed: Fix APLL calculate formula from ast2600-A2

Jonathan Marek <jonathan@marek.ca>
    regulator: qcom-rpmh: fix pm8009 ldo7

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/kuap: Restore AMR after replaying soft interrupts

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/uaccess: Avoid might_fault() when user access is enabled

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    spi: pxa2xx: Fix the controller numbering for Wildcat Point

Michael Tretter <m.tretter@pengutronix.de>
    clk: divider: fix initialization with parent_hw

Lijun Ou <oulijun@huawei.com>
    RDMA/hns: Disable RQ inline by default

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Fix type of sq_signal_bits

Kamal Heib <kamalheib1@gmail.com>
    RDMA/siw: Fix calculation of tx_valid_cpus size

Wenpeng Liang <liangwenpeng@huawei.com>
    RDMA/hns: Fixed wrong judgments in the goto branch

John Stultz <john.stultz@linaro.org>
    kselftests: dmabuf-heaps: Fix Makefile's inclusion of the kernel's usr/include dir

Daniel Latypov <dlatypov@google.com>
    kunit: tool: fix unit test cleanup handling

AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
    clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/8xx: Fix software emulation interrupt

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/dlpar: handle ibm, configure-connector delay status

Dan Carpenter <dan.carpenter@oracle.com>
    mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

Arnd Bergmann <arnd@arndb.de>
    mfd: altera-sysmgr: Fix physical address storing more

Alain Volmat <alain.volmat@foss.st.com>
    spi: stm32: properly handle 0 byte transfer

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Correct skb on loopback path

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Fix coding error in rxe_recv.c

John Garry <john.garry@huawei.com>
    perf vendor events arm64: Fix Ampere eMag event typo

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf tools: Fix DSO filtering when not finding a map for a sampled address

David Gow <davidgow@google.com>
    rtc: zynqmp: depend on HAS_IOMEM

Steven Rostedt (VMware) <rostedt@goodmis.org>
    tracepoint: Do not fail unregistering a probe due to memory failure

Parav Pandit <parav@nvidia.com>
    IB/cm: Avoid a loop when device has 255 ports

Parav Pandit <parav@nvidia.com>
    IB/mlx5: Return appropriate error code instead of ENOMEM

Douglas Anderson <dianders@chromium.org>
    iommu: Properly pass gfp_t in _iommu_map() to avoid atomic sleeping

Yong Wu <yong.wu@mediatek.com>
    iommu: Move iotlb_sync_map out from __iommu_map

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    amba: Fix resource leak for drivers without .remove

Roja Rani Yarubandi <rojay@codeaurora.org>
    i2c: i2c-qcom-geni: Add shutdown callback for i2c

Roja Rani Yarubandi <rojay@codeaurora.org>
    i2c: qcom-geni: Store DMA mapping data in geni_i2c_dev struct

Vladimir Murzin <vladimir.murzin@arm.com>
    ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores

Takeshi Saito <takeshi.saito.xv@renesas.com>
    mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to 128-bytes

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    mmc: sdhci-sprd: Fix some resource leaks in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    mmc: owl-mmc: Fix a resource leak in an error handling path and in the remove function

Pingfan Liu <kernelfans@gmail.com>
    powerpc/time: Enable sched clock for irqtime

Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
    powerpc/sstep: Fix incorrect return from analyze_instr()

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/47x: Disable 256k page size

Cédric Le Goater <clg@kaod.org>
    KVM: PPC: Make the VMX instruction emulation routines static

Shay Drory <shayd@nvidia.com>
    IB/umad: Return EPOLLERR in case of when device disassociated

Shay Drory <shayd@nvidia.com>
    IB/umad: Return EIO in case of when device disassociated

Yong Wu <yong.wu@mediatek.com>
    iommu: Switch gather->end to the inclusive end

Dan Carpenter <dan.carpenter@oracle.com>
    scsi: lpfc: Fix ancient double free

Josh Poimboeuf <jpoimboe@redhat.com>
    objtool: Fix ".cold" section suffix check for newer versions of GCC

Josh Poimboeuf <jpoimboe@redhat.com>
    objtool: Fix retpoline detection in asm code

Josh Poimboeuf <jpoimboe@redhat.com>
    objtool: Fix error handling for STD/CLD warnings

Geert Uytterhoeven <geert@linux-m68k.org>
    auxdisplay: ht16k33: Fix refresh rate handling

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    watchdog: intel-mid_wdt: Postpone IRQ handler registration till SCU is ready

Pan Bian <bianpan2016@163.com>
    isofs: release buffer head before return

Hans de Goede <hdegoede@redhat.com>
    regulator: core: Avoid debugfs: Directory ... already present! error

Dmitry Osipenko <digetx@gmail.com>
    power: supply: smb347-charger: Fix interrupt usage if interrupt is unavailable

Samuel Holland <samuel@sholland.org>
    power: supply: axp20x_usb_power: Init work before enabling IRQs

Krzysztof Kozlowski <krzk@kernel.org>
    regulator: s5m8767: Drop regulators OF node reference

Pan Bian <bianpan2016@163.com>
    spi: atmel: Put allocated master before return

Pan Bian <bianpan2016@163.com>
    regulator: s5m8767: Fix reference count leak

David Howells <dhowells@redhat.com>
    certs: Fix blacklist flag type confusion

Gabriel Krisman Bertazi <krisman@collabora.com>
    watch_queue: Drop references to /dev/watch_queue

Pan Bian <bianpan2016@163.com>
    regulator: axp20x: Fix reference cout leak

Evan Benn <evanbenn@chromium.org>
    platform/chrome: cros_ec_proto: Add LID and BATTERY to default mask

Evan Benn <evanbenn@chromium.org>
    platform/chrome: cros_ec_proto: Use EC_HOST_EVENT_MASK not BIT

Andre Przywara <andre.przywara@arm.com>
    clk: sunxi-ng: h6: Fix clock divider range on some clocks

Parav Pandit <parav@nvidia.com>
    IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex

Yishai Hadas <yishaih@nvidia.com>
    RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation

Guido Günther <agx@sigxcpu.org>
    spi: imx: Don't print error on -EPROBEDEFER

Tom Rix <trix@redhat.com>
    clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined

Arnd Bergmann <arnd@arndb.de>
    clocksource/drivers/ixp4xx: Select TIMER_OF when needed

Randy Dunlap <rdunlap@infradead.org>
    power: supply: fix sbs-charger build, needs REGMAP_I2C

Dave Jiang <dave.jiang@intel.com>
    dmaengine: idxd: set DMA channel to be private

Bartosz Golaszewski <bgolaszewski@baylibre.com>
    rtc: s5m: select REGMAP_I2C

Claudiu Beznea <claudiu.beznea@microchip.com>
    power: reset: at91-sama5d2_shdwc: fix wkupdbc mask

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Init wr_cnt as 1

Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
    RDMA/rtrs-clt: Refactor the failure cases in alloc_clt

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Fix missing wr_cqe

Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
    RDMA/rtrs: Call kobject_put in the failure path

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-clt: Set mininum limit when create QP

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Use sysfs_remove_file_self for disconnect

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs-srv: Release lock before call into close_sess

Jack Wang <jinpu.wang@cloud.ionos.com>
    RDMA/rtrs: Extend ibtrs_cq_qp_create

Nicolas Boichat <drinkcat@chromium.org>
    of/fdt: Make sure no-map does not remove already reserved regions

KarimAllah Ahmed <karahmed@amazon.de>
    fdt: Properly handle "no-map" field in the memory region

Colin Ian King <colin.king@canonical.com>
    power: supply: cpcap-charger: Fix power_supply_put on null battery pointer

Tony Lindgren <tony@atomide.com>
    power: supply: cpcap-battery: Fix missing power_supply_put()

Tony Lindgren <tony@atomide.com>
    power: supply: cpcap-charger: Fix missing power_supply_put()

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    mfd: bd9571mwv: Use devm_mfd_add_devices()

Ferry Toth <ftoth@exalondelft.nl>
    dmaengine: hsu: disable spurious interrupt

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    dmaengine: owl-dma: Fix a resource leak in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    dmaengine: fsldma: Fix a resource leak in the remove function

Bernard Metzler <bmt@zurich.ibm.com>
    RDMA/siw: Fix handling of zero-sized Read and Receive Queues.

Randy Dunlap <rdunlap@infradead.org>
    HID: core: detect and skip invalid inputs to snto32()

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: renesas: r8a779a0: Fix parent of CBFUSA clock

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: renesas: r8a779a0: Remove non-existent S2 clock

Andre Przywara <andre.przywara@arm.com>
    clk: sunxi-ng: h6: Fix CEC clock

Pratyush Yadav <p.yadav@ti.com>
    spi: cadence-quadspi: Abort read if dummy cycles required are too many

Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
    i2c: iproc: handle master read request

Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
    i2c: iproc: update slave isr mask (ISR_MASK_SLAVE)

Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
    i2c: iproc: handle only slave interrupts which are enabled

Jan Kara <jack@suse.cz>
    quota: Fix memory leak when handling corrupted quota file

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    arm64: dts: qcom: qrb5165-rb5: fix pm8009 regulators

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    regulator: qcom-rpmh-regulator: add pm8009-1 chip revision

Po-Hsu Lin <po-hsu.lin@canonical.com>
    selftests/powerpc: Make the test check in eeh-basic.sh posix compliant

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: clk-pll: propagate the error from meson_clk_pll_set_rate()

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: clk-pll: make "ret" a signed integer

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL

Tony Lindgren <tony@atomide.com>
    power: supply: cpcap: Add missing IRQF_ONESHOT to fix regression

Zhang Qilong <zhangqilong3@huawei.com>
    HSI: Fix PM usage counter unbalance in ssi_hw_init

Eric W. Biederman <ebiederm@xmission.com>
    capabilities: Don't allow writing ambiguous v3 file capabilities

Nirmoy Das <nirmoy.das@amd.com>
    drm/amdgpu/display: remove hdcp_srm sysfs on device removal

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    smp: Process pending softirqs in flush_smp_call_function_from_idle()

Geert Uytterhoeven <geert+renesas@glider.be>
    irqchip/imx: IMX_INTMUX should not default to y, unconditionally

Wang ShaoBo <bobo.shaobowang@huawei.com>
    ubifs: Fix error return code in alloc_wbufs()

Arnd Bergmann <arnd@arndb.de>
    ubifs: replay: Fix high stack usage, again

Dinghao Liu <dinghao.liu@zju.edu.cn>
    ubifs: Fix memleak in ubifs_init_authentication

Tom Rix <trix@redhat.com>
    jffs2: fix use after free in jffs2_sum_write_data()

Colin Ian King <colin.king@canonical.com>
    fs/jfs: fix potential integer overflow on shift of a int

Sameer Pujar <spujar@nvidia.com>
    ASoC: simple-card-utils: Fix device module clock

Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
    ima: Free IMA measurement buffer after kexec syscall

Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
    ima: Free IMA measurement buffer on error

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: SOF: sof-pci-dev: add missing Up-Extreme quirk

Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
    nvmet: set status to 0 in case for invalid nsid

Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
    nvmet: remove extra variable in identify ns

Keith Busch <kbusch@kernel.org>
    nvme-multipath: set nr_zones for zoned namespaces

Sagi Grimberg <sagi@grimberg.me>
    nvmet-tcp: fix potential race of tcp socket closing accept_work

Sagi Grimberg <sagi@grimberg.me>
    nvmet-tcp: fix receive data digest calculation for multiple h2cdata PDUs

Hao Xu <haoxu@linux.alibaba.com>
    io_uring: fix possible deadlock in io_uring_poll

Daniele Alessandrelli <daniele.alessandrelli@intel.com>
    crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()

Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
    hwrng: timeriomem - Fix cooldown period calculation

Imre Deak <imre.deak@intel.com>
    drm/dp_mst: Don't cache EDIDs for physical ports

Qinglang Miao <miaoqinglang@huawei.com>
    drm/lima: fix reference leak in lima_pm_busy

Maxime Ripard <maxime@cerno.tech>
    drm/vc4: hdmi: Update the CEC clock divider on HSM rate change

Maxime Ripard <maxime@cerno.tech>
    drm/vc4: hdmi: Compute the CEC clock divider from the clock rate

Dom Cobley <popcornmix@gmail.com>
    drm/vc4: hdmi: Restore cec physical address on reconnect

Dom Cobley <popcornmix@gmail.com>
    drm/vc4: hdmi: Fix up CEC registers

Dom Cobley <popcornmix@gmail.com>
    drm/vc4: hdmi: Fix register offset with longer CEC messages

Dom Cobley <popcornmix@gmail.com>
    drm/vc4: hdmi: Move hdmi reset to bind

Harald Freudenberger <freude@linux.ibm.com>
    s390/zcrypt: return EIO when msg retry limit reached

Sean Christopherson <seanjc@google.com>
    KVM: x86: Restore all 64 bits of DR6 and DR7 during RSM on x86-64

Qu Wenruo <wqu@suse.com>
    btrfs: fix double accounting of ordered extent for subpage case in btrfs_invalidapge

Zhihao Cheng <chengzhihao1@huawei.com>
    btrfs: clarify error returns values in __load_free_space_cache

Hui Wang <hui.wang@canonical.com>
    ASoC: SOF: debug: Fix a potential issue on string buffer termination

Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
    ASoC: rt5682: Fix panic in rt5682_jack_detect_handler happening during system shutdown

Jun Nie <jun.nie@linaro.org>
    ASoC: qcom: lpass: Fix i2s ctl register bit map

Peter Zijlstra <peterz@infradead.org>
    locking/lockdep: Avoid unmatched unlock

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A3E

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A5E

Andrea Parri (Microsoft) <parri.andrea@gmail.com>
    Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()

Sasha Levin <sashal@kernel.org>
    drm/mediatek: Fix aal size config

Yongqiang Niu <yongqiang.niu@mediatek.com>
    drm/mediatek: Check if fb is null

Sean Christopherson <seanjc@google.com>
    KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading PDPTRs

Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
    ASoC: qcom: Fix typo error in HDMI regmap config callbacks

Dehe Gu <gudehe@huawei.com>
    f2fs: fix a wrong condition in __submit_bio

Dan Carpenter <dan.carpenter@oracle.com>
    drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()

Yi Chen <chenyi77@huawei.com>
    f2fs: fix to avoid inconsistent quota data

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    mtd: parsers: afs: Fix freeing the part name memory in failure

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    ASoC: codecs: add missing max_register in regmap config

Sebastian Reichel <sre@kernel.org>
    ASoC: cpcap: fix microphone timeslot mask

Florian Fainelli <f.fainelli@gmail.com>
    ata: ahci_brcm: Add back regulators management

Will Deacon <will@kernel.org>
    mm: proc: Invalidate TLB after clearing soft-dirty page state

Frantisek Hrbata <frantisek@hrbata.com>
    drm/nouveau: bail out of nouveau_channel_new if channel init fails

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Fix ctr(aes) on SEC1

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size error)

Dan Carpenter <dan.carpenter@oracle.com>
    mtd: parser: imagetag: fix error codes in bcm963xx_parse_imagetag_partitions()

Robin Murphy <robin.murphy@arm.com>
    perf/arm-cmn: Move IRQs when migrating context

Robin Murphy <robin.murphy@arm.com>
    perf/arm-cmn: Fix PMU instance naming

Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    ASoC: SOF: Intel: hda: cancel D0i3 work during runtime suspend

Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
    ASoC: qcom: lpass-cpu: Remove bit clock state check

Chao Yu <chao@kernel.org>
    f2fs: compress: fix potential deadlock

Qais Yousef <qais.yousef@arm.com>
    sched/eas: Don't update misfit status if the task is pinned

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values

Tom Rix <trix@redhat.com>
    media: pxa_camera: declare variable when DEBUG is defined

Tom Rix <trix@redhat.com>
    media: mtk-vcodec: fix argument used when DEBUG is defined

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: cx25821: Fix a bug when reallocating some dma memory

Luo Meng <luomeng12@huawei.com>
    media: qm1d1c0042: fix error return code in qm1d1c0042_init()

Dan Carpenter <dan.carpenter@oracle.com>
    media: atomisp: Fix a buffer overflow in debug code

Daniel W. S. Almeida <dwlsalmeida@gmail.com>
    media: vidtv: psi: fix missing crc for PMT

Joe Perches <joe@perches.com>
    media: lmedm04: Fix misuse of comma

Daniel Scally <djrscally@gmail.com>
    media: software_node: Fix refcounts in software_node_get_next_child()

Mario Kleiner <mario.kleiner.de@gmail.com>
    drm/amd/display: Fix HDMI deep color output for DCE 6-11.

Mario Kleiner <mario.kleiner.de@gmail.com>
    drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth reduction.

Finn Thain <fthain@telegraphics.com.au>
    macintosh/adb-iop: Use big-endian autopoll mask

Pan Bian <bianpan2016@163.com>
    bsg: free the request before return error code

Guchun Chen <guchun.chen@amd.com>
    drm/amdgpu: toggle on DF Cstate after finishing xgmi injection

Qinglang Miao <miaoqinglang@huawei.com>
    drm/tegra: Fix reference leak when pm_runtime_get_sync() fails

Nathan Chancellor <natechancellor@gmail.com>
    MIPS: Compare __SYNC_loongson3_war against 0

Alexander Lobakin <alobakin@pm.me>
    MIPS: properly stop .eh_frame generation

Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
    media: ti-vpe: cal: fix write to unallocated memory

Rui Miguel Silva <rmfrfs@gmail.com>
    media: imx7: csi: Fix pad link validation

Fabio Estevam <festevam@gmail.com>
    media: imx7: csi: Fix regression for parallel cameras on i.MX6UL

Giulio Benetti <giulio.benetti@micronovasrl.com>
    drm/sun4i: tcon: fix inverted DCLK polarity

Xuewen Yan <xuewen.yan@unisoc.com>
    sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue

Jiri Olsa <jolsa@kernel.org>
    crypto: bcm - Rename struct device_private to bcm_device_private

Dinghao Liu <dinghao.liu@zju.edu.cn>
    evm: Fix memleak in init_desc

Stephan Gerhold <stephan@gerhold.net>
    ASoC: qcom: qdsp6: Move frontend AIFs to q6asm-dai

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: cs42l56: fix up error handling in probe

Zhang Changzhong <zhangchangzhong@huawei.com>
    media: aspeed: fix error return code in aspeed_video_setup_video()

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: tm6000: Fix memleak in tm6000_start_stream

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: media/pci: Fix memleak in empress_init

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: em28xx: Fix use-after-free in em28xx_alloc_urbs

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: vsp1: Fix an error handling path in the probe function

Dan Carpenter <dan.carpenter@oracle.com>
    media: camss: missing error code in msm_video_register()

Zhang Changzhong <zhangchangzhong@huawei.com>
    media: mtk-vcodec: fix error return code in vdec_vp9_decode()

Ezequiel Garcia <ezequiel@collabora.com>
    media: imx: Fix csc/scaler unregister

Ezequiel Garcia <ezequiel@collabora.com>
    media: imx: Unregister csc/scaler only if registered

Jacopo Mondi <jacopo@jmondi.org>
    media: i2c: ov5670: Fix PIXEL_RATE minimum value

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    media: ipu3-cio2: Build only for x86

Simon Ser <contact@emersion.fr>
    drm/fourcc: fix Amlogic format modifier masks

Chia-I Wu <olvaffe@gmail.com>
    drm/virtio: make sure context is created in gem open

Nathan Chancellor <natechancellor@gmail.com>
    MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0

Nathan Chancellor <natechancellor@gmail.com>
    MIPS: c-r4k: Fix section mismatch for loongson2_sc_init

Chenyang Li <lichenyang@loongson.cn>
    drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Fix leak of CMM platform device reference

Wang Xiaojun <wangxiaojun11@huawei.com>
    drm: rcar-du: Fix the return check of of_parse_phandle and of_find_device_by_node

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Fix crash when using LVDS1 clock for CRTC

Qinglang Miao <miaoqinglang@huawei.com>
    drm: rcar-du: Fix PM reference leak in rcar_cmm_enable()

Marco Elver <elver@google.com>
    kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()

Dan Carpenter <dan.carpenter@oracle.com>
    media: allegro: Fix use after free on error

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    hwrng: ingenic - Fix a resource leak in an error handling path

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm64/aes-ce - really hide slower algos when faster ones are enabled

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - fix kmap usage

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun4i-ss - linearize buffers content must be kept

Maxime Ripard <maxime@cerno.tech>
    drm/vc4: hdmi: Take into account the clock doubling flag in atomic_check

Guido Günther <agx@sigxcpu.org>
    drm/panel: mantix: Tweak init sequence

Chuhong Yuan <hslester96@gmail.com>
    drm/fb-helper: Add missed unlocks in setcmap_legacy()

Dan Carpenter <dan.carpenter@oracle.com>
    gma500: clean up error handling in init

Jialin Zhang <zhangjialin11@huawei.com>
    drm/gma500: Fix error return code in psb_driver_load()

Randy Dunlap <rdunlap@infradead.org>
    fbdev: aty: SPARC64 requires FB_ATY_CT

Linus Torvalds <torvalds@linux-foundation.org>
    tty: implement read_iter

Linus Torvalds <torvalds@linux-foundation.org>
    tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: enetc: fix destroyed phylink dereference during unbind

Maxime Chevallier <maxime.chevallier@bootlin.com>
    net: mvneta: Remove per-cpu queue mapping for Armada 3700

Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
    net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP

Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
    net: amd-xgbe: Reset link when the link never comes back

Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
    net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning

Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
    net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout

Bjarni Jonasson <bjarni.jonasson@microchip.com>
    net: phy: mscc: adding LCPLL reset to VSC8514

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: felix: don't deinitialize unused ports

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: felix: perform teardown in reverse order of setup

Lijun Pan <ljp@linux.ibm.com>
    ibmvnic: skip send_request_unmap for timeout reset

Lijun Pan <ljp@linux.ibm.com>
    ibmvnic: add memory barrier to protect long term buffer

Ilya Leoshkevich <iii@linux.ibm.com>
    bpf: Clear subreg_def for global function return values

Colin Ian King <colin.king@canonical.com>
    b43: N-PHY: Fix the update of coef for the PHY revision >= 3case

Ayush Sawal <ayush.sawal@chelsio.com>
    cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds

Robert Hancock <robert.hancock@calian.com>
    net: axienet: Handle deferred probe on clock properly

Eric Dumazet <edumazet@google.com>
    tcp: fix SO_RCVLOWAT related hangs under mem pressure

Matthieu Baerts <matthieu.baerts@tessares.net>
    selftests: mptcp: fix ACKRX debug message

Jesper Dangaard Brouer <brouer@redhat.com>
    bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx

Jun'ichi Nomura <junichi.nomura@nec.com>
    bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation

Yonghong Song <yhs@fb.com>
    bpf: Fix an unitialized value in bpf_iter

Martin KaFai Lau <kafai@fb.com>
    libbpf: Ignore non function pointer member in struct_ops

Colin Ian King <colin.king@canonical.com>
    mac80211: fix potential overflow when multiplying to u32 integers

Moshe Shemesh <moshe@nvidia.com>
    net/mlx5e: Check tunnel offload is required before setting SWP

Oz Shlomo <ozsh@nvidia.com>
    net/mlx5e: CT: manage the lifetime of the ct entry object

Shay Drory <shayd@nvidia.com>
    net/mlx5: Disable devlink reload for lag devices

Shay Drory <shayd@nvidia.com>
    net/mlx5: Disallow RoCE on lag device

Shay Drory <shayd@nvidia.com>
    net/mlx5: Disallow RoCE on multi port slave device

Shay Drory <shayd@nvidia.com>
    net/mlx5: Disable devlink reload for multi port slave device

Maxim Mikityanskiy <maximmi@mellanox.com>
    net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context

Maxim Mikityanskiy <maximmi@mellanox.com>
    net/mlx5e: Replace synchronize_rcu with synchronize_net

Shay Drory <shayd@nvidia.com>
    net/mlx5: Fix health error state handling

Maxim Mikityanskiy <maximmi@mellanox.com>
    net/mlx5e: Change interrupt moderation channel params also when channels are closed

Maxim Mikityanskiy <maximmi@mellanox.com>
    net/mlx5e: Don't change interrupt moderation params when DIM is enabled

Heiner Kallweit <hkallweit1@gmail.com>
    net: phy: consider that suspend2ram may cut off PHY power

Ioana Ciornei <ioana.ciornei@nxp.com>
    dpaa2-eth: fix memory leak in XDP_REDIRECT

Juergen Gross <jgross@suse.com>
    xen/netback: fix spurious event detection for common event case

Vasundhara Volam <vasundhara-v.volam@broadcom.com>
    bnxt_en: Fix devlink info's stored fw.psid version format.

Edwin Peer <edwin.peer@broadcom.com>
    bnxt_en: reverse order of TX disable and carrier off

Sukadev Bhattiprolu <sukadev@linux.ibm.com>
    ibmvnic: Set to CLOSED state even on error

Björn Töpel <bjorn.topel@intel.com>
    selftests/bpf: Convert test_xdp_redirect.sh to bash

Linus Lüssing <ll@simonwunderlich.de>
    ath9k: fix data bus crash when setting nf_override via debugfs

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: pnvm: increment the pointer before checking the TLV

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: pnvm: set the PNVM again if it was already loaded

Marco Elver <elver@google.com>
    bpf_lru_list: Read double-checked variable once without lock

Sara Sharon <sara.sharon@intel.com>
    iwlwifi: mvm: don't check if CSA event is running before removing

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: assign SAR table revision to the command later

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: send stored PPAG command instead of local

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: store PPAG enabled/disabled flag properly

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: fix the type we use in the PPAG table validity checks

Jae Hyun Yoo <jae.hyun.yoo@intel.com>
    soc: aspeed: snoop: Add clock control logic

Dan Carpenter <dan.carpenter@oracle.com>
    ath11k: fix a locking bug in ath11k_mac_op_start()

Anand K Mistry <amistry@google.com>
    ath10k: Fix lockdep assertion warning in ath10k_sta_statistics

Anand K Mistry <amistry@google.com>
    ath10k: Fix suspicious RCU usage warning in ath10k_wmi_tlv_parse_peer_stats_info()

Arnd Bergmann <arnd@arndb.de>
    ARM: at91: use proper asm syntax in pm_suspend

Jérôme Pouiller <jerome.pouiller@silabs.com>
    staging: wfx: fix possible panic with re-queued frames

Arnd Bergmann <arnd@arndb.de>
    optee: simplify i2c access

Arnd Bergmann <arnd@arndb.de>
    ARM: s3c: fix fiq for clang IAS

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: set enabled in the PPAG command properly

Artem Lapkin <email2tema@gmail.com>
    arm64: dts: meson: fix broken wifi node for Khadas VIM3L

Vincent Knecht <vincent.knecht@mailoo.org>
    arm64: dts: msm8916: Fix reserved and rfsa nodes unit address

Luca Weiss <luca@z3ntu.xyz>
    soc: qcom: ocmem: don't return NULL in of_get_ocmem

Jupeng Zhong <zhongjupeng@yulong.com>
    Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv

Dmitry Osipenko <digetx@gmail.com>
    opp: Correct debug message in _opp_add_static_v2()

Marek Behún <kabel@kernel.org>
    arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to a53-firmware

Rosen Penev <rosenp@gmail.com>
    ARM: dts: armada388-helios4: assign pinctrl to each fan

Rosen Penev <rosenp@gmail.com>
    ARM: dts: armada388-helios4: assign pinctrl to LEDs

Marc Kleine-Budde <mkl@pengutronix.de>
    can: mcp251xfd: mcp251xfd_probe(): fix errata reference

Geert Uytterhoeven <geert+renesas@glider.be>
    arm64: dts: renesas: beacon: Fix EEPROM compatible value

Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
    x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too

Chen-Yu Tsai <wens@csie.org>
    staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules

Guenter Roeck <linux@roeck-us.net>
    usb: dwc2: Make "trimming xfer length" a debug message

Guenter Roeck <linux@roeck-us.net>
    usb: dwc2: Abort transaction after errors with unknown reason

Guenter Roeck <linux@roeck-us.net>
    usb: dwc2: Do not update data length if it is 0 on inbound transfers

Tony Lindgren <tony@atomide.com>
    ARM: dts: Configure missing thermal interrupt for 4430

Pan Bian <bianpan2016@163.com>
    memory: ti-aemif: Drop child node when jumping out loop

Pan Bian <bianpan2016@163.com>
    Bluetooth: Put HCI device if inquiry procedure interrupts

Pan Bian <bianpan2016@163.com>
    Bluetooth: drop HCI device reference before return

Borislav Petkov <bp@suse.de>
    staging: media: atomisp: Fix size_t format specifier in hmm_alloc() debug statemenet

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    soc: ti: pm33xx: Fix some resource leak in the error handling paths of the probe function

Dan Carpenter <dan.carpenter@oracle.com>
    soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model()

Robert Foss <robert.foss@linaro.org>
    arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node

Jack Pham <jackp@codeaurora.org>
    usb: gadget: u_audio: Free requests only after callback

Maximilian Luz <luzmaximilian@gmail.com>
    ACPICA: Fix exception code class checks

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy node

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    cpufreq: brcmstb-avs-cpufreq: Free resources in error path

Stephan Gerhold <stephan@gerhold.net>
    arm64: dts: qcom: msm8916-samsung-a2015: Fix sensors

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: allwinner: H6: properly connect USB PHY to port 0

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: allwinner: A64: properly connect USB PHY to port 0

Cristian Marussi <cristian.marussi@arm.com>
    firmware: arm_scmi: Fix call site of scmi_notification_exit

Andrii Nakryiko <andrii@kernel.org>
    bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args

Andrii Nakryiko <andrii@kernel.org>
    bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    net: stmmac: dwmac-meson8b: fix enabling the timing-adjustment clock

Stephan Gerhold <stephan@gerhold.net>
    arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible

Phil Elwell <phil@raspberrypi.com>
    staging: vchiq: Fix bulk transfers on 64-bit builds

Phil Elwell <phil@raspberrypi.com>
    staging: vchiq: Fix bulk userdata handling

Dinghao Liu <dinghao.liu@zju.edu.cn>
    Bluetooth: hci_qca: Fix memleak in qca_controller_memdump

Zhang Qilong <zhangqilong3@huawei.com>
    memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops

Krzysztof Kozlowski <krzk@kernel.org>
    arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso

Krzysztof Kozlowski <krzk@kernel.org>
    arm64: dts: exynos: correct PMIC interrupt trigger level on TM2

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Spring

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Monk

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5

Adam Ford <aford173@gmail.com>
    arm64: dts: renesas: beacon: Fix audio-1.8V pin enable

Adam Ford <aford173@gmail.com>
    arm64: dts: renesas: beacon kit: Fix choppy Bluetooth Audio

Christopher William Snowhill <chris@kode54.net>
    Bluetooth: Fix initializing response id after clearing struct

Claire Chang <tientzu@chromium.org>
    Bluetooth: hci_uart: Fix a race for write_work scheduling

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: Fix error handling in case of CE pipe init failure

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915/gt: One more flush for Baytrail clear residuals

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Don't call sync_stop if it hasn't been stopped

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Assure sync with the pending stop operation at suspend

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: Call sync_stop at disconnection

Eric Biggers <ebiggers@google.com>
    random: fix the RNDRESEEDCRNG ioctl

Nathan Chancellor <nathan@kernel.org>
    vmlinux.lds.h: Define SANTIZER_DISCARDS with CONFIG_GCOV_KERNEL=y

Alexander Lobakin <alobakin@pm.me>
    MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode

Jan Kara <jack@suse.cz>
    bfq: Avoid false bfq queue merging

Hans de Goede <hdegoede@redhat.com>
    virt: vbox: Do not use wait_event_interruptible when called from kernel context

Ard Biesheuvel <ardb@kernel.org>
    PCI: Decline to resize resources if boot config must be preserved

Ansuel Smith <ansuelsmth@gmail.com>
    PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064

Ivan Zaentsev <ivan.zaentsev@wirenboard.ru>
    w1: w1_therm: Fix conversion result for negative temperatures

Sumit Garg <sumit.garg@linaro.org>
    kdb: Make memory allocations more robust

Quinn Tran <qutran@marvell.com>
    scsi: qla2xxx: Fix mailbox Ch erroneous error

Ahmed S. Darwish <a.darwish@linutronix.de>
    scsi: libsas: docs: Remove notify_ha_event()

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    debugfs: do not attempt to create a new file before the filesystem is initalized

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    debugfs: be more robust at handling improper input in debugfs_lookup()

Stefano Garzarella <sgarzare@redhat.com>
    vdpa/mlx5: fix param validation in mlx5_vdpa_get_config()

Nick Desaulniers <ndesaulniers@google.com>
    vmlinux.lds.h: add DWARF v5 sections


-------------

Diffstat:

 Documentation/admin-guide/perf/arm-cmn.rst         |   2 +-
 Documentation/admin-guide/sysctl/vm.rst            |  10 +-
 Documentation/filesystems/seq_file.rst             |   6 +
 Documentation/scsi/libsas.rst                      |   1 -
 Documentation/security/keys/core.rst               |   4 +-
 Makefile                                           |   4 +-
 arch/arm/boot/compressed/head.S                    |   4 +-
 arch/arm/boot/dts/armada-388-helios4.dts           |  28 +-
 arch/arm/boot/dts/exynos3250-artik5.dtsi           |   2 +-
 arch/arm/boot/dts/exynos3250-monk.dts              |   2 +-
 arch/arm/boot/dts/exynos3250-rinato.dts            |   2 +-
 arch/arm/boot/dts/exynos5250-spring.dts            |   2 +-
 arch/arm/boot/dts/exynos5420-arndale-octa.dts      |   2 +-
 arch/arm/boot/dts/exynos5422-odroid-core.dtsi      |   2 +-
 arch/arm/boot/dts/omap443x.dtsi                    |   2 +
 arch/arm/kernel/sys_oabi-compat.c                  |  15 +
 arch/arm/mach-at91/pm_suspend.S                    |   2 +-
 arch/arm/mach-ixp4xx/Kconfig                       |   1 -
 arch/arm/mach-s3c/irq-s3c24xx-fiq.S                |   9 +-
 arch/arm64/Kconfig                                 |   2 +-
 .../boot/dts/allwinner/sun50i-a64-pinebook.dts     |   5 +-
 .../boot/dts/allwinner/sun50i-a64-sopine.dtsi      |   1 -
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi      |   6 +-
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi       |   7 +
 .../boot/dts/amlogic/meson-sm1-khadas-vim3l.dts    |   7 +-
 .../boot/dts/exynos/exynos5433-tm2-common.dtsi     |   2 +-
 arch/arm64/boot/dts/exynos/exynos7-espresso.dts    |   2 +-
 arch/arm64/boot/dts/intel/socfpga_agilex.dtsi      |   4 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |   2 +-
 arch/arm64/boot/dts/mediatek/mt7622.dtsi           |   2 +
 .../dts/qcom/msm8916-samsung-a2015-common.dtsi     |   6 +
 .../boot/dts/qcom/msm8916-samsung-a5u-eur.dts      |   2 +-
 arch/arm64/boot/dts/qcom/msm8916.dtsi              |   4 +-
 arch/arm64/boot/dts/qcom/qrb5165-rb5.dts           |   9 +-
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts         |   4 +-
 .../boot/dts/renesas/beacon-renesom-baseboard.dtsi |   2 +-
 .../arm64/boot/dts/renesas/beacon-renesom-som.dtsi |   4 +-
 arch/arm64/boot/dts/rockchip/rk3328.dtsi           |   1 +
 arch/arm64/crypto/aes-glue.c                       |   4 +-
 arch/arm64/crypto/sha1-ce-glue.c                   |   1 +
 arch/arm64/crypto/sha2-ce-glue.c                   |   2 +
 arch/arm64/crypto/sha3-ce-glue.c                   |   4 +
 arch/arm64/crypto/sha512-ce-glue.c                 |   2 +
 arch/arm64/include/asm/module.lds.h                |   6 +-
 arch/arm64/kernel/cpufeature.c                     |   2 +-
 arch/arm64/kernel/head.S                           |   1 +
 arch/arm64/kernel/machine_kexec_file.c             |   4 +-
 arch/arm64/kernel/probes/uprobes.c                 |   2 +-
 arch/arm64/kernel/ptrace.c                         |   2 +-
 arch/arm64/kernel/suspend.c                        |   2 +-
 arch/csky/kernel/ptrace.c                          |   2 +-
 arch/mips/Makefile                                 |  19 ++
 arch/mips/cavium-octeon/setup.c                    |   9 +-
 arch/mips/include/asm/asm.h                        |  18 ++
 arch/mips/include/asm/atomic.h                     |   2 +-
 arch/mips/include/asm/cmpxchg.h                    |   6 +-
 arch/mips/kernel/cpu-probe.c                       |  15 +-
 arch/mips/kernel/vmlinux.lds.S                     |   2 +-
 arch/mips/lantiq/irq.c                             |   2 +-
 arch/mips/loongson64/Platform                      |  22 --
 arch/mips/mm/c-r4k.c                               |   2 +-
 arch/mips/vdso/Makefile                            |   5 +-
 arch/nios2/kernel/entry.S                          |   3 +
 arch/nios2/kernel/sys_nios2.c                      |  11 +-
 arch/powerpc/Kconfig                               |   2 +-
 arch/powerpc/include/asm/kexec.h                   |   1 +
 arch/powerpc/include/asm/uaccess.h                 |  13 +-
 arch/powerpc/kernel/entry_32.S                     |   3 +
 arch/powerpc/kernel/head_32.h                      |   2 +-
 arch/powerpc/kernel/head_8xx.S                     |   2 +-
 arch/powerpc/kernel/head_book3s_32.S               |   6 -
 arch/powerpc/kernel/irq.c                          |  27 +-
 arch/powerpc/kernel/prom_init.c                    |  12 +-
 arch/powerpc/kernel/time.c                         |   2 +
 arch/powerpc/kexec/elf_64.c                        |   2 +-
 arch/powerpc/kexec/file_load_64.c                  |  35 +++
 arch/powerpc/kvm/powerpc.c                         |   8 +-
 arch/powerpc/lib/sstep.c                           |   7 +-
 arch/powerpc/platforms/pseries/dlpar.c             |   7 +-
 arch/riscv/kernel/vdso/Makefile                    |   3 +-
 arch/s390/kernel/vtime.c                           |   3 +-
 arch/sparc/Kconfig                                 |   2 +-
 arch/sparc/kernel/led.c                            |   2 +
 arch/sparc/lib/memset.S                            |   1 +
 arch/um/include/shared/skas/mm_id.h                |   1 +
 arch/um/kernel/tlb.c                               |  19 +-
 arch/um/os-Linux/skas/process.c                    |   4 +
 arch/x86/crypto/aesni-intel_glue.c                 |  28 +-
 arch/x86/entry/common.c                            |   2 +-
 arch/x86/include/asm/virtext.h                     |  17 +-
 arch/x86/kernel/msr.c                              |   7 +
 arch/x86/kernel/reboot.c                           |  30 +-
 arch/x86/kvm/emulate.c                             |   4 +-
 arch/x86/kvm/mmu/tdp_mmu.c                         |   3 +-
 arch/x86/kvm/svm/nested.c                          |  22 +-
 arch/x86/kvm/svm/svm.c                             |   8 +-
 arch/x86/kvm/x86.c                                 |   1 +
 arch/x86/mm/fault.c                                |  27 +-
 arch/x86/mm/pat/memtype.c                          |   4 +-
 block/bfq-iosched.c                                |   1 +
 block/blk-settings.c                               |  12 +
 block/bsg.c                                        |   4 +-
 block/ioctl.c                                      |  21 +-
 certs/blacklist.c                                  |   2 +-
 crypto/ecdh_helper.c                               |   3 +
 crypto/michael_mic.c                               |  31 +-
 drivers/acpi/acpi_configfs.c                       |   7 +-
 drivers/acpi/property.c                            |  44 ++-
 drivers/amba/bus.c                                 |  20 +-
 drivers/ata/ahci_brcm.c                            |  14 +-
 drivers/auxdisplay/ht16k33.c                       |   3 +-
 drivers/base/regmap/regmap-sdw.c                   |   4 +-
 drivers/base/swnode.c                              |   8 +-
 drivers/block/floppy.c                             |  30 +-
 drivers/bluetooth/btqcomsmd.c                      |  27 +-
 drivers/bluetooth/btusb.c                          |  20 +-
 drivers/bluetooth/hci_ldisc.c                      |  41 ++-
 drivers/bluetooth/hci_qca.c                        |   2 +
 drivers/bluetooth/hci_serdev.c                     |   4 +-
 drivers/char/hw_random/ingenic-trng.c              |   6 +-
 drivers/char/hw_random/timeriomem-rng.c            |   2 +-
 drivers/char/random.c                              |   2 +-
 drivers/char/tpm/tpm.h                             |   4 -
 drivers/char/tpm/tpm_tis_core.c                    |  50 +--
 drivers/clk/clk-ast2600.c                          |  37 ++-
 drivers/clk/clk-divider.c                          |   9 +-
 drivers/clk/meson/clk-pll.c                        |  10 +-
 drivers/clk/qcom/gcc-msm8998.c                     | 100 +++---
 drivers/clk/renesas/r8a779a0-cpg-mssr.c            |   3 +-
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c               |  10 +-
 drivers/clocksource/Kconfig                        |   1 +
 drivers/clocksource/mxs_timer.c                    |   5 +-
 drivers/cpufreq/acpi-cpufreq.c                     |  62 +---
 drivers/cpufreq/brcmstb-avs-cpufreq.c              |  24 +-
 drivers/cpufreq/freq_table.c                       |   8 +-
 drivers/cpufreq/intel_pstate.c                     |  21 +-
 drivers/cpufreq/qcom-cpufreq-hw.c                  |  40 ++-
 .../crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c    | 173 ++++++----
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h       |   2 +
 drivers/crypto/bcm/cipher.c                        |   2 +-
 drivers/crypto/bcm/cipher.h                        |   4 +-
 drivers/crypto/bcm/util.c                          |   2 +-
 drivers/crypto/talitos.c                           |  50 ++-
 drivers/crypto/talitos.h                           |   1 +
 drivers/dax/bus.c                                  |   2 +-
 drivers/dma/fsldma.c                               |   6 +
 drivers/dma/hsu/pci.c                              |  21 +-
 drivers/dma/idxd/dma.c                             |   1 +
 drivers/dma/owl-dma.c                              |   1 +
 drivers/firmware/arm_scmi/driver.c                 |   4 +-
 drivers/gpio/gpio-pcf857x.c                        |   2 +-
 drivers/gpu/drm/Kconfig                            |   3 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h          |   2 +-
 drivers/gpu/drm/amd/amdgpu/soc15.c                 |   2 +
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h  |   4 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   2 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c |   3 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h |   2 +-
 .../gpu/drm/amd/display/dc/bios/command_table.c    |  61 ++++
 .../gpu/drm/amd/display/dc/dce/dce_clock_source.c  |  14 +
 .../drm/amd/display/dc/dce/dce_stream_encoder.c    |   1 +
 drivers/gpu/drm/amd/display/dc/dce/dce_transform.c |   8 +-
 .../drm/amd/display/dc/dcn10/dcn10_link_encoder.c  |   1 -
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |   6 +-
 .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c  |  20 +-
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c |   2 +
 .../amd/display/dc/irq/dcn21/irq_service_dcn21.c   |  22 ++
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |   6 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |   3 +-
 drivers/gpu/drm/drm_fb_helper.c                    |  15 +-
 drivers/gpu/drm/drm_modes.c                        |   4 +-
 drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c         |  22 +-
 drivers/gpu/drm/gma500/psb_drv.c                   |   2 +
 drivers/gpu/drm/i915/display/intel_hdmi.c          |   6 +-
 drivers/gpu/drm/i915/gt/gen7_renderclear.c         |  12 +-
 drivers/gpu/drm/lima/lima_sched.c                  |   2 +-
 drivers/gpu/drm/mediatek/mtk_disp_ovl.c            |   2 +-
 drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c        |   4 +-
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c              |  25 +-
 drivers/gpu/drm/msm/adreno/a6xx_gmu.h              |   8 +
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c              |   8 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c          |   2 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |   5 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c         |   2 +-
 drivers/gpu/drm/msm/msm_drv.c                      |   3 +-
 .../drm/nouveau/include/nvkm/subdev/bios/conn.h    |   1 +
 drivers/gpu/drm/nouveau/nouveau_chan.c             |   1 +
 drivers/gpu/drm/nouveau/nouveau_connector.c        |   1 +
 drivers/gpu/drm/panel/panel-elida-kd35t133.c       |   3 +-
 drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c   |   5 +
 drivers/gpu/drm/rcar-du/rcar_cmm.c                 |   2 +-
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c             |  10 +-
 drivers/gpu/drm/rcar-du/rcar_du_drv.h              |   6 +-
 drivers/gpu/drm/rcar-du/rcar_du_encoder.c          |   5 +-
 drivers/gpu/drm/rcar-du/rcar_du_kms.c              |  30 +-
 drivers/gpu/drm/rockchip/rockchip_drm_vop.h        |  11 +
 drivers/gpu/drm/scheduler/sched_main.c             |   3 +
 drivers/gpu/drm/sun4i/sun4i_tcon.c                 |  21 +-
 drivers/gpu/drm/sun4i/sun4i_tcon.h                 |   1 +
 drivers/gpu/drm/tegra/dc.c                         |   2 +-
 drivers/gpu/drm/tegra/dsi.c                        |   2 +-
 drivers/gpu/drm/tegra/hdmi.c                       |   2 +-
 drivers/gpu/drm/tegra/hub.c                        |   2 +-
 drivers/gpu/drm/tegra/sor.c                        |   2 +-
 drivers/gpu/drm/tegra/vic.c                        |   2 +-
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |  87 +++--
 drivers/gpu/drm/vc4/vc4_hdmi_regs.h                |   4 +-
 drivers/gpu/drm/virtio/virtgpu_gem.c               |   8 +-
 drivers/hid/hid-core.c                             |   3 +
 drivers/hid/hid-logitech-dj.c                      |   1 +
 drivers/hid/wacom_wac.c                            |   7 +-
 drivers/hsi/controllers/omap_ssi_core.c            |   2 +-
 drivers/hv/channel_mgmt.c                          |   3 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  21 +-
 .../hwtracing/coresight/coresight-etm4x-sysfs.c    |   2 +-
 drivers/i2c/busses/i2c-bcm-iproc.c                 | 231 +++++++++++---
 drivers/i2c/busses/i2c-brcmstb.c                   |   2 +-
 drivers/i2c/busses/i2c-exynos5.c                   |   8 +-
 drivers/i2c/busses/i2c-qcom-geni.c                 |  93 +++++-
 drivers/ide/falconide.c                            |   3 +-
 drivers/infiniband/core/cm.c                       |   8 +-
 drivers/infiniband/core/cma.c                      |  70 +++--
 drivers/infiniband/core/user_mad.c                 |  17 +-
 drivers/infiniband/hw/hns/hns_roce_device.h        |   2 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |   8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   3 +-
 drivers/infiniband/hw/mlx5/devx.c                  |   4 +-
 drivers/infiniband/hw/mlx5/main.c                  |  14 +-
 drivers/infiniband/sw/rxe/rxe_net.c                |   5 +
 drivers/infiniband/sw/rxe/rxe_recv.c               |  27 +-
 drivers/infiniband/sw/siw/siw.h                    |   2 +-
 drivers/infiniband/sw/siw/siw_main.c               |   2 +-
 drivers/infiniband/sw/siw/siw_qp.c                 | 271 ++++++++--------
 drivers/infiniband/sw/siw/siw_qp_rx.c              |  26 +-
 drivers/infiniband/sw/siw/siw_qp_tx.c              |   4 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  20 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c       |   2 +
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |  51 +--
 drivers/infiniband/ulp/rtrs/rtrs-clt.h             |   1 +
 drivers/infiniband/ulp/rtrs/rtrs-pri.h             |   9 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c       |   9 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             | 117 ++++---
 drivers/infiniband/ulp/rtrs/rtrs.c                 |  14 +-
 drivers/input/joydev.c                             |   7 +-
 drivers/input/joystick/xpad.c                      |   1 +
 drivers/input/serio/i8042-x86ia64io.h              |   4 +
 drivers/input/serio/serport.c                      |   4 +-
 drivers/input/touchscreen/elo.c                    |   4 +-
 drivers/input/touchscreen/raydium_i2c_ts.c         |   3 +-
 drivers/input/touchscreen/sur40.c                  |   1 +
 drivers/input/touchscreen/zinitix.c                |   2 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |   2 +-
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |   2 +
 drivers/iommu/iommu.c                              |  23 +-
 drivers/iommu/mtk_iommu.c                          |   2 +-
 drivers/irqchip/Kconfig                            |   3 +-
 drivers/irqchip/irq-loongson-pch-msi.c             |   2 +-
 drivers/macintosh/adb-iop.c                        |   6 +-
 drivers/mailbox/sprd-mailbox.c                     |   2 +-
 drivers/md/bcache/bcache.h                         |   3 +
 drivers/md/bcache/btree.c                          |  21 +-
 drivers/md/bcache/journal.c                        |   4 +-
 drivers/md/bcache/super.c                          |  20 ++
 drivers/md/dm-core.h                               |   4 +
 drivers/md/dm-crypt.c                              |   1 +
 drivers/md/dm-era-target.c                         |  93 ++++--
 drivers/md/dm-table.c                              | 168 +++++-----
 drivers/md/dm-writecache.c                         |  74 +++--
 drivers/md/dm.c                                    |  62 +++-
 drivers/md/dm.h                                    |   2 +-
 drivers/media/i2c/max9286.c                        |   2 +-
 drivers/media/i2c/ov5670.c                         |   3 +-
 drivers/media/pci/cx25821/cx25821-core.c           |   4 +-
 drivers/media/pci/intel/ipu3/Kconfig               |   3 +-
 drivers/media/pci/intel/ipu3/ipu3-cio2.c           |   2 +-
 drivers/media/pci/saa7134/saa7134-empress.c        |   5 +-
 drivers/media/pci/smipcie/smipcie-ir.c             |  46 +--
 drivers/media/platform/aspeed-video.c              |   6 +-
 drivers/media/platform/marvell-ccic/mcam-core.c    |   2 +
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c |   4 +-
 .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c   |   3 +-
 drivers/media/platform/pxa_camera.c                |   3 +
 drivers/media/platform/qcom/camss/camss-video.c    |   1 +
 drivers/media/platform/ti-vpe/cal.c                |   4 +-
 drivers/media/platform/vsp1/vsp1_drv.c             |   4 +-
 drivers/media/rc/ir_toy.c                          |   1 +
 drivers/media/rc/mceusb.c                          |   2 +-
 drivers/media/test-drivers/vidtv/vidtv_psi.c       |   5 +-
 drivers/media/tuners/qm1d1c0042.c                  |   4 +-
 drivers/media/usb/dvb-usb-v2/lmedm04.c             |   2 +-
 drivers/media/usb/em28xx/em28xx-core.c             |   6 +-
 drivers/media/usb/tm6000/tm6000-dvb.c              |   4 +
 drivers/media/usb/uvc/uvc_v4l2.c                   |  18 +-
 drivers/memory/mtk-smi.c                           |   4 +-
 drivers/memory/ti-aemif.c                          |   8 +-
 drivers/mfd/altera-sysmgr.c                        |   3 +-
 drivers/mfd/bd9571mwv.c                            |   6 +-
 drivers/mfd/gateworks-gsc.c                        |   2 +-
 drivers/mfd/wm831x-auxadc.c                        |   3 +-
 drivers/misc/cardreader/rts5227.c                  |   5 +
 drivers/misc/eeprom/eeprom_93xx46.c                |   1 +
 drivers/misc/fastrpc.c                             |   7 +-
 drivers/misc/mei/hbm.c                             |   2 +-
 drivers/misc/mei/hw-me-regs.h                      |   5 +
 drivers/misc/mei/interrupt.c                       |  33 +-
 drivers/misc/mei/pci-me.c                          |   5 +
 drivers/misc/vmw_vmci/vmci_queue_pair.c            |   5 +-
 drivers/mmc/host/owl-mmc.c                         |   9 +-
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |   4 +-
 drivers/mmc/host/sdhci-esdhc-imx.c                 |   3 +-
 drivers/mmc/host/sdhci-pci-o2micro.c               |  20 ++
 drivers/mmc/host/sdhci-sprd.c                      |   6 +-
 drivers/mmc/host/usdhi6rol0.c                      |   4 +-
 drivers/mtd/parsers/afs.c                          |   4 +-
 drivers/mtd/parsers/parser_imagetag.c              |   4 +
 drivers/mtd/spi-nor/controllers/hisi-sfc.c         |   4 +-
 drivers/mtd/spi-nor/core.c                         |  10 +-
 drivers/mtd/spi-nor/sfdp.c                         |   5 +-
 drivers/net/Kconfig                                |   2 +-
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c     |   2 +-
 drivers/net/dsa/ocelot/felix.c                     |  16 +-
 drivers/net/ethernet/amd/xgbe/xgbe-common.h        |  14 +
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c           |   1 +
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |   3 +-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c        |  39 ++-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   3 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c  |   4 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h     |   3 +
 drivers/net/ethernet/chelsio/cxgb4/sge.c           |  11 +-
 .../chelsio/inline_crypto/chtls/chtls_cm.h         |   3 -
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c   |  14 +-
 drivers/net/ethernet/freescale/enetc/enetc_pf.c    |   5 +-
 drivers/net/ethernet/ibm/ibmvnic.c                 |  16 +-
 drivers/net/ethernet/intel/i40e/i40e_ethtool.c     |  16 +-
 drivers/net/ethernet/intel/i40e/i40e_main.c        |  50 +--
 drivers/net/ethernet/intel/i40e/i40e_txrx.c        |   9 +-
 drivers/net/ethernet/intel/ice/ice.h               |   2 -
 drivers/net/ethernet/intel/ice/ice_dcb_nl.c        |   6 +-
 drivers/net/ethernet/intel/ice/ice_ethtool.c       |  34 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c   |  33 +-
 drivers/net/ethernet/marvell/mvneta.c              |   9 +-
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |   2 +-
 .../net/ethernet/mellanox/mlx4/resource_tracker.c  |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c  |   9 +
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 259 +++++++++++----
 drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h   |   2 +-
 .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c |   2 +-
 .../mellanox/mlx5/core/en_accel/en_accel.h         |   2 +-
 .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c |  66 ++--
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |  39 ++-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   8 +-
 drivers/net/ethernet/mellanox/mlx5/core/health.c   |  22 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   3 +-
 drivers/net/ethernet/realtek/r8169_main.c          |   4 +-
 .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |   2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |  30 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |  26 +-
 drivers/net/gtp.c                                  |   1 -
 drivers/net/phy/mscc/mscc.h                        |   8 +
 drivers/net/phy/mscc/mscc_main.c                   | 350 ++++++++++++++-------
 drivers/net/phy/phy_device.c                       |  53 +---
 drivers/net/ppp/ppp_async.c                        |   3 +-
 drivers/net/ppp/ppp_synctty.c                      |   3 +-
 drivers/net/vxlan.c                                |  11 +-
 drivers/net/wireguard/device.c                     |  19 +-
 drivers/net/wireguard/device.h                     |  15 +-
 drivers/net/wireguard/peer.c                       |  28 +-
 drivers/net/wireguard/peer.h                       |   4 +-
 drivers/net/wireguard/queueing.c                   |  86 ++++-
 drivers/net/wireguard/queueing.h                   |  45 ++-
 drivers/net/wireguard/receive.c                    |  16 +-
 drivers/net/wireguard/send.c                       |  31 +-
 drivers/net/wireless/ath/ath10k/mac.c              |   2 +
 drivers/net/wireless/ath/ath10k/snoc.c             |   5 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   3 +
 drivers/net/wireless/ath/ath11k/mac.c              |  11 +-
 drivers/net/wireless/ath/ath9k/debug.c             |   5 +-
 drivers/net/wireless/broadcom/b43/phy_n.c          |   2 +-
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c       |  13 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  43 ++-
 .../net/wireless/intel/iwlwifi/mvm/time-event.c    |   3 -
 .../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c   |  21 +-
 drivers/net/xen-netback/interface.c                |   8 +-
 drivers/nvme/host/multipath.c                      |   4 +
 drivers/nvme/target/admin-cmd.c                    |  33 +-
 drivers/nvme/target/tcp.c                          |  59 +++-
 drivers/nvmem/core.c                               |   5 +-
 drivers/nvmem/qcom-spmi-sdam.c                     |   7 +-
 drivers/of/fdt.c                                   |  12 +-
 drivers/opp/of.c                                   |   4 +-
 drivers/pci/controller/cadence/pcie-cadence-host.c |   5 +-
 drivers/pci/controller/dwc/pcie-qcom.c             |   4 +-
 drivers/pci/controller/pcie-rcar-host.c            |   2 +-
 drivers/pci/controller/pcie-rockchip.c             |  12 +-
 drivers/pci/controller/pcie-xilinx-cpm.c           |   1 +
 drivers/pci/pci-bridge-emul.c                      |  11 +-
 drivers/pci/setup-res.c                            |   6 +
 drivers/pci/syscall.c                              |  10 +-
 drivers/perf/arm-cmn.c                             |  17 +-
 drivers/phy/Kconfig                                |   1 +
 drivers/phy/cadence/phy-cadence-torrent.c          |   1 +
 drivers/phy/lantiq/phy-lantiq-rcu-usb2.c           |  10 +-
 drivers/phy/rockchip/phy-rockchip-emmc.c           |   8 +-
 drivers/platform/chrome/cros_ec_proto.c            |  12 +-
 drivers/power/reset/at91-sama5d2_shdwc.c           |   2 +-
 drivers/power/supply/Kconfig                       |   1 +
 drivers/power/supply/axp20x_usb_power.c            |   2 +-
 drivers/power/supply/cpcap-battery.c               |  12 +-
 drivers/power/supply/cpcap-charger.c               |   4 +-
 drivers/power/supply/smb347-charger.c              |  12 +-
 drivers/pwm/pwm-iqs620a.c                          |   8 +-
 drivers/pwm/pwm-rockchip.c                         |  18 +-
 drivers/regulator/axp20x-regulator.c               |   7 +-
 drivers/regulator/core.c                           |   6 +-
 drivers/regulator/qcom-rpmh-regulator.c            |  26 ++
 drivers/regulator/rohm-regulator.c                 |   9 +-
 drivers/regulator/s5m8767.c                        |  15 +-
 drivers/remoteproc/mtk_common.h                    |   1 +
 drivers/remoteproc/mtk_scp.c                       |  20 +-
 drivers/rtc/Kconfig                                |   3 +-
 drivers/s390/crypto/zcrypt_api.c                   |  14 +
 drivers/s390/virtio/virtio_ccw.c                   |   4 +-
 drivers/scsi/bnx2fc/Kconfig                        |   1 +
 drivers/scsi/lpfc/lpfc_hbadisc.c                   |  15 +-
 drivers/scsi/qla2xxx/qla_dbg.c                     |   1 +
 drivers/scsi/qla2xxx/qla_mbx.c                     |   3 +-
 drivers/scsi/sd.c                                  |   6 +-
 drivers/scsi/sd_zbc.c                              |   6 +-
 drivers/soc/aspeed/aspeed-lpc-snoop.c              |  30 +-
 drivers/soc/qcom/ocmem.c                           |   8 +-
 drivers/soc/qcom/socinfo.c                         |   2 +-
 drivers/soc/samsung/exynos-asv.c                   |  18 +-
 drivers/soc/ti/pm33xx.c                            |   5 +-
 drivers/soundwire/bus.c                            |  47 ++-
 drivers/soundwire/cadence_master.c                 |   8 +-
 drivers/soundwire/debugfs.c                        |   2 +-
 drivers/soundwire/intel_init.c                     |   3 +-
 drivers/spi/spi-atmel.c                            |   2 +-
 drivers/spi/spi-cadence-quadspi.c                  |   2 +-
 drivers/spi/spi-dw-bt1.c                           |   2 +-
 drivers/spi/spi-fsl-spi.c                          |   2 +-
 drivers/spi/spi-imx.c                              |   2 +-
 drivers/spi/spi-pxa2xx-pci.c                       |  27 +-
 drivers/spi/spi-stm32.c                            |   4 +
 drivers/spi/spi-synquacer.c                        |   4 +
 drivers/spi/spi.c                                  |   2 +-
 drivers/spmi/spmi-pmic-arb.c                       |   5 +-
 drivers/staging/gdm724x/gdm_usb.c                  |  10 +-
 drivers/staging/media/allegro-dvt/allegro-core.c   |   3 +-
 drivers/staging/media/atomisp/pci/atomisp_subdev.c |  24 +-
 drivers/staging/media/atomisp/pci/hmm/hmm.c        |   2 +-
 drivers/staging/media/imx/imx-media-csc-scaler.c   |   4 -
 drivers/staging/media/imx/imx-media-dev.c          |   7 +-
 drivers/staging/media/imx/imx7-media-csi.c         |  27 +-
 drivers/staging/mt7621-dma/Makefile                |   2 +-
 .../mt7621-dma/{mtk-hsdma.c => hsdma-mt7621.c}     |   2 +-
 drivers/staging/rtl8188eu/os_dep/usb_intf.c        |   1 +
 drivers/staging/rtl8723bs/os_dep/wifi_regd.c       |   2 +-
 .../vc04_services/interface/vchiq_arm/vchiq_arm.c  |   6 +-
 drivers/staging/wfx/data_tx.c                      |  10 +-
 drivers/staging/wfx/data_tx.h                      |   1 +
 drivers/target/iscsi/cxgbit/cxgbit_target.c        |   3 +-
 drivers/tee/optee/rpc.c                            |  31 +-
 drivers/thermal/cpufreq_cooling.c                  |   2 +-
 drivers/tty/n_gsm.c                                |   3 +-
 drivers/tty/n_hdlc.c                               |  60 ++--
 drivers/tty/n_null.c                               |   3 +-
 drivers/tty/n_r3964.c                              |  10 +-
 drivers/tty/n_tracerouter.c                        |   4 +-
 drivers/tty/n_tracesink.c                          |   4 +-
 drivers/tty/n_tty.c                                |  82 ++---
 drivers/tty/tty_io.c                               |  82 ++++-
 drivers/usb/dwc2/hcd.c                             |  15 +-
 drivers/usb/dwc2/hcd_intr.c                        |  14 +-
 drivers/usb/dwc3/gadget.c                          |  19 +-
 drivers/usb/gadget/function/u_audio.c              |  17 +-
 drivers/usb/musb/musb_core.c                       |  31 +-
 drivers/usb/serial/ftdi_sio.c                      |   5 +-
 drivers/usb/serial/mos7720.c                       |   4 +-
 drivers/usb/serial/mos7840.c                       |   4 +-
 drivers/usb/serial/option.c                        |   3 +-
 drivers/usb/serial/pl2303.c                        |   8 +-
 drivers/vdpa/mlx5/net/mlx5_vnet.c                  |   2 +-
 drivers/vfio/pci/vfio_pci_zdev.c                   |   4 +
 drivers/vfio/vfio_iommu_type1.c                    |  63 ++--
 drivers/video/fbdev/Kconfig                        |   2 +-
 drivers/virt/vboxguest/vboxguest_utils.c           |  18 +-
 drivers/w1/slaves/w1_therm.c                       |  22 +-
 drivers/watchdog/intel-mid_wdt.c                   |   8 +-
 drivers/watchdog/mei_wdt.c                         |   1 +
 drivers/watchdog/qcom-wdt.c                        |  13 +-
 fs/affs/namei.c                                    |   4 +-
 fs/btrfs/backref.c                                 |   9 +-
 fs/btrfs/backref.h                                 |   9 +-
 fs/btrfs/block-group.c                             |  29 +-
 fs/btrfs/ctree.c                                   |   7 +-
 fs/btrfs/delayed-ref.c                             |  56 ++--
 fs/btrfs/delayed-ref.h                             |  16 +-
 fs/btrfs/extent-tree.c                             | 128 ++------
 fs/btrfs/free-space-cache.c                        |   6 +-
 fs/btrfs/inode.c                                   |   3 +-
 fs/btrfs/relocation.c                              |   4 +-
 fs/btrfs/space-info.h                              |  17 +
 fs/ceph/caps.c                                     |  10 +-
 fs/debugfs/inode.c                                 |   5 +-
 fs/erofs/xattr.c                                   |  10 +-
 fs/erofs/zmap.c                                    |  10 +-
 fs/eventpoll.c                                     |   4 +-
 fs/exfat/exfat_raw.h                               |   4 +
 fs/exfat/super.c                                   |  31 +-
 fs/ext4/Kconfig                                    |   3 +-
 fs/ext4/namei.c                                    |   7 +-
 fs/f2fs/compress.c                                 |   5 +-
 fs/f2fs/data.c                                     |  12 +-
 fs/f2fs/f2fs.h                                     |   2 +-
 fs/f2fs/file.c                                     |  24 +-
 fs/f2fs/inline.c                                   |   4 +
 fs/f2fs/super.c                                    |   3 +
 fs/gfs2/bmap.c                                     |   6 +-
 fs/gfs2/lock_dlm.c                                 |   8 +-
 fs/gfs2/recovery.c                                 |   4 +-
 fs/gfs2/util.c                                     |  16 +-
 fs/io_uring.c                                      |  17 +-
 fs/isofs/dir.c                                     |   1 +
 fs/isofs/namei.c                                   |   1 +
 fs/jffs2/summary.c                                 |   3 +
 fs/jfs/jfs_dmap.c                                  |   2 +-
 fs/nfs/nfs4proc.c                                  |  15 +-
 fs/nfsd/nfsctl.c                                   |  14 +-
 fs/ocfs2/cluster/heartbeat.c                       |   8 +-
 fs/proc/proc_sysctl.c                              |   4 +-
 fs/proc/self.c                                     |   2 +-
 fs/proc/task_mmu.c                                 |   9 +-
 fs/proc/thread_self.c                              |   7 +
 fs/pstore/platform.c                               |   4 +-
 fs/quota/quota_v2.c                                |  11 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/ubifs/replay.c                                  |   4 +-
 fs/ubifs/super.c                                   |   4 +-
 fs/zonefs/super.c                                  |   3 +
 include/acpi/acexcep.h                             |  10 +-
 include/asm-generic/vmlinux.lds.h                  |  16 +-
 include/linux/bpf.h                                |   3 +
 include/linux/device-mapper.h                      |   5 +
 include/linux/entry-kvm.h                          |  14 +
 include/linux/eventpoll.h                          |   2 +-
 include/linux/filter.h                             |   2 +-
 include/linux/icmpv6.h                             |  28 +-
 include/linux/iommu.h                              |   4 +-
 include/linux/ipv6.h                               |   1 -
 include/linux/kexec.h                              |   5 +
 include/linux/key.h                                |   1 +
 include/linux/kgdb.h                               |   2 +
 include/linux/khugepaged.h                         |   2 +
 include/linux/memremap.h                           |   6 +
 include/linux/mfd/rohm-generic.h                   |  14 +-
 include/linux/rcupdate.h                           |   2 +
 include/linux/rmap.h                               |   3 +-
 include/linux/soundwire/sdw.h                      |   2 +
 include/linux/tpm.h                                |   5 +-
 include/linux/tty_ldisc.h                          |   3 +-
 include/net/act_api.h                              |   6 +-
 include/net/icmp.h                                 |   6 +-
 include/net/tcp.h                                  |   9 +-
 include/uapi/drm/drm_fourcc.h                      |   4 +-
 init/Kconfig                                       |  11 +
 init/main.c                                        |   1 +
 kernel/Makefile                                    |   2 +-
 kernel/bpf/bpf_iter.c                              |   2 +-
 kernel/bpf/bpf_lru_list.c                          |   7 +-
 kernel/bpf/devmap.c                                |   4 +-
 kernel/bpf/verifier.c                              |   3 +-
 kernel/debug/debug_core.c                          |  11 +
 kernel/debug/kdb/kdb_private.h                     |   2 +-
 kernel/entry/common.c                              |   7 +
 kernel/kcsan/core.c                                |  26 +-
 kernel/kexec_file.c                                |   5 +
 kernel/kprobes.c                                   |  31 +-
 kernel/locking/lockdep.c                           |   3 +-
 kernel/module.c                                    |  21 +-
 kernel/printk/printk.c                             |  28 +-
 kernel/printk/printk_safe.c                        |  16 +-
 kernel/rcu/tree.c                                  |  53 +++-
 kernel/rcu/tree.h                                  |   2 +-
 kernel/rcu/tree_plugin.h                           |  31 +-
 kernel/sched/fair.c                                |  45 ++-
 kernel/sched/idle.c                                |   1 +
 kernel/seccomp.c                                   |   2 +
 kernel/smp.c                                       |   4 +
 kernel/tracepoint.c                                |  80 ++++-
 mm/compaction.c                                    |  43 +--
 mm/hugetlb.c                                       |  14 +-
 mm/khugepaged.c                                    |  22 +-
 mm/memcontrol.c                                    |  30 +-
 mm/memory-failure.c                                |   6 +
 mm/memory.c                                        |  16 +-
 mm/memremap.c                                      |  15 +
 mm/slab_common.c                                   |   4 +-
 mm/slub.c                                          |   8 +-
 mm/vmscan.c                                        |   9 +-
 net/bluetooth/a2mp.c                               |   3 +-
 net/bluetooth/hci_core.c                           |   6 +-
 net/core/filter.c                                  |  13 +-
 net/ipv4/icmp.c                                    |   5 +-
 net/ipv6/icmp.c                                    |  18 +-
 net/ipv6/ip6_icmp.c                                |  12 +-
 net/mac80211/mesh_hwmp.c                           |   2 +-
 net/nfc/nci/uart.c                                 |   3 +-
 net/qrtr/tun.c                                     |  12 +-
 net/sched/act_api.c                                | 106 ++++---
 net/sched/cls_api.c                                |  12 +-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |   6 +-
 samples/Kconfig                                    |   2 +-
 samples/watch_queue/watch_test.c                   |   2 +-
 security/commoncap.c                               |  12 +-
 security/integrity/evm/evm_crypto.c                |   7 +-
 security/integrity/ima/ima_kexec.c                 |   3 +
 security/integrity/ima/ima_mok.c                   |   5 +-
 security/keys/Kconfig                              |   8 +-
 security/keys/key.c                                |   2 +
 security/keys/trusted-keys/trusted_tpm1.c          |  22 +-
 security/keys/trusted-keys/trusted_tpm2.c          |  22 +-
 security/selinux/hooks.c                           |   4 +
 sound/core/init.c                                  |   4 +
 sound/core/pcm.c                                   |   4 +
 sound/core/pcm_local.h                             |   1 +
 sound/core/pcm_native.c                            |  27 +-
 sound/firewire/fireface/ff-protocol-latter.c       | 118 +++++--
 sound/pci/hda/hda_intel.c                          |   2 +
 sound/pci/hda/patch_hdmi.c                         |   1 -
 sound/pci/hda/patch_realtek.c                      |  40 +++
 sound/soc/codecs/cpcap.c                           |  12 +-
 sound/soc/codecs/cs42l56.c                         |   3 +-
 sound/soc/codecs/rt5682-i2c.c                      |   3 +
 sound/soc/codecs/wsa881x.c                         |   1 +
 sound/soc/generic/simple-card-utils.c              |  13 +-
 sound/soc/intel/boards/sof_sdw.c                   |   6 +-
 sound/soc/qcom/lpass-apq8016.c                     |   2 +-
 sound/soc/qcom/lpass-cpu.c                         |  30 +-
 sound/soc/qcom/lpass-lpaif-reg.h                   |   3 -
 sound/soc/qcom/lpass.h                             |   1 -
 sound/soc/qcom/qdsp6/q6asm-dai.c                   |  21 ++
 sound/soc/qcom/qdsp6/q6routing.c                   |  18 --
 sound/soc/sh/siu.h                                 |   2 +-
 sound/soc/sh/siu_pcm.c                             |   2 +-
 sound/soc/sof/debug.c                              |   2 +-
 sound/soc/sof/intel/hda-dsp.c                      |   4 +
 sound/soc/sof/sof-pci-dev.c                        |   7 +
 sound/usb/pcm.c                                    |   2 +-
 tools/lib/bpf/libbpf.c                             |  22 +-
 tools/objtool/arch/x86/special.c                   |   2 +-
 tools/objtool/check.c                              |  15 +-
 tools/objtool/check.h                              |  11 +
 tools/perf/builtin-record.c                        |   2 +-
 .../pmu-events/arch/arm64/ampere/emag/cache.json   |   2 +-
 tools/perf/tests/sample-parsing.c                  |   2 +-
 tools/perf/util/event.c                            |   2 +
 tools/perf/util/evlist.c                           |   8 +
 tools/perf/util/evlist.h                           |   4 +
 .../perf/util/intel-pt-decoder/intel-pt-decoder.c  |  41 ++-
 .../perf/util/intel-pt-decoder/intel-pt-decoder.h  |   2 +
 tools/perf/util/intel-pt.c                         |  29 +-
 tools/perf/util/symbol.c                           |   7 +-
 tools/testing/kunit/kunit_tool_test.py             |  14 +-
 tools/testing/selftests/bpf/test_xdp_redirect.sh   |  10 +-
 tools/testing/selftests/dmabuf-heaps/Makefile      |   2 +-
 .../trigger-synthetic_event_syntax_errors.tc       |  35 ++-
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |   2 +-
 tools/testing/selftests/powerpc/eeh/eeh-basic.sh   |   2 +-
 tools/testing/selftests/seccomp/seccomp_bpf.c      |   2 +-
 tools/testing/selftests/wireguard/netns.sh         |  15 +-
 672 files changed, 5877 insertions(+), 3028 deletions(-)



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 001/663] vmlinux.lds.h: add DWARF v5 sections
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 002/663] vdpa/mlx5: fix param validation in mlx5_vdpa_get_config() Greg Kroah-Hartman
                   ` (662 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Murphy, Fangrui Song,
	Nathan Chancellor, Mark Wielaard, Sedat Dilek, Nick Desaulniers,
	Masahiro Yamada

From: Nick Desaulniers <ndesaulniers@google.com>

commit 3c4fa46b30c551b1df2fb1574a684f68bc22067c upstream.

We expect toolchains to produce these new debug info sections as part of
DWARF v5. Add explicit placements to prevent the linker warnings from
--orphan-section=warn.

Compilers may produce such sections with explicit -gdwarf-5, or based on
the implicit default version of DWARF when -g is used via DEBUG_INFO.
This implicit default changes over time, and has changed to DWARF v5
with GCC 11.

.debug_sup was mentioned in review, but without compilers producing it
today, let's wait to add it until it becomes necessary.

Cc: stable@vger.kernel.org
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1922707
Reported-by: Chris Murphy <lists@colorremedies.com>
Suggested-by: Fangrui Song <maskray@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Mark Wielaard <mark@klomp.org>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/asm-generic/vmlinux.lds.h |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -828,8 +828,13 @@
 		/* DWARF 4 */						\
 		.debug_types	0 : { *(.debug_types) }			\
 		/* DWARF 5 */						\
+		.debug_addr	0 : { *(.debug_addr) }			\
+		.debug_line_str	0 : { *(.debug_line_str) }		\
+		.debug_loclists	0 : { *(.debug_loclists) }		\
 		.debug_macro	0 : { *(.debug_macro) }			\
-		.debug_addr	0 : { *(.debug_addr) }
+		.debug_names	0 : { *(.debug_names) }			\
+		.debug_rnglists	0 : { *(.debug_rnglists) }		\
+		.debug_str_offsets	0 : { *(.debug_str_offsets) }
 
 /* Stabs debugging sections. */
 #define STABS_DEBUG							\



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 002/663] vdpa/mlx5: fix param validation in mlx5_vdpa_get_config()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 001/663] vmlinux.lds.h: add DWARF v5 sections Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 003/663] debugfs: be more robust at handling improper input in debugfs_lookup() Greg Kroah-Hartman
                   ` (661 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefano Garzarella,
	Michael S. Tsirkin, Jason Wang, Eli Cohen

From: Stefano Garzarella <sgarzare@redhat.com>

commit dcfde1635e764fd69cc756c7780d144e288608e9 upstream.

It's legal to have 'offset + len' equal to
sizeof(struct virtio_net_config), since 'ndev->config' is a
'struct virtio_net_config', so we can safely copy its content under
this condition.

Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20210208161741.104939-1-sgarzare@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eli Cohen <elic@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vdpa/mlx5/net/mlx5_vnet.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -1805,7 +1805,7 @@ static void mlx5_vdpa_get_config(struct
 	struct mlx5_vdpa_dev *mvdev = to_mvdev(vdev);
 	struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
 
-	if (offset + len < sizeof(struct virtio_net_config))
+	if (offset + len <= sizeof(struct virtio_net_config))
 		memcpy(buf, (u8 *)&ndev->config + offset, len);
 }
 



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 003/663] debugfs: be more robust at handling improper input in debugfs_lookup()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 001/663] vmlinux.lds.h: add DWARF v5 sections Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 002/663] vdpa/mlx5: fix param validation in mlx5_vdpa_get_config() Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 004/663] debugfs: do not attempt to create a new file before the filesystem is initalized Greg Kroah-Hartman
                   ` (660 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Michael Walle,
	Marc Zyngier

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bc6de804d36b3709d54fa22bd128cbac91c11526 upstream.

debugfs_lookup() doesn't like it if it is passed an illegal name
pointer, or if the filesystem isn't even initialized yet.  If either of
these happen, it will crash the system, so fix it up by properly testing
for valid input and that we are up and running before trying to find a
file in the filesystem.

Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: stable <stable@vger.kernel.org>
Reported-by: Michael Walle <michael@walle.cc>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210218100818.3622317-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/debugfs/inode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -297,7 +297,7 @@ struct dentry *debugfs_lookup(const char
 {
 	struct dentry *dentry;
 
-	if (IS_ERR(parent))
+	if (!debugfs_initialized() || IS_ERR_OR_NULL(name) || IS_ERR(parent))
 		return NULL;
 
 	if (!parent)



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 004/663] debugfs: do not attempt to create a new file before the filesystem is initalized
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 003/663] debugfs: be more robust at handling improper input in debugfs_lookup() Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 005/663] scsi: libsas: docs: Remove notify_ha_event() Greg Kroah-Hartman
                   ` (659 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Michael Walle,
	Marc Zyngier

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 56348560d495d2501e87db559a61de717cd3ab02 upstream.

Some subsystems want to add debugfs files at early boot, way before
debugfs is initialized.  This seems to work somehow as the vfs layer
will not allow it to happen, but let's be explicit and test to ensure we
are properly up and running before allowing files to be created.

Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: stable <stable@vger.kernel.org>
Reported-by: Michael Walle <michael@walle.cc>
Reported-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210218100818.3622317-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/debugfs/inode.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -318,6 +318,9 @@ static struct dentry *start_creating(con
 	if (!(debugfs_allow & DEBUGFS_ALLOW_API))
 		return ERR_PTR(-EPERM);
 
+	if (!debugfs_initialized())
+		return ERR_PTR(-ENOENT);
+
 	pr_debug("creating file '%s'\n", name);
 
 	if (IS_ERR(parent))



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 005/663] scsi: libsas: docs: Remove notify_ha_event()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 004/663] debugfs: do not attempt to create a new file before the filesystem is initalized Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 006/663] scsi: qla2xxx: Fix mailbox Ch erroneous error Greg Kroah-Hartman
                   ` (658 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Garry, Jack Wang,
	Ahmed S. Darwish, Martin K. Petersen

From: Ahmed S. Darwish <a.darwish@linutronix.de>

commit 3f901c81dfad6930de5d4e6b582c4fde880cdada upstream.

The ->notify_ha_event() hook has long been removed from the libsas event
interface.

Remove it from documentation.

Link: https://lore.kernel.org/r/20210118100955.1761652-2-a.darwish@linutronix.de
Fixes: 042ebd293b86 ("scsi: libsas: kill useless ha_event and do some cleanup")
Cc: stable@vger.kernel.org
Reviewed-by: John Garry <john.garry@huawei.com>
Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/scsi/libsas.rst |    1 -
 1 file changed, 1 deletion(-)

--- a/Documentation/scsi/libsas.rst
+++ b/Documentation/scsi/libsas.rst
@@ -189,7 +189,6 @@ num_phys
 The event interface::
 
 	/* LLDD calls these to notify the class of an event. */
-	void (*notify_ha_event)(struct sas_ha_struct *, enum ha_event);
 	void (*notify_port_event)(struct sas_phy *, enum port_event);
 	void (*notify_phy_event)(struct sas_phy *, enum phy_event);
 



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 006/663] scsi: qla2xxx: Fix mailbox Ch erroneous error
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 005/663] scsi: libsas: docs: Remove notify_ha_event() Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 007/663] kdb: Make memory allocations more robust Greg Kroah-Hartman
                   ` (657 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Quinn Tran,
	Nilesh Javali, Martin K. Petersen

From: Quinn Tran <qutran@marvell.com>

commit 044c218b04503858ca4e17f61899c8baa0ae9ba1 upstream.

Mailbox Ch/dump ram extend expects mb register 10 to be set. If not
set/clear, firmware can pick up garbage from previous invocation of this
mailbox. Example: mctp dump can set mb10.  On subsequent flash read which
use mailbox cmd Ch, mb10 can retain previous value.

Link: https://lore.kernel.org/r/20210111093134.1206-6-njavali@marvell.com
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_dbg.c |    1 +
 drivers/scsi/qla2xxx/qla_mbx.c |    3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -202,6 +202,7 @@ qla24xx_dump_ram(struct qla_hw_data *ha,
 		wrt_reg_word(&reg->mailbox0, MBC_DUMP_RISC_RAM_EXTENDED);
 		wrt_reg_word(&reg->mailbox1, LSW(addr));
 		wrt_reg_word(&reg->mailbox8, MSW(addr));
+		wrt_reg_word(&reg->mailbox10, 0);
 
 		wrt_reg_word(&reg->mailbox2, MSW(LSD(dump_dma)));
 		wrt_reg_word(&reg->mailbox3, LSW(LSD(dump_dma)));
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4277,7 +4277,8 @@ qla2x00_dump_ram(scsi_qla_host_t *vha, d
 	if (MSW(addr) || IS_FWI2_CAPABLE(vha->hw)) {
 		mcp->mb[0] = MBC_DUMP_RISC_RAM_EXTENDED;
 		mcp->mb[8] = MSW(addr);
-		mcp->out_mb = MBX_8|MBX_0;
+		mcp->mb[10] = 0;
+		mcp->out_mb = MBX_10|MBX_8|MBX_0;
 	} else {
 		mcp->mb[0] = MBC_DUMP_RISC_RAM;
 		mcp->out_mb = MBX_0;



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 007/663] kdb: Make memory allocations more robust
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 006/663] scsi: qla2xxx: Fix mailbox Ch erroneous error Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 008/663] w1: w1_therm: Fix conversion result for negative temperatures Greg Kroah-Hartman
                   ` (656 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sumit Garg, Daniel Thompson

From: Sumit Garg <sumit.garg@linaro.org>

commit 93f7a6d818deef69d0ba652d46bae6fbabbf365c upstream.

Currently kdb uses in_interrupt() to determine whether its library
code has been called from the kgdb trap handler or from a saner calling
context such as driver init. This approach is broken because
in_interrupt() alone isn't able to determine kgdb trap handler entry from
normal task context. This can happen during normal use of basic features
such as breakpoints and can also be trivially reproduced using:
echo g > /proc/sysrq-trigger

We can improve this by adding check for in_dbg_master() instead which
explicitly determines if we are running in debugger context.

Cc: stable@vger.kernel.org
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Link: https://lore.kernel.org/r/1611313556-4004-1-git-send-email-sumit.garg@linaro.org
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/debug/kdb/kdb_private.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -230,7 +230,7 @@ extern struct task_struct *kdb_curr_task
 
 #define kdb_task_has_cpu(p) (task_curr(p))
 
-#define GFP_KDB (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
+#define GFP_KDB (in_dbg_master() ? GFP_ATOMIC : GFP_KERNEL)
 
 extern void *debug_kmalloc(size_t size, gfp_t flags);
 extern void debug_kfree(void *);



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 008/663] w1: w1_therm: Fix conversion result for negative temperatures
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 007/663] kdb: Make memory allocations more robust Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 009/663] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 Greg Kroah-Hartman
                   ` (655 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Marciniak, Ivan Zaentsev

From: Ivan Zaentsev <ivan.zaentsev@wirenboard.ru>

commit 2f6055c26f1913763eabc66c7c27d0693561e966 upstream.

DS18B20 device driver returns an incorrect value for negative temperatures
due to a missing sign-extension in w1_DS18B20_convert_temp().

Fix by using s16 temperature value when converting to int.

Fixes: 9ace0b4dab1c (w1: w1_therm: Add support for GXCAS GX20MH01 device.)
Cc: stable <stable@vger.kernel.org>
Reported-by: Paweł Marciniak <sunwire@gmail.com>
Signed-off-by: Ivan Zaentsev <ivan.zaentsev@wirenboard.ru>
Link: https://lore.kernel.org/r/20210121093021.224764-1-ivan.zaentsev@wirenboard.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_therm.c |   22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -667,28 +667,24 @@ static inline int w1_DS18B20_get_resolut
  */
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-	int t;
-	u32 bv;
+	u16 bv;
+	s16 t;
+
+	/* Signed 16-bit value to unsigned, cpu order */
+	bv = le16_to_cpup((__le16 *)rom);
 
 	/* Config register bit R2 = 1 - GX20MH01 in 13 or 14 bit resolution mode */
 	if (rom[4] & 0x80) {
-		/* Signed 16-bit value to unsigned, cpu order */
-		bv = le16_to_cpup((__le16 *)rom);
-
 		/* Insert two temperature bits from config register */
 		/* Avoid arithmetic shift of signed value */
 		bv = (bv << 2) | (rom[4] & 3);
-
-		t = (int) sign_extend32(bv, 17); /* Degrees, lowest bit is 2^-6 */
-		return (t*1000)/64;  /* Millidegrees */
+		t = (s16) bv;	/* Degrees, lowest bit is 2^-6 */
+		return (int)t * 1000 / 64;	/* Sign-extend to int; millidegrees */
 	}
-
-	t = (int)le16_to_cpup((__le16 *)rom);
-	return t*1000/16;
+	t = (s16)bv;	/* Degrees, lowest bit is 2^-4 */
+	return (int)t * 1000 / 16;	/* Sign-extend to int; millidegrees */
 }
 
-
-
 /**
  * w1_DS18S20_convert_temp() - temperature computation for DS18S20
  * @rom: data read from device RAM (8 data bytes + 1 CRC byte)



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 009/663] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 008/663] w1: w1_therm: Fix conversion result for negative temperatures Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 010/663] PCI: Decline to resize resources if boot config must be preserved Greg Kroah-Hartman
                   ` (654 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilia Mirkin, Ansuel Smith,
	Lorenzo Pieralisi, Bjorn Helgaas, Stanimir Varbanov

From: Ansuel Smith <ansuelsmth@gmail.com>

commit 2cfef1971aea6119ee27429181d6cb3383031ac2 upstream.

The use of PHY_REFCLK_USE_PAD introduced a regression for apq8064 devices.
It was tested that while apq doesn't require the padding, ipq SoC must use
it or the kernel hangs on boot.

Link: https://lore.kernel.org/r/20201019165555.8269-1-ansuelsmth@gmail.com
Fixes: de3c4bf64897 ("PCI: qcom: Add support for tx term offset for rev 2.1.0")
Reported-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Cc: stable@vger.kernel.org	# v4.19+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pcie-qcom.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -395,7 +395,9 @@ static int qcom_pcie_init_2_1_0(struct q
 
 	/* enable external reference clock */
 	val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
-	val &= ~PHY_REFCLK_USE_PAD;
+	/* USE_PAD is required only for ipq806x */
+	if (!of_device_is_compatible(node, "qcom,pcie-apq8064"))
+		val &= ~PHY_REFCLK_USE_PAD;
 	val |= PHY_REFCLK_SSP_EN;
 	writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
 



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 010/663] PCI: Decline to resize resources if boot config must be preserved
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 009/663] PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 011/663] virt: vbox: Do not use wait_event_interruptible when called from kernel context Greg Kroah-Hartman
                   ` (653 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Bjorn Helgaas

From: Ard Biesheuvel <ardb@kernel.org>

commit 729e3a669d1b62e9876a671ac03ccba399a23b68 upstream.

The _DSM #5 method in the ACPI host bridge object tells us whether the OS
must preserve the resource assignments done by firmware. If this is the
case, we should not permit drivers to resize BARs on the fly. Make
pci_resize_resource() take this into account.

Link: https://lore.kernel.org/r/20210109095353.13417-1-ardb@kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v5.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/setup-res.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -410,10 +410,16 @@ EXPORT_SYMBOL(pci_release_resource);
 int pci_resize_resource(struct pci_dev *dev, int resno, int size)
 {
 	struct resource *res = dev->resource + resno;
+	struct pci_host_bridge *host;
 	int old, ret;
 	u32 sizes;
 	u16 cmd;
 
+	/* Check if we must preserve the firmware's resource assignment */
+	host = pci_find_host_bridge(dev->bus);
+	if (host->preserve_config)
+		return -ENOTSUPP;
+
 	/* Make sure the resource isn't assigned before resizing it. */
 	if (!(res->flags & IORESOURCE_UNSET))
 		return -EBUSY;



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 011/663] virt: vbox: Do not use wait_event_interruptible when called from kernel context
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 010/663] PCI: Decline to resize resources if boot config must be preserved Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 012/663] bfq: Avoid false bfq queue merging Greg Kroah-Hartman
                   ` (652 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ludovic Pouzenc, Hans de Goede

From: Hans de Goede <hdegoede@redhat.com>

commit c35901b39ddc20077f4ae7b9f7bf344487f62212 upstream.

Do not use wait_event_interruptible when vbg_hgcm_call() gets called from
kernel-context, such as it being called by the vboxsf filesystem code.

This fixes some filesystem related system calls on shared folders
unexpectedly failing with -EINTR.

Fixes: 0532a1b0d045 ("virt: vbox: Implement passing requestor info to the host for VirtualBox 6.0.x")
Reported-by: Ludovic Pouzenc <bugreports@pouzenc.fr>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210121150754.147598-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/virt/vboxguest/vboxguest_utils.c |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -468,7 +468,7 @@ static int hgcm_cancel_call(struct vbg_d
  *               Cancellation fun.
  */
 static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
-			    u32 timeout_ms, bool *leak_it)
+			    u32 timeout_ms, bool interruptible, bool *leak_it)
 {
 	int rc, cancel_rc, ret;
 	long timeout;
@@ -495,10 +495,15 @@ static int vbg_hgcm_do_call(struct vbg_d
 	else
 		timeout = msecs_to_jiffies(timeout_ms);
 
-	timeout = wait_event_interruptible_timeout(
-					gdev->hgcm_wq,
-					hgcm_req_done(gdev, &call->header),
-					timeout);
+	if (interruptible) {
+		timeout = wait_event_interruptible_timeout(gdev->hgcm_wq,
+							   hgcm_req_done(gdev, &call->header),
+							   timeout);
+	} else {
+		timeout = wait_event_timeout(gdev->hgcm_wq,
+					     hgcm_req_done(gdev, &call->header),
+					     timeout);
+	}
 
 	/* timeout > 0 means hgcm_req_done has returned true, so success */
 	if (timeout > 0)
@@ -631,7 +636,8 @@ int vbg_hgcm_call(struct vbg_dev *gdev,
 	hgcm_call_init_call(call, client_id, function, parms, parm_count,
 			    bounce_bufs);
 
-	ret = vbg_hgcm_do_call(gdev, call, timeout_ms, &leak_it);
+	ret = vbg_hgcm_do_call(gdev, call, timeout_ms,
+			       requestor & VMMDEV_REQUESTOR_USERMODE, &leak_it);
 	if (ret == 0) {
 		*vbox_status = call->header.result;
 		ret = hgcm_call_copy_back_result(call, parms, parm_count,



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 012/663] bfq: Avoid false bfq queue merging
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 011/663] virt: vbox: Do not use wait_event_interruptible when called from kernel context Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 013/663] ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode Greg Kroah-Hartman
                   ` (651 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Kara, Paolo Valente, Jens Axboe

From: Jan Kara <jack@suse.cz>

commit 41e76c85660c022c6bf5713bfb6c21e64a487cec upstream.

bfq_setup_cooperator() uses bfqd->in_serv_last_pos so detect whether it
makes sense to merge current bfq queue with the in-service queue.
However if the in-service queue is freshly scheduled and didn't dispatch
any requests yet, bfqd->in_serv_last_pos is stale and contains value
from the previously scheduled bfq queue which can thus result in a bogus
decision that the two queues should be merged. This bug can be observed
for example with the following fio jobfile:

[global]
direct=0
ioengine=sync
invalidate=1
size=1g
rw=read

[reader]
numjobs=4
directory=/mnt

where the 4 processes will end up in the one shared bfq queue although
they do IO to physically very distant files (for some reason I was able to
observe this only with slice_idle=1ms setting).

Fix the problem by invalidating bfqd->in_serv_last_pos when switching
in-service queue.

Fixes: 058fdecc6de7 ("block, bfq: fix in-service-queue check for queue merging")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Acked-by: Paolo Valente <paolo.valente@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/bfq-iosched.c |    1 +
 1 file changed, 1 insertion(+)

--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2937,6 +2937,7 @@ static void __bfq_set_in_service_queue(s
 	}
 
 	bfqd->in_service_queue = bfqq;
+	bfqd->in_serv_last_pos = 0;
 }
 
 /*



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 013/663] ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 012/663] bfq: Avoid false bfq queue merging Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 014/663] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Greg Kroah-Hartman
                   ` (650 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit fb3c293b82c31a9a68fbcf4e7a45fadd8a47ea2b upstream.

The commit f274baa49be6 ("ALSA: usb-audio: Allow non-vmalloc buffer
for PCM buffers") introduced the mode to allocate coherent pages for
PCM buffers, and it used bus->controller device as its DMA device.
It turned out, however, that bus->sysdev is a more appropriate device
to be used for DMA mapping in HCD code.

This patch corrects the device reference accordingly.

Note that, on most platforms, both point to the very same device,
hence this patch doesn't change anything practically.  But on
platforms like xhcd-plat hcd, the change becomes effective.

Fixes: f274baa49be6 ("ALSA: usb-audio: Allow non-vmalloc buffer for PCM buffers")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210205144559.29555-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1861,7 +1861,7 @@ void snd_usb_preallocate_buffer(struct s
 {
 	struct snd_pcm *pcm = subs->stream->pcm;
 	struct snd_pcm_substream *s = pcm->streams[subs->direction].substream;
-	struct device *dev = subs->dev->bus->controller;
+	struct device *dev = subs->dev->bus->sysdev;
 
 	if (snd_usb_use_vmalloc)
 		snd_pcm_set_managed_buffer(s, SNDRV_DMA_TYPE_VMALLOC,



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 014/663] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 013/663] ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 015/663] vmlinux.lds.h: Define SANTIZER_DISCARDS with CONFIG_GCOV_KERNEL=y Greg Kroah-Hartman
                   ` (649 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Lobakin, Kees Cook,
	Nathan Chancellor, Thomas Bogendoerfer

From: Alexander Lobakin <alobakin@pm.me>

commit 8ac7c87acdcac156670f9920c8acbd84308ff4b1 upstream.

MIPS uses its own declaration of rwdata, and thus it should be kept
in sync with the asm-generic one. Currently PAGE_ALIGNED_DATA() is
missing from the linker script, which emits the following ld
warnings:

mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/kernel/vdso.o' being placed
in section `.data..page_aligned'
mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/vdso/vdso-image.o' being placed
in section `.data..page_aligned'

Add the necessary declaration, so the mentioned structures will be
placed in vmlinux as intended:

ffffffff80630580 D __end_once
ffffffff80630580 D __start___dyndbg
ffffffff80630580 D __start_once
ffffffff80630580 D __stop___dyndbg
ffffffff80634000 d mips_vdso_data
ffffffff80638000 d vdso_data
ffffffff80638580 D _gp
ffffffff8063c000 T __init_begin
ffffffff8063c000 D _edata
ffffffff8063c000 T _sinittext

->

ffffffff805a4000 D __end_init_task
ffffffff805a4000 D __nosave_begin
ffffffff805a4000 D __nosave_end
ffffffff805a4000 d mips_vdso_data
ffffffff805a8000 d vdso_data
ffffffff805ac000 D mmlist_lock
ffffffff805ac080 D tasklist_lock

Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO")
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: stable@vger.kernel.org # 4.4+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/vmlinux.lds.S |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -90,6 +90,7 @@ SECTIONS
 
 		INIT_TASK_DATA(THREAD_SIZE)
 		NOSAVE_DATA
+		PAGE_ALIGNED_DATA(PAGE_SIZE)
 		CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
 		READ_MOSTLY_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
 		DATA_DATA



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 015/663] vmlinux.lds.h: Define SANTIZER_DISCARDS with CONFIG_GCOV_KERNEL=y
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 014/663] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 016/663] random: fix the RNDRESEEDCRNG ioctl Greg Kroah-Hartman
                   ` (648 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Fangrui Song,
	Nick Desaulniers, Nathan Chancellor, Kees Cook

From: Nathan Chancellor <nathan@kernel.org>

commit f5b6a74d9c08b19740ca056876bf6584acdba582 upstream.

clang produces .eh_frame sections when CONFIG_GCOV_KERNEL is enabled,
even when -fno-asynchronous-unwind-tables is in KBUILD_CFLAGS:

$ make CC=clang vmlinux
...
ld: warning: orphan section `.eh_frame' from `init/main.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/version.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/do_mounts.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/do_mounts_initrd.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/initramfs.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/calibrate.o' being placed in section `.eh_frame'
ld: warning: orphan section `.eh_frame' from `init/init_task.o' being placed in section `.eh_frame'
...

$ rg "GCOV_KERNEL|GCOV_PROFILE_ALL" .config
CONFIG_GCOV_KERNEL=y
CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
CONFIG_GCOV_PROFILE_ALL=y

This was already handled for a couple of other options in
commit d812db78288d ("vmlinux.lds.h: Avoid KASAN and KCSAN's unwanted
sections") and there is an open LLVM bug for this issue. Take advantage
of that section for this config as well so that there are no more orphan
warnings.

Link: https://bugs.llvm.org/show_bug.cgi?id=46478
Link: https://github.com/ClangBuiltLinux/linux/issues/1069
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Fangrui Song <maskray@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Fixes: d812db78288d ("vmlinux.lds.h: Avoid KASAN and KCSAN's unwanted sections")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210130004650.2682422-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/asm-generic/vmlinux.lds.h |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -993,12 +993,13 @@
 #endif
 
 /*
- * Clang's -fsanitize=kernel-address and -fsanitize=thread produce
- * unwanted sections (.eh_frame and .init_array.*), but
- * CONFIG_CONSTRUCTORS wants to keep any .init_array.* sections.
+ * Clang's -fprofile-arcs, -fsanitize=kernel-address, and
+ * -fsanitize=thread produce unwanted sections (.eh_frame
+ * and .init_array.*), but CONFIG_CONSTRUCTORS wants to
+ * keep any .init_array.* sections.
  * https://bugs.llvm.org/show_bug.cgi?id=46478
  */
-#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KCSAN)
+#if defined(CONFIG_GCOV_KERNEL) || defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KCSAN)
 # ifdef CONFIG_CONSTRUCTORS
 #  define SANITIZER_DISCARDS						\
 	*(.eh_frame)



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 016/663] random: fix the RNDRESEEDCRNG ioctl
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 015/663] vmlinux.lds.h: Define SANTIZER_DISCARDS with CONFIG_GCOV_KERNEL=y Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 017/663] ALSA: pcm: Call sync_stop at disconnection Greg Kroah-Hartman
                   ` (647 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, linux-crypto, Andy Lutomirski,
	Jann Horn, Theodore Tso, Ard Biesheuvel, Eric Biggers

From: Eric Biggers <ebiggers@google.com>

commit 11a0b5e0ec8c13bef06f7414f9e914506140d5cb upstream.

The RNDRESEEDCRNG ioctl reseeds the primary_crng from itself, which
doesn't make sense.  Reseed it from the input_pool instead.

Fixes: d848e5f8e1eb ("random: add new ioctl RNDRESEEDCRNG")
Cc: stable@vger.kernel.org
Cc: linux-crypto@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jann Horn <jannh@google.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20210112192818.69921-1-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/random.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1972,7 +1972,7 @@ static long random_ioctl(struct file *f,
 			return -EPERM;
 		if (crng_init < 2)
 			return -ENODATA;
-		crng_reseed(&primary_crng, NULL);
+		crng_reseed(&primary_crng, &input_pool);
 		crng_global_init_time = jiffies - 1;
 		return 0;
 	default:



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 017/663] ALSA: pcm: Call sync_stop at disconnection
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 016/663] random: fix the RNDRESEEDCRNG ioctl Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 018/663] ALSA: pcm: Assure sync with the pending stop operation at suspend Greg Kroah-Hartman
                   ` (646 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 29bb274e94974669acb5186a75538f20df1508b6 upstream.

The PCM core should perform the sync for the pending stop operations
at disconnection.  Otherwise it may lead to unexpected access.

Currently the old user of sync_stop, USB-audio driver, has its own
sync, so this isn't needed, but it's better to guarantee the sync in
the PCM core level.

This patch adds the missing sync_stop call at PCM disconnection
callback.  It also assures the IRQ sync if it's specified in the
card.  snd_pcm_sync_stop() is slightly modified to be called also for
any PCM substream object now.

Fixes: 1e850beea278 ("ALSA: pcm: Add the support for sync-stop operation")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210206203656.15959-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/init.c       |    4 ++++
 sound/core/pcm.c        |    4 ++++
 sound/core/pcm_local.h  |    1 +
 sound/core/pcm_native.c |   16 ++++++++--------
 4 files changed, 17 insertions(+), 8 deletions(-)

--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -14,6 +14,7 @@
 #include <linux/ctype.h>
 #include <linux/pm.h>
 #include <linux/completion.h>
+#include <linux/interrupt.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -418,6 +419,9 @@ int snd_card_disconnect(struct snd_card
 	/* notify all devices that we are disconnected */
 	snd_device_disconnect_all(card);
 
+	if (card->sync_irq > 0)
+		synchronize_irq(card->sync_irq);
+
 	snd_info_card_disconnect(card);
 	if (card->registered) {
 		device_del(&card->card_dev);
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -1111,6 +1111,10 @@ static int snd_pcm_dev_disconnect(struct
 		}
 	}
 
+	for (cidx = 0; cidx < 2; cidx++)
+		for (substream = pcm->streams[cidx].substream; substream; substream = substream->next)
+			snd_pcm_sync_stop(substream, false);
+
 	pcm_call_notify(pcm, n_disconnect);
 	for (cidx = 0; cidx < 2; cidx++) {
 		snd_unregister_device(&pcm->streams[cidx].dev);
--- a/sound/core/pcm_local.h
+++ b/sound/core/pcm_local.h
@@ -63,6 +63,7 @@ static inline void snd_pcm_timer_done(st
 
 void __snd_pcm_xrun(struct snd_pcm_substream *substream);
 void snd_pcm_group_init(struct snd_pcm_group *group);
+void snd_pcm_sync_stop(struct snd_pcm_substream *substream, bool sync_irq);
 
 #ifdef CONFIG_SND_DMA_SGBUF
 struct page *snd_pcm_sgbuf_ops_page(struct snd_pcm_substream *substream,
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -583,13 +583,13 @@ static inline void snd_pcm_timer_notify(
 #endif
 }
 
-static void snd_pcm_sync_stop(struct snd_pcm_substream *substream)
+void snd_pcm_sync_stop(struct snd_pcm_substream *substream, bool sync_irq)
 {
-	if (substream->runtime->stop_operating) {
+	if (substream->runtime && substream->runtime->stop_operating) {
 		substream->runtime->stop_operating = false;
-		if (substream->ops->sync_stop)
+		if (substream->ops && substream->ops->sync_stop)
 			substream->ops->sync_stop(substream);
-		else if (substream->pcm->card->sync_irq > 0)
+		else if (sync_irq && substream->pcm->card->sync_irq > 0)
 			synchronize_irq(substream->pcm->card->sync_irq);
 	}
 }
@@ -686,7 +686,7 @@ static int snd_pcm_hw_params(struct snd_
 		if (atomic_read(&substream->mmap_count))
 			return -EBADFD;
 
-	snd_pcm_sync_stop(substream);
+	snd_pcm_sync_stop(substream, true);
 
 	params->rmask = ~0U;
 	err = snd_pcm_hw_refine(substream, params);
@@ -809,7 +809,7 @@ static int do_hw_free(struct snd_pcm_sub
 {
 	int result = 0;
 
-	snd_pcm_sync_stop(substream);
+	snd_pcm_sync_stop(substream, true);
 	if (substream->ops->hw_free)
 		result = substream->ops->hw_free(substream);
 	if (substream->managed_buffer_alloc)
@@ -1736,7 +1736,7 @@ static void snd_pcm_post_resume(struct s
 	snd_pcm_trigger_tstamp(substream);
 	runtime->status->state = runtime->status->suspended_state;
 	snd_pcm_timer_notify(substream, SNDRV_TIMER_EVENT_MRESUME);
-	snd_pcm_sync_stop(substream);
+	snd_pcm_sync_stop(substream, true);
 }
 
 static const struct action_ops snd_pcm_action_resume = {
@@ -1866,7 +1866,7 @@ static int snd_pcm_do_prepare(struct snd
 			      snd_pcm_state_t state)
 {
 	int err;
-	snd_pcm_sync_stop(substream);
+	snd_pcm_sync_stop(substream, true);
 	err = substream->ops->prepare(substream);
 	if (err < 0)
 		return err;



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 018/663] ALSA: pcm: Assure sync with the pending stop operation at suspend
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 017/663] ALSA: pcm: Call sync_stop at disconnection Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 019/663] ALSA: pcm: Dont call sync_stop if it hasnt been stopped Greg Kroah-Hartman
                   ` (645 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 2c87c1a49c9d113a9f3e8e951d7d64be5ff50ac1 upstream.

The current PCM code calls the sync_stop at the resume action due to
the analogy to the PCM prepare call pattern.  But, it makes little
sense, as the sync should have been done rather at the suspend time,
not at the resume time.

This patch corrects the sync_stop call at suspend/resume to assure the
sync before finishing the suspend.

Fixes: 1e850beea278 ("ALSA: pcm: Add the support for sync-stop operation")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210206203656.15959-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/pcm_native.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1615,6 +1615,7 @@ static int snd_pcm_do_suspend(struct snd
 	if (! snd_pcm_running(substream))
 		return 0;
 	substream->ops->trigger(substream, SNDRV_PCM_TRIGGER_SUSPEND);
+	runtime->stop_operating = true;
 	return 0; /* suspend unconditionally */
 }
 
@@ -1691,6 +1692,12 @@ int snd_pcm_suspend_all(struct snd_pcm *
 				return err;
 		}
 	}
+
+	for (stream = 0; stream < 2; stream++)
+		for (substream = pcm->streams[stream].substream;
+		     substream; substream = substream->next)
+			snd_pcm_sync_stop(substream, false);
+
 	return 0;
 }
 EXPORT_SYMBOL(snd_pcm_suspend_all);
@@ -1736,7 +1743,6 @@ static void snd_pcm_post_resume(struct s
 	snd_pcm_trigger_tstamp(substream);
 	runtime->status->state = runtime->status->suspended_state;
 	snd_pcm_timer_notify(substream, SNDRV_TIMER_EVENT_MRESUME);
-	snd_pcm_sync_stop(substream, true);
 }
 
 static const struct action_ops snd_pcm_action_resume = {



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 019/663] ALSA: pcm: Dont call sync_stop if it hasnt been stopped
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 018/663] ALSA: pcm: Assure sync with the pending stop operation at suspend Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 020/663] drm/i915/gt: One more flush for Baytrail clear residuals Greg Kroah-Hartman
                   ` (644 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 700cb70730777c159a988e01daa93f20a1ae9b58 upstream.

The PCM stop operation sets the stop_operating flag for indicating the
sync_stop post-process.  This flag is, however, set unconditionally
even if the PCM trigger weren't issued.  This may lead to
inconsistency in the driver side.

Correct the code to set stop_operating flag only after the trigger
STOP is actually called.

Fixes: 1e850beea278 ("ALSA: pcm: Add the support for sync-stop operation")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210206203656.15959-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/pcm_native.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1421,8 +1421,10 @@ static int snd_pcm_do_stop(struct snd_pc
 			   snd_pcm_state_t state)
 {
 	if (substream->runtime->trigger_master == substream &&
-	    snd_pcm_running(substream))
+	    snd_pcm_running(substream)) {
 		substream->ops->trigger(substream, SNDRV_PCM_TRIGGER_STOP);
+		substream->runtime->stop_operating = true;
+	}
 	return 0; /* unconditonally stop all substreams */
 }
 
@@ -1435,7 +1437,6 @@ static void snd_pcm_post_stop(struct snd
 		runtime->status->state = state;
 		snd_pcm_timer_notify(substream, SNDRV_TIMER_EVENT_MSTOP);
 	}
-	runtime->stop_operating = true;
 	wake_up(&runtime->sleep);
 	wake_up(&runtime->tsleep);
 }



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 020/663] drm/i915/gt: One more flush for Baytrail clear residuals
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 019/663] ALSA: pcm: Dont call sync_stop if it hasnt been stopped Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 021/663] ath10k: Fix error handling in case of CE pipe init failure Greg Kroah-Hartman
                   ` (643 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Wilson, Mika Kuoppala,
	Akeem G Abodunrin, Hans de Goede, Diego Calleja

From: Chris Wilson <chris@chris-wilson.co.uk>

commit e627d5923cae93fa4188f4c4afba6486169a1337 upstream.

CI reports that Baytail requires one more invalidate after CACHE_MODE
for it to be happy.

Fixes: ace44e13e577 ("drm/i915/gt: Clear CACHE_MODE prior to clearing residuals")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Reviewed-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Diego Calleja <diegocg@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210119110802.22228-1-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/gt/gen7_renderclear.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
@@ -353,19 +353,21 @@ static void gen7_emit_pipeline_flush(str
 
 static void gen7_emit_pipeline_invalidate(struct batch_chunk *batch)
 {
-	u32 *cs = batch_alloc_items(batch, 0, 8);
+	u32 *cs = batch_alloc_items(batch, 0, 10);
 
 	/* ivb: Stall before STATE_CACHE_INVALIDATE */
-	*cs++ = GFX_OP_PIPE_CONTROL(4);
+	*cs++ = GFX_OP_PIPE_CONTROL(5);
 	*cs++ = PIPE_CONTROL_STALL_AT_SCOREBOARD |
 		PIPE_CONTROL_CS_STALL;
 	*cs++ = 0;
 	*cs++ = 0;
+	*cs++ = 0;
 
-	*cs++ = GFX_OP_PIPE_CONTROL(4);
+	*cs++ = GFX_OP_PIPE_CONTROL(5);
 	*cs++ = PIPE_CONTROL_STATE_CACHE_INVALIDATE;
 	*cs++ = 0;
 	*cs++ = 0;
+	*cs++ = 0;
 
 	batch_advance(batch, cs);
 }
@@ -397,6 +399,7 @@ static void emit_batch(struct i915_vma *
 	batch_add(&cmds, 0xffff0000);
 	batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_1));
 	batch_add(&cmds, 0xffff0000 | PIXEL_SUBSPAN_COLLECT_OPT_DISABLE);
+	gen7_emit_pipeline_invalidate(&cmds);
 	gen7_emit_pipeline_flush(&cmds);
 
 	/* Switch to the media pipeline and our base address */



^ permalink raw reply	[flat|nested] 682+ messages in thread

* [PATCH 5.10 021/663] ath10k: Fix error handling in case of CE pipe init failure
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 020/663] drm/i915/gt: One more flush for Baytrail clear residuals Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 022/663] Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
                   ` (642 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Brian Norris,
	Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit 31561e8557cd1eeba5806ac9ce820f8323b2201b ]

Currently if the copy engine pipe init fails for snoc based
chipsets, the rri is not freed.

Fix this error handling for copy engine pipe init
failure.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1

Fixes: 4945af5b264f ("ath10k: enable SRRI/DRRI support on ddr for WCN3990")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1607713210-18320-1-git-send-email-pillair@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/snoc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
index fd41f25456dc4..daae470ecf5aa 100644
--- a/drivers/net/wireless/ath/ath10k/snoc.c
+++ b/drivers/net/wireless/ath/ath10k/snoc.c
@@ -1045,12 +1045,13 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar,
 	ret = ath10k_snoc_init_pipes(ar);
 	if (ret) {
 		ath10k_err(ar, "failed to initialize CE: %d\n", ret);
-		goto err_wlan_enable;
+		goto err_free_rri;
 	}
 
 	return 0;
 
-err_wlan_enable:
+err_free_rri:
+	ath10k_ce_free_rri(ar);
 	ath10k_snoc_wlan_disable(ar);
 
 	return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 022/663] Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 021/663] ath10k: Fix error handling in case of CE pipe init failure Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 023/663] Bluetooth: hci_uart: Fix a race for write_work scheduling Greg Kroah-Hartman
                   ` (641 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Marcel Holtmann,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 9a39a927be01d89e53f04304ab99a8761e08910d ]

Some resource should be released in the error handling path of the probe
function, as already done in the remove function.

The remove function was fixed in commit 5052de8deff5 ("soc: qcom: smd:
Transition client drivers from smd to rpmsg")

Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btqcomsmd.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
index 98d53764871f5..2acb719e596f5 100644
--- a/drivers/bluetooth/btqcomsmd.c
+++ b/drivers/bluetooth/btqcomsmd.c
@@ -142,12 +142,16 @@ static int btqcomsmd_probe(struct platform_device *pdev)
 
 	btq->cmd_channel = qcom_wcnss_open_channel(wcnss, "APPS_RIVA_BT_CMD",
 						   btqcomsmd_cmd_callback, btq);
-	if (IS_ERR(btq->cmd_channel))
-		return PTR_ERR(btq->cmd_channel);
+	if (IS_ERR(btq->cmd_channel)) {
+		ret = PTR_ERR(btq->cmd_channel);
+		goto destroy_acl_channel;
+	}
 
 	hdev = hci_alloc_dev();
-	if (!hdev)
-		return -ENOMEM;
+	if (!hdev) {
+		ret = -ENOMEM;
+		goto destroy_cmd_channel;
+	}
 
 	hci_set_drvdata(hdev, btq);
 	btq->hdev = hdev;
@@ -161,14 +165,21 @@ static int btqcomsmd_probe(struct platform_device *pdev)
 	hdev->set_bdaddr = qca_set_bdaddr_rome;
 
 	ret = hci_register_dev(hdev);
-	if (ret < 0) {
-		hci_free_dev(hdev);
-		return ret;
-	}
+	if (ret < 0)
+		goto hci_free_dev;
 
 	platform_set_drvdata(pdev, btq);
 
 	return 0;
+
+hci_free_dev:
+	hci_free_dev(hdev);
+destroy_cmd_channel:
+	rpmsg_destroy_ept(btq->cmd_channel);
+destroy_acl_channel:
+	rpmsg_destroy_ept(btq->acl_channel);
+
+	return ret;
 }
 
 static int btqcomsmd_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 023/663] Bluetooth: hci_uart: Fix a race for write_work scheduling
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 022/663] Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 024/663] Bluetooth: Fix initializing response id after clearing struct Greg Kroah-Hartman
                   ` (640 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claire Chang, Marcel Holtmann, Sasha Levin

From: Claire Chang <tientzu@chromium.org>

[ Upstream commit afe0b1c86458f121b085271e4f3034017a90d4a3 ]

In hci_uart_write_work, there is a loop/goto checking the value of
HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.

In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
hci_uart_write_work worker will do hci_uart_dequeue properly.

However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
the loop breaks, but before HCI_UART_SENDING is cleared in
hci_uart_write_work, the schedule_work is skipped incorrectly.

Fix this race by changing the order of HCI_UART_SENDING and
HCI_UART_TX_WAKEUP modification.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 82f5169bf3d3 ("Bluetooth: hci_uart: add serdev driver support library")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_ldisc.c  | 7 +++----
 drivers/bluetooth/hci_serdev.c | 4 ++--
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index f83d67eafc9f0..8be4d807d1370 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -127,10 +127,9 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
 	if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
 		goto no_schedule;
 
-	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
-		set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+	set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state))
 		goto no_schedule;
-	}
 
 	BT_DBG("");
 
@@ -174,10 +173,10 @@ restart:
 		kfree_skb(skb);
 	}
 
+	clear_bit(HCI_UART_SENDING, &hu->tx_state);
 	if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
 		goto restart;
 
-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
 	wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
 }
 
diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
index ef96ad06fa54e..9e03402ef1b37 100644
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -83,9 +83,9 @@ static void hci_uart_write_work(struct work_struct *work)
 			hci_uart_tx_complete(hu, hci_skb_pkt_type(skb));
 			kfree_skb(skb);
 		}
-	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
 
-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
+		clear_bit(HCI_UART_SENDING, &hu->tx_state);
+	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
 }
 
 /* ------- Interface to HCI layer ------ */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 024/663] Bluetooth: Fix initializing response id after clearing struct
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 023/663] Bluetooth: hci_uart: Fix a race for write_work scheduling Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 025/663] arm64: dts: renesas: beacon kit: Fix choppy Bluetooth Audio Greg Kroah-Hartman
                   ` (639 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christopher William Snowhill,
	Marcel Holtmann, Sasha Levin

From: Christopher William Snowhill <chris@kode54.net>

[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ]

Looks like this was missed when patching the source to clear the structures
throughout, causing this one instance to clear the struct after the response
id is assigned.

Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members")
Signed-off-by: Christopher William Snowhill <chris@kode54.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/a2mp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index da7fd7c8c2dc0..cc26e4c047ad0 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -381,9 +381,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
 	hdev = hci_dev_get(req->id);
 	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
 		struct a2mp_amp_assoc_rsp rsp;
-		rsp.id = req->id;
 
 		memset(&rsp, 0, sizeof(rsp));
+		rsp.id = req->id;
 
 		if (tmp) {
 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 025/663] arm64: dts: renesas: beacon kit: Fix choppy Bluetooth Audio
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 024/663] Bluetooth: Fix initializing response id after clearing struct Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 026/663] arm64: dts: renesas: beacon: Fix audio-1.8V pin enable Greg Kroah-Hartman
                   ` (638 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Ford, Geert Uytterhoeven, Sasha Levin

From: Adam Ford <aford173@gmail.com>

[ Upstream commit db030c5a9658846a42fbed4d43a8b5f28a2d7ab7 ]

The Bluetooth chip is capable of operating at 4Mbps, but the
max-speed setting was on the UART node instead of the Bluetooth
node, so the chip didn't operate at the correct speed resulting
in choppy audio.  Fix this by setting the max-speed in the proper
node.

Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
Signed-off-by: Adam Ford <aford173@gmail.com>
Link: https://lore.kernel.org/r/20201213183759.223246-3-aford173@gmail.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
index 97272f5fa0abf..6d24b36ca0a7c 100644
--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
@@ -88,7 +88,6 @@
 	pinctrl-names = "default";
 	uart-has-rtscts;
 	status = "okay";
-	max-speed = <4000000>;
 
 	bluetooth {
 		compatible = "brcm,bcm43438-bt";
@@ -97,6 +96,7 @@
 		device-wakeup-gpios = <&pca9654 5 GPIO_ACTIVE_HIGH>;
 		clocks = <&osc_32k>;
 		clock-names = "extclk";
+		max-speed = <4000000>;
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 026/663] arm64: dts: renesas: beacon: Fix audio-1.8V pin enable
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 025/663] arm64: dts: renesas: beacon kit: Fix choppy Bluetooth Audio Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 027/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5 Greg Kroah-Hartman
                   ` (637 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Ford, Geert Uytterhoeven, Sasha Levin

From: Adam Ford <aford173@gmail.com>

[ Upstream commit 5a5da0b758b327b727c5392d7f11e046e113a195 ]

The fact the audio worked at all was a coincidence because the wrong
gpio enable was used.  Use the correct GPIO pin to ensure its operation.

Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
Signed-off-by: Adam Ford <aford173@gmail.com>
Link: https://lore.kernel.org/r/20201213183759.223246-6-aford173@gmail.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
index 66c9153b31015..597388f871272 100644
--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
@@ -150,7 +150,7 @@
 		regulator-name = "audio-1.8V";
 		regulator-min-microvolt = <1800000>;
 		regulator-max-microvolt = <1800000>;
-		gpio = <&gpio_exp2 7 GPIO_ACTIVE_HIGH>;
+		gpio = <&gpio_exp4 1 GPIO_ACTIVE_HIGH>;
 		enable-active-high;
 	};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 027/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 026/663] arm64: dts: renesas: beacon: Fix audio-1.8V pin enable Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 028/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Monk Greg Kroah-Hartman
                   ` (636 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit cb31334687db31c691901269d65074a7ffaecb18 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: b004a34bd0ff ("ARM: dts: exynos: Add exynos3250-artik5 dtsi file for ARTIK5 module")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
index 12887b3924af8..ad525f2accbb4 100644
--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
+++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
@@ -79,7 +79,7 @@
 	s2mps14_pmic@66 {
 		compatible = "samsung,s2mps14-pmic";
 		interrupt-parent = <&gpx3>;
-		interrupts = <5 IRQ_TYPE_NONE>;
+		interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s2mps14_irq>;
 		reg = <0x66>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 028/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Monk
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 027/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5 Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 029/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato Greg Kroah-Hartman
                   ` (635 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 8528cda2b7c667e9cd173aef1a677c71b7d5a096 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: e0cefb3f79d3 ("ARM: dts: add board dts file for Exynos3250-based Monk board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212903.216728-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos3250-monk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts
index c1a68e6120370..7e99e5812a4d3 100644
--- a/arch/arm/boot/dts/exynos3250-monk.dts
+++ b/arch/arm/boot/dts/exynos3250-monk.dts
@@ -200,7 +200,7 @@
 	s2mps14_pmic@66 {
 		compatible = "samsung,s2mps14-pmic";
 		interrupt-parent = <&gpx0>;
-		interrupts = <7 IRQ_TYPE_NONE>;
+		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
 		reg = <0x66>;
 		wakeup-source;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 029/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 028/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Monk Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 030/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Greg Kroah-Hartman
                   ` (634 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 437ae60947716bb479e2f32466f49445c0509b1e ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: faaf348ef468 ("ARM: dts: Add board dts file for exynos3250-rinato")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-3-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
index b55afaaa691e8..f9e3b13d3aac2 100644
--- a/arch/arm/boot/dts/exynos3250-rinato.dts
+++ b/arch/arm/boot/dts/exynos3250-rinato.dts
@@ -270,7 +270,7 @@
 	s2mps14_pmic@66 {
 		compatible = "samsung,s2mps14-pmic";
 		interrupt-parent = <&gpx0>;
-		interrupts = <7 IRQ_TYPE_NONE>;
+		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
 		reg = <0x66>;
 		wakeup-source;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 030/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 029/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 031/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Greg Kroah-Hartman
                   ` (633 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
index a92ade33779cf..5a9c936407ea3 100644
--- a/arch/arm/boot/dts/exynos5250-spring.dts
+++ b/arch/arm/boot/dts/exynos5250-spring.dts
@@ -109,7 +109,7 @@
 		compatible = "samsung,s5m8767-pmic";
 		reg = <0x66>;
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
 		wakeup-source;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 031/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 030/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 032/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family Greg Kroah-Hartman
                   ` (632 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
index dd7f8385d81e7..3d9b93d2b242c 100644
--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
@@ -349,7 +349,7 @@
 		reg = <0x66>;
 
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s2mps11_irq>;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 032/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 031/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 033/663] arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 Greg Kroah-Hartman
                   ` (631 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 3e7d9a583a24f7582c6bc29a0d4d624feedbc2f9 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: aac4e0615341 ("ARM: dts: odroidxu3: Enable wake alarm of S2MPS11 RTC")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-6-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
index b1cf9414ce17f..d51c1d8620a09 100644
--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
@@ -509,7 +509,7 @@
 		samsung,s2mps11-acokb-ground;
 
 		interrupt-parent = <&gpx0>;
-		interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <4 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s2mps11_irq>;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 033/663] arm64: dts: exynos: correct PMIC interrupt trigger level on TM2
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 032/663] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 034/663] arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso Greg Kroah-Hartman
                   ` (630 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit e98e2367dfb4b6d7a80c8ce795c644124eff5f36 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: 01e5d2352152 ("arm64: dts: exynos: Add dts file for Exynos5433-based TM2 board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-7-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
index 829fea23d4ab1..106397a99da6b 100644
--- a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
@@ -389,7 +389,7 @@
 	s2mps13-pmic@66 {
 		compatible = "samsung,s2mps13-pmic";
 		interrupt-parent = <&gpa0>;
-		interrupts = <7 IRQ_TYPE_NONE>;
+		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
 		reg = <0x66>;
 		samsung,s2mps11-wrstbi-ground;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 034/663] arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 033/663] arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 035/663] memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops Greg Kroah-Hartman
                   ` (629 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 1fea2eb2f5bbd3fbbe2513d2386b5f6e6db17fd7 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: 9589f7721e16 ("arm64: dts: Add S2MPS15 PMIC node on exynos7-espresso")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212903.216728-8-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
index 92fecc539c6c7..358b7b6ea84f1 100644
--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
@@ -90,7 +90,7 @@
 	s2mps15_pmic@66 {
 		compatible = "samsung,s2mps15-pmic";
 		reg = <0x66>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		interrupt-parent = <&gpa0>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pmic_irq>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 035/663] memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 034/663] arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 036/663] Bluetooth: hci_qca: Fix memleak in qca_controller_memdump Greg Kroah-Hartman
                   ` (628 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Krzysztof Kozlowski,
	Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a2d522ff0f5cc26915c4ccee9457fd4b4e1edc48 ]

pm_runtime_get_sync will increment pm usage counter
even it failed. Forgetting to putting operation will
result in reference leak here. We fix it by replacing
it with pm_runtime_resume_and_get to keep usage counter
balanced.

Fixes: 4f0a1a1ae3519 ("memory: mtk-smi: Invoke pm runtime_callback to enable clocks")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123102118.3866195-1-zhangqilong3@huawei.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/mtk-smi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
index 691e4c344cf84..75f8e0f60d81d 100644
--- a/drivers/memory/mtk-smi.c
+++ b/drivers/memory/mtk-smi.c
@@ -130,7 +130,7 @@ static void mtk_smi_clk_disable(const struct mtk_smi *smi)
 
 int mtk_smi_larb_get(struct device *larbdev)
 {
-	int ret = pm_runtime_get_sync(larbdev);
+	int ret = pm_runtime_resume_and_get(larbdev);
 
 	return (ret < 0) ? ret : 0;
 }
@@ -366,7 +366,7 @@ static int __maybe_unused mtk_smi_larb_resume(struct device *dev)
 	int ret;
 
 	/* Power on smi-common. */
-	ret = pm_runtime_get_sync(larb->smi_common_dev);
+	ret = pm_runtime_resume_and_get(larb->smi_common_dev);
 	if (ret < 0) {
 		dev_err(dev, "Failed to pm get for smi-common(%d).\n", ret);
 		return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 036/663] Bluetooth: hci_qca: Fix memleak in qca_controller_memdump
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 035/663] memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 037/663] staging: vchiq: Fix bulk userdata handling Greg Kroah-Hartman
                   ` (627 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Marcel Holtmann, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 71f8e707557b9bc25dc90a59a752528d4e7c1cbf ]

When __le32_to_cpu() fails, qca_memdump should be freed
just like when vmalloc() fails.

Fixes: d841502c79e3f ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_qca.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 244b8feba5232..5c26c7d941731 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1020,7 +1020,9 @@ static void qca_controller_memdump(struct work_struct *work)
 			dump_size = __le32_to_cpu(dump->dump_size);
 			if (!(dump_size)) {
 				bt_dev_err(hu->hdev, "Rx invalid memdump size");
+				kfree(qca_memdump);
 				kfree_skb(skb);
+				qca->qca_memdump = NULL;
 				mutex_unlock(&qca->hci_memdump_lock);
 				return;
 			}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 037/663] staging: vchiq: Fix bulk userdata handling
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 036/663] Bluetooth: hci_qca: Fix memleak in qca_controller_memdump Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 038/663] staging: vchiq: Fix bulk transfers on 64-bit builds Greg Kroah-Hartman
                   ` (626 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Dan Carpenter,
	Phil Elwell, Sasha Levin

From: Phil Elwell <phil@raspberrypi.com>

[ Upstream commit 96ae327678eceabf455b11a88ba14ad540d4b046 ]

The addition of the local 'userdata' pointer to
vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
WAITING modes are used, in which case the value provided by the
caller is not returned to them as expected, but instead it is replaced
with a NULL. This lack of a suitable context may cause the application
to crash or otherwise malfunction.

Fixes: 4184da4f316a ("staging: vchiq: fix __user annotations")
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Link: https://lore.kernel.org/r/20210105162030.1415213-2-phil@raspberrypi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 01125d9f991bb..5bc9b394212b8 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -953,7 +953,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 	struct vchiq_service *service;
 	struct bulk_waiter_node *waiter = NULL;
 	bool found = false;
-	void *userdata = NULL;
+	void *userdata;
 	int status = 0;
 	int ret;
 
@@ -992,6 +992,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
 			"found bulk_waiter %pK for pid %d", waiter,
 			current->pid);
 		userdata = &waiter->bulk_waiter;
+	} else {
+		userdata = args->userdata;
 	}
 
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 038/663] staging: vchiq: Fix bulk transfers on 64-bit builds
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 037/663] staging: vchiq: Fix bulk userdata handling Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 039/663] arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible Greg Kroah-Hartman
                   ` (625 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dan Carpenter,
	Phil Elwell, Sasha Levin

From: Phil Elwell <phil@raspberrypi.com>

[ Upstream commit 88753cc19f087abe0d39644b844e67a59cfb5a3d ]

The recent change to the bulk transfer compat function missed the fact
the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
to the VPU would have shown.

Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Link: https://lore.kernel.org/r/20210105162030.1415213-3-phil@raspberrypi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 5bc9b394212b8..3d378da119e7a 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1714,7 +1714,7 @@ vchiq_compat_ioctl_queue_bulk(struct file *file,
 {
 	struct vchiq_queue_bulk_transfer32 args32;
 	struct vchiq_queue_bulk_transfer args;
-	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT) ?
+	enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT32) ?
 				  VCHIQ_BULK_TRANSMIT : VCHIQ_BULK_RECEIVE;
 
 	if (copy_from_user(&args32, argp, sizeof(args32)))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 039/663] arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 038/663] staging: vchiq: Fix bulk transfers on 64-bit builds Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 040/663] net: stmmac: dwmac-meson8b: fix enabling the timing-adjustment clock Greg Kroah-Hartman
                   ` (624 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Bjorn Andersson,
	Sasha Levin

From: Stephan Gerhold <stephan@gerhold.net>

[ Upstream commit 826e6faf49ae1eb065759a30832a2e34740bd8b1 ]

Unlike most MSM8916 boards, samsung-a5u uses WCN3660B instead of
WCN3620 to support the 5 GHz band additionally.

WCN3660B has similar requirements as WCN3620, but it needs the XO
clock to run at 48 MHz instead of 19.2 MHz. So far it was possible
to describe that configuration using the qcom,wcn3680 compatible.

However, as of commit 8490987bdb9a ("wcn36xx: Hook and identify RF_IRIS_WCN3680"),
the wcn36xx driver will now use the qcom,wcn3680 compatible
to enable functionality specific to WCN3680. In particular,
WCN3680 supports 802.11ac, which is not available in WCN3660B.

Use the new qcom,wcn3660b compatible to describe the chip properly.

Fixes: 0d7051999175 ("arm64: dts: msm8916-samsung-a5u: Override iris compatible")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20210106102134.59801-4-stephan@gerhold.net
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts b/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
index e39c04d977c25..dd35c3344358c 100644
--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
+++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
@@ -38,7 +38,7 @@
 
 &pronto {
 	iris {
-		compatible = "qcom,wcn3680";
+		compatible = "qcom,wcn3660b";
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 040/663] net: stmmac: dwmac-meson8b: fix enabling the timing-adjustment clock
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 039/663] arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 041/663] bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h Greg Kroah-Hartman
                   ` (623 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Florian Fainelli,
	Martin Blumenstingl, Jakub Kicinski, Sasha Levin

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 025822884a4fd2d0af51dcf77ddc494e60c5ff63 ]

The timing-adjustment clock only has to be enabled when a) there is a
2ns RX delay configured using device-tree and b) the phy-mode indicates
that the RX delay should be enabled.

Only enable the RX delay if both are true, instead of (by accident) also
enabling it when there's the 2ns RX delay configured but the phy-mode
incicates that the RX delay is not used.

Fixes: 9308c47640d515 ("net: stmmac: dwmac-meson8b: add support for the RX delay configuration")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 9ddadae8e4c51..752658ec7beeb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -301,7 +301,7 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
 		return -EINVAL;
 	};
 
-	if (rx_dly_config & PRG_ETH0_ADJ_ENABLE) {
+	if (delay_config & PRG_ETH0_ADJ_ENABLE) {
 		if (!dwmac->timing_adj_clk) {
 			dev_err(dwmac->dev,
 				"The timing-adjustment clock is mandatory for the RX delay re-timing\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 041/663] bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 040/663] net: stmmac: dwmac-meson8b: fix enabling the timing-adjustment clock Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 042/663] bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args Greg Kroah-Hartman
                   ` (622 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Andrii Nakryiko,
	Alexei Starovoitov, Yonghong Song, Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit a643bff752dcf72a07e1b2ab2f8587e4f51118be ]

Add bpf_patch_call_args() prototype. This function is called from BPF verifier
and only if CONFIG_BPF_JIT_ALWAYS_ON is not defined. This fixes compiler
warning about missing prototype in some kernel configurations.

Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210112075520.4103414-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/bpf.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 2b16bf48aab61..642ce03f19c4c 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1371,7 +1371,10 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
 /* verify correctness of eBPF program */
 int bpf_check(struct bpf_prog **fp, union bpf_attr *attr,
 	      union bpf_attr __user *uattr);
+
+#ifndef CONFIG_BPF_JIT_ALWAYS_ON
 void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
+#endif
 
 struct btf *bpf_get_btf_vmlinux(void);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 042/663] bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 041/663] bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 043/663] firmware: arm_scmi: Fix call site of scmi_notification_exit Greg Kroah-Hartman
                   ` (621 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Andrii Nakryiko,
	Alexei Starovoitov, Yonghong Song, Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit 6943c2b05bf09fd5c5729f7d7d803bf3f126cb9a ]

BPF interpreter uses extra input argument, so re-casts __bpf_call_base into
__bpf_call_base_args. Avoid compiler warning about incompatible function
prototypes by casting to void * first.

Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210112075520.4103414-3-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/filter.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 1b62397bd1247..e2ffa02f9067a 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -886,7 +886,7 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);
 u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
 #define __bpf_call_base_args \
 	((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \
-	 __bpf_call_base)
+	 (void *)__bpf_call_base)
 
 struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog);
 void bpf_jit_compile(struct bpf_prog *prog);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 043/663] firmware: arm_scmi: Fix call site of scmi_notification_exit
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 042/663] bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 044/663] arm64: dts: allwinner: A64: properly connect USB PHY to port 0 Greg Kroah-Hartman
                   ` (620 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Marussi, Sudeep Holla, Sasha Levin

From: Cristian Marussi <cristian.marussi@arm.com>

[ Upstream commit a90b6543bf062d65292b2c76f1630507d1c9d8ec ]

Call scmi_notification_exit() only when SCMI platform driver instance has
been really successfully removed.

Link: https://lore.kernel.org/r/20210112191326.29091-1-cristian.marussi@arm.com
Fixes: 6b8a69131dc63 ("firmware: arm_scmi: Enable notification core")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
[sudeep.holla: Move the call outside the list mutex locking]
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/arm_scmi/driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 3dfd8b6a0ebf7..6b2ce3f28f7b9 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -847,8 +847,6 @@ static int scmi_remove(struct platform_device *pdev)
 	struct scmi_info *info = platform_get_drvdata(pdev);
 	struct idr *idr = &info->tx_idr;
 
-	scmi_notification_exit(&info->handle);
-
 	mutex_lock(&scmi_list_mutex);
 	if (info->users)
 		ret = -EBUSY;
@@ -859,6 +857,8 @@ static int scmi_remove(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
+	scmi_notification_exit(&info->handle);
+
 	/* Safe to free channels since no more users */
 	ret = idr_for_each(idr, info->desc->ops->chan_free, idr);
 	idr_destroy(&info->tx_idr);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 044/663] arm64: dts: allwinner: A64: properly connect USB PHY to port 0
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 043/663] firmware: arm_scmi: Fix call site of scmi_notification_exit Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 045/663] arm64: dts: allwinner: H6: " Greg Kroah-Hartman
                   ` (619 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Chen-Yu Tsai,
	Maxime Ripard, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit cc72570747e43335f4933a24dd74d5653639176a ]

In recent Allwinner SoCs the first USB host controller (HCI0) shares
the first PHY with the MUSB controller. Probably to make this sharing
work, we were avoiding to declare this in the DT. This has two
shortcomings:
- U-Boot (which uses the same .dts) cannot use this port in host mode
  without a PHY linked, so we were loosing one USB port there.
- It requires the MUSB driver to be enabled and loaded, although we
  don't actually use it.

To avoid those issues, let's add this PHY link to the A64 .dtsi file.
After all PHY port 0 *is* connected to HCI0, so we should describe
it as this. Remove the part from the Pinebook DTS which already had
this property.

This makes it work in U-Boot, also improves compatiblity when no MUSB
driver is loaded (for instance in distribution installers).

Fixes: dc03a047df1d ("arm64: allwinner: a64: add EHCI0/OHCI0 nodes to A64 DTSI")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210113152630.28810-2-andre.przywara@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 4 ----
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi         | 4 ++++
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
index 896f34fd9fc3a..d07cf05549c32 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
@@ -126,8 +126,6 @@
 };
 
 &ehci0 {
-	phys = <&usbphy 0>;
-	phy-names = "usb";
 	status = "okay";
 };
 
@@ -177,8 +175,6 @@
 };
 
 &ohci0 {
-	phys = <&usbphy 0>;
-	phy-names = "usb";
 	status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index dc238814013cb..15f6408e73a27 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -593,6 +593,8 @@
 				 <&ccu CLK_USB_OHCI0>;
 			resets = <&ccu RST_BUS_OHCI0>,
 				 <&ccu RST_BUS_EHCI0>;
+			phys = <&usbphy 0>;
+			phy-names = "usb";
 			status = "disabled";
 		};
 
@@ -603,6 +605,8 @@
 			clocks = <&ccu CLK_BUS_OHCI0>,
 				 <&ccu CLK_USB_OHCI0>;
 			resets = <&ccu RST_BUS_OHCI0>;
+			phys = <&usbphy 0>;
+			phy-names = "usb";
 			status = "disabled";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 045/663] arm64: dts: allwinner: H6: properly connect USB PHY to port 0
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 044/663] arm64: dts: allwinner: A64: properly connect USB PHY to port 0 Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 046/663] arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card Greg Kroah-Hartman
                   ` (618 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Chen-Yu Tsai,
	Maxime Ripard, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit da2fb8457f71138d455cba82edec0d34f858e506 ]

In recent Allwinner SoCs the first USB host controller (HCI0) shares
the first PHY with the MUSB controller. Probably to make this sharing
work, we were avoiding to declare this in the DT. This has two
shortcomings:
- U-Boot (which uses the same .dts) cannot use this port in host mode
  without a PHY linked, so we were loosing one USB port there.
- It requires the MUSB driver to be enabled and loaded, although we
  don't actually use it.

To avoid those issues, let's add this PHY link to the H6 .dtsi file.
After all PHY port 0 *is* connected to HCI0, so we should describe
it as this.

This makes it work in U-Boot, also improves compatiblity when no MUSB
driver is loaded (for instance in distribution installers).

Fixes: eabb3d424b6d ("arm64: dts: allwinner: h6: add USB2-related device nodes")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210113152630.28810-3-andre.przywara@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
index 28c77d6872f64..0361f5f467093 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
@@ -667,6 +667,8 @@
 				 <&ccu CLK_USB_OHCI0>;
 			resets = <&ccu RST_BUS_OHCI0>,
 				 <&ccu RST_BUS_EHCI0>;
+			phys = <&usb2phy 0>;
+			phy-names = "usb";
 			status = "disabled";
 		};
 
@@ -677,6 +679,8 @@
 			clocks = <&ccu CLK_BUS_OHCI0>,
 				 <&ccu CLK_USB_OHCI0>;
 			resets = <&ccu RST_BUS_OHCI0>;
+			phys = <&usb2phy 0>;
+			phy-names = "usb";
 			status = "disabled";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 046/663] arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 045/663] arm64: dts: allwinner: H6: " Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 047/663] arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency Greg Kroah-Hartman
                   ` (617 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Chen-Yu Tsai,
	Maxime Ripard, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit 941432d007689f3774646e41a1439228b6c6ee0e ]

The SD card on the SoPine SoM module is somewhat concealed, so was
originally defined as "non-removable".
However there is a working card-detect pin (tested on two different
SoM versions), and in certain SoM base boards it might be actually
accessible at runtime.
Also the Pine64-LTS shares the SoPine base .dtsi, so inherited the
non-removable flag, even though the SD card slot is perfectly accessible
and usable there. (It turns out that just *my* board has a broken card
detect switch, so I originally thought CD wouldn't work on the LTS.)

Drop the "non-removable" flag to describe the SD card slot properly.

Fixes: c3904a269891 ("arm64: allwinner: a64: add DTSI file for SoPine SoM")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210113152630.28810-5-andre.przywara@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
index c48692b06e1fa..3402cec87035b 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
@@ -32,7 +32,6 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&mmc0_pins>;
 	vmmc-supply = <&reg_dcdc1>;
-	non-removable;
 	disable-wp;
 	bus-width = <4>;
 	cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 047/663] arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 046/663] arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 048/663] arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz Greg Kroah-Hartman
                   ` (616 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Chen-Yu Tsai,
	Maxime Ripard, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit cfe6c487b9a1abc6197714ec5605716a5428cf03 ]

The H6 manual explicitly lists a frequency limit of 150 MHz for the bus
frequency of the MMC controllers. So far we had no explicit limits in the
DT, which limited eMMC to the spec defined frequencies, or whatever the
driver defines (both Linux and FreeBSD use 52 MHz here).

Put those maximum frequencies in the SoC .dtsi, to allow higher speed
modes (which still would need to be explicitly enabled, per board).

Tested with an eMMC using HS-200 on a Pine H64. Running at the spec'ed
200 MHz indeed fails with I/O errors, but 150 MHz seems to work stably.

Fixes: 8f54bd1595b3 ("arm64: allwinner: h6: add device tree nodes for MMC controllers")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210113152630.28810-6-andre.przywara@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
index 0361f5f467093..4592fb7a6161d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
@@ -436,6 +436,7 @@
 			interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&mmc0_pins>;
+			max-frequency = <150000000>;
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;
@@ -452,6 +453,7 @@
 			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&mmc1_pins>;
+			max-frequency = <150000000>;
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;
@@ -468,6 +470,7 @@
 			interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
 			pinctrl-names = "default";
 			pinctrl-0 = <&mmc2_pins>;
+			max-frequency = <150000000>;
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 048/663] arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 047/663] arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 049/663] arm64: dts: qcom: msm8916-samsung-a2015: Fix sensors Greg Kroah-Hartman
                   ` (615 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Chen-Yu Tsai,
	Maxime Ripard, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit 948c657cc45e8ce48cb533d4e2106145fa765759 ]

In contrast to the H6 (and later) manuals, the A64 datasheet does not
specify any limitations in the maximum possible frequency for eMMC
controllers.
However experimentation has found that a 150 MHz limit similar to other
SoCs and also the MMC0 and MMC1 controllers on the A64 seems to exist
for the MMC2 controller.

Limit the frequency for the MMC2 controller to 150 MHz in the SoC .dtsi.
The Pinebook seems to be the an odd exception, since it apparently seems
to work with 200 MHz as well, so overwrite this in its board .dts file.

Tested on a Pine64-LTS: 200 MHz HS-200 fails, 150 MHz HS-200 works.

Fixes: 22be992faea7 ("arm64: allwinner: a64: Increase the MMC max frequency")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210113152630.28810-7-andre.przywara@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 1 +
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi         | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
index d07cf05549c32..7ae16541d14f5 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
@@ -167,6 +167,7 @@
 	pinctrl-0 = <&mmc2_pins>, <&mmc2_ds_pin>;
 	vmmc-supply = <&reg_dcdc1>;
 	vqmmc-supply = <&reg_eldo1>;
+	max-frequency = <200000000>;
 	bus-width = <8>;
 	non-removable;
 	cap-mmc-hw-reset;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 15f6408e73a27..7a41015a9ce59 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -514,7 +514,7 @@
 			resets = <&ccu RST_BUS_MMC2>;
 			reset-names = "ahb";
 			interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
-			max-frequency = <200000000>;
+			max-frequency = <150000000>;
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 049/663] arm64: dts: qcom: msm8916-samsung-a2015: Fix sensors
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 048/663] arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 050/663] cpufreq: brcmstb-avs-cpufreq: Free resources in error path Greg Kroah-Hartman
                   ` (614 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Bjorn Andersson,
	Sasha Levin

From: Stephan Gerhold <stephan@gerhold.net>

[ Upstream commit 3716a583fe0bbe3babf4ce260064a7fa13d6d989 ]

When the BMC150 accelerometer/magnetometer was added to the device tree,
the sensors were working without specifying any regulator supplies,
likely because the regulators were on by default and then never turned off.

For some reason, this is no longer the case for pm8916_l17, which prevents
the sensors from working in some cases.

Now that the bmc150_accel/bmc150_magn drivers can enable necessary
regulators, declare the necessary regulator supplies to make the sensors
work again.

Fixes: 079f81acf10f ("arm64: dts: qcom: msm8916-samsung-a2015: Add accelerometer/magnetometer")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20210111175358.97171-1-stephan@gerhold.net
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
index f7ac4c4033db6..7bf2cb01513e3 100644
--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
@@ -106,6 +106,9 @@
 		interrupt-parent = <&msmgpio>;
 		interrupts = <115 IRQ_TYPE_EDGE_RISING>;
 
+		vdd-supply = <&pm8916_l17>;
+		vddio-supply = <&pm8916_l5>;
+
 		pinctrl-names = "default";
 		pinctrl-0 = <&accel_int_default>;
 	};
@@ -113,6 +116,9 @@
 	magnetometer@12 {
 		compatible = "bosch,bmc150_magn";
 		reg = <0x12>;
+
+		vdd-supply = <&pm8916_l17>;
+		vddio-supply = <&pm8916_l5>;
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 050/663] cpufreq: brcmstb-avs-cpufreq: Free resources in error path
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 049/663] arm64: dts: qcom: msm8916-samsung-a2015: Fix sensors Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 051/663] cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() Greg Kroah-Hartman
                   ` (613 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Viresh Kumar,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 05f456286fd489558c72a4711d22a5612c965685 ]

If 'cpufreq_register_driver()' fails, we must release the resources
allocated in 'brcm_avs_prepare_init()' as already done in the remove
function.

To do that, introduce a new function 'brcm_avs_prepare_uninit()' in order
to avoid code duplication. This also makes the code more readable (IMHO).

Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Viresh: Updated Subject ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/brcmstb-avs-cpufreq.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 3e31e5d28b79c..e25ccb744187d 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -597,6 +597,16 @@ unmap_base:
 	return ret;
 }
 
+static void brcm_avs_prepare_uninit(struct platform_device *pdev)
+{
+	struct private_data *priv;
+
+	priv = platform_get_drvdata(pdev);
+
+	iounmap(priv->avs_intr_base);
+	iounmap(priv->base);
+}
+
 static int brcm_avs_cpufreq_init(struct cpufreq_policy *policy)
 {
 	struct cpufreq_frequency_table *freq_table;
@@ -732,21 +742,22 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
 
 	brcm_avs_driver.driver_data = pdev;
 
-	return cpufreq_register_driver(&brcm_avs_driver);
+	ret = cpufreq_register_driver(&brcm_avs_driver);
+	if (ret)
+		brcm_avs_prepare_uninit(pdev);
+
+	return ret;
 }
 
 static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
 {
-	struct private_data *priv;
 	int ret;
 
 	ret = cpufreq_unregister_driver(&brcm_avs_driver);
 	if (ret)
 		return ret;
 
-	priv = platform_get_drvdata(pdev);
-	iounmap(priv->base);
-	iounmap(priv->avs_intr_base);
+	brcm_avs_prepare_uninit(pdev);
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 051/663] cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 050/663] cpufreq: brcmstb-avs-cpufreq: Free resources in error path Greg Kroah-Hartman
@ 2021-03-01 16:04 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 052/663] arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy node Greg Kroah-Hartman
                   ` (612 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Viresh Kumar,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 3657f729b6fb5f2c0bf693742de2dcd49c572aa1 ]

If 'cpufreq_unregister_driver()' fails, just WARN and continue, so that
other resources are freed.

Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Viresh: Updated Subject ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/brcmstb-avs-cpufreq.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index e25ccb744187d..4153150e20db5 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -754,8 +754,7 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
 	int ret;
 
 	ret = cpufreq_unregister_driver(&brcm_avs_driver);
-	if (ret)
-		return ret;
+	WARN_ON(ret);
 
 	brcm_avs_prepare_uninit(pdev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 052/663] arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy node
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2021-03-01 16:04 ` [PATCH 5.10 051/663] cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 053/663] ACPICA: Fix exception code class checks Greg Kroah-Hartman
                   ` (611 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit c6433083f5930fdf52ad47c8c0459719c810dc89 ]

The gmac2phy is integrated with the PHY within the SoC. Any properties
related to this integration can be included in the .dtsi file, instead
of having board dts files specify them separately.

Add the clock_in_out property to specify the direction of the PHY clock.
This is the minimum required to have gmac2phy working on Linux. Other
examples include assigned-clocks, assigned-clock-rates, and
assigned-clock-parents properties, but the hardware default plus the
implementation requesting the appropriate clock rate also works.

Fixes: 9c4cc910fe28 ("ARM64: dts: rockchip: Add gmac2phy node support for rk3328")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20210117100710.4857-2-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index db0d5c8e5f96a..93c734d8a46c2 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -928,6 +928,7 @@
 		phy-mode = "rmii";
 		phy-handle = <&phy>;
 		snps,txpbl = <0x4>;
+		clock_in_out = "output";
 		status = "disabled";
 
 		mdio {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 053/663] ACPICA: Fix exception code class checks
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 052/663] arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy node Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 054/663] usb: gadget: u_audio: Free requests only after callback Greg Kroah-Hartman
                   ` (610 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maximilian Luz, Bob Moore,
	Erik Kaneda, Rafael J. Wysocki, Sasha Levin

From: Maximilian Luz <luzmaximilian@gmail.com>

[ Upstream commit 3dfaea3811f8b6a89a347e8da9ab862cdf3e30fe ]

ACPICA commit 1a3a549286ea9db07d7ec700e7a70dd8bcc4354e

The macros to classify different AML exception codes are broken. For
instance,

  ACPI_ENV_EXCEPTION(Status)

will always evaluate to zero due to

  #define AE_CODE_ENVIRONMENTAL      0x0000
  #define ACPI_ENV_EXCEPTION(Status) (Status & AE_CODE_ENVIRONMENTAL)

Similarly, ACPI_AML_EXCEPTION(Status) will evaluate to a non-zero
value for error codes of type AE_CODE_PROGRAMMER, AE_CODE_ACPI_TABLES,
as well as AE_CODE_AML, and not just AE_CODE_AML as the name suggests.

This commit fixes those checks.

Fixes: d46b6537f0ce ("ACPICA: AML Parser: ignore all exceptions resulting from incorrect AML during table load")
Link: https://github.com/acpica/acpica/commit/1a3a5492
Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/acpi/acexcep.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
index 2fc624a617690..f8a4afb0279a3 100644
--- a/include/acpi/acexcep.h
+++ b/include/acpi/acexcep.h
@@ -59,11 +59,11 @@ struct acpi_exception_info {
 
 #define AE_OK                           (acpi_status) 0x0000
 
-#define ACPI_ENV_EXCEPTION(status)      (status & AE_CODE_ENVIRONMENTAL)
-#define ACPI_AML_EXCEPTION(status)      (status & AE_CODE_AML)
-#define ACPI_PROG_EXCEPTION(status)     (status & AE_CODE_PROGRAMMER)
-#define ACPI_TABLE_EXCEPTION(status)    (status & AE_CODE_ACPI_TABLES)
-#define ACPI_CNTL_EXCEPTION(status)     (status & AE_CODE_CONTROL)
+#define ACPI_ENV_EXCEPTION(status)      (((status) & AE_CODE_MASK) == AE_CODE_ENVIRONMENTAL)
+#define ACPI_AML_EXCEPTION(status)      (((status) & AE_CODE_MASK) == AE_CODE_AML)
+#define ACPI_PROG_EXCEPTION(status)     (((status) & AE_CODE_MASK) == AE_CODE_PROGRAMMER)
+#define ACPI_TABLE_EXCEPTION(status)    (((status) & AE_CODE_MASK) == AE_CODE_ACPI_TABLES)
+#define ACPI_CNTL_EXCEPTION(status)     (((status) & AE_CODE_MASK) == AE_CODE_CONTROL)
 
 /*
  * Environmental exceptions
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 054/663] usb: gadget: u_audio: Free requests only after callback
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 053/663] ACPICA: Fix exception code class checks Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 055/663] arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node Greg Kroah-Hartman
                   ` (609 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Jack Pham,
	Jerome Brunet, Sasha Levin, Ferry Toth, Peter Chen

From: Jack Pham <jackp@codeaurora.org>

[ Upstream commit 7de8681be2cde9f6953d3be1fa6ce05f9fe6e637 ]

As per the kernel doc for usb_ep_dequeue(), it states that "this
routine is asynchronous, that is, it may return before the completion
routine runs". And indeed since v5.0 the dwc3 gadget driver updated
its behavior to place dequeued requests on to a cancelled list to be
given back later after the endpoint is stopped.

The free_ep() was incorrectly assuming that a request was ready to
be freed after calling dequeue which results in a use-after-free
in dwc3 when it traverses its cancelled list. Fix this by moving
the usb_ep_free_request() call to the callback itself in case the
ep is disabled.

Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
Reported-and-tested-by: Ferry Toth <fntoth@gmail.com>
Reviewed-and-tested-by: Peter Chen <peter.chen@nxp.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/u_audio.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index e6d32c5367812..908e49dafd620 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 	struct snd_uac_chip *uac = prm->uac;
 
 	/* i/f shutting down */
-	if (!prm->ep_enabled || req->status == -ESHUTDOWN)
+	if (!prm->ep_enabled) {
+		usb_ep_free_request(ep, req);
+		return;
+	}
+
+	if (req->status == -ESHUTDOWN)
 		return;
 
 	/*
@@ -336,8 +341,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
 
 	for (i = 0; i < params->req_number; i++) {
 		if (prm->ureq[i].req) {
-			usb_ep_dequeue(ep, prm->ureq[i].req);
-			usb_ep_free_request(ep, prm->ureq[i].req);
+			if (usb_ep_dequeue(ep, prm->ureq[i].req))
+				usb_ep_free_request(ep, prm->ureq[i].req);
+			/*
+			 * If usb_ep_dequeue() cannot successfully dequeue the
+			 * request, the request will be freed by the completion
+			 * callback.
+			 */
+
 			prm->ureq[i].req = NULL;
 		}
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 055/663] arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 054/663] usb: gadget: u_audio: Free requests only after callback Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 056/663] soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model() Greg Kroah-Hartman
                   ` (608 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Foss, Bjorn Andersson, Sasha Levin

From: Robert Foss <robert.foss@linaro.org>

[ Upstream commit d4863ef399a29cae3001b3fedfd2864e651055ba ]

Switch reset pin of ov8856 node from GPIO_ACTIVE_HIGH to GPIO_ACTIVE_LOW,
this issue prevented the ov8856 from probing properly as it did not respon
to I2C messages.

Fixes: d4919a44564b ("arm64: dts: qcom: sdm845-db845c: Add ov8856 & ov7251
camera nodes")

Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://lore.kernel.org/r/20201221100955.148584-1-robert.foss@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
index c0b93813ea9ac..c4ac6f5dc008d 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
@@ -1114,11 +1114,11 @@
 		reg = <0x10>;
 
 		// CAM0_RST_N
-		reset-gpios = <&tlmm 9 0>;
+		reset-gpios = <&tlmm 9 GPIO_ACTIVE_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&cam0_default>;
 		gpios = <&tlmm 13 0>,
-			<&tlmm 9 0>;
+			<&tlmm 9 GPIO_ACTIVE_LOW>;
 
 		clocks = <&clock_camcc CAM_CC_MCLK0_CLK>;
 		clock-names = "xvclk";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 056/663] soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 055/663] arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 057/663] soc: ti: pm33xx: Fix some resource leak in the error handling paths of the probe function Greg Kroah-Hartman
                   ` (607 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Douglas Anderson,
	Stephen Boyd, Dan Carpenter, Bjorn Andersson, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5fb33d8960dc7abdabc6fe599a30c2c99b082ef6 ]

These need to be < ARRAY_SIZE() instead of <= ARRAY_SIZE() to prevent
accessing one element beyond the end of the array.

Acked-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Fixes: e9247e2ce577 ("soc: qcom: socinfo: fix printing of pmic_model")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YAf+o85Z9lgkq3Nw@mwanda
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/socinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index b44ede48decc0..e0620416e5743 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -280,7 +280,7 @@ static int qcom_show_pmic_model(struct seq_file *seq, void *p)
 	if (model < 0)
 		return -EINVAL;
 
-	if (model <= ARRAY_SIZE(pmic_models) && pmic_models[model])
+	if (model < ARRAY_SIZE(pmic_models) && pmic_models[model])
 		seq_printf(seq, "%s\n", pmic_models[model]);
 	else
 		seq_printf(seq, "unknown (%d)\n", model);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 057/663] soc: ti: pm33xx: Fix some resource leak in the error handling paths of the probe function
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 056/663] soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model() Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 058/663] staging: media: atomisp: Fix size_t format specifier in hmm_alloc() debug statemenet Greg Kroah-Hartman
                   ` (606 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Santosh Shilimkar, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 17ad4662595ea0c4fd7496b664523ef632e63349 ]

'am33xx_pm_rtc_setup()' allocates some resources that must be freed on the
error. Commit 2152fbbd47c0 ("soc: ti: pm33xx: Simplify RTC usage to prepare
to drop platform data") has introduced the use of these resources but has
only updated the remove function.

Fix the error handling path of the probe function now.

Fixes: 2152fbbd47c0 ("soc: ti: pm33xx: Simplify RTC usage to prepare to drop platform data")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/pm33xx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
index d2f5e7001a93c..dc21aa855a458 100644
--- a/drivers/soc/ti/pm33xx.c
+++ b/drivers/soc/ti/pm33xx.c
@@ -536,7 +536,7 @@ static int am33xx_pm_probe(struct platform_device *pdev)
 
 	ret = am33xx_push_sram_idle();
 	if (ret)
-		goto err_free_sram;
+		goto err_unsetup_rtc;
 
 	am33xx_pm_set_ipc_ops();
 
@@ -566,6 +566,9 @@ static int am33xx_pm_probe(struct platform_device *pdev)
 
 err_put_wkup_m3_ipc:
 	wkup_m3_ipc_put(m3_ipc);
+err_unsetup_rtc:
+	iounmap(rtc_base_virt);
+	clk_put(rtc_fck);
 err_free_sram:
 	am33xx_pm_free_sram();
 	pm33xx_dev = NULL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 058/663] staging: media: atomisp: Fix size_t format specifier in hmm_alloc() debug statemenet
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 057/663] soc: ti: pm33xx: Fix some resource leak in the error handling paths of the probe function Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 059/663] Bluetooth: drop HCI device reference before return Greg Kroah-Hartman
                   ` (605 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Sakari Ailus,
	Borislav Petkov, Sasha Levin

From: Borislav Petkov <bp@suse.de>

[ Upstream commit bfe21ef195a9f2785747e698dfd19f75554e2d91 ]

Fix this build warning on 32-bit:

  drivers/staging/media/atomisp/pci/hmm/hmm.c: In function ‘hmm_alloc’:
  drivers/staging/media/atomisp/pci/hmm/hmm.c:272:3: warning: format ‘%ld’ \
     expects argument of type ‘long int’, but argument 6 has type ‘size_t {aka unsigned int}’ [-Wformat=]
     "%s: pages: 0x%08x (%ld bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
     ^

Fixes: 03884c93560c ("media: atomisp: add debug for hmm alloc")
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20201126181150.10576-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/atomisp/pci/hmm/hmm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm.c b/drivers/staging/media/atomisp/pci/hmm/hmm.c
index e0eaff0f8a228..6a5ee46070898 100644
--- a/drivers/staging/media/atomisp/pci/hmm/hmm.c
+++ b/drivers/staging/media/atomisp/pci/hmm/hmm.c
@@ -269,7 +269,7 @@ ia_css_ptr hmm_alloc(size_t bytes, enum hmm_bo_type type,
 		hmm_set(bo->start, 0, bytes);
 
 	dev_dbg(atomisp_dev,
-		"%s: pages: 0x%08x (%ld bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
+		"%s: pages: 0x%08x (%zu bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
 		__func__, bo->start, bytes, type, from_highmem, userptr, cached);
 
 	return bo->start;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 059/663] Bluetooth: drop HCI device reference before return
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 058/663] staging: media: atomisp: Fix size_t format specifier in hmm_alloc() debug statemenet Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 060/663] Bluetooth: Put HCI device if inquiry procedure interrupts Greg Kroah-Hartman
                   ` (604 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Bian, Marcel Holtmann, Sasha Levin

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ]

Call hci_dev_put() to decrement reference count of HCI device hdev if
fails to duplicate memory.

Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/a2mp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index cc26e4c047ad0..463bad58478b2 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -512,6 +512,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
 		assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
 		if (!assoc) {
 			amp_ctrl_put(ctrl);
+			hci_dev_put(hdev);
 			return -ENOMEM;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 060/663] Bluetooth: Put HCI device if inquiry procedure interrupts
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 059/663] Bluetooth: drop HCI device reference before return Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 061/663] memory: ti-aemif: Drop child node when jumping out loop Greg Kroah-Hartman
                   ` (603 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Bian, Marcel Holtmann, Sasha Levin

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ]

Jump to the label done to decrement the reference count of HCI device
hdev on path that the Inquiry procedure is interrupted.

Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c4aa2cbb92697..555058270f112 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1356,8 +1356,10 @@ int hci_inquiry(void __user *arg)
 		 * cleared). If it is interrupted by a signal, return -EINTR.
 		 */
 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
-				TASK_INTERRUPTIBLE))
-			return -EINTR;
+				TASK_INTERRUPTIBLE)) {
+			err = -EINTR;
+			goto done;
+		}
 	}
 
 	/* for unlimited number of responses we will use buffer with
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 061/663] memory: ti-aemif: Drop child node when jumping out loop
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 060/663] Bluetooth: Put HCI device if inquiry procedure interrupts Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 062/663] ARM: dts: Configure missing thermal interrupt for 4430 Greg Kroah-Hartman
                   ` (602 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Bian, Krzysztof Kozlowski, Sasha Levin

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 94e9dd43cf327366388c8f146bccdc6322c0d999 ]

Call of_node_put() to decrement the reference count of the child node
child_np when jumping out of the loop body of
for_each_available_child_of_node(), which is a macro that increments and
decrements the reference count of child node. If the loop is broken, the
reference of the child node should be dropped manually.

Fixes: 5a7c81547c1d ("memory: ti-aemif: introduce AEMIF driver")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Link: https://lore.kernel.org/r/20210121090359.61763-1-bianpan2016@163.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/ti-aemif.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
index 159a16f5e7d67..51d20c2ccb755 100644
--- a/drivers/memory/ti-aemif.c
+++ b/drivers/memory/ti-aemif.c
@@ -378,8 +378,10 @@ static int aemif_probe(struct platform_device *pdev)
 		 */
 		for_each_available_child_of_node(np, child_np) {
 			ret = of_aemif_parse_abus_config(pdev, child_np);
-			if (ret < 0)
+			if (ret < 0) {
+				of_node_put(child_np);
 				goto error;
+			}
 		}
 	} else if (pdata && pdata->num_abus_data > 0) {
 		for (i = 0; i < pdata->num_abus_data; i++, aemif->num_cs++) {
@@ -405,8 +407,10 @@ static int aemif_probe(struct platform_device *pdev)
 		for_each_available_child_of_node(np, child_np) {
 			ret = of_platform_populate(child_np, NULL,
 						   dev_lookup, dev);
-			if (ret < 0)
+			if (ret < 0) {
+				of_node_put(child_np);
 				goto error;
+			}
 		}
 	} else if (pdata) {
 		for (i = 0; i < pdata->num_sub_devices; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 062/663] ARM: dts: Configure missing thermal interrupt for 4430
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 061/663] memory: ti-aemif: Drop child node when jumping out loop Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 063/663] usb: dwc2: Do not update data length if it is 0 on inbound transfers Greg Kroah-Hartman
                   ` (601 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Carl Philipp Klemm, Daniel Lezcano,
	Eduardo Valentin, Merlijn Wajer, Pavel Machek, Peter Ujfalusi,
	Sebastian Reichel, Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 44f416879a442600b006ef7dec3a6dc98bcf59c6 ]

We have gpio_86 wired internally to the bandgap thermal shutdown
interrupt on 4430 like we have it on 4460 according to the TRM.
This can be found easily by searching for TSHUT.

For some reason the thermal shutdown interrupt was never added
for 4430, let's add it. I believe this is needed for the thermal
shutdown interrupt handler ti_bandgap_tshut_irq_handler() to call
orderly_poweroff().

Fixes: aa9bb4bb8878 ("arm: dts: add omap4430 thermal data")
Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Eduardo Valentin <edubezval@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap443x.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi
index cb309743de5da..dd8ef58cbaed4 100644
--- a/arch/arm/boot/dts/omap443x.dtsi
+++ b/arch/arm/boot/dts/omap443x.dtsi
@@ -33,10 +33,12 @@
 	};
 
 	ocp {
+		/* 4430 has only gpio_86 tshut and no talert interrupt */
 		bandgap: bandgap@4a002260 {
 			reg = <0x4a002260 0x4
 			       0x4a00232C 0x4>;
 			compatible = "ti,omap4430-bandgap";
+			gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
 
 			#thermal-sensor-cells = <0>;
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 063/663] usb: dwc2: Do not update data length if it is 0 on inbound transfers
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 062/663] ARM: dts: Configure missing thermal interrupt for 4430 Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 064/663] usb: dwc2: Abort transaction after errors with unknown reason Greg Kroah-Hartman
                   ` (600 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Saenz Julienne,
	Douglas Anderson, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 415fa1c7305dedbb345e2cc8ac91769bc1c83f1a ]

The DWC2 documentation states that transfers with zero data length should
set the number of packets to 1 and the transfer length to 0. This is not
currently the case for inbound transfers: the transfer length is set to
the maximum packet length. This can have adverse effects if the chip
actually does transfer data as it is programmed to do. Follow chip
documentation and keep the transfer length set to 0 in that situation.

Fixes: 56f5b1cff22a1 ("staging: Core files for the DWC2 driver")
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-2-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index e9ac215b96633..fc3269f5faf19 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -1313,19 +1313,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
 			if (num_packets > max_hc_pkt_count) {
 				num_packets = max_hc_pkt_count;
 				chan->xfer_len = num_packets * chan->max_packet;
+			} else if (chan->ep_is_in) {
+				/*
+				 * Always program an integral # of max packets
+				 * for IN transfers.
+				 * Note: This assumes that the input buffer is
+				 * aligned and sized accordingly.
+				 */
+				chan->xfer_len = num_packets * chan->max_packet;
 			}
 		} else {
 			/* Need 1 packet for transfer length of 0 */
 			num_packets = 1;
 		}
 
-		if (chan->ep_is_in)
-			/*
-			 * Always program an integral # of max packets for IN
-			 * transfers
-			 */
-			chan->xfer_len = num_packets * chan->max_packet;
-
 		if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
 		    chan->ep_type == USB_ENDPOINT_XFER_ISOC)
 			/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 064/663] usb: dwc2: Abort transaction after errors with unknown reason
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 063/663] usb: dwc2: Do not update data length if it is 0 on inbound transfers Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 065/663] usb: dwc2: Make "trimming xfer length" a debug message Greg Kroah-Hartman
                   ` (599 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Boris ARZUR, Douglas Anderson,
	Nicolas Saenz Julienne, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ]

In some situations, the following error messages are reported.

dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown
dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021

This is sometimes followed by:

dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length

and then:

WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913
			dwc2_assign_and_init_hc+0x98c/0x990

The warning suggests that an odd buffer address is to be used for DMA.

After an error is observed, the receive buffer may be full
(urb->actual_length >= urb->length). However, the urb is still left in
the queue unless three errors were observed in a row. When it is queued
again, the dwc2 hcd code translates this into a 1-block transfer.
If urb->actual_length (ie the total expected receive length) is not
DMA-aligned, the buffer pointer programmed into the chip will be
unaligned. This results in the observed warning.

To solve the problem, abort input transactions after an error with
unknown cause if the entire packet was already received. This may be
a bit drastic, but we don't really know why the transfer was aborted
even though the entire packet was received. Aborting the transfer in
this situation is less risky than accepting a potentially corrupted
packet.

With this patch in place, the 'ChHltd set' and 'trimming xfer length'
messages are still observed, but there are no more transfer attempts
with odd buffer addresses.

Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better")
Cc: Boris ARZUR <boris@konbu.org>
Cc: Douglas Anderson <dianders@chromium.org>
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index a052d39b4375e..12819e019e13c 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1977,6 +1977,18 @@ error:
 		qtd->error_count++;
 		dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
 					  qtd, DWC2_HC_XFER_XACT_ERR);
+		/*
+		 * We can get here after a completed transaction
+		 * (urb->actual_length >= urb->length) which was not reported
+		 * as completed. If that is the case, and we do not abort
+		 * the transfer, a transfer of size 0 will be enqueued
+		 * subsequently. If urb->actual_length is not DMA-aligned,
+		 * the buffer will then point to an unaligned address, and
+		 * the resulting behavior is undefined. Bail out in that
+		 * situation.
+		 */
+		if (qtd->urb->actual_length >= qtd->urb->length)
+			qtd->error_count = 3;
 		dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
 		dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 065/663] usb: dwc2: Make "trimming xfer length" a debug message
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 064/663] usb: dwc2: Abort transaction after errors with unknown reason Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 066/663] staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules Greg Kroah-Hartman
                   ` (598 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Saenz Julienne,
	Douglas Anderson, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ]

With some USB network adapters, such as DM96xx, the following message
is seen for each maximum size receive packet.

dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length

This happens because the packet size requested by the driver is 1522
bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to
receive 24*64 = 1536 bytes, and the chip does indeed send more than
1522 bytes of data. Since the event does not indicate an error condition,
the message is just noise. Demote it to debug level.

Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver")
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd_intr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 12819e019e13c..d5f4ec1b73b15 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -500,7 +500,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
 						      &short_read);
 
 	if (urb->actual_length + xfer_length > urb->length) {
-		dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+		dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
 		xfer_length = urb->length - urb->actual_length;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 066/663] staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 065/663] usb: dwc2: Make "trimming xfer length" a debug message Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 067/663] x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too Greg Kroah-Hartman
                   ` (597 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 61834c967a929f6b4b7fcb91f43fa225cc29aa19 ]

The custom regulatory ruleset in the rtl8723bs driver lists an incorrect
number of rules: one too many. This results in an out-of-bounds access,
as detected by KASAN. This was possible thanks to the newly added support
for KASAN on ARMv7.

Fix this by filling in the correct number of rules given.

KASAN report:

==================================================================
BUG: KASAN: global-out-of-bounds in cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211]
Read of size 4 at addr bf20c254 by task ip/971

CPU: 2 PID: 971 Comm: ip Tainted: G         C        5.11.0-rc2-00020-gf7fe528a7ebe #1
Hardware name: Allwinner sun8i Family
[<c0113338>] (unwind_backtrace) from [<c010e8a4>] (show_stack+0x10/0x14)
[<c010e8a4>] (show_stack) from [<c0e0f868>] (dump_stack+0x9c/0xb4)
[<c0e0f868>] (dump_stack) from [<c0388284>] (print_address_description.constprop.2+0x1dc/0x2dc)
[<c0388284>] (print_address_description.constprop.2) from [<c03885cc>] (kasan_report+0x1a8/0x1c4)
[<c03885cc>] (kasan_report) from [<bf00a354>] (cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211])
[<bf00a354>] (cfg80211_does_bw_fit_range [cfg80211]) from [<bf00b41c>] (freq_reg_info_regd.part.6+0x108/0x124 [>
[<bf00b41c>] (freq_reg_info_regd.part.6 [cfg80211]) from [<bf00df00>] (handle_channel_custom.constprop.12+0x48/>
[<bf00df00>] (handle_channel_custom.constprop.12 [cfg80211]) from [<bf00e150>] (wiphy_apply_custom_regulatory+0>
[<bf00e150>] (wiphy_apply_custom_regulatory [cfg80211]) from [<bf1fb9e8>] (rtw_regd_init+0x60/0x70 [r8723bs])
[<bf1fb9e8>] (rtw_regd_init [r8723bs]) from [<bf1ee5a8>] (rtw_cfg80211_init_wiphy+0x164/0x1e8 [r8723bs])
[<bf1ee5a8>] (rtw_cfg80211_init_wiphy [r8723bs]) from [<bf1f8d50>] (_netdev_open+0xe4/0x28c [r8723bs])
[<bf1f8d50>] (_netdev_open [r8723bs]) from [<bf1f8f58>] (netdev_open+0x60/0x88 [r8723bs])
[<bf1f8f58>] (netdev_open [r8723bs]) from [<c0bb3730>] (__dev_open+0x178/0x220)
[<c0bb3730>] (__dev_open) from [<c0bb3cdc>] (__dev_change_flags+0x258/0x2c4)
[<c0bb3cdc>] (__dev_change_flags) from [<c0bb3d88>] (dev_change_flags+0x40/0x80)
[<c0bb3d88>] (dev_change_flags) from [<c0bc86fc>] (do_setlink+0x538/0x1160)
[<c0bc86fc>] (do_setlink) from [<c0bcf9e8>] (__rtnl_newlink+0x65c/0xad8)
[<c0bcf9e8>] (__rtnl_newlink) from [<c0bcfeb0>] (rtnl_newlink+0x4c/0x6c)
[<c0bcfeb0>] (rtnl_newlink) from [<c0bc67c8>] (rtnetlink_rcv_msg+0x1f8/0x454)
[<c0bc67c8>] (rtnetlink_rcv_msg) from [<c0c330e4>] (netlink_rcv_skb+0xc4/0x1e0)
[<c0c330e4>] (netlink_rcv_skb) from [<c0c32478>] (netlink_unicast+0x2c8/0x3c4)
[<c0c32478>] (netlink_unicast) from [<c0c32894>] (netlink_sendmsg+0x320/0x5f0)
[<c0c32894>] (netlink_sendmsg) from [<c0b75eb0>] (____sys_sendmsg+0x320/0x3e0)
[<c0b75eb0>] (____sys_sendmsg) from [<c0b78394>] (___sys_sendmsg+0xe8/0x12c)
[<c0b78394>] (___sys_sendmsg) from [<c0b78a50>] (__sys_sendmsg+0xc0/0x120)
[<c0b78a50>] (__sys_sendmsg) from [<c0100060>] (ret_fast_syscall+0x0/0x58)
Exception stack(0xc5693fa8 to 0xc5693ff0)
3fa0:                   00000074 c7a39800 00000003 b6cee648 00000000 00000000
3fc0: 00000074 c7a39800 00000001 00000128 78d18349 00000000 b6ceeda0 004f7cb0
3fe0: 00000128 b6cee5e8 aeca151f aec1d746

The buggy address belongs to the variable:
 rtw_drv_halt+0xf908/0x6b4 [r8723bs]

Memory state around the buggy address:
 bf20c100: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
 bf20c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>bf20c200: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
                                         ^
 bf20c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 bf20c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20210108141401.31741-1-wens@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
index 578b9f734231e..65592bf84f380 100644
--- a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+++ b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
@@ -34,7 +34,7 @@
 	NL80211_RRF_PASSIVE_SCAN)
 
 static const struct ieee80211_regdomain rtw_regdom_rd = {
-	.n_reg_rules = 3,
+	.n_reg_rules = 2,
 	.alpha2 = "99",
 	.reg_rules = {
 		RTW_2GHZ_CH01_11,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 067/663] x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 066/663] staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 068/663] arm64: dts: renesas: beacon: Fix EEPROM compatible value Greg Kroah-Hartman
                   ` (596 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Misono Tomohiro, Borislav Petkov,
	Sasha Levin

From: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>

[ Upstream commit 02a16aa13574c8526beadfc9ae8cc9b66315fa2d ]

Commit

  a7e1f67ed29f ("x86/msr: Filter MSR writes")

introduced a module parameter to disable writing to the MSR device file
and tainted the kernel upon writing. As MSR registers can be written by
the X86_IOC_WRMSR_REGS ioctl too, the same filtering and tainting should
be applied to the ioctl as well.

 [ bp: Massage commit message and space out statements. ]

Fixes: a7e1f67ed29f ("x86/msr: Filter MSR writes")
Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210127122456.13939-1-misono.tomohiro@jp.fujitsu.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/msr.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
index c0d4098106589..79f900ffde4c5 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c
@@ -184,6 +184,13 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
 		err = security_locked_down(LOCKDOWN_MSR);
 		if (err)
 			break;
+
+		err = filter_write(regs[1]);
+		if (err)
+			return err;
+
+		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+
 		err = wrmsr_safe_regs_on_cpu(cpu, regs);
 		if (err)
 			break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 068/663] arm64: dts: renesas: beacon: Fix EEPROM compatible value
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 067/663] x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 069/663] can: mcp251xfd: mcp251xfd_probe(): fix errata reference Greg Kroah-Hartman
                   ` (595 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 74477936a828a7c91a61ba7e625b7ce2299c8c98 ]

"make dtbs_check" fails with:

    arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dt.yaml: eeprom@50: compatible: 'oneOf' conditional failed, one must be fixed:
	    'microchip,at24c64' does not match '^(atmel|catalyst|microchip|nxp|ramtron|renesas|rohm|st),(24(c|cs|lc|mac)[0-9]+|spd)$'

Fix this by dropping the bogus "at" prefix.

Fixes: a1d8a344f1ca0709 ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20210128110136.2293490-1-geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
index 6d24b36ca0a7c..289cf711307d6 100644
--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
@@ -147,7 +147,7 @@
 	};
 
 	eeprom@50 {
-		compatible = "microchip,at24c64", "atmel,24c64";
+		compatible = "microchip,24c64", "atmel,24c64";
 		pagesize = <32>;
 		read-only;	/* Manufacturing EEPROM programmed at factory */
 		reg = <0x50>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 069/663] can: mcp251xfd: mcp251xfd_probe(): fix errata reference
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 068/663] arm64: dts: renesas: beacon: Fix EEPROM compatible value Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 070/663] ARM: dts: armada388-helios4: assign pinctrl to LEDs Greg Kroah-Hartman
                   ` (594 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 28eb119c042e8d3420b577b5b3ea851a111e7b2d ]

This patch fixes the reference to the errata for both the mcp2517fd
and the mcp2518fd.

Fixes: f5b84dedf7eb ("can: mcp25xxfd: mcp25xxfd_probe(): add SPI clk limit related errata information")
Link: https://lore.kernel.org/r/20210128104644.2982125-2-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 59de6b3b5f026..096d818c167e2 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -2824,7 +2824,7 @@ static int mcp251xfd_probe(struct spi_device *spi)
 			spi_get_device_id(spi)->driver_data;
 
 	/* Errata Reference:
-	 * mcp2517fd: DS80000789B, mcp2518fd: DS80000792C 4.
+	 * mcp2517fd: DS80000792C 5., mcp2518fd: DS80000789C 4.
 	 *
 	 * The SPI can write corrupted data to the RAM at fast SPI
 	 * speeds:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 070/663] ARM: dts: armada388-helios4: assign pinctrl to LEDs
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 069/663] can: mcp251xfd: mcp251xfd_probe(): fix errata reference Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 071/663] ARM: dts: armada388-helios4: assign pinctrl to each fan Greg Kroah-Hartman
                   ` (593 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rosen Penev, Gregory CLEMENT, Sasha Levin

From: Rosen Penev <rosenp@gmail.com>

[ Upstream commit e011c9025a4691b5c734029577a920bd6c320994 ]

Split up the pins to match earlier definitions. Allows LEDs to flash
properly.

Fixes: ced8025b569e ("ARM: dts: armada388-helios4")

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/armada-388-helios4.dts | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
index fb49df2a3bce7..e4c274ca26501 100644
--- a/arch/arm/boot/dts/armada-388-helios4.dts
+++ b/arch/arm/boot/dts/armada-388-helios4.dts
@@ -70,6 +70,9 @@
 
 	system-leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&helios_system_led_pins>;
+
 		status-led {
 			label = "helios4:green:status";
 			gpios = <&gpio0 24 GPIO_ACTIVE_LOW>;
@@ -86,6 +89,9 @@
 
 	io-leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&helios_io_led_pins>;
+
 		sata1-led {
 			label = "helios4:green:ata1";
 			gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
@@ -286,9 +292,12 @@
 						       "mpp39", "mpp40";
 					marvell,function = "sd0";
 				};
-				helios_led_pins: helios-led-pins {
-					marvell,pins = "mpp24", "mpp25",
-						       "mpp49", "mpp50",
+				helios_system_led_pins: helios-system-led-pins {
+					marvell,pins = "mpp24", "mpp25";
+					marvell,function = "gpio";
+				};
+				helios_io_led_pins: helios-io-led-pins {
+					marvell,pins = "mpp49", "mpp50",
 						       "mpp52", "mpp53",
 						       "mpp54";
 					marvell,function = "gpio";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 071/663] ARM: dts: armada388-helios4: assign pinctrl to each fan
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 070/663] ARM: dts: armada388-helios4: assign pinctrl to LEDs Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05   ` Greg Kroah-Hartman
                   ` (592 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rosen Penev, Gregory CLEMENT, Sasha Levin

From: Rosen Penev <rosenp@gmail.com>

[ Upstream commit 46ecdfc1830eaa40a11d7f832089c82b0e67ea96 ]

Split up the pins for each fan. This is needed in order to control them

Fixes: ced8025b569e ("ARM: dts: armada388-helios4")

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/armada-388-helios4.dts | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
index e4c274ca26501..a7ff774d797c8 100644
--- a/arch/arm/boot/dts/armada-388-helios4.dts
+++ b/arch/arm/boot/dts/armada-388-helios4.dts
@@ -127,11 +127,15 @@
 	fan1: j10-pwm {
 		compatible = "pwm-fan";
 		pwms = <&gpio1 9 40000>;	/* Target freq:25 kHz */
+		pinctrl-names = "default";
+		pinctrl-0 = <&helios_fan1_pins>;
 	};
 
 	fan2: j17-pwm {
 		compatible = "pwm-fan";
 		pwms = <&gpio1 23 40000>;	/* Target freq:25 kHz */
+		pinctrl-names = "default";
+		pinctrl-0 = <&helios_fan2_pins>;
 	};
 
 	usb2_phy: usb2-phy {
@@ -302,9 +306,12 @@
 						       "mpp54";
 					marvell,function = "gpio";
 				};
-				helios_fan_pins: helios-fan-pins {
-					marvell,pins = "mpp41", "mpp43",
-						       "mpp48", "mpp55";
+				helios_fan1_pins: helios_fan1_pins {
+					marvell,pins = "mpp41", "mpp43";
+					marvell,function = "gpio";
+				};
+				helios_fan2_pins: helios_fan2_pins {
+					marvell,pins = "mpp48", "mpp55";
 					marvell,function = "gpio";
 				};
 				microsom_spi1_cs_pins: spi1-cs-pins {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 072/663] arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to a53-firmware
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
@ 2021-03-01 16:05   ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 002/663] vdpa/mlx5: fix param validation in mlx5_vdpa_get_config() Greg Kroah-Hartman
                     ` (662 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Behún, Gregory CLEMENT,
	linux-arm-kernel, Sasha Levin

From: Marek Behún <kabel@kernel.org>

[ Upstream commit a9d9bfcadfb43b856dbcf9419de75f7420d5a225 ]

The partition called "u-boot" in reality contains TF-A and U-Boot, and
TF-A is before U-Boot.

Rename this parition to "a53-firmware" to avoid confusion for users,
since they cannot simply build U-Boot from U-Boot repository and flash
the resulting image there. Instead they have to build the firmware with
the sources from the mox-boot-builder repository [1] and flash the
a53-firmware.bin binary there.

[1] https://gitlab.nic.cz/turris/mox-boot-builder

Signed-off-by: Marek Behún <kabel@kernel.org>
Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index bf76ebe463794..cca143e4b6bf8 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -204,7 +204,7 @@
 			};
 
 			partition@20000 {
-				label = "u-boot";
+				label = "a53-firmware";
 				reg = <0x20000 0x160000>;
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 072/663] arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to a53-firmware
@ 2021-03-01 16:05   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Marek Behún, Sasha Levin, Greg Kroah-Hartman,
	Gregory CLEMENT, stable, linux-arm-kernel

From: Marek Behún <kabel@kernel.org>

[ Upstream commit a9d9bfcadfb43b856dbcf9419de75f7420d5a225 ]

The partition called "u-boot" in reality contains TF-A and U-Boot, and
TF-A is before U-Boot.

Rename this parition to "a53-firmware" to avoid confusion for users,
since they cannot simply build U-Boot from U-Boot repository and flash
the resulting image there. Instead they have to build the firmware with
the sources from the mox-boot-builder repository [1] and flash the
a53-firmware.bin binary there.

[1] https://gitlab.nic.cz/turris/mox-boot-builder

Signed-off-by: Marek Behún <kabel@kernel.org>
Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index bf76ebe463794..cca143e4b6bf8 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -204,7 +204,7 @@
 			};
 
 			partition@20000 {
-				label = "u-boot";
+				label = "a53-firmware";
 				reg = <0x20000 0x160000>;
 			};
 
-- 
2.27.0




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 073/663] opp: Correct debug message in _opp_add_static_v2()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2021-03-01 16:05   ` Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 074/663] Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv Greg Kroah-Hartman
                   ` (590 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Geis, Nicolas Chauvet,
	Matt Merhar, Dmitry Osipenko, Viresh Kumar, Sasha Levin

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit d7b9d9b31a3e55dcc9b5c289abfafe31efa5b5c4 ]

The debug message always prints rate=0 instead of a proper value, fix it.

Fixes: 6c591eec67cb ("OPP: Add helpers for reading the binding properties")
Tested-by: Peter Geis <pgwipeout@gmail.com>
Tested-by: Nicolas Chauvet <kwizart@gmail.com>
Tested-by: Matt Merhar <mattmerhar@protonmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
[ Viresh: Added Fixes tag ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/of.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index 9faeb83e4b326..363277b31ecbb 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -751,7 +751,6 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
 		struct device *dev, struct device_node *np)
 {
 	struct dev_pm_opp *new_opp;
-	u64 rate = 0;
 	u32 val;
 	int ret;
 	bool rate_not_available = false;
@@ -768,7 +767,8 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
 
 	/* Check if the OPP supports hardware's hierarchy of versions or not */
 	if (!_opp_is_supported(dev, opp_table, np)) {
-		dev_dbg(dev, "OPP not supported by hardware: %llu\n", rate);
+		dev_dbg(dev, "OPP not supported by hardware: %lu\n",
+			new_opp->rate);
 		goto free_opp;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 074/663] Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 073/663] opp: Correct debug message in _opp_add_static_v2() Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 075/663] soc: qcom: ocmem: dont return NULL in of_get_ocmem Greg Kroah-Hartman
                   ` (589 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jupeng Zhong, Marcel Holtmann, Sasha Levin

From: Jupeng Zhong <zhongjupeng@yulong.com>

[ Upstream commit de71a6cb4bf24d8993b9ca90d1ddb131b60251a1 ]

In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should be
released.

Omit the labels “err_out” and “err_free_skb” in this function
implementation so that the desired exception handling code
would be directly specified in the affected if branches.

Fixes: a1c49c434e15 ("btusb: Add protocol support for MediaTek MT7668U USB devices")
Signed-off-by: Jupeng Zhong <zhongjupeng@yulong.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 1c942869baacc..2953b96b3ceda 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2827,7 +2827,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
 		skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
 		if (!skb) {
 			hdev->stat.err_rx++;
-			goto err_out;
+			return;
 		}
 
 		hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
@@ -2845,13 +2845,18 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
 		 */
 		if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
 			data->evt_skb = skb_clone(skb, GFP_ATOMIC);
-			if (!data->evt_skb)
-				goto err_out;
+			if (!data->evt_skb) {
+				kfree_skb(skb);
+				return;
+			}
 		}
 
 		err = hci_recv_frame(hdev, skb);
-		if (err < 0)
-			goto err_free_skb;
+		if (err < 0) {
+			kfree_skb(data->evt_skb);
+			data->evt_skb = NULL;
+			return;
+		}
 
 		if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
 				       &data->flags)) {
@@ -2860,11 +2865,6 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
 			wake_up_bit(&data->flags,
 				    BTUSB_TX_WAIT_VND_EVT);
 		}
-err_out:
-		return;
-err_free_skb:
-		kfree_skb(data->evt_skb);
-		data->evt_skb = NULL;
 		return;
 	} else if (urb->status == -ENOENT) {
 		/* Avoid suspend failed when usb_kill_urb */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 075/663] soc: qcom: ocmem: dont return NULL in of_get_ocmem
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 074/663] Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 076/663] arm64: dts: msm8916: Fix reserved and rfsa nodes unit address Greg Kroah-Hartman
                   ` (588 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Masney, Luca Weiss,
	Bjorn Andersson, Sasha Levin

From: Luca Weiss <luca@z3ntu.xyz>

[ Upstream commit 01f937ffc4686837d6c43dea80c6ade6cbd2940a ]

If ocmem probe fails for whatever reason, of_get_ocmem returned NULL.
Without this, users must check for both NULL and IS_ERR on the returned
pointer - which didn't happen in drivers/gpu/drm/msm/adreno/adreno_gpu.c
leading to a NULL pointer dereference.

Reviewed-by: Brian Masney <masneyb@onstation.org>
Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver")
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20210130142349.53335-1-luca@z3ntu.xyz
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/ocmem.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c
index 7f9e9944d1eae..f1875dc31ae2c 100644
--- a/drivers/soc/qcom/ocmem.c
+++ b/drivers/soc/qcom/ocmem.c
@@ -189,6 +189,7 @@ struct ocmem *of_get_ocmem(struct device *dev)
 {
 	struct platform_device *pdev;
 	struct device_node *devnode;
+	struct ocmem *ocmem;
 
 	devnode = of_parse_phandle(dev->of_node, "sram", 0);
 	if (!devnode || !devnode->parent) {
@@ -202,7 +203,12 @@ struct ocmem *of_get_ocmem(struct device *dev)
 		return ERR_PTR(-EPROBE_DEFER);
 	}
 
-	return platform_get_drvdata(pdev);
+	ocmem = platform_get_drvdata(pdev);
+	if (!ocmem) {
+		dev_err(dev, "Cannot get ocmem\n");
+		return ERR_PTR(-ENODEV);
+	}
+	return ocmem;
 }
 EXPORT_SYMBOL(of_get_ocmem);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 076/663] arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 075/663] soc: qcom: ocmem: dont return NULL in of_get_ocmem Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 077/663] arm64: dts: meson: fix broken wifi node for Khadas VIM3L Greg Kroah-Hartman
                   ` (587 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Knecht, Bjorn Andersson, Sasha Levin

From: Vincent Knecht <vincent.knecht@mailoo.org>

[ Upstream commit d5ae2528b0b56cf054b27d48b0cb85330900082f ]

Fix `reserved` and `rfsa` unit address according to their reg address

Fixes: 7258e10e6a0b ("ARM: dts: msm8916: Update reserved-memory")

Signed-off-by: Vincent Knecht <vincent.knecht@mailoo.org>
Link: https://lore.kernel.org/r/20210123104417.518105-1-vincent.knecht@mailoo.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index aaa21899f1a63..0e34ed48b9fae 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -55,7 +55,7 @@
 			no-map;
 		};
 
-		reserved@8668000 {
+		reserved@86680000 {
 			reg = <0x0 0x86680000 0x0 0x80000>;
 			no-map;
 		};
@@ -68,7 +68,7 @@
 			qcom,client-id = <1>;
 		};
 
-		rfsa@867e00000 {
+		rfsa@867e0000 {
 			reg = <0x0 0x867e0000 0x0 0x20000>;
 			no-map;
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 077/663] arm64: dts: meson: fix broken wifi node for Khadas VIM3L
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 076/663] arm64: dts: msm8916: Fix reserved and rfsa nodes unit address Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 078/663] iwlwifi: mvm: set enabled in the PPAG command properly Greg Kroah-Hartman
                   ` (586 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem Lapkin, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Artem Lapkin <email2tema@gmail.com>

[ Upstream commit 39be8f441f78908e97ff913571e10ec03387a63a ]

move &sd_emmc_a ... from /* */ commented area, because cant load wifi fw
without sd-uhs-sdr50 option on VIM3L

[   11.686590] brcmfmac: brcmf_chip_cores_check: CPU core not detected
[   11.696382] brcmfmac: brcmf_sdio_probe_attach: brcmf_chip_attach failed!
[   11.706240] brcmfmac: brcmf_sdio_probe: brcmf_sdio_probe_attach failed
[   11.715890] brcmfmac: brcmf_ops_sdio_probe: F2 error, probe failed -19...
[   13.718424] brcmfmac: brcmf_chip_recognition: chip backplane type 15 is not supported

Signed-off-by: Artem Lapkin <art@khadas.com>
Fixes: f1bb924e8f5b ("arm64: dts: meson: fix mmc0 tuning error on Khadas VIM3")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20210129085041.1408540-1-art@khadas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
index 4b517ca720597..06de0b1ce7267 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
@@ -89,13 +89,12 @@
 	status = "okay";
 };
 
-&sd_emmc_a {
-	sd-uhs-sdr50;
-};
-
 &usb {
 	phys = <&usb2_phy0>, <&usb2_phy1>;
 	phy-names = "usb2-phy0", "usb2-phy1";
 };
  */
 
+&sd_emmc_a {
+	sd-uhs-sdr50;
+};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 078/663] iwlwifi: mvm: set enabled in the PPAG command properly
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 077/663] arm64: dts: meson: fix broken wifi node for Khadas VIM3L Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 079/663] ARM: s3c: fix fiq for clang IAS Greg Kroah-Hartman
                   ` (585 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit efaa85cf2294d5e10a724e24356507eeb3836f72 ]

When version 2 of the PER_PLATFORM_ANT_GAIN_CMD was implemented, we
started copying the values from the command that we have stored into a
local instance.  But we accidentally forgot to copy the enabled flag,
so in practice PPAG is never really enabled.  Fix this by copying the
flag from our stored data a we should.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210131201908.24d7bf754ad5.I0e8abc2b8747508b6118242533d68c856ca6dffb@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 6385b9641126b..059ce227151ea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1034,6 +1034,8 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
 		return 0;
 	}
 
+	ppag_table.v1.enabled = mvm->fwrt.ppag_table.v1.enabled;
+
 	cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, PHY_OPS_GROUP,
 					PER_PLATFORM_ANT_GAIN_CMD,
 					IWL_FW_CMD_VER_UNKNOWN);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 079/663] ARM: s3c: fix fiq for clang IAS
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 078/663] iwlwifi: mvm: set enabled in the PPAG command properly Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 080/663] optee: simplify i2c access Greg Kroah-Hartman
                   ` (584 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Agner, Arnd Bergmann,
	Nick Desaulniers, Nathan Chancellor, Krzysztof Kozlowski,
	Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ]

Building with the clang integrated assembler produces a couple of
errors for the s3c24xx fiq support:

  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified
    subnes pc, lr, #4 @@ return, still have work to do

  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition
    s3c24xx_spi_fiq_txrx:

There are apparently two problems: one with extraneous or duplicate
labels, and one with old-style opcode mnemonics. Stefan Agner has
previously fixed other problems like this, but missed this particular
file.

Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support")
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-s3c/irq-s3c24xx-fiq.S | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/arch/arm/mach-s3c/irq-s3c24xx-fiq.S b/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
index b54cbd0122413..5d238d9a798e1 100644
--- a/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
+++ b/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
@@ -35,7 +35,6 @@
 	@ and an offset to the irq acknowledgment word
 
 ENTRY(s3c24xx_spi_fiq_rx)
-s3c24xx_spi_fix_rx:
 	.word	fiq_rx_end - fiq_rx_start
 	.word	fiq_rx_irq_ack - fiq_rx_start
 fiq_rx_start:
@@ -49,7 +48,7 @@ fiq_rx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	@@ set IRQ controller so that next op will trigger IRQ
 	mov	fiq_rtmp, #0
@@ -61,7 +60,6 @@ fiq_rx_irq_ack:
 fiq_rx_end:
 
 ENTRY(s3c24xx_spi_fiq_txrx)
-s3c24xx_spi_fiq_txrx:
 	.word	fiq_txrx_end - fiq_txrx_start
 	.word	fiq_txrx_irq_ack - fiq_txrx_start
 fiq_txrx_start:
@@ -76,7 +74,7 @@ fiq_txrx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	mov	fiq_rtmp, #0
 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
@@ -88,7 +86,6 @@ fiq_txrx_irq_ack:
 fiq_txrx_end:
 
 ENTRY(s3c24xx_spi_fiq_tx)
-s3c24xx_spi_fix_tx:
 	.word	fiq_tx_end - fiq_tx_start
 	.word	fiq_tx_irq_ack - fiq_tx_start
 fiq_tx_start:
@@ -101,7 +98,7 @@ fiq_tx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	mov	fiq_rtmp, #0
 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 080/663] optee: simplify i2c access
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 079/663] ARM: s3c: fix fiq for clang IAS Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 081/663] staging: wfx: fix possible panic with re-queued frames Greg Kroah-Hartman
                   ` (583 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jorge Ramirez-Ortiz, Arnd Bergmann,
	Jens Wiklander, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 67bc809752796acb2641ca343cad5b45eef31d7c ]

Storing a bogus i2c_client structure on the stack adds overhead and
causes a compile-time warning:

drivers/tee/optee/rpc.c:493:6: error: stack frame size of 1056 bytes in function 'optee_handle_rpc' [-Werror,-Wframe-larger-than=]
void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,

Change the implementation of handle_rpc_func_cmd_i2c_transfer() to
open-code the i2c_transfer() call, which makes it easier to read
and avoids the warning.

Fixes: c05210ab9757 ("drivers: optee: allow op-tee to access devices on the i2c bus")
Tested-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tee/optee/rpc.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c
index 1e3614e4798f0..6cbb3643c6c48 100644
--- a/drivers/tee/optee/rpc.c
+++ b/drivers/tee/optee/rpc.c
@@ -54,8 +54,9 @@ bad:
 static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
 					     struct optee_msg_arg *arg)
 {
-	struct i2c_client client = { 0 };
 	struct tee_param *params;
+	struct i2c_adapter *adapter;
+	struct i2c_msg msg = { };
 	size_t i;
 	int ret = -EOPNOTSUPP;
 	u8 attr[] = {
@@ -85,48 +86,48 @@ static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
 			goto bad;
 	}
 
-	client.adapter = i2c_get_adapter(params[0].u.value.b);
-	if (!client.adapter)
+	adapter = i2c_get_adapter(params[0].u.value.b);
+	if (!adapter)
 		goto bad;
 
 	if (params[1].u.value.a & OPTEE_MSG_RPC_CMD_I2C_FLAGS_TEN_BIT) {
-		if (!i2c_check_functionality(client.adapter,
+		if (!i2c_check_functionality(adapter,
 					     I2C_FUNC_10BIT_ADDR)) {
-			i2c_put_adapter(client.adapter);
+			i2c_put_adapter(adapter);
 			goto bad;
 		}
 
-		client.flags = I2C_CLIENT_TEN;
+		msg.flags = I2C_M_TEN;
 	}
 
-	client.addr = params[0].u.value.c;
-	snprintf(client.name, I2C_NAME_SIZE, "i2c%d", client.adapter->nr);
+	msg.addr = params[0].u.value.c;
+	msg.buf  = params[2].u.memref.shm->kaddr;
+	msg.len  = params[2].u.memref.size;
 
 	switch (params[0].u.value.a) {
 	case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD:
-		ret = i2c_master_recv(&client, params[2].u.memref.shm->kaddr,
-				      params[2].u.memref.size);
+		msg.flags |= I2C_M_RD;
 		break;
 	case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR:
-		ret = i2c_master_send(&client, params[2].u.memref.shm->kaddr,
-				      params[2].u.memref.size);
 		break;
 	default:
-		i2c_put_adapter(client.adapter);
+		i2c_put_adapter(adapter);
 		goto bad;
 	}
 
+	ret = i2c_transfer(adapter, &msg, 1);
+
 	if (ret < 0) {
 		arg->ret = TEEC_ERROR_COMMUNICATION;
 	} else {
-		params[3].u.value.a = ret;
+		params[3].u.value.a = msg.len;
 		if (optee_to_msg_param(arg->params, arg->num_params, params))
 			arg->ret = TEEC_ERROR_BAD_PARAMETERS;
 		else
 			arg->ret = TEEC_SUCCESS;
 	}
 
-	i2c_put_adapter(client.adapter);
+	i2c_put_adapter(adapter);
 	kfree(params);
 	return;
 bad:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 081/663] staging: wfx: fix possible panic with re-queued frames
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 080/663] optee: simplify i2c access Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 082/663] ARM: at91: use proper asm syntax in pm_suspend Greg Kroah-Hartman
                   ` (582 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jérôme Pouiller, Sasha Levin

From: Jérôme Pouiller <jerome.pouiller@silabs.com>

[ Upstream commit 26df933d9b83ea668304dc4ec641d52ea1fc4091 ]

When the firmware rejects a frame (because station become asleep or
disconnected), the frame is re-queued in mac80211. However, the
re-queued frame was 8 bytes longer than the original one (the size of
the ICV for the encryption). So, when mac80211 try to send this frame
again, it is a little bigger than expected.
If the frame is re-queued secveral time it end with a skb_over_panic
because the skb buffer is not large enough.

Note it only happens when device acts as an AP and encryption is
enabled.

This patch more or less reverts the commit 049fde130419 ("staging: wfx:
drop useless field from struct wfx_tx_priv").

Fixes: 049fde130419 ("staging: wfx: drop useless field from struct wfx_tx_priv")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20210208135254.399964-1-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/wfx/data_tx.c | 10 +++++++++-
 drivers/staging/wfx/data_tx.h |  1 +
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/wfx/data_tx.c b/drivers/staging/wfx/data_tx.c
index 36b36ef39d053..77fb104efdec1 100644
--- a/drivers/staging/wfx/data_tx.c
+++ b/drivers/staging/wfx/data_tx.c
@@ -331,6 +331,7 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta,
 {
 	struct hif_msg *hif_msg;
 	struct hif_req_tx *req;
+	struct wfx_tx_priv *tx_priv;
 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -344,11 +345,14 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta,
 
 	// From now tx_info->control is unusable
 	memset(tx_info->rate_driver_data, 0, sizeof(struct wfx_tx_priv));
+	// Fill tx_priv
+	tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
+	tx_priv->icv_size = wfx_tx_get_icv_len(hw_key);
 
 	// Fill hif_msg
 	WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
 	WARN(offset & 1, "attempt to transmit an unaligned frame");
-	skb_put(skb, wfx_tx_get_icv_len(hw_key));
+	skb_put(skb, tx_priv->icv_size);
 	skb_push(skb, wmsg_len);
 	memset(skb->data, 0, wmsg_len);
 	hif_msg = (struct hif_msg *)skb->data;
@@ -484,6 +488,7 @@ static void wfx_tx_fill_rates(struct wfx_dev *wdev,
 
 void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
 {
+	const struct wfx_tx_priv *tx_priv;
 	struct ieee80211_tx_info *tx_info;
 	struct wfx_vif *wvif;
 	struct sk_buff *skb;
@@ -495,6 +500,7 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
 		return;
 	}
 	tx_info = IEEE80211_SKB_CB(skb);
+	tx_priv = wfx_skb_tx_priv(skb);
 	wvif = wdev_to_wvif(wdev, ((struct hif_msg *)skb->data)->interface);
 	WARN_ON(!wvif);
 	if (!wvif)
@@ -503,6 +509,8 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
 	// Note that wfx_pending_get_pkt_us_delay() get data from tx_info
 	_trace_tx_stats(arg, skb, wfx_pending_get_pkt_us_delay(wdev, skb));
 	wfx_tx_fill_rates(wdev, tx_info, arg);
+	skb_trim(skb, skb->len - tx_priv->icv_size);
+
 	// From now, you can touch to tx_info->status, but do not touch to
 	// tx_priv anymore
 	// FIXME: use ieee80211_tx_info_clear_status()
diff --git a/drivers/staging/wfx/data_tx.h b/drivers/staging/wfx/data_tx.h
index 46c9fff7a870e..401363d6b563a 100644
--- a/drivers/staging/wfx/data_tx.h
+++ b/drivers/staging/wfx/data_tx.h
@@ -35,6 +35,7 @@ struct tx_policy_cache {
 
 struct wfx_tx_priv {
 	ktime_t xmit_timestamp;
+	unsigned char icv_size;
 };
 
 void wfx_tx_policy_init(struct wfx_vif *wvif);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 082/663] ARM: at91: use proper asm syntax in pm_suspend
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 081/663] staging: wfx: fix possible panic with re-queued frames Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 083/663] ath10k: Fix suspicious RCU usage warning in ath10k_wmi_tlv_parse_peer_stats_info() Greg Kroah-Hartman
                   ` (581 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Nathan Chancellor,
	Nicolas Ferre, Arnd Bergmann, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d30337da8677cd73cb19444436b311c13e57356f ]

Compiling with the clang integrated assembler warns about
a recently added instruction:

<instantiation>:14:13: error: unknown token in expression
 ldr tmp1, =#0x00020010UL
arch/arm/mach-at91/pm_suspend.S:542:2: note: while in macro instantiation
 at91_plla_enable

Remove the extra '#' character that is not used for the 'ldr'
instruction when doing an indirect load of a constant.

Fixes: 4fd36e458392 ("ARM: at91: pm: add plla disable/enable support for sam9x60")
Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20210204160129.2249394-1-arnd@kernel.org'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-at91/pm_suspend.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index 0184de05c1be1..b683c2caa40b9 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -442,7 +442,7 @@ ENDPROC(at91_backup_mode)
 	str	tmp1, [pmc, #AT91_PMC_PLL_UPDT]
 
 	/* step 2. */
-	ldr	tmp1, =#AT91_PMC_PLL_ACR_DEFAULT_PLLA
+	ldr	tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
 	str	tmp1, [pmc, #AT91_PMC_PLL_ACR]
 
 	/* step 3. */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 083/663] ath10k: Fix suspicious RCU usage warning in ath10k_wmi_tlv_parse_peer_stats_info()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 082/663] ARM: at91: use proper asm syntax in pm_suspend Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 084/663] ath10k: Fix lockdep assertion warning in ath10k_sta_statistics Greg Kroah-Hartman
                   ` (580 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anand K Mistry, Kalle Valo, Sasha Levin

From: Anand K Mistry <amistry@google.com>

[ Upstream commit 2615e3cdbd9c0e864f5906279c952a309871d225 ]

The ieee80211_find_sta_by_ifaddr call in
ath10k_wmi_tlv_parse_peer_stats_info must be called while holding the
RCU read lock. Otherwise, the following warning will be seen when RCU
usage checking is enabled:

=============================
WARNING: suspicious RCU usage
5.10.3 #8 Tainted: G        W
-----------------------------
include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
no locks held by ksoftirqd/1/16.

stack backtrace:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G        W         5.10.3 #8
Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.104.0 09/05/2019
Call Trace:
 dump_stack+0xab/0x115
 sta_info_hash_lookup+0x71/0x1e9 [mac80211]
 ? lock_is_held_type+0xe6/0x12f
 ? __kasan_kmalloc+0xfb/0x112
 ieee80211_find_sta_by_ifaddr+0x12/0x61 [mac80211]
 ath10k_wmi_tlv_parse_peer_stats_info+0xbd/0x10b [ath10k_core]
 ath10k_wmi_tlv_iter+0x8b/0x1a1 [ath10k_core]
 ? ath10k_wmi_tlv_iter+0x1a1/0x1a1 [ath10k_core]
 ath10k_wmi_tlv_event_peer_stats_info+0x103/0x13b [ath10k_core]
 ath10k_wmi_tlv_op_rx+0x722/0x80d [ath10k_core]
 ath10k_htc_rx_completion_handler+0x16e/0x1d7 [ath10k_core]
 ath10k_pci_process_rx_cb+0x116/0x22c [ath10k_pci]
 ? ath10k_htc_process_trailer+0x332/0x332 [ath10k_core]
 ? _raw_spin_unlock_irqrestore+0x34/0x61
 ? lockdep_hardirqs_on+0x8e/0x12e
 ath10k_ce_per_engine_service+0x55/0x74 [ath10k_core]
 ath10k_ce_per_engine_service_any+0x76/0x84 [ath10k_core]
 ath10k_pci_napi_poll+0x49/0x141 [ath10k_pci]
 net_rx_action+0x11a/0x347
 __do_softirq+0x2d3/0x539
 run_ksoftirqd+0x4b/0x86
 smpboot_thread_fn+0x1d0/0x2ab
 ? cpu_report_death+0x7f/0x7f
 kthread+0x189/0x191
 ? cpu_report_death+0x7f/0x7f
 ? kthread_blkcg+0x31/0x31
 ret_from_fork+0x22/0x30

Fixes: 0f7cb26830a6e ("ath10k: add rx bitrate report for SDIO")
Signed-off-by: Anand K Mistry <amistry@google.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210202134451.1.I0d2e83c42755671b7143504b62787fd06cd914ed@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 7b5834157fe51..e6135795719a1 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -240,8 +240,10 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
 		   __le32_to_cpu(stat->last_tx_rate_code),
 		   __le32_to_cpu(stat->last_tx_bitrate_kbps));
 
+	rcu_read_lock();
 	sta = ieee80211_find_sta_by_ifaddr(ar->hw, stat->peer_macaddr.addr, NULL);
 	if (!sta) {
+		rcu_read_unlock();
 		ath10k_warn(ar, "not found station for peer stats\n");
 		return -EINVAL;
 	}
@@ -251,6 +253,7 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
 	arsta->rx_bitrate_kbps = __le32_to_cpu(stat->last_rx_bitrate_kbps);
 	arsta->tx_rate_code = __le32_to_cpu(stat->last_tx_rate_code);
 	arsta->tx_bitrate_kbps = __le32_to_cpu(stat->last_tx_bitrate_kbps);
+	rcu_read_unlock();
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 084/663] ath10k: Fix lockdep assertion warning in ath10k_sta_statistics
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 083/663] ath10k: Fix suspicious RCU usage warning in ath10k_wmi_tlv_parse_peer_stats_info() Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 085/663] ath11k: fix a locking bug in ath11k_mac_op_start() Greg Kroah-Hartman
                   ` (579 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anand K Mistry, Kalle Valo, Sasha Levin

From: Anand K Mistry <amistry@google.com>

[ Upstream commit 7df28718928d08034b36168200d67b558ce36f3d ]

ath10k_debug_fw_stats_request just be called with conf_mutex held,
otherwise the following warning is seen when lock debugging is enabled:

WARNING: CPU: 0 PID: 793 at drivers/net/wireless/ath/ath10k/debug.c:357 ath10k_debug_fw_stats_request+0x12c/0x133 [ath10k_core]
Modules linked in: snd_hda_codec_hdmi designware_i2s snd_hda_intel snd_intel_dspcfg snd_hda_codec i2c_piix4 snd_hwdep snd_hda_core acpi_als kfifo_buf industrialio snd_soc_max98357a snd_soc_adau7002 snd_soc_acp_da7219mx98357_mach snd_soc_da7219 acp_audio_dma ccm xt_MASQUERADE fuse ath10k_pci ath10k_core lzo_rle ath lzo_compress mac80211 zram cfg80211 r8152 mii joydev
CPU: 0 PID: 793 Comm: wpa_supplicant Tainted: G        W         5.10.9 #5
Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.104.0 09/05/2019
RIP: 0010:ath10k_debug_fw_stats_request+0x12c/0x133 [ath10k_core]
Code: 1e bb a1 ff ff ff 4c 89 ef 48 c7 c6 d3 31 2e c0 89 da 31 c0 e8 bd f8 ff ff 89 d8 eb 02 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b e9 04 ff ff ff 0f 1f 44 00 00 55 48 89 e5 41 56 53 48 89 fb
RSP: 0018:ffffb2478099f7d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9e432700cce0 RCX: 11c85cfd6b8e3b00
RDX: ffff9e432700cce0 RSI: ffff9e43127c5668 RDI: ffff9e4318deddf0
RBP: ffffb2478099f7f8 R08: 0000000000000002 R09: 00000003fd7068cc
R10: ffffffffc01b2749 R11: ffffffffc029efaf R12: ffff9e432700c000
R13: ffff9e43127c33e0 R14: ffffb2478099f918 R15: ffff9e43127c33e0
FS:  00007f7ea48e2740(0000) GS:ffff9e432aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000059aa799ddf38 CR3: 0000000118de2000 CR4: 00000000001506f0
Call Trace:
 ath10k_sta_statistics+0x4d/0x270 [ath10k_core]
 sta_set_sinfo+0x1be/0xaec [mac80211]
 ieee80211_get_station+0x58/0x76 [mac80211]
 rdev_get_station+0xf1/0x11e [cfg80211]
 nl80211_get_station+0x7f/0x146 [cfg80211]
 genl_rcv_msg+0x32e/0x35e
 ? nl80211_stop_ap+0x19/0x19 [cfg80211]
 ? nl80211_get_station+0x146/0x146 [cfg80211]
 ? genl_rcv+0x19/0x36
 ? genl_rcv+0x36/0x36
 netlink_rcv_skb+0x89/0xfb
 genl_rcv+0x28/0x36
 netlink_unicast+0x169/0x23b
 netlink_sendmsg+0x38a/0x402
 sock_sendmsg+0x72/0x76
 ____sys_sendmsg+0x153/0x1cc
 ? copy_msghdr_from_user+0x5d/0x85
 ___sys_sendmsg+0x7c/0xb5
 ? lock_acquire+0x181/0x23d
 ? syscall_trace_enter+0x15e/0x160
 ? find_held_lock+0x3d/0xb2
 ? syscall_trace_enter+0x15e/0x160
 ? sched_clock_cpu+0x15/0xc6
 __sys_sendmsg+0x62/0x9a
 do_syscall_64+0x43/0x55
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 4913e675630e ("ath10k: enable rx duration report default for wmi tlv")
Signed-off-by: Anand K Mistry <amistry@google.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210202144033.1.I9e556f9fb1110d58c31d04a8a1293995fb8bb678@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 2e3eb5bbe49c8..4bc84cc5e824b 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -9116,7 +9116,9 @@ static void ath10k_sta_statistics(struct ieee80211_hw *hw,
 	if (!ath10k_peer_stats_enabled(ar))
 		return;
 
+	mutex_lock(&ar->conf_mutex);
 	ath10k_debug_fw_stats_request(ar);
+	mutex_unlock(&ar->conf_mutex);
 
 	sinfo->rx_duration = arsta->rx_duration;
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_DURATION);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 085/663] ath11k: fix a locking bug in ath11k_mac_op_start()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 084/663] ath10k: Fix lockdep assertion warning in ath10k_sta_statistics Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 086/663] soc: aspeed: snoop: Add clock control logic Greg Kroah-Hartman
                   ` (578 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit c202e2ebe1dc454ad54fd0018c023ec553d47284 ]

This error path leads to a Smatch warning:

	drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
	error: double unlocked '&ar->conf_mutex' (orig line 4251)

We're not holding the lock when we do the "goto err;" so it leads to a
double unlock.  The fix is to hold the lock for a little longer.

Fixes: c83c500b55b6 ("ath11k: enable idle power save mode")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[kvalo@codeaurora.org: move also rcu_assign_pointer() call]
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YBk4GoeE+yc0wlJH@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index af427d9051a07..b5bd9b06da89e 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4213,11 +4213,6 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 	/* Configure the hash seed for hash based reo dest ring selection */
 	ath11k_wmi_pdev_lro_cfg(ar, ar->pdev->pdev_id);
 
-	mutex_unlock(&ar->conf_mutex);
-
-	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
-			   &ab->pdevs[ar->pdev_idx]);
-
 	/* allow device to enter IMPS */
 	if (ab->hw_params.idle_ps) {
 		ret = ath11k_wmi_pdev_set_param(ar, WMI_PDEV_PARAM_IDLE_PS_CONFIG,
@@ -4227,6 +4222,12 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
 			goto err;
 		}
 	}
+
+	mutex_unlock(&ar->conf_mutex);
+
+	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
+			   &ab->pdevs[ar->pdev_idx]);
+
 	return 0;
 
 err:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 086/663] soc: aspeed: snoop: Add clock control logic
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 085/663] ath11k: fix a locking bug in ath11k_mac_op_start() Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 087/663] iwlwifi: mvm: fix the type we use in the PPAG table validity checks Greg Kroah-Hartman
                   ` (577 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jae Hyun Yoo, Vernon Mauery,
	John Wang, Joel Stanley, Sasha Levin

From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>

[ Upstream commit 3f94cf15583be554df7aaa651b8ff8e1b68fbe51 ]

If LPC SNOOP driver is registered ahead of lpc-ctrl module, LPC
SNOOP block will be enabled without heart beating of LCLK until
lpc-ctrl enables the LCLK. This issue causes improper handling on
host interrupts when the host sends interrupt in that time frame.
Then kernel eventually forcibly disables the interrupt with
dumping stack and printing a 'nobody cared this irq' message out.

To prevent this issue, all LPC sub-nodes should enable LCLK
individually so this patch adds clock control logic into the LPC
SNOOP driver.

Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201208091748.1920-1-wangzhiqiang.bj@bytedance.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/aspeed/aspeed-lpc-snoop.c | 30 ++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c
index f3d8d53ab84de..dbe5325a324d5 100644
--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
+++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/bitops.h>
+#include <linux/clk.h>
 #include <linux/interrupt.h>
 #include <linux/fs.h>
 #include <linux/kfifo.h>
@@ -67,6 +68,7 @@ struct aspeed_lpc_snoop_channel {
 struct aspeed_lpc_snoop {
 	struct regmap		*regmap;
 	int			irq;
+	struct clk		*clk;
 	struct aspeed_lpc_snoop_channel chan[NUM_SNOOP_CHANNELS];
 };
 
@@ -282,22 +284,42 @@ static int aspeed_lpc_snoop_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	lpc_snoop->clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(lpc_snoop->clk)) {
+		rc = PTR_ERR(lpc_snoop->clk);
+		if (rc != -EPROBE_DEFER)
+			dev_err(dev, "couldn't get clock\n");
+		return rc;
+	}
+	rc = clk_prepare_enable(lpc_snoop->clk);
+	if (rc) {
+		dev_err(dev, "couldn't enable clock\n");
+		return rc;
+	}
+
 	rc = aspeed_lpc_snoop_config_irq(lpc_snoop, pdev);
 	if (rc)
-		return rc;
+		goto err;
 
 	rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 0, port);
 	if (rc)
-		return rc;
+		goto err;
 
 	/* Configuration of 2nd snoop channel port is optional */
 	if (of_property_read_u32_index(dev->of_node, "snoop-ports",
 				       1, &port) == 0) {
 		rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 1, port);
-		if (rc)
+		if (rc) {
 			aspeed_lpc_disable_snoop(lpc_snoop, 0);
+			goto err;
+		}
 	}
 
+	return 0;
+
+err:
+	clk_disable_unprepare(lpc_snoop->clk);
+
 	return rc;
 }
 
@@ -309,6 +331,8 @@ static int aspeed_lpc_snoop_remove(struct platform_device *pdev)
 	aspeed_lpc_disable_snoop(lpc_snoop, 0);
 	aspeed_lpc_disable_snoop(lpc_snoop, 1);
 
+	clk_disable_unprepare(lpc_snoop->clk);
+
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 087/663] iwlwifi: mvm: fix the type we use in the PPAG table validity checks
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 086/663] soc: aspeed: snoop: Add clock control logic Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 088/663] iwlwifi: mvm: store PPAG enabled/disabled flag properly Greg Kroah-Hartman
                   ` (576 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 5a6842455c113920001df83cffa28accceeb0927 ]

The value we receive from ACPI is a long long unsigned integer but the
values should be treated as signed char.  When comparing the received
value with ACPI_PPAG_MIN_LB/HB, we were doing an unsigned comparison,
so the negative value would actually be treated as a very high number.

To solve this issue, assign the value to our table of s8's before
making the comparison, so the value is already converted when we do
so.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210135352.b0ec69f312bc.If77fd9c61a96aa7ef2ac96d935b7efd7df502399@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 059ce227151ea..c351c91a9ec96 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -999,16 +999,23 @@ read_table:
 			union acpi_object *ent;
 
 			ent = &wifi_pkg->package.elements[idx++];
-			if (ent->type != ACPI_TYPE_INTEGER ||
-			    (j == 0 && ent->integer.value > ACPI_PPAG_MAX_LB) ||
-			    (j == 0 && ent->integer.value < ACPI_PPAG_MIN_LB) ||
-			    (j != 0 && ent->integer.value > ACPI_PPAG_MAX_HB) ||
-			    (j != 0 && ent->integer.value < ACPI_PPAG_MIN_HB)) {
-				ppag_table.v1.enabled = cpu_to_le32(0);
+			if (ent->type != ACPI_TYPE_INTEGER) {
 				ret = -EINVAL;
 				goto out_free;
 			}
+
 			gain[i * num_sub_bands + j] = ent->integer.value;
+
+			if ((j == 0 &&
+			     (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_LB ||
+			      gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_LB)) ||
+			    (j != 0 &&
+			     (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_HB ||
+			      gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_HB))) {
+				ppag_table.v1.enabled = cpu_to_le32(0);
+				ret = -EINVAL;
+				goto out_free;
+			}
 		}
 	}
 	ret = 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 088/663] iwlwifi: mvm: store PPAG enabled/disabled flag properly
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 087/663] iwlwifi: mvm: fix the type we use in the PPAG table validity checks Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 089/663] iwlwifi: mvm: send stored PPAG command instead of local Greg Kroah-Hartman
                   ` (575 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 551d793f65364c904921ac168d4b4028bb51be69 ]

When reading the PPAG table from ACPI, we should store everything in
our fwrt structure, so it can be accessed later.  But we had a local
ppag_table variable in the function and were erroneously storing the
enabled/disabled flag in it instead of storing it in the fwrt.  Fix
this by removing the local variable and storing everything directly in
fwrt.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210135352.889862e6d393.I8b894c1b2b3fe0ad2fb39bf438273ea47eb5afa4@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index c351c91a9ec96..2d2fe45603c8b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -929,7 +929,6 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 static int iwl_mvm_get_ppag_table(struct iwl_mvm *mvm)
 {
 	union acpi_object *wifi_pkg, *data, *enabled;
-	union iwl_ppag_table_cmd ppag_table;
 	int i, j, ret, tbl_rev, num_sub_bands;
 	int idx = 2;
 	s8 *gain;
@@ -983,8 +982,8 @@ read_table:
 		goto out_free;
 	}
 
-	ppag_table.v1.enabled = cpu_to_le32(enabled->integer.value);
-	if (!ppag_table.v1.enabled) {
+	mvm->fwrt.ppag_table.v1.enabled = cpu_to_le32(enabled->integer.value);
+	if (!mvm->fwrt.ppag_table.v1.enabled) {
 		ret = 0;
 		goto out_free;
 	}
@@ -1012,7 +1011,7 @@ read_table:
 			    (j != 0 &&
 			     (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_HB ||
 			      gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_HB))) {
-				ppag_table.v1.enabled = cpu_to_le32(0);
+				mvm->fwrt.ppag_table.v1.enabled = cpu_to_le32(0);
 				ret = -EINVAL;
 				goto out_free;
 			}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 089/663] iwlwifi: mvm: send stored PPAG command instead of local
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 088/663] iwlwifi: mvm: store PPAG enabled/disabled flag properly Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 090/663] iwlwifi: mvm: assign SAR table revision to the command later Greg Kroah-Hartman
                   ` (574 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 659844d391826bfc5c8b4d9a06869ed51d859c76 ]

Some change conflicts apparently cause a confusion between a local
variable being used to send the PPAG command and the introduction of a
union for this command.  Most parts of the local command were never
copied from the stored data, so the FW was getting garbage in the
tables instead of getting valid values.

Fix this by completely removing the local and using only the union
that we have stored in fwrt.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210135352.d090e0301023.I7d57f4d7da9a3297734c51cf988199323c76916d@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 2d2fe45603c8b..34a44300a15eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1027,7 +1027,6 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
 {
 	u8 cmd_ver;
 	int i, j, ret, num_sub_bands, cmd_size;
-	union iwl_ppag_table_cmd ppag_table;
 	s8 *gain;
 
 	if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) {
@@ -1040,15 +1039,13 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
 		return 0;
 	}
 
-	ppag_table.v1.enabled = mvm->fwrt.ppag_table.v1.enabled;
-
 	cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, PHY_OPS_GROUP,
 					PER_PLATFORM_ANT_GAIN_CMD,
 					IWL_FW_CMD_VER_UNKNOWN);
 	if (cmd_ver == 1) {
 		num_sub_bands = IWL_NUM_SUB_BANDS;
 		gain = mvm->fwrt.ppag_table.v1.gain[0];
-		cmd_size = sizeof(ppag_table.v1);
+		cmd_size = sizeof(mvm->fwrt.ppag_table.v1);
 		if (mvm->fwrt.ppag_ver == 2) {
 			IWL_DEBUG_RADIO(mvm,
 					"PPAG table is v2 but FW supports v1, sending truncated table\n");
@@ -1056,7 +1053,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
 	} else if (cmd_ver == 2) {
 		num_sub_bands = IWL_NUM_SUB_BANDS_V2;
 		gain = mvm->fwrt.ppag_table.v2.gain[0];
-		cmd_size = sizeof(ppag_table.v2);
+		cmd_size = sizeof(mvm->fwrt.ppag_table.v2);
 		if (mvm->fwrt.ppag_ver == 1) {
 			IWL_DEBUG_RADIO(mvm,
 					"PPAG table is v1 but FW supports v2, sending padded table\n");
@@ -1076,7 +1073,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
 	IWL_DEBUG_RADIO(mvm, "Sending PER_PLATFORM_ANT_GAIN_CMD\n");
 	ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(PHY_OPS_GROUP,
 						PER_PLATFORM_ANT_GAIN_CMD),
-				   0, cmd_size, &ppag_table);
+				   0, cmd_size, &mvm->fwrt.ppag_table);
 	if (ret < 0)
 		IWL_ERR(mvm, "failed to send PER_PLATFORM_ANT_GAIN_CMD (%d)\n",
 			ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 090/663] iwlwifi: mvm: assign SAR table revision to the command later
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 089/663] iwlwifi: mvm: send stored PPAG command instead of local Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 091/663] iwlwifi: mvm: dont check if CSA event is running before removing Greg Kroah-Hartman
                   ` (573 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 28db1862067cb09ebfdccfbc129a52c6fdb4c4d7 ]

The call to iwl_sar_geo_init() was moved to the end of the
iwl_mvm_sar_geo_init() function, after the table revision is assigned
to the FW command.  But the revision is only known after
iwl_sar_geo_init() is called, so we were always assigning zero to it.

Fix that by moving the assignment code after the iwl_sar_geo_init()
function is called.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: 45acebf8d6a6 ("iwlwifi: fix sar geo table initialization")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210135352.cef55ef3a065.If96c60f08d24c2262c287168a6f0dbd7cf0f8f5c@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 34a44300a15eb..ad374b25e2550 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -896,12 +896,10 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 	if (cmd_ver == 3) {
 		len = sizeof(cmd.v3);
 		n_bands = ARRAY_SIZE(cmd.v3.table[0]);
-		cmd.v3.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
 	} else if (fw_has_api(&mvm->fwrt.fw->ucode_capa,
 			      IWL_UCODE_TLV_API_SAR_TABLE_VER)) {
 		len = sizeof(cmd.v2);
 		n_bands = ARRAY_SIZE(cmd.v2.table[0]);
-		cmd.v2.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
 	} else {
 		len = sizeof(cmd.v1);
 		n_bands = ARRAY_SIZE(cmd.v1.table[0]);
@@ -921,6 +919,16 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 	if (ret)
 		return 0;
 
+	/*
+	 * Set the revision on versions that contain it.
+	 * This must be done after calling iwl_sar_geo_init().
+	 */
+	if (cmd_ver == 3)
+		cmd.v3.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
+	else if (fw_has_api(&mvm->fwrt.fw->ucode_capa,
+			    IWL_UCODE_TLV_API_SAR_TABLE_VER))
+		cmd.v2.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
+
 	return iwl_mvm_send_cmd_pdu(mvm,
 				    WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT),
 				    0, len, &cmd);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 091/663] iwlwifi: mvm: dont check if CSA event is running before removing
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 090/663] iwlwifi: mvm: assign SAR table revision to the command later Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 092/663] bpf_lru_list: Read double-checked variable once without lock Greg Kroah-Hartman
                   ` (572 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit b8a86164454aa745ecb534d7477d50d440ea05b6 ]

We may want to remove it before it started (i.e. before the
actual switch time).

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 58ddd9b6d194 ("iwlwifi: mvm: don't send a CSA command the firmware doesn't know")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210171218.835db8987b8a.Ic6c5d28d744302db1bc6c4314bd3138ba472f834@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 1db6d8d38822a..3939eccd3d5ac 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -1055,9 +1055,6 @@ void iwl_mvm_remove_csa_period(struct iwl_mvm *mvm,
 
 	lockdep_assert_held(&mvm->mutex);
 
-	if (!te_data->running)
-		return;
-
 	spin_lock_bh(&mvm->time_event_lock);
 	id = te_data->id;
 	spin_unlock_bh(&mvm->time_event_lock);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 092/663] bpf_lru_list: Read double-checked variable once without lock
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 091/663] iwlwifi: mvm: dont check if CSA event is running before removing Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 093/663] iwlwifi: pnvm: set the PNVM again if it was already loaded Greg Kroah-Hartman
                   ` (571 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+3536db46dfa58c573458,
	syzbot+516acdb03d3e27d91bcd, Marco Elver, Andrii Nakryiko,
	Martin KaFai Lau, Sasha Levin

From: Marco Elver <elver@google.com>

[ Upstream commit 6df8fb83301d68ea0a0c0e1cbcc790fcc333ed12 ]

For double-checked locking in bpf_common_lru_push_free(), node->type is
read outside the critical section and then re-checked under the lock.
However, concurrent writes to node->type result in data races.

For example, the following concurrent access was observed by KCSAN:

  write to 0xffff88801521bc22 of 1 bytes by task 10038 on cpu 1:
   __bpf_lru_node_move_in        kernel/bpf/bpf_lru_list.c:91
   __local_list_flush            kernel/bpf/bpf_lru_list.c:298
   ...
  read to 0xffff88801521bc22 of 1 bytes by task 10043 on cpu 0:
   bpf_common_lru_push_free      kernel/bpf/bpf_lru_list.c:507
   bpf_lru_push_free             kernel/bpf/bpf_lru_list.c:555
   ...

Fix the data races where node->type is read outside the critical section
(for double-checked locking) by marking the access with READ_ONCE() as
well as ensuring the variable is only accessed once.

Fixes: 3a08c2fd7634 ("bpf: LRU List")
Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
Reported-by: syzbot+516acdb03d3e27d91bcd@syzkaller.appspotmail.com
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210209112701.3341724-1-elver@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/bpf_lru_list.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
index 1b6b9349cb857..d99e89f113c43 100644
--- a/kernel/bpf/bpf_lru_list.c
+++ b/kernel/bpf/bpf_lru_list.c
@@ -502,13 +502,14 @@ struct bpf_lru_node *bpf_lru_pop_free(struct bpf_lru *lru, u32 hash)
 static void bpf_common_lru_push_free(struct bpf_lru *lru,
 				     struct bpf_lru_node *node)
 {
+	u8 node_type = READ_ONCE(node->type);
 	unsigned long flags;
 
-	if (WARN_ON_ONCE(node->type == BPF_LRU_LIST_T_FREE) ||
-	    WARN_ON_ONCE(node->type == BPF_LRU_LOCAL_LIST_T_FREE))
+	if (WARN_ON_ONCE(node_type == BPF_LRU_LIST_T_FREE) ||
+	    WARN_ON_ONCE(node_type == BPF_LRU_LOCAL_LIST_T_FREE))
 		return;
 
-	if (node->type == BPF_LRU_LOCAL_LIST_T_PENDING) {
+	if (node_type == BPF_LRU_LOCAL_LIST_T_PENDING) {
 		struct bpf_lru_locallist *loc_l;
 
 		loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 093/663] iwlwifi: pnvm: set the PNVM again if it was already loaded
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 092/663] bpf_lru_list: Read double-checked variable once without lock Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 094/663] iwlwifi: pnvm: increment the pointer before checking the TLV Greg Kroah-Hartman
                   ` (570 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 4a81598f0f39cffbf1c29c4a184063d513661c4a ]

When the interface goes up, we have already loaded the PNVM during
init, so we don't load it anymore.  But we still need to set the PNVM
values in the context so that the FW can load it again.

Call set_pnvm when the PNVM is already loaded and change the
trans_pcie implementation to accept a second call to set_pnvm when we
have already allocated and, in this case, only set the values without
allocating again.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210172142.622546a3566f.I659a8b9aa944d213c4ba446e142d74f3f6db9c64@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c  |  7 ++++++-
 .../intel/iwlwifi/pcie/ctxt-info-gen3.c       | 21 +++++++++++--------
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index 895a907acdf0f..1e16f83b402b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -227,6 +227,7 @@ int iwl_pnvm_load(struct iwl_trans *trans,
 	struct iwl_notification_wait pnvm_wait;
 	static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP,
 						PNVM_INIT_COMPLETE_NTFY) };
+	int ret;
 
 	/* if the SKU_ID is empty, there's nothing to do */
 	if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
@@ -236,7 +237,6 @@ int iwl_pnvm_load(struct iwl_trans *trans,
 	if (!trans->pnvm_loaded) {
 		const struct firmware *pnvm;
 		char pnvm_name[64];
-		int ret;
 
 		/*
 		 * The prefix unfortunately includes a hyphen at the end, so
@@ -264,6 +264,11 @@ int iwl_pnvm_load(struct iwl_trans *trans,
 
 			release_firmware(pnvm);
 		}
+	} else {
+		/* if we already loaded, we need to set it again */
+		ret = iwl_trans_set_pnvm(trans, NULL, 0);
+		if (ret)
+			return ret;
 	}
 
 	iwl_init_notification_wait(notif_wait, &pnvm_wait,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index 2d43899fbdd7a..81ef4fc8d7831 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -345,17 +345,20 @@ int iwl_trans_pcie_ctx_info_gen3_set_pnvm(struct iwl_trans *trans,
 	if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
 		return 0;
 
-	ret = iwl_pcie_ctxt_info_alloc_dma(trans, data, len,
-					   &trans_pcie->pnvm_dram);
-	if (ret < 0) {
-		IWL_DEBUG_FW(trans, "Failed to allocate PNVM DMA %d.\n",
-			     ret);
-		return ret;
+	/* only allocate the DRAM if not allocated yet */
+	if (!trans->pnvm_loaded) {
+		if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
+			return -EBUSY;
+
+		ret = iwl_pcie_ctxt_info_alloc_dma(trans, data, len,
+						   &trans_pcie->pnvm_dram);
+		if (ret < 0) {
+			IWL_DEBUG_FW(trans, "Failed to allocate PNVM DMA %d.\n",
+				     ret);
+			return ret;
+		}
 	}
 
-	if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
-		return -EBUSY;
-
 	prph_sc_ctrl->pnvm_cfg.pnvm_base_addr =
 		cpu_to_le64(trans_pcie->pnvm_dram.physical);
 	prph_sc_ctrl->pnvm_cfg.pnvm_size =
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 094/663] iwlwifi: pnvm: increment the pointer before checking the TLV
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 093/663] iwlwifi: pnvm: set the PNVM again if it was already loaded Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 095/663] ath9k: fix data bus crash when setting nf_override via debugfs Greg Kroah-Hartman
                   ` (569 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit ff11a8ee2d2d0f78514ac9b42fb50c525ca695c7 ]

If the SKU_ID doesn't match, we don't increment the pointer and keep
checking the same TLV over and over again.

We need to increment the pointer in all situtations, namely if the TLV
is not a SKU_ID, if the SKU_ID matched or if the SKU_ID didn't match.
So we can increment the pointer already before checking for these
conditions to solve the problem.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210210172142.de94d366f3ff.I9a5a54906cf0f4ec8af981d6066bfd771152ffb9@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index 1e16f83b402b8..37ce4fe136c5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -198,14 +198,14 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
 				     le32_to_cpu(sku_id->data[1]),
 				     le32_to_cpu(sku_id->data[2]));
 
+			data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+			len -= ALIGN(tlv_len, 4);
+
 			if (trans->sku_id[0] == le32_to_cpu(sku_id->data[0]) &&
 			    trans->sku_id[1] == le32_to_cpu(sku_id->data[1]) &&
 			    trans->sku_id[2] == le32_to_cpu(sku_id->data[2])) {
 				int ret;
 
-				data += sizeof(*tlv) + ALIGN(tlv_len, 4);
-				len -= ALIGN(tlv_len, 4);
-
 				ret = iwl_pnvm_handle_section(trans, data, len);
 				if (!ret)
 					return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 095/663] ath9k: fix data bus crash when setting nf_override via debugfs
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 094/663] iwlwifi: pnvm: increment the pointer before checking the TLV Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 096/663] selftests/bpf: Convert test_xdp_redirect.sh to bash Greg Kroah-Hartman
                   ` (568 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Wunderlich, Linus Lüssing,
	Kalle Valo, Sasha Levin

From: Linus Lüssing <ll@simonwunderlich.de>

[ Upstream commit 12c8f3d1cdd84f01ee777b756db9dddc1f1c9d17 ]

When trying to set the noise floor via debugfs, a "data bus error"
crash like the following can happen:

[   88.433133] Data bus error, epc == 80221c28, ra == 83314e60
[   88.438895] Oops[#1]:
[   88.441246] CPU: 0 PID: 7263 Comm: sh Not tainted 4.14.195 #0
[   88.447174] task: 838a1c20 task.stack: 82d5e000
[   88.451847] $ 0   : 00000000 00000030 deadc0de 83141de4
[   88.457248] $ 4   : b810a2c4 0000a2c4 83230fd4 00000000
[   88.462652] $ 8   : 0000000a 00000000 00000001 00000000
[   88.468055] $12   : 7f8ef318 00000000 00000000 77f802a0
[   88.473457] $16   : 83230080 00000002 0000001b 83230080
[   88.478861] $20   : 83a1c3f8 00841000 77f7adb0 ffffff92
[   88.484263] $24   : 00000fa4 77edd860
[   88.489665] $28   : 82d5e000 82d5fda8 00000000 83314e60
[   88.495070] Hi    : 00000000
[   88.498044] Lo    : 00000000
[   88.501040] epc   : 80221c28 ioread32+0x8/0x10
[   88.505671] ra    : 83314e60 ath9k_hw_loadnf+0x88/0x520 [ath9k_hw]
[   88.512049] Status: 1000fc03 KERNEL EXL IE
[   88.516369] Cause : 5080801c (ExcCode 07)
[   88.520508] PrId  : 00019374 (MIPS 24Kc)
[   88.524556] Modules linked in: ath9k ath9k_common pppoe ppp_async l2tp_ppp cdc_mbim batman_adv ath9k_hw ath sr9700 smsc95xx sierra_net rndis_host qmi_wwan pppox ppp_generic pl2303 nf_conntrack_ipv6 mcs7830 mac80211 kalmia iptable_nat ipt_REJECT ipt_MASQUERADE huawei_cdc_ncm ftdi_sio dm9601 cfg80211 cdc_subset cdc_ncm cdc_ether cdc_eem ax88179_178a asix xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_NETMAP xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CLASSIFY usbserial usbnet usbhid slhc rtl8150 r8152 pegasus nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack
[   88.597894]  libcrc32c kaweth iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hso hid_generic crc_ccitt compat cdc_wdm cdc_acm br_netfilter hid evdev input_core nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_beet ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel xfrm4_mode_tunnel xfrm4_mode_transport xfrm4_mode_beet ipcomp esp4 ah4 tunnel6 tunnel4 tun xfrm_user xfrm_ipcomp af_key xfrm_algo sha256_generic sha1_generic jitterentropy_rng drbg md5 hmac echainiv des_generic deflate zlib_inflate zlib_deflate cbc authenc crypto_acompress ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic
[   88.671671]  crypto_hash
[   88.674292] Process sh (pid: 7263, threadinfo=82d5e000, task=838a1c20, tls=77f81efc)
[   88.682279] Stack : 00008060 00000008 00000200 00000000 00000000 00000000 00000000 00000002
[   88.690916]         80500000 83230080 82d5fe22 00841000 77f7adb0 00000000 00000000 83156858
[   88.699553]         00000000 8352fa00 83ad62b0 835302a8 00000000 300a00f8 00000003 82d5fe38
[   88.708190]         82d5fef4 00000001 77f54dc4 77f80000 77f7adb0 c79fe901 00000000 00000000
[   88.716828]         80510000 00000002 00841000 77f54dc4 77f80000 801ce4cc 0000000b 41824292
[   88.725465]         ...
[   88.727994] Call Trace:
[   88.730532] [<80221c28>] ioread32+0x8/0x10
[   88.734765] Code: 00000000  8c820000  0000000f <03e00008> 00000000  08088708  00000000  aca40000  03e00008
[   88.744846]
[   88.746464] ---[ end trace db226b2de1b69b9e ]---
[   88.753477] Kernel panic - not syncing: Fatal exception
[   88.759981] Rebooting in 3 seconds..

The "REG_READ(ah, AR_PHY_AGC_CONTROL)" in ath9k_hw_loadnf() does not
like being called when the hardware is asleep, leading to this crash.

The easiest way to reproduce this is trying to set nf_override while
the hardware is down:

  $ ip link set down dev wlan0
  $ echo "-85" > /sys/kernel/debug/ieee80211/phy0/ath9k/nf_override

Fixing this crash by waking the hardware up before trying to set the
noise floor. Similar to what other ath9k debugfs files do.

Tested on a Lima board from 8devices, which has a QCA 4531 chipset.

Fixes: b90189759a7f ("ath9k: add noise floor override option")
Cc: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210209184352.4272-1-linus.luessing@c0d3.blue
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/debug.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 26ea51a721564..859a865c59950 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1223,8 +1223,11 @@ static ssize_t write_file_nf_override(struct file *file,
 
 	ah->nf_override = val;
 
-	if (ah->curchan)
+	if (ah->curchan) {
+		ath9k_ps_wakeup(sc);
 		ath9k_hw_loadnf(ah, ah->curchan);
+		ath9k_ps_restore(sc);
+	}
 
 	return count;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 096/663] selftests/bpf: Convert test_xdp_redirect.sh to bash
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 095/663] ath9k: fix data bus crash when setting nf_override via debugfs Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 097/663] ibmvnic: Set to CLOSED state even on error Greg Kroah-Hartman
                   ` (567 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Daniel Borkmann, Andrii Nakryiko, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 732fa32330667a80ce4985ca81b6e9d6b2ad2072 ]

The test_xdp_redirect.sh script uses a bash feature, '&>'. On systems,
e.g. Debian, where '/bin/sh' is dash, this will not work as
expected. Use bash in the shebang to get the expected behavior.

Further, using 'set -e' means that the error of a command cannot be
captured without the command being executed with '&&' or '||'. Let us
restructure the ping-commands, and use them as an if-expression, so
that we can capture the return value.

v4: Added missing Fixes:, and removed local variables. (Andrii)
v3: Reintroduced /bin/bash, and kept 'set -e'. (Andrii)
v2: Kept /bin/sh and removed bashisms. (Randy)

Fixes: 996139e801fd ("selftests: bpf: add a test for XDP redirect")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210211082029.1687666-1-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_xdp_redirect.sh | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_xdp_redirect.sh b/tools/testing/selftests/bpf/test_xdp_redirect.sh
index dd80f0c84afb4..c033850886f44 100755
--- a/tools/testing/selftests/bpf/test_xdp_redirect.sh
+++ b/tools/testing/selftests/bpf/test_xdp_redirect.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 # Create 2 namespaces with two veth peers, and
 # forward packets in-between using generic XDP
 #
@@ -57,12 +57,8 @@ test_xdp_redirect()
 	ip link set dev veth1 $xdpmode obj test_xdp_redirect.o sec redirect_to_222 &> /dev/null
 	ip link set dev veth2 $xdpmode obj test_xdp_redirect.o sec redirect_to_111 &> /dev/null
 
-	ip netns exec ns1 ping -c 1 10.1.1.22 &> /dev/null
-	local ret1=$?
-	ip netns exec ns2 ping -c 1 10.1.1.11 &> /dev/null
-	local ret2=$?
-
-	if [ $ret1 -eq 0 -a $ret2 -eq 0 ]; then
+	if ip netns exec ns1 ping -c 1 10.1.1.22 &> /dev/null &&
+	   ip netns exec ns2 ping -c 1 10.1.1.11 &> /dev/null; then
 		echo "selftests: test_xdp_redirect $xdpmode [PASS]";
 	else
 		ret=1
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 097/663] ibmvnic: Set to CLOSED state even on error
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 096/663] selftests/bpf: Convert test_xdp_redirect.sh to bash Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 098/663] bnxt_en: reverse order of TX disable and carrier off Greg Kroah-Hartman
                   ` (566 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sukadev Bhattiprolu, Abdul Haleem,
	David S. Miller, Sasha Levin

From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>

[ Upstream commit d4083d3c00f60a09ad82e3bf17ff57fec69c8aa6 ]

If set_link_state() fails for any reason, we still cleanup the adapter
state and cannot recover from a partial close anyway. So set the adapter
to CLOSED state. That way if a new soft/hard reset is processed, the
adapter will remain in the CLOSED state until the next ibmvnic_open().

Fixes: 01d9bd792d16 ("ibmvnic: Reorganize device close")
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Reported-by: Abdul Haleem <abdhalee@in.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index ee16e0e4fa5fc..d789c3cb7f87b 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1329,10 +1329,8 @@ static int __ibmvnic_close(struct net_device *netdev)
 
 	adapter->state = VNIC_CLOSING;
 	rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_DN);
-	if (rc)
-		return rc;
 	adapter->state = VNIC_CLOSED;
-	return 0;
+	return rc;
 }
 
 static int ibmvnic_close(struct net_device *netdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 098/663] bnxt_en: reverse order of TX disable and carrier off
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 097/663] ibmvnic: Set to CLOSED state even on error Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 099/663] bnxt_en: Fix devlink infos stored fw.psid version format Greg Kroah-Hartman
                   ` (565 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Edwin Peer, Michael Chan,
	David S. Miller, Sasha Levin

From: Edwin Peer <edwin.peer@broadcom.com>

[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ]

A TX queue can potentially immediately timeout after it is stopped
and the last TX timestamp on that queue was more than 5 seconds ago with
carrier still up.  Prevent these intermittent false TX timeouts
by bringing down carrier first before calling netif_tx_disable().

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 033bfab24ef2f..c7c5c01a783a0 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -8856,9 +8856,10 @@ void bnxt_tx_disable(struct bnxt *bp)
 			txr->dev_state = BNXT_DEV_STATE_CLOSING;
 		}
 	}
+	/* Drop carrier first to prevent TX timeout */
+	netif_carrier_off(bp->dev);
 	/* Stop all TX queues */
 	netif_tx_disable(bp->dev);
-	netif_carrier_off(bp->dev);
 }
 
 void bnxt_tx_enable(struct bnxt *bp)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 099/663] bnxt_en: Fix devlink infos stored fw.psid version format.
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 098/663] bnxt_en: reverse order of TX disable and carrier off Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 100/663] xen/netback: fix spurious event detection for common event case Greg Kroah-Hartman
                   ` (564 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasundhara Volam, Michael Chan,
	David S. Miller, Sasha Levin

From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>

[ Upstream commit db28b6c77f4050f62599267a886b61fbd6504633 ]

The running fw.psid version is in decimal format but the stored
fw.psid is in hex format.  This can mislead the user to reset the
NIC to activate the stored version to become the running version.

Fix it to display the stored fw.psid in decimal format.

Fixes: 1388875b3916 ("bnxt_en: Add stored FW version info to devlink info_get cb.")
Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 184b6d0513b2a..8b0e916afe6b1 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -474,8 +474,8 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
 	if (BNXT_PF(bp) && !bnxt_hwrm_get_nvm_cfg_ver(bp, &nvm_cfg_ver)) {
 		u32 ver = nvm_cfg_ver.vu32;
 
-		sprintf(buf, "%X.%X.%X", (ver >> 16) & 0xF, (ver >> 8) & 0xF,
-			ver & 0xF);
+		sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xf, (ver >> 8) & 0xf,
+			ver & 0xf);
 		rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_STORED,
 				      DEVLINK_INFO_VERSION_GENERIC_FW_PSID,
 				      buf);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 100/663] xen/netback: fix spurious event detection for common event case
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 099/663] bnxt_en: Fix devlink infos stored fw.psid version format Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 101/663] dpaa2-eth: fix memory leak in XDP_REDIRECT Greg Kroah-Hartman
                   ` (563 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Juergen Gross, Jan Beulich,
	Paul Durrant, Wei Liu, David S. Miller, Sasha Levin

From: Juergen Gross <jgross@suse.com>

[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ]

In case of a common event for rx and tx queue the event should be
regarded to be spurious if no rx and no tx requests are pending.

Unfortunately the condition for testing that is wrong causing to
decide a event being spurious if no rx OR no tx requests are
pending.

Fix that plus using local variables for rx/tx pending indicators in
order to split function calls and if condition.

Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netback/interface.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index acb786d8b1d8f..e02a4fbb74de5 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -162,13 +162,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
 {
 	struct xenvif_queue *queue = dev_id;
 	int old;
+	bool has_rx, has_tx;
 
 	old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
 	WARN(old, "Interrupt while EOI pending\n");
 
-	/* Use bitwise or as we need to call both functions. */
-	if ((!xenvif_handle_tx_interrupt(queue) |
-	     !xenvif_handle_rx_interrupt(queue))) {
+	has_tx = xenvif_handle_tx_interrupt(queue);
+	has_rx = xenvif_handle_rx_interrupt(queue);
+
+	if (!has_rx && !has_tx) {
 		atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
 		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 101/663] dpaa2-eth: fix memory leak in XDP_REDIRECT
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 100/663] xen/netback: fix spurious event detection for common event case Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 102/663] net: phy: consider that suspend2ram may cut off PHY power Greg Kroah-Hartman
                   ` (562 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ioana Ciornei, David S. Miller, Sasha Levin

From: Ioana Ciornei <ioana.ciornei@nxp.com>

[ Upstream commit e12be9139cca26d689fe1a9257054b76752f725b ]

If xdp_do_redirect() fails, the calling driver should handle recycling
or freeing of the page associated with the frame. The dpaa2-eth driver
didn't do either of them and just incremented a counter.
Fix this by trying to DMA map back the page and recycle it or, if the
mapping fails, just free it.

Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index d880ab2a7d962..f91c67489e629 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -399,10 +399,20 @@ static u32 dpaa2_eth_run_xdp(struct dpaa2_eth_priv *priv,
 		xdp.frame_sz = DPAA2_ETH_RX_BUF_RAW_SIZE;
 
 		err = xdp_do_redirect(priv->net_dev, &xdp, xdp_prog);
-		if (unlikely(err))
+		if (unlikely(err)) {
+			addr = dma_map_page(priv->net_dev->dev.parent,
+					    virt_to_page(vaddr), 0,
+					    priv->rx_buf_size, DMA_BIDIRECTIONAL);
+			if (unlikely(dma_mapping_error(priv->net_dev->dev.parent, addr))) {
+				free_pages((unsigned long)vaddr, 0);
+			} else {
+				ch->buf_count++;
+				dpaa2_eth_xdp_release_buf(priv, ch, addr);
+			}
 			ch->stats.xdp_drop++;
-		else
+		} else {
 			ch->stats.xdp_redirect++;
+		}
 		break;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 102/663] net: phy: consider that suspend2ram may cut off PHY power
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 101/663] dpaa2-eth: fix memory leak in XDP_REDIRECT Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 103/663] net/mlx5e: Dont change interrupt moderation params when DIM is enabled Greg Kroah-Hartman
                   ` (561 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Heiner Kallweit,
	David S. Miller, Sasha Levin

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit 4c0d2e96ba055bd8911bb8287def4f8ebbad15b6 ]

Claudiu reported that on his system S2R cuts off power to the PHY and
after resuming certain PHY settings are lost. The PM folks confirmed
that cutting off power to selected components in S2R is a valid case.
Therefore resuming from S2R, same as from hibernation, has to assume
that the PHY has power-on defaults. As a consequence use the restore
callback also as resume callback.
In addition make sure that the interrupt configuration is restored.
Let's do this in phy_init_hw() and ensure that after this call
actual interrupt configuration is in sync with phydev->interrupts.
Currently, if interrupt was enabled before hibernation, we would
resume with interrupt disabled because that's the power-on default.

This fix applies cleanly only after the commit marked as fixed.

I don't have an affected system, therefore change is compile-tested
only.

[0] https://lore.kernel.org/netdev/1610120754-14331-1-git-send-email-claudiu.beznea@microchip.com/

Fixes: 611d779af7ca ("net: phy: fix MDIO bus PM PHY resuming")
Reported-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 53 ++++++++++++------------------------
 1 file changed, 17 insertions(+), 36 deletions(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 5dab6be6fc383..dd1f711140c3d 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -300,50 +300,22 @@ static int mdio_bus_phy_resume(struct device *dev)
 
 	phydev->suspended_by_mdio_bus = 0;
 
-	ret = phy_resume(phydev);
+	ret = phy_init_hw(phydev);
 	if (ret < 0)
 		return ret;
 
-no_resume:
-	if (phydev->attached_dev && phydev->adjust_link)
-		phy_start_machine(phydev);
-
-	return 0;
-}
-
-static int mdio_bus_phy_restore(struct device *dev)
-{
-	struct phy_device *phydev = to_phy_device(dev);
-	struct net_device *netdev = phydev->attached_dev;
-	int ret;
-
-	if (!netdev)
-		return 0;
-
-	ret = phy_init_hw(phydev);
+	ret = phy_resume(phydev);
 	if (ret < 0)
 		return ret;
-
+no_resume:
 	if (phydev->attached_dev && phydev->adjust_link)
 		phy_start_machine(phydev);
 
 	return 0;
 }
 
-static const struct dev_pm_ops mdio_bus_phy_pm_ops = {
-	.suspend = mdio_bus_phy_suspend,
-	.resume = mdio_bus_phy_resume,
-	.freeze = mdio_bus_phy_suspend,
-	.thaw = mdio_bus_phy_resume,
-	.restore = mdio_bus_phy_restore,
-};
-
-#define MDIO_BUS_PHY_PM_OPS (&mdio_bus_phy_pm_ops)
-
-#else
-
-#define MDIO_BUS_PHY_PM_OPS NULL
-
+static SIMPLE_DEV_PM_OPS(mdio_bus_phy_pm_ops, mdio_bus_phy_suspend,
+			 mdio_bus_phy_resume);
 #endif /* CONFIG_PM */
 
 /**
@@ -554,7 +526,7 @@ static const struct device_type mdio_bus_phy_type = {
 	.name = "PHY",
 	.groups = phy_dev_groups,
 	.release = phy_device_release,
-	.pm = MDIO_BUS_PHY_PM_OPS,
+	.pm = pm_ptr(&mdio_bus_phy_pm_ops),
 };
 
 static int phy_request_driver_module(struct phy_device *dev, u32 phy_id)
@@ -1143,10 +1115,19 @@ int phy_init_hw(struct phy_device *phydev)
 	if (ret < 0)
 		return ret;
 
-	if (phydev->drv->config_init)
+	if (phydev->drv->config_init) {
 		ret = phydev->drv->config_init(phydev);
+		if (ret < 0)
+			return ret;
+	}
 
-	return ret;
+	if (phydev->drv->config_intr) {
+		ret = phydev->drv->config_intr(phydev);
+		if (ret < 0)
+			return ret;
+	}
+
+	return 0;
 }
 EXPORT_SYMBOL(phy_init_hw);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 103/663] net/mlx5e: Dont change interrupt moderation params when DIM is enabled
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 102/663] net: phy: consider that suspend2ram may cut off PHY power Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 104/663] net/mlx5e: Change interrupt moderation channel params also when channels are closed Greg Kroah-Hartman
                   ` (560 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Tariq Toukan,
	Saeed Mahameed, Sasha Levin

From: Maxim Mikityanskiy <maximmi@mellanox.com>

[ Upstream commit 019f93bc4ba3a0dcb77f448ee77fc4c9c1b89565 ]

When mlx5e_ethtool_set_coalesce doesn't change DIM state
(enabled/disabled), it calls mlx5e_set_priv_channels_coalesce
unconditionally, which in turn invokes a firmware command to set
interrupt moderation parameters. It shouldn't happen while DIM manages
those parameters dynamically (it might even be happening at the same
time).

This patch fixes it by splitting mlx5e_set_priv_channels_coalesce into
two functions (for RX and TX) and calling them only when DIM is disabled
(for RX and TX respectively).

Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/mellanox/mlx5/core/en_ethtool.c   | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index e596f050c4316..eab058ef6e9ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -522,7 +522,7 @@ static int mlx5e_get_coalesce(struct net_device *netdev,
 #define MLX5E_MAX_COAL_FRAMES		MLX5_MAX_CQ_COUNT
 
 static void
-mlx5e_set_priv_channels_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
+mlx5e_set_priv_channels_tx_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
 {
 	struct mlx5_core_dev *mdev = priv->mdev;
 	int tc;
@@ -537,6 +537,17 @@ mlx5e_set_priv_channels_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesc
 						coal->tx_coalesce_usecs,
 						coal->tx_max_coalesced_frames);
 		}
+	}
+}
+
+static void
+mlx5e_set_priv_channels_rx_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
+{
+	struct mlx5_core_dev *mdev = priv->mdev;
+	int i;
+
+	for (i = 0; i < priv->channels.num; ++i) {
+		struct mlx5e_channel *c = priv->channels.c[i];
 
 		mlx5_core_modify_cq_moderation(mdev, &c->rq.cq.mcq,
 					       coal->rx_coalesce_usecs,
@@ -593,7 +604,10 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
 	reset_tx = !!coal->use_adaptive_tx_coalesce != priv->channels.params.tx_dim_enabled;
 
 	if (!reset_rx && !reset_tx) {
-		mlx5e_set_priv_channels_coalesce(priv, coal);
+		if (!coal->use_adaptive_rx_coalesce)
+			mlx5e_set_priv_channels_rx_coalesce(priv, coal);
+		if (!coal->use_adaptive_tx_coalesce)
+			mlx5e_set_priv_channels_tx_coalesce(priv, coal);
 		priv->channels.params = new_channels.params;
 		goto out;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 104/663] net/mlx5e: Change interrupt moderation channel params also when channels are closed
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 103/663] net/mlx5e: Dont change interrupt moderation params when DIM is enabled Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 105/663] net/mlx5: Fix health error state handling Greg Kroah-Hartman
                   ` (559 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Tariq Toukan,
	Saeed Mahameed, Sasha Levin

From: Maxim Mikityanskiy <maximmi@mellanox.com>

[ Upstream commit 65ba8594a238c20e458b3d2d39d91067cbffd0b1 ]

struct mlx5e_params contains fields ({rx,tx}_cq_moderation) that depend
on two things: whether DIM is enabled and the state of a private flag
(MLX5E_PFLAG_{RX,TX}_CQE_BASED_MODER). Whenever the DIM state changes,
mlx5e_reset_{rx,tx}_moderation is called to update the fields, however,
only if the channels are open. The flow where the channels are closed
misses the required update of the fields. This commit moves the calls of
mlx5e_reset_{rx,tx}_moderation, so that they run in both flows.

Fixes: ebeaf084ad5c ("net/mlx5e: Properly set default values when disabling adaptive moderation")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/mellanox/mlx5/core/en_ethtool.c  | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index eab058ef6e9ff..b8622440243b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -594,24 +594,9 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
 	tx_moder->pkts    = coal->tx_max_coalesced_frames;
 	new_channels.params.tx_dim_enabled = !!coal->use_adaptive_tx_coalesce;
 
-	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
-		priv->channels.params = new_channels.params;
-		goto out;
-	}
-	/* we are opened */
-
 	reset_rx = !!coal->use_adaptive_rx_coalesce != priv->channels.params.rx_dim_enabled;
 	reset_tx = !!coal->use_adaptive_tx_coalesce != priv->channels.params.tx_dim_enabled;
 
-	if (!reset_rx && !reset_tx) {
-		if (!coal->use_adaptive_rx_coalesce)
-			mlx5e_set_priv_channels_rx_coalesce(priv, coal);
-		if (!coal->use_adaptive_tx_coalesce)
-			mlx5e_set_priv_channels_tx_coalesce(priv, coal);
-		priv->channels.params = new_channels.params;
-		goto out;
-	}
-
 	if (reset_rx) {
 		u8 mode = MLX5E_GET_PFLAG(&new_channels.params,
 					  MLX5E_PFLAG_RX_CQE_BASED_MODER);
@@ -625,6 +610,20 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
 		mlx5e_reset_tx_moderation(&new_channels.params, mode);
 	}
 
+	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+		priv->channels.params = new_channels.params;
+		goto out;
+	}
+
+	if (!reset_rx && !reset_tx) {
+		if (!coal->use_adaptive_rx_coalesce)
+			mlx5e_set_priv_channels_rx_coalesce(priv, coal);
+		if (!coal->use_adaptive_tx_coalesce)
+			mlx5e_set_priv_channels_tx_coalesce(priv, coal);
+		priv->channels.params = new_channels.params;
+		goto out;
+	}
+
 	err = mlx5e_safe_switch_channels(priv, &new_channels, NULL, NULL);
 
 out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 105/663] net/mlx5: Fix health error state handling
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 104/663] net/mlx5e: Change interrupt moderation channel params also when channels are closed Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 106/663] net/mlx5e: Replace synchronize_rcu with synchronize_net Greg Kroah-Hartman
                   ` (558 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shay Drory, Moshe Shemesh,
	Saeed Mahameed, Sasha Levin

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit 51d138c2610a236c1ed0059d034ee4c74f452b86 ]

Currently, when we discover a fatal error, we are queueing a work that
will wait for a lock in order to enter the device to error state.
Meanwhile, FW commands are still being processed, and gets timeouts.
This can block the driver for few minutes before the work will manage
to get the lock and enter to error state.

Setting the device to error state before queueing health work, in order
to avoid FW commands being processed while the work is waiting for the
lock.

Fixes: c1d4d2e92ad6 ("net/mlx5: Avoid calling sleeping function by the health poll thread")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlx5/core/health.c  | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 54523bed16cd3..0c32c485eb588 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -190,6 +190,16 @@ static bool reset_fw_if_needed(struct mlx5_core_dev *dev)
 	return true;
 }
 
+static void enter_error_state(struct mlx5_core_dev *dev, bool force)
+{
+	if (mlx5_health_check_fatal_sensors(dev) || force) { /* protected state setting */
+		dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
+		mlx5_cmd_flush(dev);
+	}
+
+	mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
+}
+
 void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
 {
 	bool err_detected = false;
@@ -208,12 +218,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
 		goto unlock;
 	}
 
-	if (mlx5_health_check_fatal_sensors(dev) || force) { /* protected state setting */
-		dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
-		mlx5_cmd_flush(dev);
-	}
-
-	mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
+	enter_error_state(dev, force);
 unlock:
 	mutex_unlock(&dev->intf_state_mutex);
 }
@@ -613,7 +618,7 @@ static void mlx5_fw_fatal_reporter_err_work(struct work_struct *work)
 	priv = container_of(health, struct mlx5_priv, health);
 	dev = container_of(priv, struct mlx5_core_dev, priv);
 
-	mlx5_enter_error_state(dev, false);
+	enter_error_state(dev, false);
 	if (IS_ERR_OR_NULL(health->fw_fatal_reporter)) {
 		if (mlx5_health_try_recover(dev))
 			mlx5_core_err(dev, "health recovery failed\n");
@@ -707,8 +712,9 @@ static void poll_health(struct timer_list *t)
 		mlx5_core_err(dev, "Fatal error %u detected\n", fatal_error);
 		dev->priv.health.fatal_error = fatal_error;
 		print_health_info(dev);
+		dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
 		mlx5_trigger_health_work(dev);
-		goto out;
+		return;
 	}
 
 	count = ioread32be(health->health_counter);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 106/663] net/mlx5e: Replace synchronize_rcu with synchronize_net
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 105/663] net/mlx5: Fix health error state handling Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 107/663] net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context Greg Kroah-Hartman
                   ` (557 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Tariq Toukan,
	Saeed Mahameed, Sasha Levin

From: Maxim Mikityanskiy <maximmi@mellanox.com>

[ Upstream commit 4d6e6b0c6d4bed8a7128500701354e2dc6098fa3 ]

The commit cited below switched from using napi_synchronize to
synchronize_rcu to have a guarantee that it will finish in finite time.
However, on average, synchronize_rcu takes more time than
napi_synchronize. Given that it's called multiple times per channel on
deactivation, it accumulates to a significant amount, which causes
timeouts in some applications (for example, when using bonding with
NetworkManager).

This commit replaces synchronize_rcu with synchronize_net, which is
faster when called under rtnl_lock, allowing to speed up the described
flow.

Fixes: 9c25a22dfb00 ("net/mlx5e: Use synchronize_rcu to sync with NAPI")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h          | 2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c    | 2 +-
 .../net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c    | 2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c         | 8 ++++----
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
index d487e5e371625..8d991c3b7a503 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
@@ -83,7 +83,7 @@ static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
 
 	clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
 	/* Let other device's napi(s) and XSK wakeups see our new state. */
-	synchronize_rcu();
+	synchronize_net();
 }
 
 static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
index be3465ba38ca1..f95905fc4979e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
@@ -106,7 +106,7 @@ err_free_cparam:
 void mlx5e_close_xsk(struct mlx5e_channel *c)
 {
 	clear_bit(MLX5E_CHANNEL_STATE_XSK, c->state);
-	synchronize_rcu(); /* Sync with the XSK wakeup and with NAPI. */
+	synchronize_net(); /* Sync with the XSK wakeup and with NAPI. */
 
 	mlx5e_close_rq(&c->xskrq);
 	mlx5e_close_cq(&c->xskrq.cq);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
index 6a1d82503ef8f..0f13b661f7f98 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
@@ -663,7 +663,7 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
 	priv_rx = mlx5e_get_ktls_rx_priv_ctx(tls_ctx);
 	set_bit(MLX5E_PRIV_RX_FLAG_DELETING, priv_rx->flags);
 	mlx5e_set_ktls_rx_priv_ctx(tls_ctx, NULL);
-	synchronize_rcu(); /* Sync with NAPI */
+	synchronize_net(); /* Sync with NAPI */
 	if (!cancel_work_sync(&priv_rx->rule.work))
 		/* completion is needed, as the priv_rx in the add flow
 		 * is maintained on the wqe info (wi), not on the socket.
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 42848db8f8dd6..6394f9d8c6851 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -919,7 +919,7 @@ void mlx5e_activate_rq(struct mlx5e_rq *rq)
 void mlx5e_deactivate_rq(struct mlx5e_rq *rq)
 {
 	clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
-	synchronize_rcu(); /* Sync with NAPI to prevent mlx5e_post_rx_wqes. */
+	synchronize_net(); /* Sync with NAPI to prevent mlx5e_post_rx_wqes. */
 }
 
 void mlx5e_close_rq(struct mlx5e_rq *rq)
@@ -1380,7 +1380,7 @@ static void mlx5e_deactivate_txqsq(struct mlx5e_txqsq *sq)
 	struct mlx5_wq_cyc *wq = &sq->wq;
 
 	clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
-	synchronize_rcu(); /* Sync with NAPI to prevent netif_tx_wake_queue. */
+	synchronize_net(); /* Sync with NAPI to prevent netif_tx_wake_queue. */
 
 	mlx5e_tx_disable_queue(sq->txq);
 
@@ -1456,7 +1456,7 @@ void mlx5e_activate_icosq(struct mlx5e_icosq *icosq)
 void mlx5e_deactivate_icosq(struct mlx5e_icosq *icosq)
 {
 	clear_bit(MLX5E_SQ_STATE_ENABLED, &icosq->state);
-	synchronize_rcu(); /* Sync with NAPI. */
+	synchronize_net(); /* Sync with NAPI. */
 }
 
 void mlx5e_close_icosq(struct mlx5e_icosq *sq)
@@ -1535,7 +1535,7 @@ void mlx5e_close_xdpsq(struct mlx5e_xdpsq *sq)
 	struct mlx5e_channel *c = sq->channel;
 
 	clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
-	synchronize_rcu(); /* Sync with NAPI. */
+	synchronize_net(); /* Sync with NAPI. */
 
 	mlx5e_destroy_sq(c->mdev, sq->sqn);
 	mlx5e_free_xdpsq_descs(sq);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 107/663] net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 106/663] net/mlx5e: Replace synchronize_rcu with synchronize_net Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 108/663] net/mlx5: Disable devlink reload for multi port slave device Greg Kroah-Hartman
                   ` (556 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Tariq Toukan,
	Saeed Mahameed, Sasha Levin

From: Maxim Mikityanskiy <maximmi@mellanox.com>

[ Upstream commit b850bbff965129c34f50962638c0a66c82563536 ]

wait_for_resync is unreliable - if it timeouts, priv_rx will be freed
anyway. However, mlx5e_ktls_handle_get_psv_completion will be called
sooner or later, leading to use-after-free. For example, it can happen
if a CQ error happened, and ICOSQ stopped, but later on the queues are
destroyed, and ICOSQ is flushed with mlx5e_free_icosq_descs.

This patch converts the lifecycle of priv_rx to fully refcount-based, so
that the struct won't be freed before the refcount goes to zero.

Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../mellanox/mlx5/core/en_accel/ktls_rx.c     | 64 +++++++++----------
 1 file changed, 30 insertions(+), 34 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
index 0f13b661f7f98..d06532d0baa43 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
@@ -57,6 +57,20 @@ struct mlx5e_ktls_offload_context_rx {
 	struct mlx5e_ktls_rx_resync_ctx resync;
 };
 
+static bool mlx5e_ktls_priv_rx_put(struct mlx5e_ktls_offload_context_rx *priv_rx)
+{
+	if (!refcount_dec_and_test(&priv_rx->resync.refcnt))
+		return false;
+
+	kfree(priv_rx);
+	return true;
+}
+
+static void mlx5e_ktls_priv_rx_get(struct mlx5e_ktls_offload_context_rx *priv_rx)
+{
+	refcount_inc(&priv_rx->resync.refcnt);
+}
+
 static int mlx5e_ktls_create_tir(struct mlx5_core_dev *mdev, u32 *tirn, u32 rqtn)
 {
 	int err, inlen;
@@ -326,7 +340,7 @@ static void resync_handle_work(struct work_struct *work)
 	priv_rx = container_of(resync, struct mlx5e_ktls_offload_context_rx, resync);
 
 	if (unlikely(test_bit(MLX5E_PRIV_RX_FLAG_DELETING, priv_rx->flags))) {
-		refcount_dec(&resync->refcnt);
+		mlx5e_ktls_priv_rx_put(priv_rx);
 		return;
 	}
 
@@ -334,7 +348,7 @@ static void resync_handle_work(struct work_struct *work)
 	sq = &c->async_icosq;
 
 	if (resync_post_get_progress_params(sq, priv_rx))
-		refcount_dec(&resync->refcnt);
+		mlx5e_ktls_priv_rx_put(priv_rx);
 }
 
 static void resync_init(struct mlx5e_ktls_rx_resync_ctx *resync,
@@ -377,7 +391,11 @@ unlock:
 	return err;
 }
 
-/* Function is called with elevated refcount, it decreases it. */
+/* Function can be called with the refcount being either elevated or not.
+ * It decreases the refcount and may free the kTLS priv context.
+ * Refcount is not elevated only if tls_dev_del has been called, but GET_PSV was
+ * already in flight.
+ */
 void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi,
 					  struct mlx5e_icosq *sq)
 {
@@ -410,7 +428,7 @@ void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi,
 	tls_offload_rx_resync_async_request_end(priv_rx->sk, cpu_to_be32(hw_seq));
 	priv_rx->stats->tls_resync_req_end++;
 out:
-	refcount_dec(&resync->refcnt);
+	mlx5e_ktls_priv_rx_put(priv_rx);
 	dma_unmap_single(dev, buf->dma_addr, PROGRESS_PARAMS_PADDED_SIZE, DMA_FROM_DEVICE);
 	kfree(buf);
 }
@@ -431,9 +449,9 @@ static bool resync_queue_get_psv(struct sock *sk)
 		return false;
 
 	resync = &priv_rx->resync;
-	refcount_inc(&resync->refcnt);
+	mlx5e_ktls_priv_rx_get(priv_rx);
 	if (unlikely(!queue_work(resync->priv->tls->rx_wq, &resync->work)))
-		refcount_dec(&resync->refcnt);
+		mlx5e_ktls_priv_rx_put(priv_rx);
 
 	return true;
 }
@@ -625,31 +643,6 @@ err_create_key:
 	return err;
 }
 
-/* Elevated refcount on the resync object means there are
- * outstanding operations (uncompleted GET_PSV WQEs) that
- * will read the resync / priv_rx objects once completed.
- * Wait for them to avoid use-after-free.
- */
-static void wait_for_resync(struct net_device *netdev,
-			    struct mlx5e_ktls_rx_resync_ctx *resync)
-{
-#define MLX5E_KTLS_RX_RESYNC_TIMEOUT 20000 /* msecs */
-	unsigned long exp_time = jiffies + msecs_to_jiffies(MLX5E_KTLS_RX_RESYNC_TIMEOUT);
-	unsigned int refcnt;
-
-	do {
-		refcnt = refcount_read(&resync->refcnt);
-		if (refcnt == 1)
-			return;
-
-		msleep(20);
-	} while (time_before(jiffies, exp_time));
-
-	netdev_warn(netdev,
-		    "Failed waiting for kTLS RX resync refcnt to be released (%u).\n",
-		    refcnt);
-}
-
 void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
 {
 	struct mlx5e_ktls_offload_context_rx *priv_rx;
@@ -671,8 +664,7 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
 		wait_for_completion(&priv_rx->add_ctx);
 	resync = &priv_rx->resync;
 	if (cancel_work_sync(&resync->work))
-		refcount_dec(&resync->refcnt);
-	wait_for_resync(netdev, resync);
+		mlx5e_ktls_priv_rx_put(priv_rx);
 
 	priv_rx->stats->tls_del++;
 	if (priv_rx->rule.rule)
@@ -680,5 +672,9 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
 
 	mlx5_core_destroy_tir(mdev, priv_rx->tirn);
 	mlx5_ktls_destroy_key(mdev, priv_rx->key_id);
-	kfree(priv_rx);
+	/* priv_rx should normally be freed here, but if there is an outstanding
+	 * GET_PSV, deallocation will be delayed until the CQE for GET_PSV is
+	 * processed.
+	 */
+	mlx5e_ktls_priv_rx_put(priv_rx);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 108/663] net/mlx5: Disable devlink reload for multi port slave device
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 107/663] net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 109/663] net/mlx5: Disallow RoCE on " Greg Kroah-Hartman
                   ` (555 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shay Drory, Moshe Shemesh,
	Saeed Mahameed, Sasha Levin

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit d89ddaae1766f8fe571ea6eb63ec098ff556f1dd ]

Devlink reload can't be allowed on a multi port slave device, because
reload of slave device doesn't take effect.

The right flow is to disable devlink reload for multi port slave
device. Hence, disabling it in mlx5_core probing.

Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index e455a2f31f070..8246b6285d5a4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1380,7 +1380,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 		dev_err(&pdev->dev, "mlx5_crdump_enable failed with error code %d\n", err);
 
 	pci_save_state(pdev);
-	devlink_reload_enable(devlink);
+	if (!mlx5_core_is_mp_slave(dev))
+		devlink_reload_enable(devlink);
 	return 0;
 
 err_load_one:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 109/663] net/mlx5: Disallow RoCE on multi port slave device
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 108/663] net/mlx5: Disable devlink reload for multi port slave device Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 110/663] net/mlx5: Disallow RoCE on lag device Greg Kroah-Hartman
                   ` (554 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shay Drory, Moshe Shemesh,
	Saeed Mahameed, Sasha Levin

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit c70f8597fcc1399ef6d5b5ce648a31d887d5dba2 ]

In dual port mode, setting roce enabled/disable for the slave device
have no effect. e.g.: the slave device roce status remain unchanged.
Therefore disable it and add an error message.
Enable or disable roce of the master device affect both master and slave
devices.

Fixes: cc9defcbb8fa ("net/mlx5: Handle "enable_roce" devlink param")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index a28f95df2901d..7ffc94c4979b2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -282,6 +282,10 @@ static int mlx5_devlink_enable_roce_validate(struct devlink *devlink, u32 id,
 		NL_SET_ERR_MSG_MOD(extack, "Device doesn't support RoCE");
 		return -EOPNOTSUPP;
 	}
+	if (mlx5_core_is_mp_slave(dev)) {
+		NL_SET_ERR_MSG_MOD(extack, "Multi port slave device can't configure RoCE");
+		return -EOPNOTSUPP;
+	}
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 110/663] net/mlx5: Disallow RoCE on lag device
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 109/663] net/mlx5: Disallow RoCE on " Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:05 ` [PATCH 5.10 111/663] net/mlx5: Disable devlink reload for lag devices Greg Kroah-Hartman
                   ` (553 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shay Drory, Moshe Shemesh,
	Saeed Mahameed, Sasha Levin

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit 7ab91f2b03367f9d25dd807ebdfb0d67295e0e41 ]

In lag mode, setting roce enabled/disable of lag device have no effect.
e.g.: bond device (roce/vf_lag) roce status remain unchanged.
Therefore disable it and add an error message.

Fixes: cc9defcbb8fa ("net/mlx5: Handle "enable_roce" devlink param")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 7ffc94c4979b2..0450ab5f5f756 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -282,8 +282,8 @@ static int mlx5_devlink_enable_roce_validate(struct devlink *devlink, u32 id,
 		NL_SET_ERR_MSG_MOD(extack, "Device doesn't support RoCE");
 		return -EOPNOTSUPP;
 	}
-	if (mlx5_core_is_mp_slave(dev)) {
-		NL_SET_ERR_MSG_MOD(extack, "Multi port slave device can't configure RoCE");
+	if (mlx5_core_is_mp_slave(dev) || mlx5_lag_is_active(dev)) {
+		NL_SET_ERR_MSG_MOD(extack, "Multi port slave/Lag device can't configure RoCE");
 		return -EOPNOTSUPP;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 111/663] net/mlx5: Disable devlink reload for lag devices
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 110/663] net/mlx5: Disallow RoCE on lag device Greg Kroah-Hartman
@ 2021-03-01 16:05 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 112/663] net/mlx5e: CT: manage the lifetime of the ct entry object Greg Kroah-Hartman
                   ` (552 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shay Drory, Moshe Shemesh,
	Saeed Mahameed, Sasha Levin

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit edac23c2b3d3ac64cfcd351087295893671adbf5 ]

Devlink reload can't be allowed on lag devices since reloading one lag
device will cause traffic on the bond to get stucked.
Users who wish to reload a lag device, need to remove the device from
the bond, and only then reload it.

Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 0450ab5f5f756..bf5cf022e279d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -137,6 +137,11 @@ static int mlx5_devlink_reload_down(struct devlink *devlink, bool netns_change,
 {
 	struct mlx5_core_dev *dev = devlink_priv(devlink);
 
+	if (mlx5_lag_is_active(dev)) {
+		NL_SET_ERR_MSG_MOD(extack, "reload is unsupported in Lag mode\n");
+		return -EOPNOTSUPP;
+	}
+
 	switch (action) {
 	case DEVLINK_RELOAD_ACTION_DRIVER_REINIT:
 		mlx5_unload_one(dev, false);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 112/663] net/mlx5e: CT: manage the lifetime of the ct entry object
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2021-03-01 16:05 ` [PATCH 5.10 111/663] net/mlx5: Disable devlink reload for lag devices Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 113/663] net/mlx5e: Check tunnel offload is required before setting SWP Greg Kroah-Hartman
                   ` (551 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roi Dayan, Oz Shlomo, Saeed Mahameed,
	Sasha Levin

From: Oz Shlomo <ozsh@nvidia.com>

[ Upstream commit a2173131526dc845eb1968a15bc192b3fc2ff000 ]

The ct entry object is accessed by the ct add, del, stats and restore
methods. In addition, it is referenced from several hash tables.

The lifetime of the ct entry object was not managed which triggered race
conditions as in the following kasan dump:
[ 3374.973945] ==================================================================
[ 3374.988552] BUG: KASAN: use-after-free in memcmp+0x4c/0x98
[ 3374.999590] Read of size 1 at addr ffff00036129ea55 by task ksoftirqd/1/15
[ 3375.016415] CPU: 1 PID: 15 Comm: ksoftirqd/1 Tainted: G           O      5.4.31+ #1
[ 3375.055301] Call trace:
[ 3375.060214]  dump_backtrace+0x0/0x238
[ 3375.067580]  show_stack+0x24/0x30
[ 3375.074244]  dump_stack+0xe0/0x118
[ 3375.081085]  print_address_description.isra.9+0x74/0x3d0
[ 3375.091771]  __kasan_report+0x198/0x1e8
[ 3375.099486]  kasan_report+0xc/0x18
[ 3375.106324]  __asan_load1+0x60/0x68
[ 3375.113338]  memcmp+0x4c/0x98
[ 3375.119409]  mlx5e_tc_ct_restore_flow+0x3a4/0x6f8 [mlx5_core]
[ 3375.131073]  mlx5e_rep_tc_update_skb+0x1d4/0x2f0 [mlx5_core]
[ 3375.142553]  mlx5e_handle_rx_cqe_rep+0x198/0x308 [mlx5_core]
[ 3375.154034]  mlx5e_poll_rx_cq+0x2a0/0x1060 [mlx5_core]
[ 3375.164459]  mlx5e_napi_poll+0x1d4/0xa78 [mlx5_core]
[ 3375.174453]  net_rx_action+0x28c/0x7a8
[ 3375.182004]  __do_softirq+0x1b4/0x5d0

Manage the lifetime of the ct entry object by using synchornization
mechanisms for concurrent access.

Fixes: ac991b48d43c ("net/mlx5e: CT: Offload established flows")
Signed-off-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Oz Shlomo <ozsh@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/mellanox/mlx5/core/en/tc_ct.c    | 259 +++++++++++++-----
 1 file changed, 192 insertions(+), 67 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
index 6bc6b48a56dc7..24e2c0d955b99 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -12,6 +12,7 @@
 #include <net/flow_offload.h>
 #include <net/netfilter/nf_flow_table.h>
 #include <linux/workqueue.h>
+#include <linux/refcount.h>
 #include <linux/xarray.h>
 
 #include "lib/fs_chains.h"
@@ -51,11 +52,11 @@ struct mlx5_tc_ct_priv {
 	struct mlx5_flow_table *ct_nat;
 	struct mlx5_flow_table *post_ct;
 	struct mutex control_lock; /* guards parallel adds/dels */
-	struct mutex shared_counter_lock;
 	struct mapping_ctx *zone_mapping;
 	struct mapping_ctx *labels_mapping;
 	enum mlx5_flow_namespace_type ns_type;
 	struct mlx5_fs_chains *chains;
+	spinlock_t ht_lock; /* protects ft entries */
 };
 
 struct mlx5_ct_flow {
@@ -124,6 +125,10 @@ struct mlx5_ct_counter {
 	bool is_shared;
 };
 
+enum {
+	MLX5_CT_ENTRY_FLAG_VALID,
+};
+
 struct mlx5_ct_entry {
 	struct rhash_head node;
 	struct rhash_head tuple_node;
@@ -134,6 +139,12 @@ struct mlx5_ct_entry {
 	struct mlx5_ct_tuple tuple;
 	struct mlx5_ct_tuple tuple_nat;
 	struct mlx5_ct_zone_rule zone_rules[2];
+
+	struct mlx5_tc_ct_priv *ct_priv;
+	struct work_struct work;
+
+	refcount_t refcnt;
+	unsigned long flags;
 };
 
 static const struct rhashtable_params cts_ht_params = {
@@ -740,6 +751,87 @@ err_attr:
 	return err;
 }
 
+static bool
+mlx5_tc_ct_entry_valid(struct mlx5_ct_entry *entry)
+{
+	return test_bit(MLX5_CT_ENTRY_FLAG_VALID, &entry->flags);
+}
+
+static struct mlx5_ct_entry *
+mlx5_tc_ct_entry_get(struct mlx5_tc_ct_priv *ct_priv, struct mlx5_ct_tuple *tuple)
+{
+	struct mlx5_ct_entry *entry;
+
+	entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, tuple,
+				       tuples_ht_params);
+	if (entry && mlx5_tc_ct_entry_valid(entry) &&
+	    refcount_inc_not_zero(&entry->refcnt)) {
+		return entry;
+	} else if (!entry) {
+		entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_nat_ht,
+					       tuple, tuples_nat_ht_params);
+		if (entry && mlx5_tc_ct_entry_valid(entry) &&
+		    refcount_inc_not_zero(&entry->refcnt))
+			return entry;
+	}
+
+	return entry ? ERR_PTR(-EINVAL) : NULL;
+}
+
+static void mlx5_tc_ct_entry_remove_from_tuples(struct mlx5_ct_entry *entry)
+{
+	struct mlx5_tc_ct_priv *ct_priv = entry->ct_priv;
+
+	rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+			       &entry->tuple_nat_node,
+			       tuples_nat_ht_params);
+	rhashtable_remove_fast(&ct_priv->ct_tuples_ht, &entry->tuple_node,
+			       tuples_ht_params);
+}
+
+static void mlx5_tc_ct_entry_del(struct mlx5_ct_entry *entry)
+{
+	struct mlx5_tc_ct_priv *ct_priv = entry->ct_priv;
+
+	mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+
+	spin_lock_bh(&ct_priv->ht_lock);
+	mlx5_tc_ct_entry_remove_from_tuples(entry);
+	spin_unlock_bh(&ct_priv->ht_lock);
+
+	mlx5_tc_ct_counter_put(ct_priv, entry);
+	kfree(entry);
+}
+
+static void
+mlx5_tc_ct_entry_put(struct mlx5_ct_entry *entry)
+{
+	if (!refcount_dec_and_test(&entry->refcnt))
+		return;
+
+	mlx5_tc_ct_entry_del(entry);
+}
+
+static void mlx5_tc_ct_entry_del_work(struct work_struct *work)
+{
+	struct mlx5_ct_entry *entry = container_of(work, struct mlx5_ct_entry, work);
+
+	mlx5_tc_ct_entry_del(entry);
+}
+
+static void
+__mlx5_tc_ct_entry_put(struct mlx5_ct_entry *entry)
+{
+	struct mlx5e_priv *priv;
+
+	if (!refcount_dec_and_test(&entry->refcnt))
+		return;
+
+	priv = netdev_priv(entry->ct_priv->netdev);
+	INIT_WORK(&entry->work, mlx5_tc_ct_entry_del_work);
+	queue_work(priv->wq, &entry->work);
+}
+
 static struct mlx5_ct_counter *
 mlx5_tc_ct_counter_create(struct mlx5_tc_ct_priv *ct_priv)
 {
@@ -792,16 +884,26 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
 	}
 
 	/* Use the same counter as the reverse direction */
-	mutex_lock(&ct_priv->shared_counter_lock);
-	rev_entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, &rev_tuple,
-					   tuples_ht_params);
-	if (rev_entry) {
-		if (refcount_inc_not_zero(&rev_entry->counter->refcount)) {
-			mutex_unlock(&ct_priv->shared_counter_lock);
-			return rev_entry->counter;
-		}
+	spin_lock_bh(&ct_priv->ht_lock);
+	rev_entry = mlx5_tc_ct_entry_get(ct_priv, &rev_tuple);
+
+	if (IS_ERR(rev_entry)) {
+		spin_unlock_bh(&ct_priv->ht_lock);
+		goto create_counter;
+	}
+
+	if (rev_entry && refcount_inc_not_zero(&rev_entry->counter->refcount)) {
+		ct_dbg("Using shared counter entry=0x%p rev=0x%p\n", entry, rev_entry);
+		shared_counter = rev_entry->counter;
+		spin_unlock_bh(&ct_priv->ht_lock);
+
+		mlx5_tc_ct_entry_put(rev_entry);
+		return shared_counter;
 	}
-	mutex_unlock(&ct_priv->shared_counter_lock);
+
+	spin_unlock_bh(&ct_priv->ht_lock);
+
+create_counter:
 
 	shared_counter = mlx5_tc_ct_counter_create(ct_priv);
 	if (IS_ERR(shared_counter)) {
@@ -866,10 +968,14 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
 	if (!meta_action)
 		return -EOPNOTSUPP;
 
-	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
-				       cts_ht_params);
-	if (entry)
-		return 0;
+	spin_lock_bh(&ct_priv->ht_lock);
+	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
+	if (entry && refcount_inc_not_zero(&entry->refcnt)) {
+		spin_unlock_bh(&ct_priv->ht_lock);
+		mlx5_tc_ct_entry_put(entry);
+		return -EEXIST;
+	}
+	spin_unlock_bh(&ct_priv->ht_lock);
 
 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 	if (!entry)
@@ -878,6 +984,8 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
 	entry->tuple.zone = ft->zone;
 	entry->cookie = flow->cookie;
 	entry->restore_cookie = meta_action->ct_metadata.cookie;
+	refcount_set(&entry->refcnt, 2);
+	entry->ct_priv = ct_priv;
 
 	err = mlx5_tc_ct_rule_to_tuple(&entry->tuple, flow_rule);
 	if (err)
@@ -888,35 +996,40 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
 	if (err)
 		goto err_set;
 
-	err = rhashtable_insert_fast(&ct_priv->ct_tuples_ht,
-				     &entry->tuple_node,
-				     tuples_ht_params);
+	spin_lock_bh(&ct_priv->ht_lock);
+
+	err = rhashtable_lookup_insert_fast(&ft->ct_entries_ht, &entry->node,
+					    cts_ht_params);
+	if (err)
+		goto err_entries;
+
+	err = rhashtable_lookup_insert_fast(&ct_priv->ct_tuples_ht,
+					    &entry->tuple_node,
+					    tuples_ht_params);
 	if (err)
 		goto err_tuple;
 
 	if (memcmp(&entry->tuple, &entry->tuple_nat, sizeof(entry->tuple))) {
-		err = rhashtable_insert_fast(&ct_priv->ct_tuples_nat_ht,
-					     &entry->tuple_nat_node,
-					     tuples_nat_ht_params);
+		err = rhashtable_lookup_insert_fast(&ct_priv->ct_tuples_nat_ht,
+						    &entry->tuple_nat_node,
+						    tuples_nat_ht_params);
 		if (err)
 			goto err_tuple_nat;
 	}
+	spin_unlock_bh(&ct_priv->ht_lock);
 
 	err = mlx5_tc_ct_entry_add_rules(ct_priv, flow_rule, entry,
 					 ft->zone_restore_id);
 	if (err)
 		goto err_rules;
 
-	err = rhashtable_insert_fast(&ft->ct_entries_ht, &entry->node,
-				     cts_ht_params);
-	if (err)
-		goto err_insert;
+	set_bit(MLX5_CT_ENTRY_FLAG_VALID, &entry->flags);
+	mlx5_tc_ct_entry_put(entry); /* this function reference */
 
 	return 0;
 
-err_insert:
-	mlx5_tc_ct_entry_del_rules(ct_priv, entry);
 err_rules:
+	spin_lock_bh(&ct_priv->ht_lock);
 	if (mlx5_tc_ct_entry_has_nat(entry))
 		rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
 				       &entry->tuple_nat_node, tuples_nat_ht_params);
@@ -925,47 +1038,43 @@ err_tuple_nat:
 			       &entry->tuple_node,
 			       tuples_ht_params);
 err_tuple:
+	rhashtable_remove_fast(&ft->ct_entries_ht,
+			       &entry->node,
+			       cts_ht_params);
+err_entries:
+	spin_unlock_bh(&ct_priv->ht_lock);
 err_set:
 	kfree(entry);
-	netdev_warn(ct_priv->netdev,
-		    "Failed to offload ct entry, err: %d\n", err);
+	if (err != -EEXIST)
+		netdev_warn(ct_priv->netdev, "Failed to offload ct entry, err: %d\n", err);
 	return err;
 }
 
-static void
-mlx5_tc_ct_del_ft_entry(struct mlx5_tc_ct_priv *ct_priv,
-			struct mlx5_ct_entry *entry)
-{
-	mlx5_tc_ct_entry_del_rules(ct_priv, entry);
-	mutex_lock(&ct_priv->shared_counter_lock);
-	if (mlx5_tc_ct_entry_has_nat(entry))
-		rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
-				       &entry->tuple_nat_node,
-				       tuples_nat_ht_params);
-	rhashtable_remove_fast(&ct_priv->ct_tuples_ht, &entry->tuple_node,
-			       tuples_ht_params);
-	mutex_unlock(&ct_priv->shared_counter_lock);
-	mlx5_tc_ct_counter_put(ct_priv, entry);
-
-}
-
 static int
 mlx5_tc_ct_block_flow_offload_del(struct mlx5_ct_ft *ft,
 				  struct flow_cls_offload *flow)
 {
+	struct mlx5_tc_ct_priv *ct_priv = ft->ct_priv;
 	unsigned long cookie = flow->cookie;
 	struct mlx5_ct_entry *entry;
 
-	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
-				       cts_ht_params);
-	if (!entry)
+	spin_lock_bh(&ct_priv->ht_lock);
+	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
+	if (!entry) {
+		spin_unlock_bh(&ct_priv->ht_lock);
 		return -ENOENT;
+	}
 
-	mlx5_tc_ct_del_ft_entry(ft->ct_priv, entry);
-	WARN_ON(rhashtable_remove_fast(&ft->ct_entries_ht,
-				       &entry->node,
-				       cts_ht_params));
-	kfree(entry);
+	if (!mlx5_tc_ct_entry_valid(entry)) {
+		spin_unlock_bh(&ct_priv->ht_lock);
+		return -EINVAL;
+	}
+
+	rhashtable_remove_fast(&ft->ct_entries_ht, &entry->node, cts_ht_params);
+	mlx5_tc_ct_entry_remove_from_tuples(entry);
+	spin_unlock_bh(&ct_priv->ht_lock);
+
+	mlx5_tc_ct_entry_put(entry);
 
 	return 0;
 }
@@ -974,19 +1083,30 @@ static int
 mlx5_tc_ct_block_flow_offload_stats(struct mlx5_ct_ft *ft,
 				    struct flow_cls_offload *f)
 {
+	struct mlx5_tc_ct_priv *ct_priv = ft->ct_priv;
 	unsigned long cookie = f->cookie;
 	struct mlx5_ct_entry *entry;
 	u64 lastuse, packets, bytes;
 
-	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
-				       cts_ht_params);
-	if (!entry)
+	spin_lock_bh(&ct_priv->ht_lock);
+	entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
+	if (!entry) {
+		spin_unlock_bh(&ct_priv->ht_lock);
 		return -ENOENT;
+	}
+
+	if (!mlx5_tc_ct_entry_valid(entry) || !refcount_inc_not_zero(&entry->refcnt)) {
+		spin_unlock_bh(&ct_priv->ht_lock);
+		return -EINVAL;
+	}
+
+	spin_unlock_bh(&ct_priv->ht_lock);
 
 	mlx5_fc_query_cached(entry->counter->counter, &bytes, &packets, &lastuse);
 	flow_stats_update(&f->stats, bytes, packets, 0, lastuse,
 			  FLOW_ACTION_HW_STATS_DELAYED);
 
+	mlx5_tc_ct_entry_put(entry);
 	return 0;
 }
 
@@ -1478,11 +1598,9 @@ err_mapping:
 static void
 mlx5_tc_ct_flush_ft_entry(void *ptr, void *arg)
 {
-	struct mlx5_tc_ct_priv *ct_priv = arg;
 	struct mlx5_ct_entry *entry = ptr;
 
-	mlx5_tc_ct_del_ft_entry(ct_priv, entry);
-	kfree(entry);
+	mlx5_tc_ct_entry_put(entry);
 }
 
 static void
@@ -1960,6 +2078,7 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains,
 		goto err_mapping_labels;
 	}
 
+	spin_lock_init(&ct_priv->ht_lock);
 	ct_priv->ns_type = ns_type;
 	ct_priv->chains = chains;
 	ct_priv->netdev = priv->netdev;
@@ -1994,7 +2113,6 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains,
 
 	idr_init(&ct_priv->fte_ids);
 	mutex_init(&ct_priv->control_lock);
-	mutex_init(&ct_priv->shared_counter_lock);
 	rhashtable_init(&ct_priv->zone_ht, &zone_params);
 	rhashtable_init(&ct_priv->ct_tuples_ht, &tuples_ht_params);
 	rhashtable_init(&ct_priv->ct_tuples_nat_ht, &tuples_nat_ht_params);
@@ -2037,7 +2155,6 @@ mlx5_tc_ct_clean(struct mlx5_tc_ct_priv *ct_priv)
 	rhashtable_destroy(&ct_priv->ct_tuples_nat_ht);
 	rhashtable_destroy(&ct_priv->zone_ht);
 	mutex_destroy(&ct_priv->control_lock);
-	mutex_destroy(&ct_priv->shared_counter_lock);
 	idr_destroy(&ct_priv->fte_ids);
 	kfree(ct_priv);
 }
@@ -2059,14 +2176,22 @@ mlx5e_tc_ct_restore_flow(struct mlx5_tc_ct_priv *ct_priv,
 	if (!mlx5_tc_ct_skb_to_tuple(skb, &tuple, zone))
 		return false;
 
-	entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, &tuple,
-				       tuples_ht_params);
-	if (!entry)
-		entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_nat_ht,
-					       &tuple, tuples_nat_ht_params);
-	if (!entry)
+	spin_lock(&ct_priv->ht_lock);
+
+	entry = mlx5_tc_ct_entry_get(ct_priv, &tuple);
+	if (!entry) {
+		spin_unlock(&ct_priv->ht_lock);
+		return false;
+	}
+
+	if (IS_ERR(entry)) {
+		spin_unlock(&ct_priv->ht_lock);
 		return false;
+	}
+	spin_unlock(&ct_priv->ht_lock);
 
 	tcf_ct_flow_table_restore_skb(skb, entry->restore_cookie);
+	__mlx5_tc_ct_entry_put(entry);
+
 	return true;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 113/663] net/mlx5e: Check tunnel offload is required before setting SWP
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 112/663] net/mlx5e: CT: manage the lifetime of the ct entry object Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 114/663] mac80211: fix potential overflow when multiplying to u32 integers Greg Kroah-Hartman
                   ` (550 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan,
	Saeed Mahameed, Sasha Levin

From: Moshe Shemesh <moshe@nvidia.com>

[ Upstream commit e1c3940c6003d820c787473c65711b49c2d1bc42 ]

Check that tunnel offload is required before setting Software Parser
offsets to get Geneve HW offload. In case of Geneve packet we check HW
offload support of SWP in mlx5e_tunnel_features_check() and set features
accordingly, this should be reflected in skb offload requested by the
kernel and we should add the Software Parser offsets only if requested.
Otherwise, in case HW doesn't support SWP for Geneve, data path will
mistakenly try to offload Geneve SKBs with skb->encapsulation set,
regardless of whether offload was requested or not on this specific SKB.

Fixes: e3cfc7e6b7bd ("net/mlx5e: TX, Add geneve tunnel stateless offload support")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
index 1fae7fab8297e..ff81b69a59a9b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
@@ -173,7 +173,7 @@ static inline bool mlx5e_accel_tx_eseg(struct mlx5e_priv *priv,
 #endif
 
 #if IS_ENABLED(CONFIG_GENEVE)
-	if (skb->encapsulation)
+	if (skb->encapsulation && skb->ip_summed == CHECKSUM_PARTIAL)
 		mlx5e_tx_tunnel_accel(skb, eseg, ihs);
 #endif
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 114/663] mac80211: fix potential overflow when multiplying to u32 integers
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 113/663] net/mlx5e: Check tunnel offload is required before setting SWP Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 115/663] libbpf: Ignore non function pointer member in struct_ops Greg Kroah-Hartman
                   ` (549 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Johannes Berg, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 6194f7e6473be78acdc5d03edd116944bdbb2c4e ]

The multiplication of the u32 variables tx_time and estimated_retx is
performed using a 32 bit multiplication and the result is stored in
a u64 result. This has a potential u32 overflow issue, so avoid this
by casting tx_time to a u64 to force a 64 bit multiply.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210205175352.208841-1-colin.king@canonical.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/mesh_hwmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 313eee12410ec..3db514c4c63ab 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -356,7 +356,7 @@ u32 airtime_link_metric_get(struct ieee80211_local *local,
 	 */
 	tx_time = (device_constant + 10 * test_frame_len / rate);
 	estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
-	result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
+	result = ((u64)tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
 	return (u32)result;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 115/663] libbpf: Ignore non function pointer member in struct_ops
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 114/663] mac80211: fix potential overflow when multiplying to u32 integers Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 116/663] bpf: Fix an unitialized value in bpf_iter Greg Kroah-Hartman
                   ` (548 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin KaFai Lau, Andrii Nakryiko,
	Sasha Levin

From: Martin KaFai Lau <kafai@fb.com>

[ Upstream commit d2836dddc95d5dd82c7cb23726c97d8c9147f050 ]

When libbpf initializes the kernel's struct_ops in
"bpf_map__init_kern_struct_ops()", it enforces all
pointer types must be a function pointer and rejects
others.  It turns out to be too strict.  For example,
when directly using "struct tcp_congestion_ops" from vmlinux.h,
it has a "struct module *owner" member and it is set to NULL
in a bpf_tcp_cc.o.

Instead, it only needs to ensure the member is a function
pointer if it has been set (relocated) to a bpf-prog.
This patch moves the "btf_is_func_proto(kern_mtype)" check
after the existing "if (!prog) { continue; }".  The original debug
message in "if (!prog) { continue; }" is also removed since it is
no longer valid.  Beside, there is a later debug message to tell
which function pointer is set.

The "btf_is_func_proto(mtype)" has already been guaranteed
in "bpf_object__collect_st_ops_relos()" which has been run
before "bpf_map__init_kern_struct_ops()".  Thus, this check
is removed.

v2:
- Remove outdated debug message (Andrii)
  Remove because there is a later debug message to tell
  which function pointer is set.
- Following mtype->type is no longer needed. Remove:
  "skip_mods_and_typedefs(btf, mtype->type, &mtype_id)"
- Do "if (!prog)" test before skip_mods_and_typedefs.

Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210212021030.266932-1-kafai@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index ad165e6e74bc0..b954db52bb807 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -865,24 +865,24 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map,
 		if (btf_is_ptr(mtype)) {
 			struct bpf_program *prog;
 
-			mtype = skip_mods_and_typedefs(btf, mtype->type, &mtype_id);
+			prog = st_ops->progs[i];
+			if (!prog)
+				continue;
+
 			kern_mtype = skip_mods_and_typedefs(kern_btf,
 							    kern_mtype->type,
 							    &kern_mtype_id);
-			if (!btf_is_func_proto(mtype) ||
-			    !btf_is_func_proto(kern_mtype)) {
-				pr_warn("struct_ops init_kern %s: non func ptr %s is not supported\n",
+
+			/* mtype->type must be a func_proto which was
+			 * guaranteed in bpf_object__collect_st_ops_relos(),
+			 * so only check kern_mtype for func_proto here.
+			 */
+			if (!btf_is_func_proto(kern_mtype)) {
+				pr_warn("struct_ops init_kern %s: kernel member %s is not a func ptr\n",
 					map->name, mname);
 				return -ENOTSUP;
 			}
 
-			prog = st_ops->progs[i];
-			if (!prog) {
-				pr_debug("struct_ops init_kern %s: func ptr %s is not set\n",
-					 map->name, mname);
-				continue;
-			}
-
 			prog->attach_btf_id = kern_type_id;
 			prog->expected_attach_type = kern_member_idx;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 116/663] bpf: Fix an unitialized value in bpf_iter
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 115/663] libbpf: Ignore non function pointer member in struct_ops Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 117/663] bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation Greg Kroah-Hartman
                   ` (547 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+580f4f2a272e452d55cb,
	Yonghong Song, Alexei Starovoitov, Sasha Levin

From: Yonghong Song <yhs@fb.com>

[ Upstream commit 17d8beda277a36203585943e70c7909b60775fd5 ]

Commit 15d83c4d7cef ("bpf: Allow loading of a bpf_iter program")
cached btf_id in struct bpf_iter_target_info so later on
if it can be checked cheaply compared to checking registered names.

syzbot found a bug that uninitialized value may occur to
bpf_iter_target_info->btf_id. This is because we allocated
bpf_iter_target_info structure with kmalloc and never initialized
field btf_id afterwards. This uninitialized btf_id is typically
compared to a u32 bpf program func proto btf_id, and the chance
of being equal is extremely slim.

This patch fixed the issue by using kzalloc which will also
prevent future likely instances due to adding new fields.

Fixes: 15d83c4d7cef ("bpf: Allow loading of a bpf_iter program")
Reported-by: syzbot+580f4f2a272e452d55cb@syzkaller.appspotmail.com
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210212005926.2875002-1-yhs@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/bpf_iter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
index 8f10e30ea0b08..e8957e911de31 100644
--- a/kernel/bpf/bpf_iter.c
+++ b/kernel/bpf/bpf_iter.c
@@ -273,7 +273,7 @@ int bpf_iter_reg_target(const struct bpf_iter_reg *reg_info)
 {
 	struct bpf_iter_target_info *tinfo;
 
-	tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
+	tinfo = kzalloc(sizeof(*tinfo), GFP_KERNEL);
 	if (!tinfo)
 		return -ENOMEM;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 117/663] bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 116/663] bpf: Fix an unitialized value in bpf_iter Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 118/663] bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx Greg Kroah-Hartman
                   ` (546 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Junichi Nomura, Daniel Borkmann,
	Toke Høiland-Jørgensen, Sasha Levin

From: Jun'ichi Nomura <junichi.nomura@nec.com>

[ Upstream commit 7d4553b69fb335496c597c31590e982485ebe071 ]

The devmap bulk queue is allocated with GFP_ATOMIC and the allocation
may fail if there is no available space in existing percpu pool.

Since commit 75ccae62cb8d42 ("xdp: Move devmap bulk queue into struct net_device")
moved the bulk queue allocation to NETDEV_REGISTER callback, whose context
is allowed to sleep, use GFP_KERNEL instead of GFP_ATOMIC to let percpu
allocator extend the pool when needed and avoid possible failure of netdev
registration.

As the required alignment is natural, we can simply use alloc_percpu().

Fixes: 75ccae62cb8d42 ("xdp: Move devmap bulk queue into struct net_device")
Signed-off-by: Jun'ichi Nomura <junichi.nomura@nec.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/bpf/20210209082451.GA44021@jeru.linux.bs1.fc.nec.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/devmap.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 2b5ca93c17dec..b5be9659ab590 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -815,9 +815,7 @@ static int dev_map_notification(struct notifier_block *notifier,
 			break;
 
 		/* will be freed in free_netdev() */
-		netdev->xdp_bulkq =
-			__alloc_percpu_gfp(sizeof(struct xdp_dev_bulk_queue),
-					   sizeof(void *), GFP_ATOMIC);
+		netdev->xdp_bulkq = alloc_percpu(struct xdp_dev_bulk_queue);
 		if (!netdev->xdp_bulkq)
 			return NOTIFY_BAD;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 118/663] bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 117/663] bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 119/663] selftests: mptcp: fix ACKRX debug message Greg Kroah-Hartman
                   ` (545 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Carlo Carraro,
	Jesper Dangaard Brouer, Daniel Borkmann, Sasha Levin

From: Jesper Dangaard Brouer <brouer@redhat.com>

[ Upstream commit 2c0a10af688c02adcf127aad29e923e0056c6b69 ]

BPF end-user on Cilium slack-channel (Carlo Carraro) wants to use
bpf_fib_lookup for doing MTU-check, but *prior* to extending packet size,
by adjusting fib_params 'tot_len' with the packet length plus the expected
encap size. (Just like the bpf_check_mtu helper supports). He discovered
that for SKB ctx the param->tot_len was not used, instead skb->len was used
(via MTU check in is_skb_forwardable() that checks against netdev MTU).

Fix this by using fib_params 'tot_len' for MTU check. If not provided (e.g.
zero) then keep existing TC behaviour intact. Notice that 'tot_len' for MTU
check is done like XDP code-path, which checks against FIB-dst MTU.

V16:
- Revert V13 optimization, 2nd lookup is against egress/resulting netdev

V13:
- Only do ifindex lookup one time, calling dev_get_by_index_rcu().

V10:
- Use same method as XDP for 'tot_len' MTU check

Fixes: 4c79579b44b1 ("bpf: Change bpf_fib_lookup to return lookup status")
Reported-by: Carlo Carraro <colrack@gmail.com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/161287789444.790810.15247494756551413508.stgit@firesoul
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/filter.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 2ca5eecebacfa..f0a19a48c0481 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5549,6 +5549,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
 {
 	struct net *net = dev_net(skb->dev);
 	int rc = -EAFNOSUPPORT;
+	bool check_mtu = false;
 
 	if (plen < sizeof(*params))
 		return -EINVAL;
@@ -5556,22 +5557,28 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
 	if (flags & ~(BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT))
 		return -EINVAL;
 
+	if (params->tot_len)
+		check_mtu = true;
+
 	switch (params->family) {
 #if IS_ENABLED(CONFIG_INET)
 	case AF_INET:
-		rc = bpf_ipv4_fib_lookup(net, params, flags, false);
+		rc = bpf_ipv4_fib_lookup(net, params, flags, check_mtu);
 		break;
 #endif
 #if IS_ENABLED(CONFIG_IPV6)
 	case AF_INET6:
-		rc = bpf_ipv6_fib_lookup(net, params, flags, false);
+		rc = bpf_ipv6_fib_lookup(net, params, flags, check_mtu);
 		break;
 #endif
 	}
 
-	if (!rc) {
+	if (rc == BPF_FIB_LKUP_RET_SUCCESS && !check_mtu) {
 		struct net_device *dev;
 
+		/* When tot_len isn't provided by user, check skb
+		 * against MTU of FIB lookup resulting net_device
+		 */
 		dev = dev_get_by_index_rcu(net, params->ifindex);
 		if (!is_skb_forwardable(dev, skb))
 			rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 119/663] selftests: mptcp: fix ACKRX debug message
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 118/663] bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 120/663] tcp: fix SO_RCVLOWAT related hangs under mem pressure Greg Kroah-Hartman
                   ` (544 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthieu Baerts, Mat Martineau,
	David S. Miller, Sasha Levin

From: Matthieu Baerts <matthieu.baerts@tessares.net>

[ Upstream commit f384221a381751508f390b36d0e51bd5a7beb627 ]

Info from received MPCapable SYN were printed instead of the ones from
received MPCapable 3rd ACK.

Fixes: fed61c4b584c ("selftests: mptcp: make 2nd net namespace use tcp syn cookies unconditionally")
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
index 2cfd87d94db89..e927df83efb91 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
@@ -493,7 +493,7 @@ do_transfer()
 		echo "${listener_ns} SYNRX: ${cl_proto} -> ${srv_proto}: expect ${expect_synrx}, got ${stat_synrx_now_l}"
 	fi
 	if [ $expect_ackrx -ne $stat_ackrx_now_l ] ;then
-		echo "${listener_ns} ACKRX: ${cl_proto} -> ${srv_proto}: expect ${expect_synrx}, got ${stat_synrx_now_l}"
+		echo "${listener_ns} ACKRX: ${cl_proto} -> ${srv_proto}: expect ${expect_ackrx}, got ${stat_ackrx_now_l} "
 	fi
 
 	if [ $retc -eq 0 ] && [ $rets -eq 0 ];then
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 120/663] tcp: fix SO_RCVLOWAT related hangs under mem pressure
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 119/663] selftests: mptcp: fix ACKRX debug message Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 121/663] net: axienet: Handle deferred probe on clock properly Greg Kroah-Hartman
                   ` (543 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Arjun Roy, Wei Wang,
	David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit f969dc5a885736842c3511ecdea240fbb02d25d9 ]

While commit 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
fixed an issue vs too small sk_rcvbuf for given sk_rcvlowat constraint,
it missed to address issue caused by memory pressure.

1) If we are under memory pressure and socket receive queue is empty.
First incoming packet is allowed to be queued, after commit
76dfa6082032 ("tcp: allow one skb to be received per socket under memory pressure")

But we do not send EPOLLIN yet, in case tcp_data_ready() sees sk_rcvlowat
is bigger than skb length.

2) Then, when next packet comes, it is dropped, and we directly
call sk->sk_data_ready().

3) If application is using poll(), tcp_poll() will then use
tcp_stream_is_readable() and decide the socket receive queue is
not yet filled, so nothing will happen.

Even when sender retransmits packets, phases 2) & 3) repeat
and flow is effectively frozen, until memory pressure is off.

Fix is to consider tcp_under_memory_pressure() to take care
of global memory pressure or memcg pressure.

Fixes: 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Arjun Roy <arjunroy@google.com>
Suggested-by: Wei Wang <weiwan@google.com>
Reviewed-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/tcp.h | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index fe9747ee70a6f..7d66c61d22c7d 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1424,8 +1424,13 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied);
  */
 static inline bool tcp_rmem_pressure(const struct sock *sk)
 {
-	int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
-	int threshold = rcvbuf - (rcvbuf >> 3);
+	int rcvbuf, threshold;
+
+	if (tcp_under_memory_pressure(sk))
+		return true;
+
+	rcvbuf = READ_ONCE(sk->sk_rcvbuf);
+	threshold = rcvbuf - (rcvbuf >> 3);
 
 	return atomic_read(&sk->sk_rmem_alloc) > threshold;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 121/663] net: axienet: Handle deferred probe on clock properly
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 120/663] tcp: fix SO_RCVLOWAT related hangs under mem pressure Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 122/663] cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds Greg Kroah-Hartman
                   ` (542 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Hancock, David S. Miller, Sasha Levin

From: Robert Hancock <robert.hancock@calian.com>

[ Upstream commit 57baf8cc70ea4cf5503c9d42f31f6a86d7f5ff1a ]

This driver is set up to use a clock mapping in the device tree if it is
present, but still work without one for backward compatibility. However,
if getting the clock returns -EPROBE_DEFER, then we need to abort and
return that error from our driver initialization so that the probe can
be retried later after the clock is set up.

Move clock initialization to earlier in the process so we do not waste as
much effort if the clock is not yet available. Switch to use
devm_clk_get_optional and abort initialization on any error reported.
Also enable the clock regardless of whether the controller is using an MDIO
bus, as the clock is required in any case.

Fixes: 09a0354cadec267be7f ("net: axienet: Use clock framework to get device clock rate")
Signed-off-by: Robert Hancock <robert.hancock@calian.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/xilinx/xilinx_axienet_main.c | 26 +++++++++----------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 9aafd3ecdaa4d..eea0bb7c23ede 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1805,6 +1805,18 @@ static int axienet_probe(struct platform_device *pdev)
 	lp->options = XAE_OPTION_DEFAULTS;
 	lp->rx_bd_num = RX_BD_NUM_DEFAULT;
 	lp->tx_bd_num = TX_BD_NUM_DEFAULT;
+
+	lp->clk = devm_clk_get_optional(&pdev->dev, NULL);
+	if (IS_ERR(lp->clk)) {
+		ret = PTR_ERR(lp->clk);
+		goto free_netdev;
+	}
+	ret = clk_prepare_enable(lp->clk);
+	if (ret) {
+		dev_err(&pdev->dev, "Unable to enable clock: %d\n", ret);
+		goto free_netdev;
+	}
+
 	/* Map device registers */
 	ethres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	lp->regs = devm_ioremap_resource(&pdev->dev, ethres);
@@ -1980,20 +1992,6 @@ static int axienet_probe(struct platform_device *pdev)
 
 	lp->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
 	if (lp->phy_node) {
-		lp->clk = devm_clk_get(&pdev->dev, NULL);
-		if (IS_ERR(lp->clk)) {
-			dev_warn(&pdev->dev, "Failed to get clock: %ld\n",
-				 PTR_ERR(lp->clk));
-			lp->clk = NULL;
-		} else {
-			ret = clk_prepare_enable(lp->clk);
-			if (ret) {
-				dev_err(&pdev->dev, "Unable to enable clock: %d\n",
-					ret);
-				goto free_netdev;
-			}
-		}
-
 		ret = axienet_mdio_setup(lp);
 		if (ret)
 			dev_warn(&pdev->dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 122/663] cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 121/663] net: axienet: Handle deferred probe on clock properly Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 123/663] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Greg Kroah-Hartman
                   ` (541 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ayush Sawal, Jakub Kicinski,
	David S. Miller, Sasha Levin

From: Ayush Sawal <ayush.sawal@chelsio.com>

[ Upstream commit 2355a6773a2cb0d2dce13432dde78497f1d6617b ]

The Max imm data size in cxgb4 is not similar to the max imm data size
in the chtls. This caused an mismatch in output of is_ofld_imm() of
cxgb4 and chtls. So fixed this by keeping the max wreq size of imm data
same in both chtls and cxgb4 as MAX_IMM_OFLD_TX_DATA_WR_LEN.

As cxgb4's max imm. data value for ofld packets is changed to
MAX_IMM_OFLD_TX_DATA_WR_LEN. Using the same in cxgbit also.

Fixes: 36bedb3f2e5b8 ("crypto: chtls - Inline TLS record Tx")
Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h        |  3 +++
 drivers/net/ethernet/chelsio/cxgb4/sge.c              | 11 ++++++++---
 .../ethernet/chelsio/inline_crypto/chtls/chtls_cm.h   |  3 ---
 drivers/target/iscsi/cxgbit/cxgbit_target.c           |  3 +--
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 1b49f2fa9b185..34546f5312eee 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -46,6 +46,9 @@
 #define MAX_ULD_QSETS 16
 #define MAX_ULD_NPORTS 4
 
+/* ulp_mem_io + ulptx_idata + payload + padding */
+#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
+
 /* CPL message priority levels */
 enum {
 	CPL_PRIORITY_DATA     = 0,  /* data messages */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 196652a114c5f..3334c9e2152ab 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2842,17 +2842,22 @@ int t4_mgmt_tx(struct adapter *adap, struct sk_buff *skb)
  *	@skb: the packet
  *
  *	Returns true if a packet can be sent as an offload WR with immediate
- *	data.  We currently use the same limit as for Ethernet packets.
+ *	data.
+ *	FW_OFLD_TX_DATA_WR limits the payload to 255 bytes due to 8-bit field.
+ *      However, FW_ULPTX_WR commands have a 256 byte immediate only
+ *      payload limit.
  */
 static inline int is_ofld_imm(const struct sk_buff *skb)
 {
 	struct work_request_hdr *req = (struct work_request_hdr *)skb->data;
 	unsigned long opcode = FW_WR_OP_G(ntohl(req->wr_hi));
 
-	if (opcode == FW_CRYPTO_LOOKASIDE_WR)
+	if (unlikely(opcode == FW_ULPTX_WR))
+		return skb->len <= MAX_IMM_ULPTX_WR_LEN;
+	else if (opcode == FW_CRYPTO_LOOKASIDE_WR)
 		return skb->len <= SGE_MAX_WR_LEN;
 	else
-		return skb->len <= MAX_IMM_TX_PKT_LEN;
+		return skb->len <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
 }
 
 /**
diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
index 47ba81e42f5d0..b1161bdeda4dc 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
@@ -50,9 +50,6 @@
 #define MIN_RCV_WND (24 * 1024U)
 #define LOOPBACK(x)     (((x) & htonl(0xff000000)) == htonl(0x7f000000))
 
-/* ulp_mem_io + ulptx_idata + payload + padding */
-#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
-
 /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
 #define TX_HEADER_LEN \
 	(sizeof(struct fw_ofld_tx_data_wr) + sizeof(struct sge_opaque_hdr))
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index 9b3eb2e8c92ad..b926e1d6c7b8e 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -86,8 +86,7 @@ static int cxgbit_is_ofld_imm(const struct sk_buff *skb)
 	if (likely(cxgbit_skcb_flags(skb) & SKCBF_TX_ISO))
 		length += sizeof(struct cpl_tx_data_iso);
 
-#define MAX_IMM_TX_PKT_LEN	256
-	return length <= MAX_IMM_TX_PKT_LEN;
+	return length <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
 }
 
 /*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 123/663] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 122/663] cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 124/663] bpf: Clear subreg_def for global function return values Greg Kroah-Hartman
                   ` (540 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Larry Finger,
	David S. Miller, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ]

The documentation for the PHY update [1] states:

Loop 4 times with index i

    If PHY Revision >= 3
        Copy table[i] to coef[i]
    Otherwise
        Set coef[i] to 0

the copy of the table to coef is currently implemented the wrong way
around, table is being updated from uninitialized values in coeff.
Fix this by swapping the assignment around.

[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/

Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration")
Addresses-Coverity: ("Uninitialized scalar variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
index b669dff24b6e0..665b737fbb0d8 100644
--- a/drivers/net/wireless/broadcom/b43/phy_n.c
+++ b/drivers/net/wireless/broadcom/b43/phy_n.c
@@ -5311,7 +5311,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
 
 	for (i = 0; i < 4; i++) {
 		if (dev->phy.rev >= 3)
-			table[i] = coef[i];
+			coef[i] = table[i];
 		else
 			coef[i] = 0;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 124/663] bpf: Clear subreg_def for global function return values
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 123/663] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 125/663] ibmvnic: add memory barrier to protect long term buffer Greg Kroah-Hartman
                   ` (539 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yauheni Kaliuta, Ilya Leoshkevich,
	Daniel Borkmann, Sasha Levin

From: Ilya Leoshkevich <iii@linux.ibm.com>

[ Upstream commit 45159b27637b0fef6d5ddb86fc7c46b13c77960f ]

test_global_func4 fails on s390 as reported by Yauheni in [1].

The immediate problem is that the zext code includes the instruction,
whose result needs to be zero-extended, into the zero-extension
patchlet, and if this instruction happens to be a branch, then its
delta is not adjusted. As a result, the verifier rejects the program
later.

However, according to [2], as far as the verifier's algorithm is
concerned and as specified by the insn_no_def() function, branching
insns do not define anything. This includes call insns, even though
one might argue that they define %r0.

This means that the real problem is that zero extension kicks in at
all. This happens because clear_caller_saved_regs() sets BPF_REG_0's
subreg_def after global function calls. This can be fixed in many
ways; this patch mimics what helper function call handling already
does.

  [1] https://lore.kernel.org/bpf/20200903140542.156624-1-yauheni.kaliuta@redhat.com/
  [2] https://lore.kernel.org/bpf/CAADnVQ+2RPKcftZw8d+B1UwB35cpBhpF5u3OocNh90D9pETPwg@mail.gmail.com/

Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
Reported-by: Yauheni Kaliuta <yauheni.kaliuta@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210212040408.90109-1-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c09594e70f90a..6c2e4947beaeb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4786,8 +4786,9 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 					subprog);
 			clear_caller_saved_regs(env, caller->regs);
 
-			/* All global functions return SCALAR_VALUE */
+			/* All global functions return a 64-bit SCALAR_VALUE */
 			mark_reg_unknown(env, caller->regs, BPF_REG_0);
+			caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
 
 			/* continue with next insn after call */
 			return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 125/663] ibmvnic: add memory barrier to protect long term buffer
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 124/663] bpf: Clear subreg_def for global function return values Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 126/663] ibmvnic: skip send_request_unmap for timeout reset Greg Kroah-Hartman
                   ` (538 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lijun Pan, Thomas Falcon,
	David S. Miller, Sasha Levin

From: Lijun Pan <ljp@linux.ibm.com>

[ Upstream commit 42557dab78edc8235aba5b441f2eb35f725a0ede ]

dma_rmb() barrier is added to load the long term buffer before copying
it to socket buffer; and dma_wmb() barrier is added to update the
long term buffer before it being accessed by VIOS (virtual i/o server).

Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
Acked-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d789c3cb7f87b..d6cd131625525 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1592,6 +1592,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 		skb_copy_from_linear_data(skb, dst, skb->len);
 	}
 
+	/* post changes to long_term_buff *dst before VIOS accessing it */
+	dma_wmb();
+
 	tx_pool->consumer_index =
 	    (tx_pool->consumer_index + 1) % tx_pool->num_buffers;
 
@@ -2432,6 +2435,8 @@ restart_poll:
 		offset = be16_to_cpu(next->rx_comp.off_frame_data);
 		flags = next->rx_comp.flags;
 		skb = rx_buff->skb;
+		/* load long_term_buff before copying to skb */
+		dma_rmb();
 		skb_copy_to_linear_data(skb, rx_buff->data + offset,
 					length);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 126/663] ibmvnic: skip send_request_unmap for timeout reset
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 125/663] ibmvnic: add memory barrier to protect long term buffer Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 127/663] net: dsa: felix: perform teardown in reverse order of setup Greg Kroah-Hartman
                   ` (537 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lijun Pan, David S. Miller, Sasha Levin

From: Lijun Pan <ljp@linux.ibm.com>

[ Upstream commit 7d3a7b9ea59ddb223aec59b45fa1713c633aaed4 ]

Timeout reset will trigger the VIOS to unmap it automatically,
similarly as FAILVOER and MOBILITY events. If we unmap it
in the linux side, we will see errors like
"30000003: Error 4 in REQUEST_UNMAP_RSP".
So, don't call send_request_unmap for timeout reset.

Fixes: ed651a10875f ("ibmvnic: Updated reset handling")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d6cd131625525..5e1f4e71af7bc 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -249,8 +249,13 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter,
 	if (!ltb->buff)
 		return;
 
+	/* VIOS automatically unmaps the long term buffer at remote
+	 * end for the following resets:
+	 * FAILOVER, MOBILITY, TIMEOUT.
+	 */
 	if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
-	    adapter->reset_reason != VNIC_RESET_MOBILITY)
+	    adapter->reset_reason != VNIC_RESET_MOBILITY &&
+	    adapter->reset_reason != VNIC_RESET_TIMEOUT)
 		send_request_unmap(adapter, ltb->map_id);
 	dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 127/663] net: dsa: felix: perform teardown in reverse order of setup
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 126/663] ibmvnic: skip send_request_unmap for timeout reset Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 128/663] net: dsa: felix: dont deinitialize unused ports Greg Kroah-Hartman
                   ` (536 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Florian Fainelli,
	Jakub Kicinski, Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit d19741b0f54487cf3a11307900f8633935cd2849 ]

In general it is desirable that cleanup is the reverse process of setup.
In this case I am not seeing any particular issue, but with the
introduction of devlink-sb for felix, a non-obvious decision had to be
made as to where to put its cleanup method. When there's a convention in
place, that decision becomes obvious.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/ocelot/felix.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
index 89d7c9b231863..7e506a1d8b2ff 100644
--- a/drivers/net/dsa/ocelot/felix.c
+++ b/drivers/net/dsa/ocelot/felix.c
@@ -635,14 +635,14 @@ static void felix_teardown(struct dsa_switch *ds)
 	struct felix *felix = ocelot_to_felix(ocelot);
 	int port;
 
-	if (felix->info->mdio_bus_free)
-		felix->info->mdio_bus_free(ocelot);
+	ocelot_deinit_timestamp(ocelot);
+	ocelot_deinit(ocelot);
 
 	for (port = 0; port < ocelot->num_phys_ports; port++)
 		ocelot_deinit_port(ocelot, port);
-	ocelot_deinit_timestamp(ocelot);
-	/* stop workqueue thread */
-	ocelot_deinit(ocelot);
+
+	if (felix->info->mdio_bus_free)
+		felix->info->mdio_bus_free(ocelot);
 }
 
 static int felix_hwtstamp_get(struct dsa_switch *ds, int port,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 128/663] net: dsa: felix: dont deinitialize unused ports
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 127/663] net: dsa: felix: perform teardown in reverse order of setup Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 129/663] net: phy: mscc: adding LCPLL reset to VSC8514 Greg Kroah-Hartman
                   ` (535 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit 42b5adbbac03bdb396192316c015fa3e64ffd5a1 ]

ocelot_init_port is called only if dsa_is_unused_port == false, however
ocelot_deinit_port is called unconditionally. This causes a warning in
the skb_queue_purge inside ocelot_deinit_port saying that the spin lock
protecting ocelot_port->tx_skbs was not initialized.

Fixes: e5fb512d81d0 ("net: mscc: ocelot: deinitialize only initialized ports")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/ocelot/felix.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
index 7e506a1d8b2ff..4e53464411edf 100644
--- a/drivers/net/dsa/ocelot/felix.c
+++ b/drivers/net/dsa/ocelot/felix.c
@@ -638,8 +638,12 @@ static void felix_teardown(struct dsa_switch *ds)
 	ocelot_deinit_timestamp(ocelot);
 	ocelot_deinit(ocelot);
 
-	for (port = 0; port < ocelot->num_phys_ports; port++)
+	for (port = 0; port < ocelot->num_phys_ports; port++) {
+		if (dsa_is_unused_port(ds, port))
+			continue;
+
 		ocelot_deinit_port(ocelot, port);
+	}
 
 	if (felix->info->mdio_bus_free)
 		felix->info->mdio_bus_free(ocelot);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 129/663] net: phy: mscc: adding LCPLL reset to VSC8514
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 128/663] net: dsa: felix: dont deinitialize unused ports Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 130/663] net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout Greg Kroah-Hartman
                   ` (534 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steen Hegelund, Bjarni Jonasson,
	David S. Miller, Sasha Levin

From: Bjarni Jonasson <bjarni.jonasson@microchip.com>

[ Upstream commit 3cc2c646be0b22037f31c958e96c0544a073d108 ]

At Power-On Reset, transients may cause the LCPLL to lock onto a
clock that is momentarily unstable. This is normally seen in QSGMII
setups where the higher speed 6G SerDes is being used.
This patch adds an initial LCPLL Reset to the PHY (first instance)
to avoid this issue.

Fixes: e4f9ba642f0b ("net: phy: mscc: add support for VSC8514 PHY.")
Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
Signed-off-by: Bjarni Jonasson <bjarni.jonasson@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mscc/mscc.h      |   8 +
 drivers/net/phy/mscc/mscc_main.c | 350 ++++++++++++++++++++-----------
 2 files changed, 236 insertions(+), 122 deletions(-)

diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h
index 9481bce94c2ed..c2023f93c0b24 100644
--- a/drivers/net/phy/mscc/mscc.h
+++ b/drivers/net/phy/mscc/mscc.h
@@ -102,6 +102,7 @@ enum rgmii_clock_delay {
 #define PHY_MCB_S6G_READ		  BIT(30)
 
 #define PHY_S6G_PLL5G_CFG0		  0x06
+#define PHY_S6G_PLL5G_CFG2		  0x08
 #define PHY_S6G_LCPLL_CFG		  0x11
 #define PHY_S6G_PLL_CFG			  0x2b
 #define PHY_S6G_COMMON_CFG		  0x2c
@@ -121,6 +122,9 @@ enum rgmii_clock_delay {
 #define PHY_S6G_PLL_FSM_CTRL_DATA_POS	  8
 #define PHY_S6G_PLL_FSM_ENA_POS		  7
 
+#define PHY_S6G_CFG2_FSM_DIS              1
+#define PHY_S6G_CFG2_FSM_CLK_BP          23
+
 #define MSCC_EXT_PAGE_ACCESS		  31
 #define MSCC_PHY_PAGE_STANDARD		  0x0000 /* Standard registers */
 #define MSCC_PHY_PAGE_EXTENDED		  0x0001 /* Extended registers */
@@ -412,6 +416,10 @@ struct vsc8531_edge_rate_table {
 };
 #endif /* CONFIG_OF_MDIO */
 
+enum csr_target {
+	MACRO_CTRL  = 0x07,
+};
+
 #if IS_ENABLED(CONFIG_MACSEC)
 int vsc8584_macsec_init(struct phy_device *phydev);
 void vsc8584_handle_macsec_interrupt(struct phy_device *phydev);
diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
index 6bc7406a1ce73..41a410124437d 100644
--- a/drivers/net/phy/mscc/mscc_main.c
+++ b/drivers/net/phy/mscc/mscc_main.c
@@ -710,6 +710,113 @@ static int phy_base_read(struct phy_device *phydev, u32 regnum)
 	return __phy_package_read(phydev, regnum);
 }
 
+static u32 vsc85xx_csr_read(struct phy_device *phydev,
+			    enum csr_target target, u32 reg)
+{
+	unsigned long deadline;
+	u32 val, val_l, val_h;
+
+	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
+
+	/* CSR registers are grouped under different Target IDs.
+	 * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
+	 * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
+	 * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
+	 * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
+	 */
+
+	/* Setup the Target ID */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
+		       MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
+
+	if ((target >> 2 == 0x1) || (target >> 2 == 0x3))
+		/* non-MACsec access */
+		target &= 0x3;
+	else
+		target = 0;
+
+	/* Trigger CSR Action - Read into the CSR's */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
+		       MSCC_PHY_CSR_CNTL_19_CMD | MSCC_PHY_CSR_CNTL_19_READ |
+		       MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
+		       MSCC_PHY_CSR_CNTL_19_TARGET(target));
+
+	/* Wait for register access*/
+	deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+	do {
+		usleep_range(500, 1000);
+		val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
+	} while (time_before(jiffies, deadline) &&
+		!(val & MSCC_PHY_CSR_CNTL_19_CMD));
+
+	if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
+		return 0xffffffff;
+
+	/* Read the Least Significant Word (LSW) (17) */
+	val_l = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_17);
+
+	/* Read the Most Significant Word (MSW) (18) */
+	val_h = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_18);
+
+	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+		       MSCC_PHY_PAGE_STANDARD);
+
+	return (val_h << 16) | val_l;
+}
+
+static int vsc85xx_csr_write(struct phy_device *phydev,
+			     enum csr_target target, u32 reg, u32 val)
+{
+	unsigned long deadline;
+
+	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
+
+	/* CSR registers are grouped under different Target IDs.
+	 * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
+	 * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
+	 * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
+	 * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
+	 */
+
+	/* Setup the Target ID */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
+		       MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
+
+	/* Write the Least Significant Word (LSW) (17) */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_17, (u16)val);
+
+	/* Write the Most Significant Word (MSW) (18) */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_18, (u16)(val >> 16));
+
+	if ((target >> 2 == 0x1) || (target >> 2 == 0x3))
+		/* non-MACsec access */
+		target &= 0x3;
+	else
+		target = 0;
+
+	/* Trigger CSR Action - Write into the CSR's */
+	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
+		       MSCC_PHY_CSR_CNTL_19_CMD |
+		       MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
+		       MSCC_PHY_CSR_CNTL_19_TARGET(target));
+
+	/* Wait for register access */
+	deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+	do {
+		usleep_range(500, 1000);
+		val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
+	} while (time_before(jiffies, deadline) &&
+		 !(val & MSCC_PHY_CSR_CNTL_19_CMD));
+
+	if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
+		return -ETIMEDOUT;
+
+	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+		       MSCC_PHY_PAGE_STANDARD);
+
+	return 0;
+}
+
 /* bus->mdio_lock should be locked when using this function */
 static void vsc8584_csr_write(struct phy_device *phydev, u16 addr, u32 val)
 {
@@ -1131,6 +1238,92 @@ out:
 	return ret;
 }
 
+/* Access LCPLL Cfg_2 */
+static void vsc8584_pll5g_cfg2_wr(struct phy_device *phydev,
+				  bool disable_fsm)
+{
+	u32 rd_dat;
+
+	rd_dat = vsc85xx_csr_read(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2);
+	rd_dat &= ~BIT(PHY_S6G_CFG2_FSM_DIS);
+	rd_dat |= (disable_fsm << PHY_S6G_CFG2_FSM_DIS);
+	vsc85xx_csr_write(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2, rd_dat);
+}
+
+/* trigger a read to the spcified MCB */
+static int vsc8584_mcb_rd_trig(struct phy_device *phydev,
+			       u32 mcb_reg_addr, u8 mcb_slave_num)
+{
+	u32 rd_dat = 0;
+
+	/* read MCB */
+	vsc85xx_csr_write(phydev, MACRO_CTRL, mcb_reg_addr,
+			  (0x40000000 | (1L << mcb_slave_num)));
+
+	return read_poll_timeout(vsc85xx_csr_read, rd_dat,
+				 !(rd_dat & 0x40000000),
+				 4000, 200000, 0,
+				 phydev, MACRO_CTRL, mcb_reg_addr);
+}
+
+/* trigger a write to the spcified MCB */
+static int vsc8584_mcb_wr_trig(struct phy_device *phydev,
+			       u32 mcb_reg_addr,
+			       u8 mcb_slave_num)
+{
+	u32 rd_dat = 0;
+
+	/* write back MCB */
+	vsc85xx_csr_write(phydev, MACRO_CTRL, mcb_reg_addr,
+			  (0x80000000 | (1L << mcb_slave_num)));
+
+	return read_poll_timeout(vsc85xx_csr_read, rd_dat,
+				 !(rd_dat & 0x80000000),
+				 4000, 200000, 0,
+				 phydev, MACRO_CTRL, mcb_reg_addr);
+}
+
+/* Sequence to Reset LCPLL for the VIPER and ELISE PHY */
+static int vsc8584_pll5g_reset(struct phy_device *phydev)
+{
+	bool dis_fsm;
+	int ret = 0;
+
+	ret = vsc8584_mcb_rd_trig(phydev, 0x11, 0);
+	if (ret < 0)
+		goto done;
+	dis_fsm = 1;
+
+	/* Reset LCPLL */
+	vsc8584_pll5g_cfg2_wr(phydev, dis_fsm);
+
+	/* write back LCPLL MCB */
+	ret = vsc8584_mcb_wr_trig(phydev, 0x11, 0);
+	if (ret < 0)
+		goto done;
+
+	/* 10 mSec sleep while LCPLL is hold in reset */
+	usleep_range(10000, 20000);
+
+	/* read LCPLL MCB into CSRs */
+	ret = vsc8584_mcb_rd_trig(phydev, 0x11, 0);
+	if (ret < 0)
+		goto done;
+	dis_fsm = 0;
+
+	/* Release the Reset of LCPLL */
+	vsc8584_pll5g_cfg2_wr(phydev, dis_fsm);
+
+	/* write back LCPLL MCB */
+	ret = vsc8584_mcb_wr_trig(phydev, 0x11, 0);
+	if (ret < 0)
+		goto done;
+
+	usleep_range(110000, 200000);
+done:
+	return ret;
+}
+
 /* bus->mdio_lock should be locked when using this function */
 static int vsc8584_config_pre_init(struct phy_device *phydev)
 {
@@ -1579,8 +1772,16 @@ static int vsc8514_config_pre_init(struct phy_device *phydev)
 		{0x16b2, 0x00007000},
 		{0x16b4, 0x00000814},
 	};
+	struct device *dev = &phydev->mdio.dev;
 	unsigned int i;
 	u16 reg;
+	int ret;
+
+	ret = vsc8584_pll5g_reset(phydev);
+	if (ret < 0) {
+		dev_err(dev, "failed LCPLL reset, ret: %d\n", ret);
+		return ret;
+	}
 
 	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_STANDARD);
 
@@ -1615,101 +1816,6 @@ static int vsc8514_config_pre_init(struct phy_device *phydev)
 	return 0;
 }
 
-static u32 vsc85xx_csr_ctrl_phy_read(struct phy_device *phydev,
-				     u32 target, u32 reg)
-{
-	unsigned long deadline;
-	u32 val, val_l, val_h;
-
-	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
-
-	/* CSR registers are grouped under different Target IDs.
-	 * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
-	 * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
-	 * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
-	 * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
-	 */
-
-	/* Setup the Target ID */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
-		       MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
-
-	/* Trigger CSR Action - Read into the CSR's */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
-		       MSCC_PHY_CSR_CNTL_19_CMD | MSCC_PHY_CSR_CNTL_19_READ |
-		       MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
-		       MSCC_PHY_CSR_CNTL_19_TARGET(target & 0x3));
-
-	/* Wait for register access*/
-	deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
-	do {
-		usleep_range(500, 1000);
-		val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
-	} while (time_before(jiffies, deadline) &&
-		!(val & MSCC_PHY_CSR_CNTL_19_CMD));
-
-	if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
-		return 0xffffffff;
-
-	/* Read the Least Significant Word (LSW) (17) */
-	val_l = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_17);
-
-	/* Read the Most Significant Word (MSW) (18) */
-	val_h = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_18);
-
-	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
-		       MSCC_PHY_PAGE_STANDARD);
-
-	return (val_h << 16) | val_l;
-}
-
-static int vsc85xx_csr_ctrl_phy_write(struct phy_device *phydev,
-				      u32 target, u32 reg, u32 val)
-{
-	unsigned long deadline;
-
-	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
-
-	/* CSR registers are grouped under different Target IDs.
-	 * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
-	 * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
-	 * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
-	 * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
-	 */
-
-	/* Setup the Target ID */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
-		       MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
-
-	/* Write the Least Significant Word (LSW) (17) */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_17, (u16)val);
-
-	/* Write the Most Significant Word (MSW) (18) */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_18, (u16)(val >> 16));
-
-	/* Trigger CSR Action - Write into the CSR's */
-	phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
-		       MSCC_PHY_CSR_CNTL_19_CMD |
-		       MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
-		       MSCC_PHY_CSR_CNTL_19_TARGET(target & 0x3));
-
-	/* Wait for register access */
-	deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
-	do {
-		usleep_range(500, 1000);
-		val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
-	} while (time_before(jiffies, deadline) &&
-		 !(val & MSCC_PHY_CSR_CNTL_19_CMD));
-
-	if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
-		return -ETIMEDOUT;
-
-	phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
-		       MSCC_PHY_PAGE_STANDARD);
-
-	return 0;
-}
-
 static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
 			       u32 op)
 {
@@ -1717,15 +1823,15 @@ static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
 	u32 val;
 	int ret;
 
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET, reg,
-					 op | (1 << mcb));
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET, reg,
+				op | (1 << mcb));
 	if (ret)
 		return -EINVAL;
 
 	deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
 	do {
 		usleep_range(500, 1000);
-		val = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET, reg);
+		val = vsc85xx_csr_read(phydev, PHY_MCB_TARGET, reg);
 
 		if (val == 0xffffffff)
 			return -EIO;
@@ -1806,41 +1912,41 @@ static int vsc8514_config_init(struct phy_device *phydev)
 	/* lcpll mcb */
 	phy_update_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
 	/* pll5gcfg0 */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_PLL5G_CFG0, 0x7036f145);
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_PLL5G_CFG0, 0x7036f145);
 	if (ret)
 		goto err;
 
 	phy_commit_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
 	/* pllcfg */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_PLL_CFG,
-					 (3 << PHY_S6G_PLL_ENA_OFFS_POS) |
-					 (120 << PHY_S6G_PLL_FSM_CTRL_DATA_POS)
-					 | (0 << PHY_S6G_PLL_FSM_ENA_POS));
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_PLL_CFG,
+				(3 << PHY_S6G_PLL_ENA_OFFS_POS) |
+				(120 << PHY_S6G_PLL_FSM_CTRL_DATA_POS)
+				| (0 << PHY_S6G_PLL_FSM_ENA_POS));
 	if (ret)
 		goto err;
 
 	/* commoncfg */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_COMMON_CFG,
-					 (0 << PHY_S6G_SYS_RST_POS) |
-					 (0 << PHY_S6G_ENA_LANE_POS) |
-					 (0 << PHY_S6G_ENA_LOOP_POS) |
-					 (0 << PHY_S6G_QRATE_POS) |
-					 (3 << PHY_S6G_IF_MODE_POS));
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_COMMON_CFG,
+				(0 << PHY_S6G_SYS_RST_POS) |
+				(0 << PHY_S6G_ENA_LANE_POS) |
+				(0 << PHY_S6G_ENA_LOOP_POS) |
+				(0 << PHY_S6G_QRATE_POS) |
+				(3 << PHY_S6G_IF_MODE_POS));
 	if (ret)
 		goto err;
 
 	/* misccfg */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_MISC_CFG, 1);
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_MISC_CFG, 1);
 	if (ret)
 		goto err;
 
 	/* gpcfg */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_GPC_CFG, 768);
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_GPC_CFG, 768);
 	if (ret)
 		goto err;
 
@@ -1851,8 +1957,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
 		usleep_range(500, 1000);
 		phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
 				   0); /* read 6G MCB into CSRs */
-		reg = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET,
-						PHY_S6G_PLL_STATUS);
+		reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
+				       PHY_S6G_PLL_STATUS);
 		if (reg == 0xffffffff) {
 			phy_unlock_mdio_bus(phydev);
 			return -EIO;
@@ -1866,8 +1972,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
 	}
 
 	/* misccfg */
-	ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
-					 PHY_S6G_MISC_CFG, 0);
+	ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+				PHY_S6G_MISC_CFG, 0);
 	if (ret)
 		goto err;
 
@@ -1878,8 +1984,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
 		usleep_range(500, 1000);
 		phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
 				   0); /* read 6G MCB into CSRs */
-		reg = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET,
-						PHY_S6G_IB_STATUS0);
+		reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
+				       PHY_S6G_IB_STATUS0);
 		if (reg == 0xffffffff) {
 			phy_unlock_mdio_bus(phydev);
 			return -EIO;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 130/663] net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 129/663] net: phy: mscc: adding LCPLL reset to VSC8514 Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 131/663] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning Greg Kroah-Hartman
                   ` (533 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudheesh Mavila, Shyam Sundar S K,
	Tom Lendacky, David S. Miller, Sasha Levin

From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>

[ Upstream commit 30b7edc82ec82578f4f5e6706766f0a9535617d3 ]

Sometimes mailbox commands timeout when the RX data path becomes
unresponsive. This prevents the submission of new mailbox commands to DXIO.
This patch identifies the timeout and resets the RX data path so that the
next message can be submitted properly.

Fixes: 549b32af9f7c ("amd-xgbe: Simplify mailbox interface rate change code")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 +++++++++++
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 28 ++++++++++++++++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index b40d4377cc71d..b2cd3bdba9f89 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -1279,10 +1279,18 @@
 #define MDIO_PMA_10GBR_FECCTRL		0x00ab
 #endif
 
+#ifndef MDIO_PMA_RX_CTRL1
+#define MDIO_PMA_RX_CTRL1		0x8051
+#endif
+
 #ifndef MDIO_PCS_DIG_CTRL
 #define MDIO_PCS_DIG_CTRL		0x8000
 #endif
 
+#ifndef MDIO_PCS_DIGITAL_STAT
+#define MDIO_PCS_DIGITAL_STAT		0x8010
+#endif
+
 #ifndef MDIO_AN_XNP
 #define MDIO_AN_XNP			0x0016
 #endif
@@ -1358,6 +1366,8 @@
 #define XGBE_KR_TRAINING_ENABLE		BIT(1)
 
 #define XGBE_PCS_CL37_BP		BIT(12)
+#define XGBE_PCS_PSEQ_STATE_MASK	0x1c
+#define XGBE_PCS_PSEQ_STATE_POWER_GOOD	0x10
 
 #define XGBE_AN_CL37_INT_CMPLT		BIT(0)
 #define XGBE_AN_CL37_INT_MASK		0x01
@@ -1375,6 +1385,10 @@
 #define XGBE_PMA_CDR_TRACK_EN_OFF	0x00
 #define XGBE_PMA_CDR_TRACK_EN_ON	0x01
 
+#define XGBE_PMA_RX_RST_0_MASK		BIT(4)
+#define XGBE_PMA_RX_RST_0_RESET_ON	0x10
+#define XGBE_PMA_RX_RST_0_RESET_OFF	0x00
+
 /* Bit setting and getting macros
  *  The get macro will extract the current bit field value from within
  *  the variable
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 859ded0c06b05..087948085ae19 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -1953,6 +1953,27 @@ static void xgbe_phy_set_redrv_mode(struct xgbe_prv_data *pdata)
 	xgbe_phy_put_comm_ownership(pdata);
 }
 
+static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
+{
+	int reg;
+
+	reg = XMDIO_READ_BITS(pdata, MDIO_MMD_PCS, MDIO_PCS_DIGITAL_STAT,
+			      XGBE_PCS_PSEQ_STATE_MASK);
+	if (reg == XGBE_PCS_PSEQ_STATE_POWER_GOOD) {
+		/* Mailbox command timed out, reset of RX block is required.
+		 * This can be done by asseting the reset bit and wait for
+		 * its compeletion.
+		 */
+		XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
+				 XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_ON);
+		ndelay(20);
+		XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
+				 XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_OFF);
+		usleep_range(40, 50);
+		netif_err(pdata, link, pdata->netdev, "firmware mailbox reset performed\n");
+	}
+}
+
 static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 					unsigned int cmd, unsigned int sub_cmd)
 {
@@ -1960,9 +1981,11 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 	unsigned int wait;
 
 	/* Log if a previous command did not complete */
-	if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
+	if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
 		netif_dbg(pdata, link, pdata->netdev,
 			  "firmware mailbox not ready for command\n");
+		xgbe_phy_rx_reset(pdata);
+	}
 
 	/* Construct the command */
 	XP_SET_BITS(s0, XP_DRIVER_SCRATCH_0, COMMAND, cmd);
@@ -1984,6 +2007,9 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 
 	netif_dbg(pdata, link, pdata->netdev,
 		  "firmware mailbox command did not complete\n");
+
+	/* Reset on error */
+	xgbe_phy_rx_reset(pdata);
 }
 
 static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 131/663] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 130/663] net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 132/663] net: amd-xgbe: Reset link when the link never comes back Greg Kroah-Hartman
                   ` (532 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudheesh Mavila, Shyam Sundar S K,
	Tom Lendacky, David S. Miller, Sasha Levin

From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>

[ Upstream commit 186edbb510bd60e748f93975989ccba25ee99c50 ]

The current driver calls netif_carrier_off() late in the link tear down
which can result in a netdev watchdog timeout.

Calling netif_carrier_off() immediately after netif_tx_stop_all_queues()
avoids the warning.

 ------------[ cut here ]------------
 NETDEV WATCHDOG: enp3s0f2 (amd-xgbe): transmit queue 0 timed out
 WARNING: CPU: 3 PID: 0 at net/sched/sch_generic.c:461 dev_watchdog+0x20d/0x220
 Modules linked in: amd_xgbe(E)  amd-xgbe 0000:03:00.2 enp3s0f2: Link is Down
 CPU: 3 PID: 0 Comm: swapper/3 Tainted: G            E
 Hardware name: AMD Bilby-RV2/Bilby-RV2, BIOS RBB1202A 10/18/2019
 RIP: 0010:dev_watchdog+0x20d/0x220
 Code: 00 49 63 4e e0 eb 92 4c 89 e7 c6 05 c6 e2 c1 00 01 e8 e7 ce fc ff 89 d9 48
 RSP: 0018:ffff90cfc28c3e88 EFLAGS: 00010286
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006
 RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff90cfc28d63c0
 RBP: ffff90cfb977845c R08: 0000000000000050 R09: 0000000000196018
 R10: ffff90cfc28c3ef8 R11: 0000000000000000 R12: ffff90cfb9778000
 R13: 0000000000000003 R14: ffff90cfb9778480 R15: 0000000000000010
 FS:  0000000000000000(0000) GS:ffff90cfc28c0000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f240ff2d9d0 CR3: 00000001e3e0a000 CR4: 00000000003406e0
 Call Trace:
  <IRQ>
  ? pfifo_fast_reset+0x100/0x100
  call_timer_fn+0x2b/0x130
  run_timer_softirq+0x3e8/0x440
  ? enqueue_hrtimer+0x39/0x90

Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c  | 1 +
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 2709a2db56577..395eb0b526802 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1368,6 +1368,7 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
 		return;
 
 	netif_tx_stop_all_queues(netdev);
+	netif_carrier_off(pdata->netdev);
 
 	xgbe_stop_timers(pdata);
 	flush_workqueue(pdata->dev_workqueue);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 93ef5a30cb8d9..19ee4db0156d6 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1396,7 +1396,6 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
 	pdata->phy_if.phy_impl.stop(pdata);
 
 	pdata->phy.link = 0;
-	netif_carrier_off(pdata->netdev);
 
 	xgbe_phy_adjust_link(pdata);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 132/663] net: amd-xgbe: Reset link when the link never comes back
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 131/663] net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 133/663] net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP Greg Kroah-Hartman
                   ` (531 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudheesh Mavila, Shyam Sundar S K,
	Tom Lendacky, David S. Miller, Sasha Levin

From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>

[ Upstream commit 84fe68eb67f9499309cffd97c1ba269de125ff14 ]

Normally, auto negotiation and reconnect should be automatically done by
the hardware. But there seems to be an issue where auto negotiation has
to be restarted manually. This happens because of link training and so
even though still connected to the partner the link never "comes back".
This needs an auto-negotiation restart.

Also, a change in xgbe-mdio is needed to get ethtool to recognize the
link down and get the link change message. This change is only
required in a backplane connection mode.

Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c   | 2 +-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 19ee4db0156d6..4e97b48695220 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1345,7 +1345,7 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
 							     &an_restart);
 	if (an_restart) {
 		xgbe_phy_config_aneg(pdata);
-		return;
+		goto adjust_link;
 	}
 
 	if (pdata->phy.link) {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 087948085ae19..d3f72faecd1da 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -2610,6 +2610,14 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
 	if (reg & MDIO_STAT1_LSTATUS)
 		return 1;
 
+	if (pdata->phy.autoneg == AUTONEG_ENABLE &&
+	    phy_data->port_mode == XGBE_PORT_MODE_BACKPLANE) {
+		if (!test_bit(XGBE_LINK_INIT, &pdata->dev_state)) {
+			netif_carrier_off(pdata->netdev);
+			*an_restart = 1;
+		}
+	}
+
 	/* No link, attempt a receiver reset cycle */
 	if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
 		phy_data->rrc_count = 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 133/663] net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 132/663] net: amd-xgbe: Reset link when the link never comes back Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 134/663] net: mvneta: Remove per-cpu queue mapping for Armada 3700 Greg Kroah-Hartman
                   ` (530 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudheesh Mavila, Shyam Sundar S K,
	Tom Lendacky, David S. Miller, Sasha Levin

From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>

[ Upstream commit 9eab3fdb419916f66a72d1572f68d82cd9b3f963 ]

Frequent link up/down events can happen when a Bel Fuse SFP part is
connected to the amd-xgbe device. Try to avoid the frequent link
issues by resetting the PHY as documented in Bel Fuse SFP datasheets.

Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index d3f72faecd1da..18e48b3bc402b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -922,6 +922,9 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
 	if ((phy_id & 0xfffffff0) != 0x03625d10)
 		return false;
 
+	/* Reset PHY - wait for self-clearing reset bit to clear */
+	genphy_soft_reset(phy_data->phydev);
+
 	/* Disable RGMII mode */
 	phy_write(phy_data->phydev, 0x18, 0x7007);
 	reg = phy_read(phy_data->phydev, 0x18);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 134/663] net: mvneta: Remove per-cpu queue mapping for Armada 3700
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 133/663] net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 135/663] net: enetc: fix destroyed phylink dereference during unbind Greg Kroah-Hartman
                   ` (529 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Chevallier, David S. Miller,
	Sasha Levin

From: Maxime Chevallier <maxime.chevallier@bootlin.com>

[ Upstream commit cf9bf871280d9e0a8869d98c2602d29caf69dfa3 ]

According to Errata #23 "The per-CPU GbE interrupt is limited to Core
0", we can't use the per-cpu interrupt mechanism on the Armada 3700
familly.

This is correctly checked for RSS configuration, but the initial queue
mapping is still done by having the queues spread across all the CPUs in
the system, both in the init path and in the cpu_hotplug path.

Fixes: 2636ac3cc2b4 ("net: mvneta: Add network support for Armada 3700 SoC")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvneta.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index ceb4f27898002..c6b735b305156 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3409,7 +3409,9 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
 		return -ENOMEM;
 
 	/* Setup XPS mapping */
-	if (txq_number > 1)
+	if (pp->neta_armada3700)
+		cpu = 0;
+	else if (txq_number > 1)
 		cpu = txq->id % num_present_cpus();
 	else
 		cpu = pp->rxq_def % num_present_cpus();
@@ -4187,6 +4189,11 @@ static int mvneta_cpu_online(unsigned int cpu, struct hlist_node *node)
 						  node_online);
 	struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
 
+	/* Armada 3700's per-cpu interrupt for mvneta is broken, all interrupts
+	 * are routed to CPU 0, so we don't need all the cpu-hotplug support
+	 */
+	if (pp->neta_armada3700)
+		return 0;
 
 	spin_lock(&pp->lock);
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 135/663] net: enetc: fix destroyed phylink dereference during unbind
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 134/663] net: mvneta: Remove per-cpu queue mapping for Armada 3700 Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 136/663] tty: convert tty_ldisc_ops read() function to take a kernel pointer Greg Kroah-Hartman
                   ` (528 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit 3af409ca278d4a8d50e91f9f7c4c33b175645cf3 ]

The following call path suggests that calling unregister_netdev on an
interface that is up will first bring it down.

enetc_pf_remove
-> unregister_netdev
   -> unregister_netdevice_queue
      -> unregister_netdevice_many
         -> dev_close_many
            -> __dev_close_many
               -> enetc_close
                  -> enetc_stop
                     -> phylink_stop

However, enetc first destroys the phylink instance, then calls
unregister_netdev. This is already dissimilar to the setup (and error
path teardown path) from enetc_pf_probe, but more than that, it is buggy
because it is invalid to call phylink_stop after phylink_destroy.

So let's first unregister the netdev (and let the .ndo_stop events
consume themselves), then destroy the phylink instance, then free the
netdev.

Fixes: 71b77a7a27a3 ("enetc: Migrate to PHYLINK and PCS_LYNX")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/enetc/enetc_pf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
index 06514af0df106..796e3d6f23f09 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -1164,14 +1164,15 @@ static void enetc_pf_remove(struct pci_dev *pdev)
 	struct enetc_ndev_priv *priv;
 
 	priv = netdev_priv(si->ndev);
-	enetc_phylink_destroy(priv);
-	enetc_mdiobus_destroy(pf);
 
 	if (pf->num_vfs)
 		enetc_sriov_configure(pdev, 0);
 
 	unregister_netdev(si->ndev);
 
+	enetc_phylink_destroy(priv);
+	enetc_mdiobus_destroy(pf);
+
 	enetc_free_msix(priv);
 
 	enetc_free_si_resources(priv);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 136/663] tty: convert tty_ldisc_ops read() function to take a kernel pointer
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 135/663] net: enetc: fix destroyed phylink dereference during unbind Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 137/663] tty: implement read_iter Greg Kroah-Hartman
                   ` (527 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Al Viro,
	Linus Torvalds, Sasha Levin

From: Linus Torvalds <torvalds@linux-foundation.org>

[ Upstream commit 3b830a9c34d5897be07176ce4e6f2d75e2c8cfd7 ]

The tty line discipline .read() function was passed the final user
pointer destination as an argument, which doesn't match the 'write()'
function, and makes it very inconvenient to do a splice method for
ttys.

This is a conversion to use a kernel buffer instead.

NOTE! It does this by passing the tty line discipline ->read() function
an additional "cookie" to fill in, and an offset into the cookie data.

The line discipline can fill in the cookie data with its own private
information, and then the reader will repeat the read until either the
cookie is cleared or it runs out of data.

The only real user of this is N_HDLC, which can use this to handle big
packets, even if the kernel buffer is smaller than the whole packet.

Cc: Christoph Hellwig <hch@lst.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_ldisc.c | 34 +++++++--------
 drivers/input/serio/serport.c |  4 +-
 drivers/net/ppp/ppp_async.c   |  3 +-
 drivers/net/ppp/ppp_synctty.c |  3 +-
 drivers/tty/n_gsm.c           |  3 +-
 drivers/tty/n_hdlc.c          | 60 +++++++++++++++++--------
 drivers/tty/n_null.c          |  3 +-
 drivers/tty/n_r3964.c         | 10 ++---
 drivers/tty/n_tracerouter.c   |  4 +-
 drivers/tty/n_tracesink.c     |  4 +-
 drivers/tty/n_tty.c           | 82 +++++++++++++++--------------------
 drivers/tty/tty_io.c          | 64 +++++++++++++++++++++++++--
 include/linux/tty_ldisc.h     |  3 +-
 net/nfc/nci/uart.c            |  3 +-
 14 files changed, 178 insertions(+), 102 deletions(-)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 8be4d807d1370..637c5b8c2aa1a 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -801,7 +801,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
  * We don't provide read/write/poll interface for user space.
  */
 static ssize_t hci_uart_tty_read(struct tty_struct *tty, struct file *file,
-				 unsigned char __user *buf, size_t nr)
+				 unsigned char *buf, size_t nr,
+				 void **cookie, unsigned long offset)
 {
 	return 0;
 }
@@ -818,29 +819,28 @@ static __poll_t hci_uart_tty_poll(struct tty_struct *tty,
 	return 0;
 }
 
+static struct tty_ldisc_ops hci_uart_ldisc = {
+	.owner		= THIS_MODULE,
+	.magic		= TTY_LDISC_MAGIC,
+	.name		= "n_hci",
+	.open		= hci_uart_tty_open,
+	.close		= hci_uart_tty_close,
+	.read		= hci_uart_tty_read,
+	.write		= hci_uart_tty_write,
+	.ioctl		= hci_uart_tty_ioctl,
+	.compat_ioctl	= hci_uart_tty_ioctl,
+	.poll		= hci_uart_tty_poll,
+	.receive_buf	= hci_uart_tty_receive,
+	.write_wakeup	= hci_uart_tty_wakeup,
+};
+
 static int __init hci_uart_init(void)
 {
-	static struct tty_ldisc_ops hci_uart_ldisc;
 	int err;
 
 	BT_INFO("HCI UART driver ver %s", VERSION);
 
 	/* Register the tty discipline */
-
-	memset(&hci_uart_ldisc, 0, sizeof(hci_uart_ldisc));
-	hci_uart_ldisc.magic		= TTY_LDISC_MAGIC;
-	hci_uart_ldisc.name		= "n_hci";
-	hci_uart_ldisc.open		= hci_uart_tty_open;
-	hci_uart_ldisc.close		= hci_uart_tty_close;
-	hci_uart_ldisc.read		= hci_uart_tty_read;
-	hci_uart_ldisc.write		= hci_uart_tty_write;
-	hci_uart_ldisc.ioctl		= hci_uart_tty_ioctl;
-	hci_uart_ldisc.compat_ioctl	= hci_uart_tty_ioctl;
-	hci_uart_ldisc.poll		= hci_uart_tty_poll;
-	hci_uart_ldisc.receive_buf	= hci_uart_tty_receive;
-	hci_uart_ldisc.write_wakeup	= hci_uart_tty_wakeup;
-	hci_uart_ldisc.owner		= THIS_MODULE;
-
 	err = tty_register_ldisc(N_HCI, &hci_uart_ldisc);
 	if (err) {
 		BT_ERR("HCI line discipline registration failed. (%d)", err);
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 8ac970a423de6..33e9d9bfd036f 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -156,7 +156,9 @@ out:
  * returning 0 characters.
  */
 
-static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, unsigned char __user * buf, size_t nr)
+static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file,
+				  unsigned char *kbuf, size_t nr,
+				  void **cookie, unsigned long offset)
 {
 	struct serport *serport = (struct serport*) tty->disc_data;
 	struct serio *serio;
diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index 29a0917a81e60..f14a9d190de91 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -259,7 +259,8 @@ static int ppp_asynctty_hangup(struct tty_struct *tty)
  */
 static ssize_t
 ppp_asynctty_read(struct tty_struct *tty, struct file *file,
-		  unsigned char __user *buf, size_t count)
+		  unsigned char *buf, size_t count,
+		  void **cookie, unsigned long offset)
 {
 	return -EAGAIN;
 }
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index 0f338752c38b9..f774b7e52da44 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -257,7 +257,8 @@ static int ppp_sync_hangup(struct tty_struct *tty)
  */
 static ssize_t
 ppp_sync_read(struct tty_struct *tty, struct file *file,
-	       unsigned char __user *buf, size_t count)
+	      unsigned char *buf, size_t count,
+	      void **cookie, unsigned long offset)
 {
 	return -EAGAIN;
 }
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 25f3152089c2a..fea1eeac5b907 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2557,7 +2557,8 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
  */
 
 static ssize_t gsmld_read(struct tty_struct *tty, struct file *file,
-			 unsigned char __user *buf, size_t nr)
+			  unsigned char *buf, size_t nr,
+			  void **cookie, unsigned long offset)
 {
 	return -EOPNOTSUPP;
 }
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 12557ee1edb68..1363e659dc1db 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -416,13 +416,19 @@ static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *data,
  * Returns the number of bytes returned or error code.
  */
 static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
-			   __u8 __user *buf, size_t nr)
+			   __u8 *kbuf, size_t nr,
+			   void **cookie, unsigned long offset)
 {
 	struct n_hdlc *n_hdlc = tty->disc_data;
 	int ret = 0;
 	struct n_hdlc_buf *rbuf;
 	DECLARE_WAITQUEUE(wait, current);
 
+	/* Is this a repeated call for an rbuf we already found earlier? */
+	rbuf = *cookie;
+	if (rbuf)
+		goto have_rbuf;
+
 	add_wait_queue(&tty->read_wait, &wait);
 
 	for (;;) {
@@ -436,25 +442,8 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
 		set_current_state(TASK_INTERRUPTIBLE);
 
 		rbuf = n_hdlc_buf_get(&n_hdlc->rx_buf_list);
-		if (rbuf) {
-			if (rbuf->count > nr) {
-				/* too large for caller's buffer */
-				ret = -EOVERFLOW;
-			} else {
-				__set_current_state(TASK_RUNNING);
-				if (copy_to_user(buf, rbuf->buf, rbuf->count))
-					ret = -EFAULT;
-				else
-					ret = rbuf->count;
-			}
-
-			if (n_hdlc->rx_free_buf_list.count >
-			    DEFAULT_RX_BUF_COUNT)
-				kfree(rbuf);
-			else
-				n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
+		if (rbuf)
 			break;
-		}
 
 		/* no data */
 		if (tty_io_nonblock(tty, file)) {
@@ -473,6 +462,39 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
 	remove_wait_queue(&tty->read_wait, &wait);
 	__set_current_state(TASK_RUNNING);
 
+	if (!rbuf)
+		return ret;
+	*cookie = rbuf;
+
+have_rbuf:
+	/* Have we used it up entirely? */
+	if (offset >= rbuf->count)
+		goto done_with_rbuf;
+
+	/* More data to go, but can't copy any more? EOVERFLOW */
+	ret = -EOVERFLOW;
+	if (!nr)
+		goto done_with_rbuf;
+
+	/* Copy as much data as possible */
+	ret = rbuf->count - offset;
+	if (ret > nr)
+		ret = nr;
+	memcpy(kbuf, rbuf->buf+offset, ret);
+	offset += ret;
+
+	/* If we still have data left, we leave the rbuf in the cookie */
+	if (offset < rbuf->count)
+		return ret;
+
+done_with_rbuf:
+	*cookie = NULL;
+
+	if (n_hdlc->rx_free_buf_list.count > DEFAULT_RX_BUF_COUNT)
+		kfree(rbuf);
+	else
+		n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
+
 	return ret;
 
 }	/* end of n_hdlc_tty_read() */
diff --git a/drivers/tty/n_null.c b/drivers/tty/n_null.c
index 96feabae47407..ce03ae78f5c6a 100644
--- a/drivers/tty/n_null.c
+++ b/drivers/tty/n_null.c
@@ -20,7 +20,8 @@ static void n_null_close(struct tty_struct *tty)
 }
 
 static ssize_t n_null_read(struct tty_struct *tty, struct file *file,
-			   unsigned char __user * buf, size_t nr)
+			   unsigned char *buf, size_t nr,
+			   void **cookie, unsigned long offset)
 {
 	return -EOPNOTSUPP;
 }
diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
index 934dd2fb2ec80..3161f0a535e37 100644
--- a/drivers/tty/n_r3964.c
+++ b/drivers/tty/n_r3964.c
@@ -129,7 +129,7 @@ static void remove_client_block(struct r3964_info *pInfo,
 static int r3964_open(struct tty_struct *tty);
 static void r3964_close(struct tty_struct *tty);
 static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
-		unsigned char __user * buf, size_t nr);
+		void *cookie, unsigned char *buf, size_t nr);
 static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
 		const unsigned char *buf, size_t nr);
 static int r3964_ioctl(struct tty_struct *tty, struct file *file,
@@ -1058,7 +1058,8 @@ static void r3964_close(struct tty_struct *tty)
 }
 
 static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
-			  unsigned char __user * buf, size_t nr)
+			  unsigned char *kbuf, size_t nr,
+			  void **cookie, unsigned long offset)
 {
 	struct r3964_info *pInfo = tty->disc_data;
 	struct r3964_client_info *pClient;
@@ -1109,10 +1110,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
 		kfree(pMsg);
 		TRACE_M("r3964_read - msg kfree %p", pMsg);
 
-		if (copy_to_user(buf, &theMsg, ret)) {
-			ret = -EFAULT;
-			goto unlock;
-		}
+		memcpy(kbuf, &theMsg, ret);
 
 		TRACE_PS("read - return %d", ret);
 		goto unlock;
diff --git a/drivers/tty/n_tracerouter.c b/drivers/tty/n_tracerouter.c
index 4479af4d2fa5c..3490ed51b1a3c 100644
--- a/drivers/tty/n_tracerouter.c
+++ b/drivers/tty/n_tracerouter.c
@@ -118,7 +118,9 @@ static void n_tracerouter_close(struct tty_struct *tty)
  *	 -EINVAL
  */
 static ssize_t n_tracerouter_read(struct tty_struct *tty, struct file *file,
-				  unsigned char __user *buf, size_t nr) {
+				  unsigned char *buf, size_t nr,
+				  void **cookie, unsigned long offset)
+{
 	return -EINVAL;
 }
 
diff --git a/drivers/tty/n_tracesink.c b/drivers/tty/n_tracesink.c
index d96ba82cc3569..1d9931041fd8b 100644
--- a/drivers/tty/n_tracesink.c
+++ b/drivers/tty/n_tracesink.c
@@ -115,7 +115,9 @@ static void n_tracesink_close(struct tty_struct *tty)
  *	 -EINVAL
  */
 static ssize_t n_tracesink_read(struct tty_struct *tty, struct file *file,
-				unsigned char __user *buf, size_t nr) {
+				unsigned char *buf, size_t nr,
+				void **cookie, unsigned long offset)
+{
 	return -EINVAL;
 }
 
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c2869489ba681..e8963165082ee 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -164,29 +164,24 @@ static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
 		memset(buffer, 0x00, size);
 }
 
-static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
-			    size_t tail, size_t n)
+static void tty_copy(struct tty_struct *tty, void *to, size_t tail, size_t n)
 {
 	struct n_tty_data *ldata = tty->disc_data;
 	size_t size = N_TTY_BUF_SIZE - tail;
 	void *from = read_buf_addr(ldata, tail);
-	int uncopied;
 
 	if (n > size) {
 		tty_audit_add_data(tty, from, size);
-		uncopied = copy_to_user(to, from, size);
-		zero_buffer(tty, from, size - uncopied);
-		if (uncopied)
-			return uncopied;
+		memcpy(to, from, size);
+		zero_buffer(tty, from, size);
 		to += size;
 		n -= size;
 		from = ldata->read_buf;
 	}
 
 	tty_audit_add_data(tty, from, n);
-	uncopied = copy_to_user(to, from, n);
-	zero_buffer(tty, from, n - uncopied);
-	return uncopied;
+	memcpy(to, from, n);
+	zero_buffer(tty, from, n);
 }
 
 /**
@@ -1942,15 +1937,16 @@ static inline int input_available_p(struct tty_struct *tty, int poll)
 /**
  *	copy_from_read_buf	-	copy read data directly
  *	@tty: terminal device
- *	@b: user data
+ *	@kbp: data
  *	@nr: size of data
  *
  *	Helper function to speed up n_tty_read.  It is only called when
- *	ICANON is off; it copies characters straight from the tty queue to
- *	user space directly.  It can be profitably called twice; once to
- *	drain the space from the tail pointer to the (physical) end of the
- *	buffer, and once to drain the space from the (physical) beginning of
- *	the buffer to head pointer.
+ *	ICANON is off; it copies characters straight from the tty queue.
+ *
+ *	It can be profitably called twice; once to drain the space from
+ *	the tail pointer to the (physical) end of the buffer, and once
+ *	to drain the space from the (physical) beginning of the buffer
+ *	to head pointer.
  *
  *	Called under the ldata->atomic_read_lock sem
  *
@@ -1960,7 +1956,7 @@ static inline int input_available_p(struct tty_struct *tty, int poll)
  */
 
 static int copy_from_read_buf(struct tty_struct *tty,
-				      unsigned char __user **b,
+				      unsigned char **kbp,
 				      size_t *nr)
 
 {
@@ -1976,8 +1972,7 @@ static int copy_from_read_buf(struct tty_struct *tty,
 	n = min(*nr, n);
 	if (n) {
 		unsigned char *from = read_buf_addr(ldata, tail);
-		retval = copy_to_user(*b, from, n);
-		n -= retval;
+		memcpy(*kbp, from, n);
 		is_eof = n == 1 && *from == EOF_CHAR(tty);
 		tty_audit_add_data(tty, from, n);
 		zero_buffer(tty, from, n);
@@ -1986,7 +1981,7 @@ static int copy_from_read_buf(struct tty_struct *tty,
 		if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
 		    (head == ldata->read_tail))
 			n = 0;
-		*b += n;
+		*kbp += n;
 		*nr -= n;
 	}
 	return retval;
@@ -1995,12 +1990,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
 /**
  *	canon_copy_from_read_buf	-	copy read data in canonical mode
  *	@tty: terminal device
- *	@b: user data
+ *	@kbp: data
  *	@nr: size of data
  *
  *	Helper function for n_tty_read.  It is only called when ICANON is on;
  *	it copies one line of input up to and including the line-delimiting
- *	character into the user-space buffer.
+ *	character into the result buffer.
  *
  *	NB: When termios is changed from non-canonical to canonical mode and
  *	the read buffer contains data, n_tty_set_termios() simulates an EOF
@@ -2016,14 +2011,14 @@ static int copy_from_read_buf(struct tty_struct *tty,
  */
 
 static int canon_copy_from_read_buf(struct tty_struct *tty,
-				    unsigned char __user **b,
+				    unsigned char **kbp,
 				    size_t *nr)
 {
 	struct n_tty_data *ldata = tty->disc_data;
 	size_t n, size, more, c;
 	size_t eol;
 	size_t tail;
-	int ret, found = 0;
+	int found = 0;
 
 	/* N.B. avoid overrun if nr == 0 */
 	if (!*nr)
@@ -2059,10 +2054,8 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
 	n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu tail:%zu more:%zu\n",
 		    __func__, eol, found, n, c, tail, more);
 
-	ret = tty_copy_to_user(tty, *b, tail, n);
-	if (ret)
-		return -EFAULT;
-	*b += n;
+	tty_copy(tty, *kbp, tail, n);
+	*kbp += n;
 	*nr -= n;
 
 	if (found)
@@ -2127,10 +2120,11 @@ static int job_control(struct tty_struct *tty, struct file *file)
  */
 
 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
-			 unsigned char __user *buf, size_t nr)
+			  unsigned char *kbuf, size_t nr,
+			  void **cookie, unsigned long offset)
 {
 	struct n_tty_data *ldata = tty->disc_data;
-	unsigned char __user *b = buf;
+	unsigned char *kb = kbuf;
 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	int c;
 	int minimum, time;
@@ -2176,17 +2170,13 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 		/* First test for status change. */
 		if (packet && tty->link->ctrl_status) {
 			unsigned char cs;
-			if (b != buf)
+			if (kb != kbuf)
 				break;
 			spin_lock_irq(&tty->link->ctrl_lock);
 			cs = tty->link->ctrl_status;
 			tty->link->ctrl_status = 0;
 			spin_unlock_irq(&tty->link->ctrl_lock);
-			if (put_user(cs, b)) {
-				retval = -EFAULT;
-				break;
-			}
-			b++;
+			*kb++ = cs;
 			nr--;
 			break;
 		}
@@ -2229,24 +2219,20 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 		}
 
 		if (ldata->icanon && !L_EXTPROC(tty)) {
-			retval = canon_copy_from_read_buf(tty, &b, &nr);
+			retval = canon_copy_from_read_buf(tty, &kb, &nr);
 			if (retval)
 				break;
 		} else {
 			int uncopied;
 
 			/* Deal with packet mode. */
-			if (packet && b == buf) {
-				if (put_user(TIOCPKT_DATA, b)) {
-					retval = -EFAULT;
-					break;
-				}
-				b++;
+			if (packet && kb == kbuf) {
+				*kb++ = TIOCPKT_DATA;
 				nr--;
 			}
 
-			uncopied = copy_from_read_buf(tty, &b, &nr);
-			uncopied += copy_from_read_buf(tty, &b, &nr);
+			uncopied = copy_from_read_buf(tty, &kb, &nr);
+			uncopied += copy_from_read_buf(tty, &kb, &nr);
 			if (uncopied) {
 				retval = -EFAULT;
 				break;
@@ -2255,7 +2241,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
 		n_tty_check_unthrottle(tty);
 
-		if (b - buf >= minimum)
+		if (kb - kbuf >= minimum)
 			break;
 		if (time)
 			timeout = time;
@@ -2267,8 +2253,8 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 	remove_wait_queue(&tty->read_wait, &wait);
 	mutex_unlock(&ldata->atomic_read_lock);
 
-	if (b - buf)
-		retval = b - buf;
+	if (kb - kbuf)
+		retval = kb - kbuf;
 
 	return retval;
 }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 21cd5ac6ca8b5..a50c8a4318228 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -830,6 +830,65 @@ static void tty_update_time(struct timespec64 *time)
 		time->tv_sec = sec;
 }
 
+/*
+ * Iterate on the ldisc ->read() function until we've gotten all
+ * the data the ldisc has for us.
+ *
+ * The "cookie" is something that the ldisc read function can fill
+ * in to let us know that there is more data to be had.
+ *
+ * We promise to continue to call the ldisc until it stops returning
+ * data or clears the cookie. The cookie may be something that the
+ * ldisc maintains state for and needs to free.
+ */
+static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct file *file,
+		char __user *buf, size_t count)
+{
+	int retval = 0;
+	void *cookie = NULL;
+	unsigned long offset = 0;
+	char kernel_buf[64];
+
+	do {
+		int size, uncopied;
+
+		size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
+		size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
+		if (!size)
+			break;
+
+		/*
+		 * A ldisc read error return will override any previously copied
+		 * data (eg -EOVERFLOW from HDLC)
+		 */
+		if (size < 0) {
+			memzero_explicit(kernel_buf, sizeof(kernel_buf));
+			return size;
+		}
+
+		uncopied = copy_to_user(buf+offset, kernel_buf, size);
+		size -= uncopied;
+		offset += size;
+		count -= size;
+
+		/*
+		 * If the user copy failed, we still need to do another ->read()
+		 * call if we had a cookie to let the ldisc clear up.
+		 *
+		 * But make sure size is zeroed.
+		 */
+		if (unlikely(uncopied)) {
+			count = 0;
+			retval = -EFAULT;
+		}
+	} while (cookie);
+
+	/* We always clear tty buffer in case they contained passwords */
+	memzero_explicit(kernel_buf, sizeof(kernel_buf));
+	return offset ? offset : retval;
+}
+
+
 /**
  *	tty_read	-	read method for tty device files
  *	@file: pointer to tty file
@@ -863,10 +922,9 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
 	ld = tty_ldisc_ref_wait(tty);
 	if (!ld)
 		return hung_up_tty_read(file, buf, count, ppos);
+	i = -EIO;
 	if (ld->ops->read)
-		i = ld->ops->read(tty, file, buf, count);
-	else
-		i = -EIO;
+		i = iterate_tty_read(ld, tty, file, buf, count);
 	tty_ldisc_deref(ld);
 
 	if (i > 0)
diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
index b1e6043e99175..572a079761165 100644
--- a/include/linux/tty_ldisc.h
+++ b/include/linux/tty_ldisc.h
@@ -185,7 +185,8 @@ struct tty_ldisc_ops {
 	void	(*close)(struct tty_struct *);
 	void	(*flush_buffer)(struct tty_struct *tty);
 	ssize_t	(*read)(struct tty_struct *tty, struct file *file,
-			unsigned char __user *buf, size_t nr);
+			unsigned char *buf, size_t nr,
+			void **cookie, unsigned long offset);
 	ssize_t	(*write)(struct tty_struct *tty, struct file *file,
 			 const unsigned char *buf, size_t nr);
 	int	(*ioctl)(struct tty_struct *tty, struct file *file,
diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c
index 11b554ce07ffc..1204c438e87dc 100644
--- a/net/nfc/nci/uart.c
+++ b/net/nfc/nci/uart.c
@@ -292,7 +292,8 @@ static int nci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
 
 /* We don't provide read/write/poll interface for user space. */
 static ssize_t nci_uart_tty_read(struct tty_struct *tty, struct file *file,
-				 unsigned char __user *buf, size_t nr)
+				 unsigned char *buf, size_t nr,
+				 void **cookie, unsigned long offset)
 {
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 137/663] tty: implement read_iter
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 136/663] tty: convert tty_ldisc_ops read() function to take a kernel pointer Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06   ` Greg Kroah-Hartman
                   ` (526 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oliver Giles, Christoph Hellwig,
	Al Viro, Linus Torvalds, Sasha Levin

From: Linus Torvalds <torvalds@linux-foundation.org>

[ Upstream commit dd78b0c483e33225e0e0782b0ed887129b00f956 ]

Now that the ldisc read() function takes kernel pointers, it's fairly
straightforward to make the tty file operations use .read_iter() instead
of .read().

That automatically gives us vread() and friends, and also makes it
possible to do .splice_read() on ttys again.

Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops")
Reported-by: Oliver Giles <ohw.giles@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/tty_io.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index a50c8a4318228..3f55fe7293f31 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -142,7 +142,7 @@ LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
 /* Mutex to protect creating and releasing a tty */
 DEFINE_MUTEX(tty_mutex);
 
-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
+static ssize_t tty_read(struct kiocb *, struct iov_iter *);
 static ssize_t tty_write(struct kiocb *, struct iov_iter *);
 static __poll_t tty_poll(struct file *, poll_table *);
 static int tty_open(struct inode *, struct file *);
@@ -473,8 +473,9 @@ static void tty_show_fdinfo(struct seq_file *m, struct file *file)
 
 static const struct file_operations tty_fops = {
 	.llseek		= no_llseek,
-	.read		= tty_read,
+	.read_iter	= tty_read,
 	.write_iter	= tty_write,
+	.splice_read	= generic_file_splice_read,
 	.splice_write	= iter_file_splice_write,
 	.poll		= tty_poll,
 	.unlocked_ioctl	= tty_ioctl,
@@ -487,8 +488,9 @@ static const struct file_operations tty_fops = {
 
 static const struct file_operations console_fops = {
 	.llseek		= no_llseek,
-	.read		= tty_read,
+	.read_iter	= tty_read,
 	.write_iter	= redirected_tty_write,
+	.splice_read	= generic_file_splice_read,
 	.splice_write	= iter_file_splice_write,
 	.poll		= tty_poll,
 	.unlocked_ioctl	= tty_ioctl,
@@ -841,16 +843,17 @@ static void tty_update_time(struct timespec64 *time)
  * data or clears the cookie. The cookie may be something that the
  * ldisc maintains state for and needs to free.
  */
-static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct file *file,
-		char __user *buf, size_t count)
+static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
+		struct file *file, struct iov_iter *to)
 {
 	int retval = 0;
 	void *cookie = NULL;
 	unsigned long offset = 0;
 	char kernel_buf[64];
+	size_t count = iov_iter_count(to);
 
 	do {
-		int size, uncopied;
+		int size, copied;
 
 		size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
 		size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
@@ -866,10 +869,9 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
 			return size;
 		}
 
-		uncopied = copy_to_user(buf+offset, kernel_buf, size);
-		size -= uncopied;
-		offset += size;
-		count -= size;
+		copied = copy_to_iter(kernel_buf, size, to);
+		offset += copied;
+		count -= copied;
 
 		/*
 		 * If the user copy failed, we still need to do another ->read()
@@ -877,7 +879,7 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
 		 *
 		 * But make sure size is zeroed.
 		 */
-		if (unlikely(uncopied)) {
+		if (unlikely(copied != size)) {
 			count = 0;
 			retval = -EFAULT;
 		}
@@ -904,10 +906,10 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
  *	read calls may be outstanding in parallel.
  */
 
-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
-			loff_t *ppos)
+static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
 {
 	int i;
+	struct file *file = iocb->ki_filp;
 	struct inode *inode = file_inode(file);
 	struct tty_struct *tty = file_tty(file);
 	struct tty_ldisc *ld;
@@ -920,11 +922,9 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
 	/* We want to wait for the line discipline to sort out in this
 	   situation */
 	ld = tty_ldisc_ref_wait(tty);
-	if (!ld)
-		return hung_up_tty_read(file, buf, count, ppos);
 	i = -EIO;
-	if (ld->ops->read)
-		i = iterate_tty_read(ld, tty, file, buf, count);
+	if (ld && ld->ops->read)
+		i = iterate_tty_read(ld, tty, file, to);
 	tty_ldisc_deref(ld);
 
 	if (i > 0)
@@ -2943,7 +2943,7 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
 
 static int this_tty(const void *t, struct file *file, unsigned fd)
 {
-	if (likely(file->f_op->read != tty_read))
+	if (likely(file->f_op->read_iter != tty_read))
 		return 0;
 	return file_tty(file) != t ? 0 : fd + 1;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 138/663] fbdev: aty: SPARC64 requires FB_ATY_CT
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 001/663] vmlinux.lds.h: add DWARF v5 sections Greg Kroah-Hartman
@ 2021-03-01 16:06   ` Greg Kroah-Hartman
  2021-03-01 16:04 ` [PATCH 5.10 003/663] debugfs: be more robust at handling improper input in debugfs_lookup() Greg Kroah-Hartman
                     ` (661 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Randy Dunlap,
	David S. Miller, sparclinux, Tomi Valkeinen, dri-devel,
	linux-fbdev, Daniel Vetter, David Airlie,
	Bartlomiej Zolnierkiewicz, Geert Uytterhoeven, Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]

It looks like SPARC64 requires FB_ATY_CT to build without errors,
so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
instead of using "default y if SPARC64 && PCI", which is not strong
enough to prevent build errors.

As it currently is, FB_ATY_CT can be disabled, resulting in build
errors:

ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index cfb7f5612ef0f..4f02db65dedec 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1269,6 +1269,7 @@ config FB_ATY
 	select FB_CFB_IMAGEBLIT
 	select FB_BACKLIGHT if FB_ATY_BACKLIGHT
 	select FB_MACMODES if PPC
+	select FB_ATY_CT if SPARC64 && PCI
 	help
 	  This driver supports graphics boards with the ATI Mach64 chips.
 	  Say Y if you have such a graphics board.
@@ -1279,7 +1280,6 @@ config FB_ATY
 config FB_ATY_CT
 	bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
 	depends on PCI && FB_ATY
-	default y if SPARC64 && PCI
 	help
 	  Say Y here to support use of ATI's 64-bit Rage boards (or other
 	  boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 138/663] fbdev: aty: SPARC64 requires FB_ATY_CT
@ 2021-03-01 16:06   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Sasha Levin, linux-fbdev, Geert Uytterhoeven,
	Bartlomiej Zolnierkiewicz, David Airlie, Greg Kroah-Hartman,
	Randy Dunlap, stable, Tomi Valkeinen, Geert Uytterhoeven,
	dri-devel, Daniel Vetter, sparclinux, David S. Miller

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]

It looks like SPARC64 requires FB_ATY_CT to build without errors,
so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
instead of using "default y if SPARC64 && PCI", which is not strong
enough to prevent build errors.

As it currently is, FB_ATY_CT can be disabled, resulting in build
errors:

ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index cfb7f5612ef0f..4f02db65dedec 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1269,6 +1269,7 @@ config FB_ATY
 	select FB_CFB_IMAGEBLIT
 	select FB_BACKLIGHT if FB_ATY_BACKLIGHT
 	select FB_MACMODES if PPC
+	select FB_ATY_CT if SPARC64 && PCI
 	help
 	  This driver supports graphics boards with the ATI Mach64 chips.
 	  Say Y if you have such a graphics board.
@@ -1279,7 +1280,6 @@ config FB_ATY
 config FB_ATY_CT
 	bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
 	depends on PCI && FB_ATY
-	default y if SPARC64 && PCI
 	help
 	  Say Y here to support use of ATI's 64-bit Rage boards (or other
 	  boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
-- 
2.27.0

^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 138/663] fbdev: aty: SPARC64 requires FB_ATY_CT
@ 2021-03-01 16:06   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Sasha Levin, linux-fbdev, Geert Uytterhoeven,
	Bartlomiej Zolnierkiewicz, David Airlie, Greg Kroah-Hartman,
	Randy Dunlap, stable, Tomi Valkeinen, Geert Uytterhoeven,
	dri-devel, Daniel Vetter, sparclinux, David S. Miller

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]

It looks like SPARC64 requires FB_ATY_CT to build without errors,
so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
instead of using "default y if SPARC64 && PCI", which is not strong
enough to prevent build errors.

As it currently is, FB_ATY_CT can be disabled, resulting in build
errors:

ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index cfb7f5612ef0f..4f02db65dedec 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1269,6 +1269,7 @@ config FB_ATY
 	select FB_CFB_IMAGEBLIT
 	select FB_BACKLIGHT if FB_ATY_BACKLIGHT
 	select FB_MACMODES if PPC
+	select FB_ATY_CT if SPARC64 && PCI
 	help
 	  This driver supports graphics boards with the ATI Mach64 chips.
 	  Say Y if you have such a graphics board.
@@ -1279,7 +1280,6 @@ config FB_ATY
 config FB_ATY_CT
 	bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
 	depends on PCI && FB_ATY
-	default y if SPARC64 && PCI
 	help
 	  Say Y here to support use of ATI's 64-bit Rage boards (or other
 	  boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
-- 
2.27.0



_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 139/663] drm/gma500: Fix error return code in psb_driver_load()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2021-03-01 16:06   ` Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 140/663] gma500: clean up error handling in init Greg Kroah-Hartman
                   ` (524 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Jialin Zhang,
	Daniel Vetter, Sasha Levin

From: Jialin Zhang <zhangjialin11@huawei.com>

[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/psb_drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 34b4aae9a15e3..074f403d7ca07 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -313,6 +313,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
 	if (ret)
 		goto out_err;
 
+	ret = -ENOMEM;
+
 	dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
 	if (!dev_priv->mmu)
 		goto out_err;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 140/663] gma500: clean up error handling in init
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 139/663] drm/gma500: Fix error return code in psb_driver_load() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 141/663] drm/fb-helper: Add missed unlocks in setcmap_legacy() Greg Kroah-Hartman
                   ` (523 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Patrik Jakobsson, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ]

The main problem with this error handling was that it didn't clean up if
i2c_add_numbered_adapter() failed.  This code is pretty old, and doesn't
match with today's checkpatch.pl standards so I took the opportunity to
tidy it up a bit.  I changed the NULL comparison, and removed the
WARNING message if kzalloc() fails and updated the label names.

Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
index e281070611480..fc9a34ed58bd1 100644
--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
 	hdmi_dev = pci_get_drvdata(dev);
 
 	i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
-	if (i2c_dev == NULL) {
-		DRM_ERROR("Can't allocate interface\n");
-		ret = -ENOMEM;
-		goto exit;
-	}
+	if (!i2c_dev)
+		return -ENOMEM;
 
 	i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
 	i2c_dev->status = I2C_STAT_INIT;
@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
 			  oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
 	if (ret) {
 		DRM_ERROR("Failed to request IRQ for I2C controller\n");
-		goto err;
+		goto free_dev;
 	}
 
 	/* Adapter registration */
 	ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
-	return ret;
+	if (ret) {
+		DRM_ERROR("Failed to add I2C adapter\n");
+		goto free_irq;
+	}
 
-err:
+	return 0;
+
+free_irq:
+	free_irq(dev->irq, hdmi_dev);
+free_dev:
 	kfree(i2c_dev);
-exit:
+
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 141/663] drm/fb-helper: Add missed unlocks in setcmap_legacy()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 140/663] gma500: clean up error handling in init Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 142/663] drm/panel: mantix: Tweak init sequence Greg Kroah-Hartman
                   ` (522 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Daniel Vetter, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 0a260e731d6c4c17547ac275a2cde888a9eb4a3d ]

setcmap_legacy() does not call drm_modeset_unlock_all() in some exits,
add the missed unlocks with goto to fix it.

Fixes: 964c60063bff ("drm/fb-helper: separate the fb_setcmap helper into atomic and legacy paths")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201203144248.418281-1-hslester96@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_fb_helper.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 1543d9d109705..8033467db4bee 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -923,11 +923,15 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
 	drm_modeset_lock_all(fb_helper->dev);
 	drm_client_for_each_modeset(modeset, &fb_helper->client) {
 		crtc = modeset->crtc;
-		if (!crtc->funcs->gamma_set || !crtc->gamma_size)
-			return -EINVAL;
+		if (!crtc->funcs->gamma_set || !crtc->gamma_size) {
+			ret = -EINVAL;
+			goto out;
+		}
 
-		if (cmap->start + cmap->len > crtc->gamma_size)
-			return -EINVAL;
+		if (cmap->start + cmap->len > crtc->gamma_size) {
+			ret = -EINVAL;
+			goto out;
+		}
 
 		r = crtc->gamma_store;
 		g = r + crtc->gamma_size;
@@ -940,8 +944,9 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
 		ret = crtc->funcs->gamma_set(crtc, r, g, b,
 					     crtc->gamma_size, NULL);
 		if (ret)
-			return ret;
+			goto out;
 	}
+out:
 	drm_modeset_unlock_all(fb_helper->dev);
 
 	return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 142/663] drm/panel: mantix: Tweak init sequence
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 141/663] drm/fb-helper: Add missed unlocks in setcmap_legacy() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 143/663] drm/vc4: hdmi: Take into account the clock doubling flag in atomic_check Greg Kroah-Hartman
                   ` (521 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guido Günther, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Guido Günther <agx@sigxcpu.org>

[ Upstream commit dd396dbc4d7811c1567cc43faa4b9ad68094c44d ]

We've seen some (non permanent) burn in and bad white balance
on some of the panels. Adding this bit from a vendor supplied
sequence fixes it.

Fixes: 72967d5616d3 ("drm/panel: Add panel driver for the Mantix MLAF057WE51-X DSI panel")
Signed-off-by: Guido Günther <agx@sigxcpu.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/8451831b60d5ecb73a156613d98218a31bd55680.1605688147.git.agx@sigxcpu.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c b/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
index 0c5f22e95c2db..624d17b96a693 100644
--- a/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
+++ b/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
@@ -22,6 +22,7 @@
 /* Manufacturer specific Commands send via DSI */
 #define MANTIX_CMD_OTP_STOP_RELOAD_MIPI 0x41
 #define MANTIX_CMD_INT_CANCEL           0x4C
+#define MANTIX_CMD_SPI_FINISH           0x90
 
 struct mantix {
 	struct device *dev;
@@ -66,6 +67,10 @@ static int mantix_init_sequence(struct mantix *ctx)
 	dsi_generic_write_seq(dsi, 0x80, 0x64, 0x00, 0x64, 0x00, 0x00);
 	msleep(20);
 
+	dsi_generic_write_seq(dsi, MANTIX_CMD_SPI_FINISH, 0xA5);
+	dsi_generic_write_seq(dsi, MANTIX_CMD_OTP_STOP_RELOAD_MIPI, 0x00, 0x2F);
+	msleep(20);
+
 	dev_dbg(dev, "Panel init sequence done\n");
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 143/663] drm/vc4: hdmi: Take into account the clock doubling flag in atomic_check
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 142/663] drm/panel: mantix: Tweak init sequence Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 144/663] crypto: sun4i-ss - linearize buffers content must be kept Greg Kroah-Hartman
                   ` (520 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Dave Stevenson,
	Maxime Ripard, Sasha Levin

From: Maxime Ripard <maxime@cerno.tech>

[ Upstream commit 320e84dc6111ecc1c957e2b186d4d2bafee6bde2 ]

Commit 63495f6b4aed ("drm/vc4: hdmi: Make sure our clock rate is within
limits") was intended to compute the pixel rate to make sure we remain
within the boundaries of what the hardware can provide.

However, unlike what mode_valid was checking for, we forgot to take
into account the clock doubling flag that can be set for modes. Let's
honor that flag if it's there.

Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Fixes: 63495f6b4aed ("drm/vc4: hdmi: Make sure our clock rate is within limits")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20201215154243.540115-4-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index eaba98e15de46..db06f52de9d91 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -791,6 +791,9 @@ static int vc4_hdmi_encoder_atomic_check(struct drm_encoder *encoder,
 		pixel_rate = mode->clock * 1000;
 	}
 
+	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+		pixel_rate = pixel_rate * 2;
+
 	if (pixel_rate > vc4_hdmi->variant->max_pixel_clock)
 		return -EINVAL;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 144/663] crypto: sun4i-ss - linearize buffers content must be kept
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 143/663] drm/vc4: hdmi: Take into account the clock doubling flag in atomic_check Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 145/663] crypto: sun4i-ss - fix kmap usage Greg Kroah-Hartman
                   ` (519 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 583513510a7acd2306787865bcd19ebb2f629d42 ]

When running the non-optimized cipher function, SS produce partial random
output.
This is due to linearize buffers being reseted after each loop.

For preserving stack, instead of moving them back to start of function,
I move them in sun4i_ss_ctx.

Fixes: 8d3bcb9900ca ("crypto: sun4i-ss - reduce stack usage")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 12 ++++--------
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h        |  2 ++
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
index b72de8939497b..19f1aa577ed4d 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
@@ -233,8 +233,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 
 	while (oleft) {
 		if (ileft) {
-			char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
-
 			/*
 			 * todo is the number of consecutive 4byte word that we
 			 * can read from current SG
@@ -256,12 +254,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 				 */
 				todo = min(rx_cnt * 4 - ob, ileft);
 				todo = min_t(size_t, todo, mi.length - oi);
-				memcpy(buf + ob, mi.addr + oi, todo);
+				memcpy(ss->buf + ob, mi.addr + oi, todo);
 				ileft -= todo;
 				oi += todo;
 				ob += todo;
 				if (!(ob % 4)) {
-					writesl(ss->base + SS_RXFIFO, buf,
+					writesl(ss->base + SS_RXFIFO, ss->buf,
 						ob / 4);
 					ob = 0;
 				}
@@ -295,13 +293,11 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 				oo = 0;
 			}
 		} else {
-			char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
-
 			/*
 			 * read obl bytes in bufo, we read at maximum for
 			 * emptying the device
 			 */
-			readsl(ss->base + SS_TXFIFO, bufo, tx_cnt);
+			readsl(ss->base + SS_TXFIFO, ss->bufo, tx_cnt);
 			obl = tx_cnt * 4;
 			obo = 0;
 			do {
@@ -313,7 +309,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 				 */
 				todo = min_t(size_t,
 					     mo.length - oo, obl - obo);
-				memcpy(mo.addr + oo, bufo + obo, todo);
+				memcpy(mo.addr + oo, ss->bufo + obo, todo);
 				oleft -= todo;
 				obo += todo;
 				oo += todo;
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
index 163962f9e2845..02105b39fbfec 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
@@ -148,6 +148,8 @@ struct sun4i_ss_ctx {
 	struct reset_control *reset;
 	struct device *dev;
 	struct resource *res;
+	char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
+	char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
 	spinlock_t slock; /* control the use of the device */
 #ifdef CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG
 	u32 seed[SS_SEED_LEN / BITS_PER_LONG];
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 145/663] crypto: sun4i-ss - fix kmap usage
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 144/663] crypto: sun4i-ss - linearize buffers content must be kept Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 146/663] crypto: arm64/aes-ce - really hide slower algos when faster ones are enabled Greg Kroah-Hartman
                   ` (518 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 9bc3dd24e7dccd50757db743a3635ad5b0497e6e ]

With the recent kmap change, some tests which were conditional on
CONFIG_DEBUG_HIGHMEM now are enabled by default.
This permit to detect a problem in sun4i-ss usage of kmap.

sun4i-ss uses two kmap via sg_miter (one for input, one for output), but
using two kmap at the same time is hard:
"the ordering has to be correct and with sg_miter that's probably hard to get
right." (quoting Tlgx)

So the easiest solution is to never have two sg_miter/kmap open at the same time.
After each use of sg_miter, I store the current index, for being able to
resume sg_miter to the right place.

Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../allwinner/sun4i-ss/sun4i-ss-cipher.c      | 109 +++++++++++-------
 1 file changed, 65 insertions(+), 44 deletions(-)

diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
index 19f1aa577ed4d..1f8a38d131928 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
@@ -30,6 +30,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
 	unsigned int ileft = areq->cryptlen;
 	unsigned int oleft = areq->cryptlen;
 	unsigned int todo;
+	unsigned long pi = 0, po = 0; /* progress for in and out */
+	bool miter_err;
 	struct sg_mapping_iter mi, mo;
 	unsigned int oi, oo; /* offset for in and out */
 	unsigned long flags;
@@ -55,39 +57,51 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
 	}
 	writel(mode, ss->base + SS_CTL);
 
-	sg_miter_start(&mi, areq->src, sg_nents(areq->src),
-		       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
-	sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
-		       SG_MITER_TO_SG | SG_MITER_ATOMIC);
-	sg_miter_next(&mi);
-	sg_miter_next(&mo);
-	if (!mi.addr || !mo.addr) {
-		dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
-		err = -EINVAL;
-		goto release_ss;
-	}
 
 	ileft = areq->cryptlen / 4;
 	oleft = areq->cryptlen / 4;
 	oi = 0;
 	oo = 0;
 	do {
-		todo = min(rx_cnt, ileft);
-		todo = min_t(size_t, todo, (mi.length - oi) / 4);
-		if (todo) {
-			ileft -= todo;
-			writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
-			oi += todo * 4;
-		}
-		if (oi == mi.length) {
-			sg_miter_next(&mi);
-			oi = 0;
+		if (ileft) {
+			sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+					SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+			if (pi)
+				sg_miter_skip(&mi, pi);
+			miter_err = sg_miter_next(&mi);
+			if (!miter_err || !mi.addr) {
+				dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+				err = -EINVAL;
+				goto release_ss;
+			}
+			todo = min(rx_cnt, ileft);
+			todo = min_t(size_t, todo, (mi.length - oi) / 4);
+			if (todo) {
+				ileft -= todo;
+				writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+				oi += todo * 4;
+			}
+			if (oi == mi.length) {
+				pi += mi.length;
+				oi = 0;
+			}
+			sg_miter_stop(&mi);
 		}
 
 		spaces = readl(ss->base + SS_FCSR);
 		rx_cnt = SS_RXFIFO_SPACES(spaces);
 		tx_cnt = SS_TXFIFO_SPACES(spaces);
 
+		sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+			       SG_MITER_TO_SG | SG_MITER_ATOMIC);
+		if (po)
+			sg_miter_skip(&mo, po);
+		miter_err = sg_miter_next(&mo);
+		if (!miter_err || !mo.addr) {
+			dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+			err = -EINVAL;
+			goto release_ss;
+		}
 		todo = min(tx_cnt, oleft);
 		todo = min_t(size_t, todo, (mo.length - oo) / 4);
 		if (todo) {
@@ -96,9 +110,10 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
 			oo += todo * 4;
 		}
 		if (oo == mo.length) {
-			sg_miter_next(&mo);
 			oo = 0;
+			po += mo.length;
 		}
+		sg_miter_stop(&mo);
 	} while (oleft);
 
 	if (areq->iv) {
@@ -109,8 +124,6 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
 	}
 
 release_ss:
-	sg_miter_stop(&mi);
-	sg_miter_stop(&mo);
 	writel(0, ss->base + SS_CTL);
 	spin_unlock_irqrestore(&ss->slock, flags);
 	return err;
@@ -162,6 +175,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 	unsigned int oleft = areq->cryptlen;
 	unsigned int todo;
 	struct sg_mapping_iter mi, mo;
+	unsigned long pi = 0, po = 0; /* progress for in and out */
+	bool miter_err;
 	unsigned int oi, oo;	/* offset for in and out */
 	unsigned int ob = 0;	/* offset in buf */
 	unsigned int obo = 0;	/* offset in bufo*/
@@ -215,17 +230,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 	}
 	writel(mode, ss->base + SS_CTL);
 
-	sg_miter_start(&mi, areq->src, sg_nents(areq->src),
-		       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
-	sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
-		       SG_MITER_TO_SG | SG_MITER_ATOMIC);
-	sg_miter_next(&mi);
-	sg_miter_next(&mo);
-	if (!mi.addr || !mo.addr) {
-		dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
-		err = -EINVAL;
-		goto release_ss;
-	}
 	ileft = areq->cryptlen;
 	oleft = areq->cryptlen;
 	oi = 0;
@@ -233,6 +237,16 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 
 	while (oleft) {
 		if (ileft) {
+			sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+				       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+			if (pi)
+				sg_miter_skip(&mi, pi);
+			miter_err = sg_miter_next(&mi);
+			if (!miter_err || !mi.addr) {
+				dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+				err = -EINVAL;
+				goto release_ss;
+			}
 			/*
 			 * todo is the number of consecutive 4byte word that we
 			 * can read from current SG
@@ -265,31 +279,38 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 				}
 			}
 			if (oi == mi.length) {
-				sg_miter_next(&mi);
+				pi += mi.length;
 				oi = 0;
 			}
+			sg_miter_stop(&mi);
 		}
 
 		spaces = readl(ss->base + SS_FCSR);
 		rx_cnt = SS_RXFIFO_SPACES(spaces);
 		tx_cnt = SS_TXFIFO_SPACES(spaces);
-		dev_dbg(ss->dev,
-			"%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
-			mode,
-			oi, mi.length, ileft, areq->cryptlen, rx_cnt,
-			oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
 
 		if (!tx_cnt)
 			continue;
+		sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+			       SG_MITER_TO_SG | SG_MITER_ATOMIC);
+		if (po)
+			sg_miter_skip(&mo, po);
+		miter_err = sg_miter_next(&mo);
+		if (!miter_err || !mo.addr) {
+			dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+			err = -EINVAL;
+			goto release_ss;
+		}
 		/* todo in 4bytes word */
 		todo = min(tx_cnt, oleft / 4);
 		todo = min_t(size_t, todo, (mo.length - oo) / 4);
+
 		if (todo) {
 			readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
 			oleft -= todo * 4;
 			oo += todo * 4;
 			if (oo == mo.length) {
-				sg_miter_next(&mo);
+				po += mo.length;
 				oo = 0;
 			}
 		} else {
@@ -314,12 +335,14 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 				obo += todo;
 				oo += todo;
 				if (oo == mo.length) {
+					po += mo.length;
 					sg_miter_next(&mo);
 					oo = 0;
 				}
 			} while (obo < obl);
 			/* bufo must be fully used here */
 		}
+		sg_miter_stop(&mo);
 	}
 	if (areq->iv) {
 		for (i = 0; i < 4 && i < ivsize / 4; i++) {
@@ -329,8 +352,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
 	}
 
 release_ss:
-	sg_miter_stop(&mi);
-	sg_miter_stop(&mo);
 	writel(0, ss->base + SS_CTL);
 	spin_unlock_irqrestore(&ss->slock, flags);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 146/663] crypto: arm64/aes-ce - really hide slower algos when faster ones are enabled
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 145/663] crypto: sun4i-ss - fix kmap usage Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 147/663] hwrng: ingenic - Fix a resource leak in an error handling path Greg Kroah-Hartman
                   ` (517 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 15deb4333cd6d4e1e3216582e4c531ec40a6b060 ]

Commit 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if
faster driver is enabled") intended to hide modes from the plain NEON
driver that are also implemented by the faster bit sliced NEON one if
both are enabled. However, the defined() CPP function does not detect
if the bit sliced NEON driver is enabled as a module. So instead, let's
use IS_ENABLED() here.

Fixes: 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if ...")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/crypto/aes-glue.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 395bbf64b2abb..53c92e060c3dd 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -55,7 +55,7 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 Crypto Extensions");
 #define aes_mac_update		neon_aes_mac_update
 MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 NEON");
 #endif
-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
+#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
 MODULE_ALIAS_CRYPTO("ecb(aes)");
 MODULE_ALIAS_CRYPTO("cbc(aes)");
 MODULE_ALIAS_CRYPTO("ctr(aes)");
@@ -650,7 +650,7 @@ static int __maybe_unused xts_decrypt(struct skcipher_request *req)
 }
 
 static struct skcipher_alg aes_algs[] = { {
-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
+#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
 	.base = {
 		.cra_name		= "__ecb(aes)",
 		.cra_driver_name	= "__ecb-aes-" MODE,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 147/663] hwrng: ingenic - Fix a resource leak in an error handling path
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 146/663] crypto: arm64/aes-ce - really hide slower algos when faster ones are enabled Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 148/663] media: allegro: Fix use after free on error Greg Kroah-Hartman
                   ` (516 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	周琰杰  ,
	Herbert Xu, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit c4ff41b93d1f10d1b8be258c31a0436c5769fc00 ]

In case of error, we should call 'clk_disable_unprepare()' to undo a
previous 'clk_prepare_enable()' call, as already done in the remove
function.

Fixes: 406346d22278 ("hwrng: ingenic - Add hardware TRNG for Ingenic X1830")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/ingenic-trng.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/char/hw_random/ingenic-trng.c b/drivers/char/hw_random/ingenic-trng.c
index 954a8411d67d2..0eb80f786f4dd 100644
--- a/drivers/char/hw_random/ingenic-trng.c
+++ b/drivers/char/hw_random/ingenic-trng.c
@@ -113,13 +113,17 @@ static int ingenic_trng_probe(struct platform_device *pdev)
 	ret = hwrng_register(&trng->rng);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register hwrng\n");
-		return ret;
+		goto err_unprepare_clk;
 	}
 
 	platform_set_drvdata(pdev, trng);
 
 	dev_info(&pdev->dev, "Ingenic DTRNG driver registered\n");
 	return 0;
+
+err_unprepare_clk:
+	clk_disable_unprepare(trng->clk);
+	return ret;
 }
 
 static int ingenic_trng_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 148/663] media: allegro: Fix use after free on error
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 147/663] hwrng: ingenic - Fix a resource leak in an error handling path Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 149/663] kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state() Greg Kroah-Hartman
                   ` (515 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Tretter,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ce814ad4bb52bfc7c0472e6da0aa742ab88f4361 ]

The "channel" is added to the "dev->channels" but then if
v4l2_m2m_ctx_init() fails then we free "channel" but it's still on the
list so it could lead to a use after free.  Let's not add it to the
list until after v4l2_m2m_ctx_init() succeeds.

Fixes: cc62c74749a3 ("media: allegro: add missed checks in allegro_open()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/allegro-dvt/allegro-core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c
index 9f718f43282bc..640451134072b 100644
--- a/drivers/staging/media/allegro-dvt/allegro-core.c
+++ b/drivers/staging/media/allegro-dvt/allegro-core.c
@@ -2483,8 +2483,6 @@ static int allegro_open(struct file *file)
 	INIT_LIST_HEAD(&channel->buffers_reference);
 	INIT_LIST_HEAD(&channel->buffers_intermediate);
 
-	list_add(&channel->list, &dev->channels);
-
 	channel->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, channel,
 						allegro_queue_init);
 
@@ -2493,6 +2491,7 @@ static int allegro_open(struct file *file)
 		goto error;
 	}
 
+	list_add(&channel->list, &dev->channels);
 	file->private_data = &channel->fh;
 	v4l2_fh_add(&channel->fh);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 149/663] kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 148/663] media: allegro: Fix use after free on error Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 150/663] drm: rcar-du: Fix PM reference leak in rcar_cmm_enable() Greg Kroah-Hartman
                   ` (514 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marco Elver, Paul E. McKenney, Sasha Levin

From: Marco Elver <elver@google.com>

[ Upstream commit 71a076f4a61a6c779794ad286f356b39725edc3b ]

Rewrite kcsan_prandom_u32_max() to not depend on code that might be
instrumented, removing any dependency on lib/random32.c. The rewrite
implements a simple linear congruential generator, that is sufficient
for our purposes (for udelay() and skip_watch counter randomness).

The initial motivation for this was to allow enabling KCSAN for
kernel/sched (remove KCSAN_SANITIZE := n from kernel/sched/Makefile),
with CONFIG_DEBUG_PREEMPT=y. Without this change, we could observe
recursion:

	check_access() [via instrumentation]
	  kcsan_setup_watchpoint()
	    reset_kcsan_skip()
	      kcsan_prandom_u32_max()
	        get_cpu_var()
		  preempt_disable()
		    preempt_count_add() [in kernel/sched/core.c]
		      check_access() [via instrumentation]

Note, while this currently does not affect an unmodified kernel, it'd be
good to keep a KCSAN kernel working when KCSAN_SANITIZE := n is removed
from kernel/sched/Makefile to permit testing scheduler code with KCSAN
if desired.

Fixes: cd290ec24633 ("kcsan: Use tracing-safe version of prandom")
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kcsan/core.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 3994a217bde76..3bf98db9c702d 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -12,7 +12,6 @@
 #include <linux/moduleparam.h>
 #include <linux/percpu.h>
 #include <linux/preempt.h>
-#include <linux/random.h>
 #include <linux/sched.h>
 #include <linux/uaccess.h>
 
@@ -101,7 +100,7 @@ static atomic_long_t watchpoints[CONFIG_KCSAN_NUM_WATCHPOINTS + NUM_SLOTS-1];
 static DEFINE_PER_CPU(long, kcsan_skip);
 
 /* For kcsan_prandom_u32_max(). */
-static DEFINE_PER_CPU(struct rnd_state, kcsan_rand_state);
+static DEFINE_PER_CPU(u32, kcsan_rand_state);
 
 static __always_inline atomic_long_t *find_watchpoint(unsigned long addr,
 						      size_t size,
@@ -275,20 +274,17 @@ should_watch(const volatile void *ptr, size_t size, int type, struct kcsan_ctx *
 }
 
 /*
- * Returns a pseudo-random number in interval [0, ep_ro). See prandom_u32_max()
- * for more details.
- *
- * The open-coded version here is using only safe primitives for all contexts
- * where we can have KCSAN instrumentation. In particular, we cannot use
- * prandom_u32() directly, as its tracepoint could cause recursion.
+ * Returns a pseudo-random number in interval [0, ep_ro). Simple linear
+ * congruential generator, using constants from "Numerical Recipes".
  */
 static u32 kcsan_prandom_u32_max(u32 ep_ro)
 {
-	struct rnd_state *state = &get_cpu_var(kcsan_rand_state);
-	const u32 res = prandom_u32_state(state);
+	u32 state = this_cpu_read(kcsan_rand_state);
+
+	state = 1664525 * state + 1013904223;
+	this_cpu_write(kcsan_rand_state, state);
 
-	put_cpu_var(kcsan_rand_state);
-	return (u32)(((u64) res * ep_ro) >> 32);
+	return state % ep_ro;
 }
 
 static inline void reset_kcsan_skip(void)
@@ -639,10 +635,14 @@ static __always_inline void check_access(const volatile void *ptr, size_t size,
 
 void __init kcsan_init(void)
 {
+	int cpu;
+
 	BUG_ON(!in_task());
 
 	kcsan_debugfs_init();
-	prandom_seed_full_state(&kcsan_rand_state);
+
+	for_each_possible_cpu(cpu)
+		per_cpu(kcsan_rand_state, cpu) = (u32)get_cycles();
 
 	/*
 	 * We are in the init task, and no other tasks should be running;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 150/663] drm: rcar-du: Fix PM reference leak in rcar_cmm_enable()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 149/663] kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 151/663] drm: rcar-du: Fix crash when using LVDS1 clock for CRTC Greg Kroah-Hartman
                   ` (513 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Jacopo Mondi, Laurent Pinchart, Laurent Pinchart, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 136ce7684bc1ff4a088812f600c63daca50b32c2 ]

pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in a reference leak here.

A new function pm_runtime_resume_and_get is introduced in [0] to keep
usage counter balanced. So We fix the reference leak by replacing it
with new funtion.

[0] dd8088d5a896 ("PM: runtime: Add  pm_runtime_resume_and_get to deal with usage counter")

Fixes: e08e934d6c28 ("drm: rcar-du: Add support for CMM")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_cmm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_cmm.c b/drivers/gpu/drm/rcar-du/rcar_cmm.c
index c578095b09a53..382d53f8a22e8 100644
--- a/drivers/gpu/drm/rcar-du/rcar_cmm.c
+++ b/drivers/gpu/drm/rcar-du/rcar_cmm.c
@@ -122,7 +122,7 @@ int rcar_cmm_enable(struct platform_device *pdev)
 {
 	int ret;
 
-	ret = pm_runtime_get_sync(&pdev->dev);
+	ret = pm_runtime_resume_and_get(&pdev->dev);
 	if (ret < 0)
 		return ret;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 151/663] drm: rcar-du: Fix crash when using LVDS1 clock for CRTC
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 150/663] drm: rcar-du: Fix PM reference leak in rcar_cmm_enable() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 152/663] drm: rcar-du: Fix the return check of of_parse_phandle and of_find_device_by_node Greg Kroah-Hartman
                   ` (512 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Jacopo Mondi,
	Kieran Bingham, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 53ced169373aab52d3b5da0fee6a342002d1876d ]

On D3 and E3 platforms, the LVDS encoder includes a PLL that can
generate a clock for the corresponding CRTC, used even when the CRTC
output to a non-LVDS port. This mechanism is supported by the driver,
but the implementation is broken in dual-link LVDS mode. In that case,
the LVDS1 drm_encoder is skipped, which causes a crash when trying to
access its bridge later on.

Fix this by storing bridge pointers internally instead of retrieving
them from the encoder. The rcar_du_device encoders field isn't used
anymore and can be dropped.

Fixes: 8e8fddab0d0a ("drm: rcar-du: Skip LVDS1 output on Gen3 when using dual-link LVDS mode")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c    | 10 ++--------
 drivers/gpu/drm/rcar-du/rcar_du_drv.h     |  6 +++---
 drivers/gpu/drm/rcar-du/rcar_du_encoder.c |  5 ++++-
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
index fe86a3e677571..1b9738e44909d 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
@@ -727,13 +727,10 @@ static void rcar_du_crtc_atomic_enable(struct drm_crtc *crtc,
 	 */
 	if (rcdu->info->lvds_clk_mask & BIT(rcrtc->index) &&
 	    rstate->outputs == BIT(RCAR_DU_OUTPUT_DPAD0)) {
-		struct rcar_du_encoder *encoder =
-			rcdu->encoders[RCAR_DU_OUTPUT_LVDS0 + rcrtc->index];
+		struct drm_bridge *bridge = rcdu->lvds[rcrtc->index];
 		const struct drm_display_mode *mode =
 			&crtc->state->adjusted_mode;
-		struct drm_bridge *bridge;
 
-		bridge = drm_bridge_chain_get_first_bridge(&encoder->base);
 		rcar_lvds_clk_enable(bridge, mode->clock * 1000);
 	}
 
@@ -759,15 +756,12 @@ static void rcar_du_crtc_atomic_disable(struct drm_crtc *crtc,
 
 	if (rcdu->info->lvds_clk_mask & BIT(rcrtc->index) &&
 	    rstate->outputs == BIT(RCAR_DU_OUTPUT_DPAD0)) {
-		struct rcar_du_encoder *encoder =
-			rcdu->encoders[RCAR_DU_OUTPUT_LVDS0 + rcrtc->index];
-		struct drm_bridge *bridge;
+		struct drm_bridge *bridge = rcdu->lvds[rcrtc->index];
 
 		/*
 		 * Disable the LVDS clock output, see
 		 * rcar_du_crtc_atomic_enable().
 		 */
-		bridge = drm_bridge_chain_get_first_bridge(&encoder->base);
 		rcar_lvds_clk_disable(bridge);
 	}
 
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
index 61504c54e2ecf..3597a179bfb78 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
@@ -20,10 +20,10 @@
 
 struct clk;
 struct device;
+struct drm_bridge;
 struct drm_device;
 struct drm_property;
 struct rcar_du_device;
-struct rcar_du_encoder;
 
 #define RCAR_DU_FEATURE_CRTC_IRQ_CLOCK	BIT(0)	/* Per-CRTC IRQ and clock */
 #define RCAR_DU_FEATURE_VSP1_SOURCE	BIT(1)	/* Has inputs from VSP1 */
@@ -71,6 +71,7 @@ struct rcar_du_device_info {
 #define RCAR_DU_MAX_CRTCS		4
 #define RCAR_DU_MAX_GROUPS		DIV_ROUND_UP(RCAR_DU_MAX_CRTCS, 2)
 #define RCAR_DU_MAX_VSPS		4
+#define RCAR_DU_MAX_LVDS		2
 
 struct rcar_du_device {
 	struct device *dev;
@@ -83,11 +84,10 @@ struct rcar_du_device {
 	struct rcar_du_crtc crtcs[RCAR_DU_MAX_CRTCS];
 	unsigned int num_crtcs;
 
-	struct rcar_du_encoder *encoders[RCAR_DU_OUTPUT_MAX];
-
 	struct rcar_du_group groups[RCAR_DU_MAX_GROUPS];
 	struct platform_device *cmms[RCAR_DU_MAX_CRTCS];
 	struct rcar_du_vsp vsps[RCAR_DU_MAX_VSPS];
+	struct drm_bridge *lvds[RCAR_DU_MAX_LVDS];
 
 	struct {
 		struct drm_property *colorkey;
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
index b0335da0c1614..50fc14534fa4d 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
@@ -57,7 +57,6 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 	if (renc == NULL)
 		return -ENOMEM;
 
-	rcdu->encoders[output] = renc;
 	renc->output = output;
 	encoder = rcar_encoder_to_drm_encoder(renc);
 
@@ -91,6 +90,10 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 			ret = -EPROBE_DEFER;
 			goto done;
 		}
+
+		if (output == RCAR_DU_OUTPUT_LVDS0 ||
+		    output == RCAR_DU_OUTPUT_LVDS1)
+			rcdu->lvds[output - RCAR_DU_OUTPUT_LVDS0] = bridge;
 	}
 
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 152/663] drm: rcar-du: Fix the return check of of_parse_phandle and of_find_device_by_node
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 151/663] drm: rcar-du: Fix crash when using LVDS1 clock for CRTC Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 153/663] drm: rcar-du: Fix leak of CMM platform device reference Greg Kroah-Hartman
                   ` (511 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang Xiaojun, Hulk Robot,
	Jacopo Mondi, Geert Uytterhoeven, Kieran Bingham,
	Laurent Pinchart, Laurent Pinchart, Sasha Levin

From: Wang Xiaojun <wangxiaojun11@huawei.com>

[ Upstream commit 8d7d33f6be06f929ac2c5e8ea2323fec272790d4 ]

of_parse_phandle and of_find_device_by_node may return NULL
which cannot be checked by IS_ERR.

Fixes: 8de707aeb452 ("drm: rcar-du: kms: Initialize CMM instances")
Signed-off-by: Wang Xiaojun <wangxiaojun11@huawei.com>
Reported-by: Hulk Robot <hulkci@huawei.com>
Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>

[Replace -ENODEV with -EINVAL]

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_kms.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
index 72dda446355fe..7015e22872bbe 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
@@ -700,10 +700,10 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
 		int ret;
 
 		cmm = of_parse_phandle(np, "renesas,cmms", i);
-		if (IS_ERR(cmm)) {
+		if (!cmm) {
 			dev_err(rcdu->dev,
 				"Failed to parse 'renesas,cmms' property\n");
-			return PTR_ERR(cmm);
+			return -EINVAL;
 		}
 
 		if (!of_device_is_available(cmm)) {
@@ -713,10 +713,10 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
 		}
 
 		pdev = of_find_device_by_node(cmm);
-		if (IS_ERR(pdev)) {
+		if (!pdev) {
 			dev_err(rcdu->dev, "No device found for CMM%u\n", i);
 			of_node_put(cmm);
-			return PTR_ERR(pdev);
+			return -EINVAL;
 		}
 
 		of_node_put(cmm);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 153/663] drm: rcar-du: Fix leak of CMM platform device reference
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 152/663] drm: rcar-du: Fix the return check of of_parse_phandle and of_find_device_by_node Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 154/663] drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition Greg Kroah-Hartman
                   ` (510 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Jacopo Mondi, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 9fa120458da142da0d1d3eaf6f6a3a2c2c91d27b ]

The device references acquired by of_find_device_by_node() are not
released by the driver. Fix this by registering a cleanup action.

Fixes: 8de707aeb452 ("drm: rcar-du: kms: Initialize CMM instances")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_kms.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
index 7015e22872bbe..ecc894f0bc430 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
@@ -14,6 +14,7 @@
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_gem_cma_helper.h>
 #include <drm/drm_gem_framebuffer_helper.h>
+#include <drm/drm_managed.h>
 #include <drm/drm_probe_helper.h>
 #include <drm/drm_vblank.h>
 
@@ -726,8 +727,12 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
 		 * disabled: return 0 and let the DU continue probing.
 		 */
 		ret = rcar_cmm_init(pdev);
-		if (ret)
+		if (ret) {
+			platform_device_put(pdev);
 			return ret == -ENODEV ? 0 : ret;
+		}
+
+		rcdu->cmms[i] = pdev;
 
 		/*
 		 * Enforce suspend/resume ordering by making the CMM a provider
@@ -739,13 +744,20 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
 				"Failed to create device link to CMM%u\n", i);
 			return -EINVAL;
 		}
-
-		rcdu->cmms[i] = pdev;
 	}
 
 	return 0;
 }
 
+static void rcar_du_modeset_cleanup(struct drm_device *dev, void *res)
+{
+	struct rcar_du_device *rcdu = to_rcar_du_device(dev);
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(rcdu->cmms); ++i)
+		platform_device_put(rcdu->cmms[i]);
+}
+
 int rcar_du_modeset_init(struct rcar_du_device *rcdu)
 {
 	static const unsigned int mmio_offsets[] = {
@@ -766,6 +778,10 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
 	if (ret)
 		return ret;
 
+	ret = drmm_add_action(&rcdu->ddev, rcar_du_modeset_cleanup, NULL);
+	if (ret)
+		return ret;
+
 	dev->mode_config.min_width = 0;
 	dev->mode_config.min_height = 0;
 	dev->mode_config.normalize_zpos = true;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 154/663] drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 153/663] drm: rcar-du: Fix leak of CMM platform device reference Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 155/663] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Greg Kroah-Hartman
                   ` (509 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guchun Chen, Paul Menzel,
	Chenyang Li, Alex Deucher, Sasha Levin

From: Chenyang Li <lichenyang@loongson.cn>

[ Upstream commit 956e20eb0fbb206e5e795539db5469db099715c8 ]

Add an underscore in amdgpu_trace.h line 24 "_AMDGPU_TRACE_H".

Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Chenyang Li <lichenyang@loongson.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
index ee9480d14cbc3..86cfb3d55477f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
@@ -21,7 +21,7 @@
  *
  */
 
-#if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#if !defined(_AMDGPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
 #define _AMDGPU_TRACE_H_
 
 #include <linux/stringify.h>
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 155/663] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 154/663] drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 156/663] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Greg Kroah-Hartman
                   ` (508 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Huacai Chen,
	Thomas Bogendoerfer, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ]

When building with clang, the following section mismatch warning occurs:

WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in
reference from the function r4k_cache_init() to the function
.init.text:loongson2_sc_init()

This should have been fixed with commit ad4fddef5f23 ("mips: fix Section
mismatch in reference") but it was missed. Remove the improper __init
annotation like that commit did.

Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code")
Link: https://github.com/ClangBuiltLinux/linux/issues/787
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mm/c-r4k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index c9644c38ec28f..96adc3d23bd2d 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1593,7 +1593,7 @@ static int probe_scache(void)
 	return 1;
 }
 
-static void __init loongson2_sc_init(void)
+static void loongson2_sc_init(void)
 {
 	struct cpuinfo_mips *c = &current_cpu_data;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 156/663] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 155/663] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 157/663] drm/virtio: make sure context is created in gem open Greg Kroah-Hartman
                   ` (507 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Golovin, Nathan Chancellor,
	Thomas Bogendoerfer, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ]

When building xway_defconfig with clang:

arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant
operand [-Werror,-Wconstant-logical-operand]
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                      ^ ~~~~~~~~~~~~~~~~~
arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                      ^~
                                                      &
arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this
warning
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                     ~^~~~~~~~~~~~~~~~~~~~
1 error generated.

Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the
warning. Additionally, remove the unnecessary parentheses as this is a
simple conditional statement and shorthand '== 0' to '!'.

Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support")
Link: https://github.com/ClangBuiltLinux/linux/issues/807
Reported-by: Dmitry Golovin <dima@golovin.in>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index df8eed3875f6d..43c2f271e6ab4 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -302,7 +302,7 @@ static void ltq_hw_irq_handler(struct irq_desc *desc)
 	generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
 
 	/* if this is a EBU irq, we need to ack it or get a deadlock */
-	if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+	if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
 		ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
 			LTQ_EBU_PCC_ISTAT);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 157/663] drm/virtio: make sure context is created in gem open
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 156/663] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 158/663] drm/fourcc: fix Amlogic format modifier masks Greg Kroah-Hartman
                   ` (506 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gurchetan Singh, Gerd Hoffmann,
	Chia-I Wu, Sasha Levin

From: Chia-I Wu <olvaffe@gmail.com>

[ Upstream commit 8aeef9d4f48917ce85710949b079548974b4a638 ]

The context might still be missing when DRM_IOCTL_PRIME_FD_TO_HANDLE is
the first ioctl on the drm_file.

Fixes: 72b48ae800da ("drm/virtio: enqueue virtio_gpu_create_context after the first 3D ioctl")
Cc: Gurchetan Singh <gurchetansingh@chromium.org>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210107210726.269584-1-olvaffe@gmail.com
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_gem.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c
index c30c75ee83fce..8502400b2f9c9 100644
--- a/drivers/gpu/drm/virtio/virtgpu_gem.c
+++ b/drivers/gpu/drm/virtio/virtgpu_gem.c
@@ -39,9 +39,6 @@ static int virtio_gpu_gem_create(struct drm_file *file,
 	int ret;
 	u32 handle;
 
-	if (vgdev->has_virgl_3d)
-		virtio_gpu_create_context(dev, file);
-
 	ret = virtio_gpu_object_create(vgdev, params, &obj, NULL);
 	if (ret < 0)
 		return ret;
@@ -119,6 +116,11 @@ int virtio_gpu_gem_object_open(struct drm_gem_object *obj,
 	if (!vgdev->has_virgl_3d)
 		goto out_notify;
 
+	/* the context might still be missing when the first ioctl is
+	 * DRM_IOCTL_MODE_CREATE_DUMB or DRM_IOCTL_PRIME_FD_TO_HANDLE
+	 */
+	virtio_gpu_create_context(obj->dev, file);
+
 	objs = virtio_gpu_array_alloc(1);
 	if (!objs)
 		return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 158/663] drm/fourcc: fix Amlogic format modifier masks
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 157/663] drm/virtio: make sure context is created in gem open Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 159/663] media: ipu3-cio2: Build only for x86 Greg Kroah-Hartman
                   ` (505 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Ser, Neil Armstrong,
	Sam Ravnborg, Kevin Hilman, Daniel Vetter, Sasha Levin

From: Simon Ser <contact@emersion.fr>

[ Upstream commit cc3283f8f41f741fbaef63d0503d8fb4a7919100 ]

The comment says the layout and options use 8 bits, and the shift
uses 8 bits. However the mask is 0xf, ie. 0b00001111 (4 bits).

This could be surprising when introducing new layouts or options
that take more than 4 bits, as this would silently drop the high
bits.

Make the masks consistent with the comment and the shift.

Found when writing a drm_info patch [1].

[1]: https://github.com/ascent12/drm_info/pull/67

Signed-off-by: Simon Ser <contact@emersion.fr>
Fixes: d6528ec88309 ("drm/fourcc: Add modifier definitions for describing Amlogic Video Framebuffer Compression")
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Kevin Hilman <khilman@baylibre.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210110125103.15447-1-contact@emersion.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/drm/drm_fourcc.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h
index 82f3278012677..5498d7a6556a7 100644
--- a/include/uapi/drm/drm_fourcc.h
+++ b/include/uapi/drm/drm_fourcc.h
@@ -997,9 +997,9 @@ drm_fourcc_canonicalize_nvidia_format_mod(__u64 modifier)
  * Not all combinations are valid, and different SoCs may support different
  * combinations of layout and options.
  */
-#define __fourcc_mod_amlogic_layout_mask 0xf
+#define __fourcc_mod_amlogic_layout_mask 0xff
 #define __fourcc_mod_amlogic_options_shift 8
-#define __fourcc_mod_amlogic_options_mask 0xf
+#define __fourcc_mod_amlogic_options_mask 0xff
 
 #define DRM_FORMAT_MOD_AMLOGIC_FBC(__layout, __options) \
 	fourcc_mod_code(AMLOGIC, \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 159/663] media: ipu3-cio2: Build only for x86
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 158/663] drm/fourcc: fix Amlogic format modifier masks Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 160/663] media: i2c: ov5670: Fix PIXEL_RATE minimum value Greg Kroah-Hartman
                   ` (504 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Sakari Ailus,
	Andy Shevchenko, Mauro Carvalho Chehab, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 3ef5e42d281ea108f4ccdca186de4ce20a346326 ]

According to the original code in the driver it was never assumed to work
with big page sizes: unsigned short type followed by PAGE_SHIFT and
PAGE_MASK which may be different on non-x86 architectures.

Recently LKP found an issue on non-x86 architectures due to above
mentioned limitations. Since Sakari acknowledges that it's not really
useful to be able to compile this elsewhere, mark it x86 only.

Fixes: a31d19f88932 ("media: ipu3: allow building it with COMPILE_TEST on non-x86 archs")
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/intel/ipu3/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu3/Kconfig b/drivers/media/pci/intel/ipu3/Kconfig
index 82d7f17e6a024..7a805201034b7 100644
--- a/drivers/media/pci/intel/ipu3/Kconfig
+++ b/drivers/media/pci/intel/ipu3/Kconfig
@@ -2,7 +2,8 @@
 config VIDEO_IPU3_CIO2
 	tristate "Intel ipu3-cio2 driver"
 	depends on VIDEO_V4L2 && PCI
-	depends on (X86 && ACPI) || COMPILE_TEST
+	depends on ACPI || COMPILE_TEST
+	depends on X86
 	select MEDIA_CONTROLLER
 	select VIDEO_V4L2_SUBDEV_API
 	select V4L2_FWNODE
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 160/663] media: i2c: ov5670: Fix PIXEL_RATE minimum value
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 159/663] media: ipu3-cio2: Build only for x86 Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 161/663] media: imx: Unregister csc/scaler only if registered Greg Kroah-Hartman
                   ` (503 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Jacopo Mondi <jacopo@jmondi.org>

[ Upstream commit dc1eb7c9c290cba52937c9a224b22a400bb0ffd7 ]

The driver currently reports a single supported value for
V4L2_CID_PIXEL_RATE and initializes the control's minimum value to 0,
which is very risky, as userspace might accidentally use it as divider
when calculating the time duration of a line.

Fix this by using as minimum the only supported value when registering
the control.

Fixes: 5de35c9b8dcd1 ("media: i2c: Add Omnivision OV5670 5M sensor support")
Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5670.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
index f26252e35e08d..04d3f14902017 100644
--- a/drivers/media/i2c/ov5670.c
+++ b/drivers/media/i2c/ov5670.c
@@ -2084,7 +2084,8 @@ static int ov5670_init_controls(struct ov5670 *ov5670)
 
 	/* By default, V4L2_CID_PIXEL_RATE is read only */
 	ov5670->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov5670_ctrl_ops,
-					       V4L2_CID_PIXEL_RATE, 0,
+					       V4L2_CID_PIXEL_RATE,
+					       link_freq_configs[0].pixel_rate,
 					       link_freq_configs[0].pixel_rate,
 					       1,
 					       link_freq_configs[0].pixel_rate);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 161/663] media: imx: Unregister csc/scaler only if registered
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 160/663] media: i2c: ov5670: Fix PIXEL_RATE minimum value Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 162/663] media: imx: Fix csc/scaler unregister Greg Kroah-Hartman
                   ` (502 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ezequiel Garcia, Philipp Zabel,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Ezequiel Garcia <ezequiel@collabora.com>

[ Upstream commit bb2216548a2b13cf2942a058b475438a7a6bb028 ]

The csc/scaler device pointer (imxmd->m2m_vdev) is assigned
after the imx media device v4l2-async probe completes,
therefore we need to check if the device is non-NULL
before trying to unregister it.

This can be the case if the non-completed imx media device
is unbinded (or the driver is removed), leading to a kernel oops.

Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx-media-dev.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
index 6d2205461e565..338b8bd0bb076 100644
--- a/drivers/staging/media/imx/imx-media-dev.c
+++ b/drivers/staging/media/imx/imx-media-dev.c
@@ -53,6 +53,7 @@ static int imx6_media_probe_complete(struct v4l2_async_notifier *notifier)
 	imxmd->m2m_vdev = imx_media_csc_scaler_device_init(imxmd);
 	if (IS_ERR(imxmd->m2m_vdev)) {
 		ret = PTR_ERR(imxmd->m2m_vdev);
+		imxmd->m2m_vdev = NULL;
 		goto unlock;
 	}
 
@@ -107,10 +108,14 @@ static int imx_media_remove(struct platform_device *pdev)
 
 	v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
 
+	if (imxmd->m2m_vdev) {
+		imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
+		imxmd->m2m_vdev = NULL;
+	}
+
 	v4l2_async_notifier_unregister(&imxmd->notifier);
 	imx_media_unregister_ipu_internal_subdevs(imxmd);
 	v4l2_async_notifier_cleanup(&imxmd->notifier);
-	imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
 	media_device_unregister(&imxmd->md);
 	v4l2_device_unregister(&imxmd->v4l2_dev);
 	media_device_cleanup(&imxmd->md);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 162/663] media: imx: Fix csc/scaler unregister
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 161/663] media: imx: Unregister csc/scaler only if registered Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 163/663] media: mtk-vcodec: fix error return code in vdec_vp9_decode() Greg Kroah-Hartman
                   ` (501 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ezequiel Garcia, Philipp Zabel,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Ezequiel Garcia <ezequiel@collabora.com>

[ Upstream commit 89b14485caa4b7b2eaf70be0064f0978e68ebeee ]

The csc/scaler device private struct is released by
ipu_csc_scaler_video_device_release(), which can be called
by video_unregister_device() if there are no users
of the underlying struct video device.

Therefore, the mutex can't be held when calling
video_unregister_device() as its memory may be freed
by it, leading to a kernel oops.

Fortunately, the fix is quite simple as no locking
is needed when calling video_unregister_device(): v4l2-core
already has its own internal locking, and the structures
are also properly refcounted.

Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx-media-csc-scaler.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
index fab1155a5958c..63a0204502a8b 100644
--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -869,11 +869,7 @@ void imx_media_csc_scaler_device_unregister(struct imx_media_video_dev *vdev)
 	struct ipu_csc_scaler_priv *priv = vdev_to_priv(vdev);
 	struct video_device *vfd = priv->vdev.vfd;
 
-	mutex_lock(&priv->mutex);
-
 	video_unregister_device(vfd);
-
-	mutex_unlock(&priv->mutex);
 }
 
 struct imx_media_video_dev *
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 163/663] media: mtk-vcodec: fix error return code in vdec_vp9_decode()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 162/663] media: imx: Fix csc/scaler unregister Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 164/663] media: camss: missing error code in msm_video_register() Greg Kroah-Hartman
                   ` (500 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 4397efebf039be58e98c81a194a26100eba597bb ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: dea42fb79f4f ("media: mtk-vcodec: reset segment data then trig decoder")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index 5ea153a685225..d9880210b2ab6 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -890,7 +890,8 @@ static int vdec_vp9_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
 			memset(inst->seg_id_buf.va, 0, inst->seg_id_buf.size);
 
 			if (vsi->show_frame & BIT(2)) {
-				if (vpu_dec_start(&inst->vpu, NULL, 0)) {
+				ret = vpu_dec_start(&inst->vpu, NULL, 0);
+				if (ret) {
 					mtk_vcodec_err(inst, "vpu trig decoder failed");
 					goto DECODE_ERROR;
 				}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 164/663] media: camss: missing error code in msm_video_register()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 163/663] media: mtk-vcodec: fix error return code in vdec_vp9_decode() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 165/663] media: vsp1: Fix an error handling path in the probe function Greg Kroah-Hartman
                   ` (499 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Robert Foss,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9c67ed2ab299123872be14a3dc2ea44ce7e4538b ]

This error path returns success but it should return -EINVAL.

Fixes: cba3819d1e93 ("media: camss: Format configuration per hardware version")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/camss/camss-video.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
index 114c3ae4a4abb..15965e63cb619 100644
--- a/drivers/media/platform/qcom/camss/camss-video.c
+++ b/drivers/media/platform/qcom/camss/camss-video.c
@@ -979,6 +979,7 @@ int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
 			video->nformats = ARRAY_SIZE(formats_rdi_8x96);
 		}
 	} else {
+		ret = -EINVAL;
 		goto error_video_register;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 165/663] media: vsp1: Fix an error handling path in the probe function
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 164/663] media: camss: missing error code in msm_video_register() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 166/663] media: em28xx: Fix use-after-free in em28xx_alloc_urbs Greg Kroah-Hartman
                   ` (498 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Geert Uytterhoeven, Kieran Bingham, Laurent Pinchart,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 7113469dafc2d545fa4fa9bc649c31dc27db492e ]

A previous 'rcar_fcp_get()' call must be undone in the error handling path,
as already done in the remove function.

Fixes: 94fcdf829793 ("[media] v4l: vsp1: Add FCP support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vsp1/vsp1_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
index dc62533cf32ce..aa66e4f5f3f34 100644
--- a/drivers/media/platform/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/vsp1/vsp1_drv.c
@@ -882,8 +882,10 @@ static int vsp1_probe(struct platform_device *pdev)
 	}
 
 done:
-	if (ret)
+	if (ret) {
 		pm_runtime_disable(&pdev->dev);
+		rcar_fcp_put(vsp1->fcp);
+	}
 
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 166/663] media: em28xx: Fix use-after-free in em28xx_alloc_urbs
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 165/663] media: vsp1: Fix an error handling path in the probe function Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 167/663] media: media/pci: Fix memleak in empress_init Greg Kroah-Hartman
                   ` (497 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]

When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index e6088b5d1b805..3daa64bb1e1d9 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
 
 		usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
 		if (!usb_bufs->buf[i]) {
-			em28xx_uninit_usb_xfer(dev, mode);
-
 			for (i--; i >= 0; i--)
 				kfree(usb_bufs->buf[i]);
 
-			kfree(usb_bufs->buf);
-			usb_bufs->buf = NULL;
-
+			em28xx_uninit_usb_xfer(dev, mode);
 			return -ENOMEM;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 167/663] media: media/pci: Fix memleak in empress_init
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 166/663] media: em28xx: Fix use-after-free in em28xx_alloc_urbs Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 168/663] media: tm6000: Fix memleak in tm6000_start_stream Greg Kroah-Hartman
                   ` (496 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ]

When vb2_queue_init() fails, dev->empress_dev
should be released just like other error handling
paths.

Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index 39e3c7f8c5b46..76a37fbd84587 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -282,8 +282,11 @@ static int empress_init(struct saa7134_dev *dev)
 	q->lock = &dev->lock;
 	q->dev = &dev->pci->dev;
 	err = vb2_queue_init(q);
-	if (err)
+	if (err) {
+		video_device_release(dev->empress_dev);
+		dev->empress_dev = NULL;
 		return err;
+	}
 	dev->empress_dev->queue = q;
 	dev->empress_dev->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING |
 					V4L2_CAP_VIDEO_CAPTURE;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 168/663] media: tm6000: Fix memleak in tm6000_start_stream
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 167/663] media: media/pci: Fix memleak in empress_init Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 169/663] media: aspeed: fix error return code in aspeed_video_setup_video() Greg Kroah-Hartman
                   ` (495 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ]

When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer
and dvb->bulk_urb should be freed just like when
usb_submit_urb() fails.

Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
index 19c90fa9e443d..293a460f4616c 100644
--- a/drivers/media/usb/tm6000/tm6000-dvb.c
+++ b/drivers/media/usb/tm6000/tm6000-dvb.c
@@ -141,6 +141,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
 	if (ret < 0) {
 		printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
 							ret, __func__);
+
+		kfree(dvb->bulk_urb->transfer_buffer);
+		usb_free_urb(dvb->bulk_urb);
+		dvb->bulk_urb = NULL;
 		return ret;
 	} else
 		printk(KERN_ERR "tm6000: pipe reset\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 169/663] media: aspeed: fix error return code in aspeed_video_setup_video()
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 168/663] media: tm6000: Fix memleak in tm6000_start_stream Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 170/663] ASoC: cs42l56: fix up error handling in probe Greg Kroah-Hartman
                   ` (494 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit d497fcdab02996a4510d5dd0d743447c737c317a ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/aspeed-video.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
index c46a79eace98b..f2c4dadd6a0eb 100644
--- a/drivers/media/platform/aspeed-video.c
+++ b/drivers/media/platform/aspeed-video.c
@@ -1551,12 +1551,12 @@ static int aspeed_video_setup_video(struct aspeed_video *video)
 			       V4L2_JPEG_CHROMA_SUBSAMPLING_420, mask,
 			       V4L2_JPEG_CHROMA_SUBSAMPLING_444);
 
-	if (video->ctrl_handler.error) {
+	rc = video->ctrl_handler.error;
+	if (rc) {
 		v4l2_ctrl_handler_free(&video->ctrl_handler);
 		v4l2_device_unregister(v4l2_dev);
 
-		dev_err(video->dev, "Failed to init controls: %d\n",
-			video->ctrl_handler.error);
+		dev_err(video->dev, "Failed to init controls: %d\n", rc);
 		return rc;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 170/663] ASoC: cs42l56: fix up error handling in probe
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 169/663] media: aspeed: fix error return code in aspeed_video_setup_video() Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:06 ` [PATCH 5.10 171/663] ASoC: qcom: qdsp6: Move frontend AIFs to q6asm-dai Greg Kroah-Hartman
                   ` (493 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ]

There are two issues with this code.  The first error path forgot to set
the error code and instead returns success.  The second error path
doesn't clean up.

Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l56.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
index 97024a6ac96d7..06dcfae9dfe71 100644
--- a/sound/soc/codecs/cs42l56.c
+++ b/sound/soc/codecs/cs42l56.c
@@ -1249,6 +1249,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
 		dev_err(&i2c_client->dev,
 			"CS42L56 Device ID (%X). Expected %X\n",
 			devid, CS42L56_DEVID);
+		ret = -EINVAL;
 		goto err_enable;
 	}
 	alpha_rev = reg & CS42L56_AREV_MASK;
@@ -1306,7 +1307,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
 	ret =  devm_snd_soc_register_component(&i2c_client->dev,
 			&soc_component_dev_cs42l56, &cs42l56_dai, 1);
 	if (ret < 0)
-		return ret;
+		goto err_enable;
 
 	return 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 171/663] ASoC: qcom: qdsp6: Move frontend AIFs to q6asm-dai
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 170/663] ASoC: cs42l56: fix up error handling in probe Greg Kroah-Hartman
@ 2021-03-01 16:06 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 172/663] evm: Fix memleak in init_desc Greg Kroah-Hartman
                   ` (492 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Stephan Gerhold,
	Mark Brown, Sasha Levin

From: Stephan Gerhold <stephan@gerhold.net>

[ Upstream commit 6fd8d2d275f74baa7ac17b2656da1235f56dab99 ]

At the moment it is necessary to set up the DAPM routes between
front-end AIF<->DAI explicitly in the device tree, e.g. using

	audio-routing =
		"MM_DL1", "MultiMedia1 Playback",
		"MM_DL3", "MultiMedia3 Playback",
		"MM_DL4", "MultiMedia4 Playback",
		"MultiMedia2 Capture", "MM_UL2";

This is prone to mistakes and (sadly) there is no clear error if one
of these routes is missing. :(

Actually, this should not be necessary because the ASoC core normally
automatically links AIF<->DAI within snd_soc_dapm_link_dai_widgets().
This is done using the "stname" parameter of SND_SOC_DAPM_AIF_IN/OUT.

For SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, 0, 0, 0),
it should create the route from above: MM_DL1 <-> MultiMedia1 Playback.

This does not work at the moment because the AIF widget (MM_DL1)
and the DAI widget (MultiMedia1 Playback) belong to different
DAPM contexts (q6routing / q6asm-dai).

Fix this by declaring the AIF widgets in the same driver as the DAIs
(q6asm-dai). Now the routes above are created automatically
and no longer need to be specified in the device tree.

This is also more consistent with the back-end AIFs which are already
declared in q6afe-dais instead of q6routing. q6routing should only link
the components together using mixers.

Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20201211203255.148246-1-stephan@gerhold.net
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/qdsp6/q6asm-dai.c | 21 +++++++++++++++++++++
 sound/soc/qcom/qdsp6/q6routing.c | 18 ------------------
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index c9ac9c1d26c47..9766725c29166 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -1233,6 +1233,25 @@ static void q6asm_dai_pcm_free(struct snd_soc_component *component,
 	}
 }
 
+static const struct snd_soc_dapm_widget q6asm_dapm_widgets[] = {
+	SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL2", "MultiMedia2 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL3", "MultiMedia3 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL4", "MultiMedia4 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL5", "MultiMedia5 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL6", "MultiMedia6 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL7", "MultiMedia7 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_IN("MM_DL8", "MultiMedia8 Playback", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL1", "MultiMedia1 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL2", "MultiMedia2 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL3", "MultiMedia3 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL4", "MultiMedia4 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL5", "MultiMedia5 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL6", "MultiMedia6 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL7", "MultiMedia7 Capture", 0, SND_SOC_NOPM, 0, 0),
+	SND_SOC_DAPM_AIF_OUT("MM_UL8", "MultiMedia8 Capture", 0, SND_SOC_NOPM, 0, 0),
+};
+
 static const struct snd_soc_component_driver q6asm_fe_dai_component = {
 	.name		= DRV_NAME,
 	.open		= q6asm_dai_open,
@@ -1245,6 +1264,8 @@ static const struct snd_soc_component_driver q6asm_fe_dai_component = {
 	.pcm_construct	= q6asm_dai_pcm_new,
 	.pcm_destruct	= q6asm_dai_pcm_free,
 	.compress_ops	= &q6asm_dai_compress_ops,
+	.dapm_widgets	= q6asm_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(q6asm_dapm_widgets),
 };
 
 static struct snd_soc_dai_driver q6asm_fe_dais_template[] = {
diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index 53185e26fea17..0a6b9433f6acf 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -713,24 +713,6 @@ static const struct snd_kcontrol_new mmul8_mixer_controls[] = {
 	Q6ROUTING_TX_MIXERS(MSM_FRONTEND_DAI_MULTIMEDIA8) };
 
 static const struct snd_soc_dapm_widget msm_qdsp6_widgets[] = {
-	/* Frontend AIF */
-	SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL2", "MultiMedia2 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL3", "MultiMedia3 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL4", "MultiMedia4 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL5", "MultiMedia5 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL6", "MultiMedia6 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL7", "MultiMedia7 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_IN("MM_DL8", "MultiMedia8 Playback", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL1", "MultiMedia1 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL2", "MultiMedia2 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL3", "MultiMedia3 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL4", "MultiMedia4 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL5", "MultiMedia5 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL6", "MultiMedia6 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL7", "MultiMedia7 Capture", 0, 0, 0, 0),
-	SND_SOC_DAPM_AIF_OUT("MM_UL8", "MultiMedia8 Capture", 0, 0, 0, 0),
-
 	/* Mixer definitions */
 	SND_SOC_DAPM_MIXER("HDMI Mixer", SND_SOC_NOPM, 0, 0,
 			   hdmi_mixer_controls,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 172/663] evm: Fix memleak in init_desc
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2021-03-01 16:06 ` [PATCH 5.10 171/663] ASoC: qcom: qdsp6: Move frontend AIFs to q6asm-dai Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 173/663] crypto: bcm - Rename struct device_private to bcm_device_private Greg Kroah-Hartman
                   ` (491 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Mimi Zohar, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit ccf11dbaa07b328fa469415c362d33459c140a37 ]

tmp_tfm is allocated, but not freed on subsequent kmalloc failure, which
leads to a memory leak.  Free tmp_tfm.

Fixes: d46eb3699502b ("evm: crypto hash replaced by shash")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
[zohar@linux.ibm.com: formatted/reworded patch description]
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/integrity/evm/evm_crypto.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 168c3b78ac47b..a6dd47eb086da 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -73,7 +73,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
 {
 	long rc;
 	const char *algo;
-	struct crypto_shash **tfm, *tmp_tfm;
+	struct crypto_shash **tfm, *tmp_tfm = NULL;
 	struct shash_desc *desc;
 
 	if (type == EVM_XATTR_HMAC) {
@@ -118,13 +118,16 @@ unlock:
 alloc:
 	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
 			GFP_KERNEL);
-	if (!desc)
+	if (!desc) {
+		crypto_free_shash(tmp_tfm);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	desc->tfm = *tfm;
 
 	rc = crypto_shash_init(desc);
 	if (rc) {
+		crypto_free_shash(tmp_tfm);
 		kfree(desc);
 		return ERR_PTR(rc);
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 173/663] crypto: bcm - Rename struct device_private to bcm_device_private
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 172/663] evm: Fix memleak in init_desc Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 174/663] sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue Greg Kroah-Hartman
                   ` (490 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Qais Yousef, Herbert Xu,
	Sasha Levin

From: Jiri Olsa <jolsa@kernel.org>

[ Upstream commit f7f2b43eaf6b4cfe54c75100709be31d5c4b52c8 ]

Renaming 'struct device_private' to 'struct bcm_device_private',
because it clashes with 'struct device_private' from
'drivers/base/base.h'.

While it's not a functional problem, it's causing two distinct
type hierarchies in BTF data. It also breaks build with options:
  CONFIG_DEBUG_INFO_BTF=y
  CONFIG_CRYPTO_DEV_BCM_SPU=y

as reported by Qais Yousef [1].

[1] https://lore.kernel.org/lkml/20201229151352.6hzmjvu3qh6p2qgg@e107158-lin/

Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Qais Yousef <qais.yousef@arm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/bcm/cipher.c | 2 +-
 drivers/crypto/bcm/cipher.h | 4 ++--
 drivers/crypto/bcm/util.c   | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index 50d169e61b41d..1cb310a133b3f 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -41,7 +41,7 @@
 
 /* ================= Device Structure ================== */
 
-struct device_private iproc_priv;
+struct bcm_device_private iproc_priv;
 
 /* ==================== Parameters ===================== */
 
diff --git a/drivers/crypto/bcm/cipher.h b/drivers/crypto/bcm/cipher.h
index 035c8389cb3dd..892823ef4a019 100644
--- a/drivers/crypto/bcm/cipher.h
+++ b/drivers/crypto/bcm/cipher.h
@@ -419,7 +419,7 @@ struct spu_hw {
 	u32 num_chan;
 };
 
-struct device_private {
+struct bcm_device_private {
 	struct platform_device *pdev;
 
 	struct spu_hw spu;
@@ -466,6 +466,6 @@ struct device_private {
 	struct mbox_chan **mbox;
 };
 
-extern struct device_private iproc_priv;
+extern struct bcm_device_private iproc_priv;
 
 #endif
diff --git a/drivers/crypto/bcm/util.c b/drivers/crypto/bcm/util.c
index 2b304fc780595..77aeedb840555 100644
--- a/drivers/crypto/bcm/util.c
+++ b/drivers/crypto/bcm/util.c
@@ -348,7 +348,7 @@ char *spu_alg_name(enum spu_cipher_alg alg, enum spu_cipher_mode mode)
 static ssize_t spu_debugfs_read(struct file *filp, char __user *ubuf,
 				size_t count, loff_t *offp)
 {
-	struct device_private *ipriv;
+	struct bcm_device_private *ipriv;
 	char *buf;
 	ssize_t ret, out_offset, out_count;
 	int i;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 174/663] sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 173/663] crypto: bcm - Rename struct device_private to bcm_device_private Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 175/663] drm/sun4i: tcon: fix inverted DCLK polarity Greg Kroah-Hartman
                   ` (489 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xuewen Yan, Peter Zijlstra (Intel),
	Dietmar Eggemann, Vincent Guittot, Sasha Levin

From: Xuewen Yan <xuewen.yan@unisoc.com>

[ Upstream commit 8c1f560c1ea3f19e22ba356f62680d9d449c9ec2 ]

CPU (root cfs_rq) estimated utilization (util_est) is currently used in
dequeue_task_fair() to drive frequency selection before it is updated.

with:

CPU_util        : rq->cfs.avg.util_avg
CPU_util_est    : rq->cfs.avg.util_est
CPU_utilization : max(CPU_util, CPU_util_est)
task_util       : p->se.avg.util_avg
task_util_est   : p->se.avg.util_est

dequeue_task_fair():

    /* (1) CPU_util and task_util update + inform schedutil about
           CPU_utilization changes */
    for_each_sched_entity() /* 2 loops */
        (dequeue_entity() ->) update_load_avg() -> cfs_rq_util_change()
         -> cpufreq_update_util() ->...-> sugov_update_[shared\|single]
         -> sugov_get_util() -> cpu_util_cfs()

    /* (2) CPU_util_est and task_util_est update */
    util_est_dequeue()

cpu_util_cfs() uses CPU_utilization which could lead to a false (too
high) utilization value for schedutil in task ramp-down or ramp-up
scenarios during task dequeue.

To mitigate the issue split the util_est update (2) into:

 (A) CPU_util_est update in util_est_dequeue()
 (B) task_util_est update in util_est_update()

Place (A) before (1) and keep (B) where (2) is. The latter is necessary
since (B) relies on task_util update in (1).

Fixes: 7f65ea42eb00 ("sched/fair: Add util_est on top of PELT")
Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://lkml.kernel.org/r/1608283672-18240-1-git-send-email-xuewen.yan94@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++---------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ae7ceba8fd4f2..f3a1b7ac4458b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3932,6 +3932,22 @@ static inline void util_est_enqueue(struct cfs_rq *cfs_rq,
 	trace_sched_util_est_cfs_tp(cfs_rq);
 }
 
+static inline void util_est_dequeue(struct cfs_rq *cfs_rq,
+				    struct task_struct *p)
+{
+	unsigned int enqueued;
+
+	if (!sched_feat(UTIL_EST))
+		return;
+
+	/* Update root cfs_rq's estimated utilization */
+	enqueued  = cfs_rq->avg.util_est.enqueued;
+	enqueued -= min_t(unsigned int, enqueued, _task_util_est(p));
+	WRITE_ONCE(cfs_rq->avg.util_est.enqueued, enqueued);
+
+	trace_sched_util_est_cfs_tp(cfs_rq);
+}
+
 /*
  * Check if a (signed) value is within a specified (unsigned) margin,
  * based on the observation that:
@@ -3945,23 +3961,16 @@ static inline bool within_margin(int value, int margin)
 	return ((unsigned int)(value + margin - 1) < (2 * margin - 1));
 }
 
-static void
-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
+static inline void util_est_update(struct cfs_rq *cfs_rq,
+				   struct task_struct *p,
+				   bool task_sleep)
 {
 	long last_ewma_diff;
 	struct util_est ue;
-	int cpu;
 
 	if (!sched_feat(UTIL_EST))
 		return;
 
-	/* Update root cfs_rq's estimated utilization */
-	ue.enqueued  = cfs_rq->avg.util_est.enqueued;
-	ue.enqueued -= min_t(unsigned int, ue.enqueued, _task_util_est(p));
-	WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued);
-
-	trace_sched_util_est_cfs_tp(cfs_rq);
-
 	/*
 	 * Skip update of task's estimated utilization when the task has not
 	 * yet completed an activation, e.g. being migrated.
@@ -4001,8 +4010,7 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
 	 * To avoid overestimation of actual task utilization, skip updates if
 	 * we cannot grant there is idle time in this CPU.
 	 */
-	cpu = cpu_of(rq_of(cfs_rq));
-	if (task_util(p) > capacity_orig_of(cpu))
+	if (task_util(p) > capacity_orig_of(cpu_of(rq_of(cfs_rq))))
 		return;
 
 	/*
@@ -4085,8 +4093,11 @@ static inline void
 util_est_enqueue(struct cfs_rq *cfs_rq, struct task_struct *p) {}
 
 static inline void
-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p,
-		 bool task_sleep) {}
+util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p) {}
+
+static inline void
+util_est_update(struct cfs_rq *cfs_rq, struct task_struct *p,
+		bool task_sleep) {}
 static inline void update_misfit_status(struct task_struct *p, struct rq *rq) {}
 
 #endif /* CONFIG_SMP */
@@ -5589,6 +5600,8 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
 	int idle_h_nr_running = task_has_idle_policy(p);
 	bool was_sched_idle = sched_idle_rq(rq);
 
+	util_est_dequeue(&rq->cfs, p);
+
 	for_each_sched_entity(se) {
 		cfs_rq = cfs_rq_of(se);
 		dequeue_entity(cfs_rq, se, flags);
@@ -5639,7 +5652,7 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
 		rq->next_balance = jiffies;
 
 dequeue_throttle:
-	util_est_dequeue(&rq->cfs, p, task_sleep);
+	util_est_update(&rq->cfs, p, task_sleep);
 	hrtick_update(rq);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 175/663] drm/sun4i: tcon: fix inverted DCLK polarity
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 174/663] sched/fair: Avoid stale CPU util_est value for schedutil in task dequeue Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 176/663] media: imx7: csi: Fix regression for parallel cameras on i.MX6UL Greg Kroah-Hartman
                   ` (488 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Giulio Benetti, Sasha Levin

From: Giulio Benetti <giulio.benetti@micronovasrl.com>

[ Upstream commit 67f4aeb2b41a0629abde3794d463547f60b0cbdd ]

During commit 88bc4178568b ("drm: Use new
DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags") DRM_BUS_FLAG_*
macros have been changed to avoid ambiguity but just because of this
ambiguity previous DRM_BUS_FLAG_PIXDATA_(POS/NEG)EDGE were used meaning
_SAMPLE_ not _DRIVE_. This leads to DLCK inversion and need to fix but
instead of swapping phase values, let's adopt an easier approach Maxime
suggested:
It turned out that bit 26 of SUN4I_TCON0_IO_POL_REG is dedicated to
invert DCLK polarity and this makes things really easier than before. So
let's handle DCLK polarity by adding SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE
as bit 26 and activating according to bus_flags the same way it is done
for all the other signals polarity.

Fixes: 88bc4178568b ("drm: Use new DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags")
Suggested-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20210114081732.9386-1-giulio.benetti@benettiengineering.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun4i_tcon.c | 21 ++-------------------
 drivers/gpu/drm/sun4i/sun4i_tcon.h |  1 +
 2 files changed, 3 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 1e643bc7e786a..9f06dec0fc61d 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -569,30 +569,13 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
 	if (info->bus_flags & DRM_BUS_FLAG_DE_LOW)
 		val |= SUN4I_TCON0_IO_POL_DE_NEGATIVE;
 
-	/*
-	 * On A20 and similar SoCs, the only way to achieve Positive Edge
-	 * (Rising Edge), is setting dclk clock phase to 2/3(240°).
-	 * By default TCON works in Negative Edge(Falling Edge),
-	 * this is why phase is set to 0 in that case.
-	 * Unfortunately there's no way to logically invert dclk through
-	 * IO_POL register.
-	 * The only acceptable way to work, triple checked with scope,
-	 * is using clock phase set to 0° for Negative Edge and set to 240°
-	 * for Positive Edge.
-	 * On A33 and similar SoCs there would be a 90° phase option,
-	 * but it divides also dclk by 2.
-	 * Following code is a way to avoid quirks all around TCON
-	 * and DOTCLOCK drivers.
-	 */
-	if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE)
-		clk_set_phase(tcon->dclk, 240);
-
 	if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
-		clk_set_phase(tcon->dclk, 0);
+		val |= SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE;
 
 	regmap_update_bits(tcon->regs, SUN4I_TCON0_IO_POL_REG,
 			   SUN4I_TCON0_IO_POL_HSYNC_POSITIVE |
 			   SUN4I_TCON0_IO_POL_VSYNC_POSITIVE |
+			   SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE |
 			   SUN4I_TCON0_IO_POL_DE_NEGATIVE,
 			   val);
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
index ee555318e3c2f..e624f6977eb84 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
@@ -113,6 +113,7 @@
 #define SUN4I_TCON0_IO_POL_REG			0x88
 #define SUN4I_TCON0_IO_POL_DCLK_PHASE(phase)		((phase & 3) << 28)
 #define SUN4I_TCON0_IO_POL_DE_NEGATIVE			BIT(27)
+#define SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE		BIT(26)
 #define SUN4I_TCON0_IO_POL_HSYNC_POSITIVE		BIT(25)
 #define SUN4I_TCON0_IO_POL_VSYNC_POSITIVE		BIT(24)
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 176/663] media: imx7: csi: Fix regression for parallel cameras on i.MX6UL
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 175/663] drm/sun4i: tcon: fix inverted DCLK polarity Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 177/663] media: imx7: csi: Fix pad link validation Greg Kroah-Hartman
                   ` (487 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Rui Miguel Silva,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Fabio Estevam <festevam@gmail.com>

[ Upstream commit 9bac67214fbf4b5f23463f7742ccf69bfe684cbd ]

Commit 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as
a CSI mux") made an incorrect assumption that for imx7-media-csi,
the bound subdev must always be a CSI mux. On i.MX6UL/i.MX6ULL there
is no CSI mux at all, so do not return an error when the entity is not a
video mux and assign the IMX_MEDIA_GRP_ID_CSI_MUX group id only when
appropriate.

This is the same approach as done in imx-media-csi.c and it fixes the
csi probe regression on i.MX6UL.

Tested on a imx6ull-evk board.

Fixes: 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as a CSI mux")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx7-media-csi.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
index a3f3df9017046..31e36168f9d0f 100644
--- a/drivers/staging/media/imx/imx7-media-csi.c
+++ b/drivers/staging/media/imx/imx7-media-csi.c
@@ -1164,12 +1164,12 @@ static int imx7_csi_notify_bound(struct v4l2_async_notifier *notifier,
 	struct imx7_csi *csi = imx7_csi_notifier_to_dev(notifier);
 	struct media_pad *sink = &csi->sd.entity.pads[IMX7_CSI_PAD_SINK];
 
-	/* The bound subdev must always be the CSI mux */
-	if (WARN_ON(sd->entity.function != MEDIA_ENT_F_VID_MUX))
-		return -ENXIO;
-
-	/* Mark it as such via its group id */
-	sd->grp_id = IMX_MEDIA_GRP_ID_CSI_MUX;
+	/*
+	 * If the subdev is a video mux, it must be one of the CSI
+	 * muxes. Mark it as such via its group id.
+	 */
+	if (sd->entity.function == MEDIA_ENT_F_VID_MUX)
+		sd->grp_id = IMX_MEDIA_GRP_ID_CSI_MUX;
 
 	return v4l2_create_fwnode_links_to_pad(sd, sink);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 177/663] media: imx7: csi: Fix pad link validation
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 176/663] media: imx7: csi: Fix regression for parallel cameras on i.MX6UL Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 178/663] media: ti-vpe: cal: fix write to unallocated memory Greg Kroah-Hartman
                   ` (486 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Rui Miguel Silva,
	Sébastien Szymanski, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

From: Rui Miguel Silva <rmfrfs@gmail.com>

[ Upstream commit f5ffb81f51376eb5a12e8c4cb4871426c65bb2af ]

We can not make the assumption that the bound subdev is always a CSI
mux, in i.MX6UL/i.MX6ULL that is not the case. So, just get the entity
selected by source directly upstream from the CSI.

Fixes: 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as a CSI mux")
Reported-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Fabio Estevam <festevam@gmail.com>
Tested-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx7-media-csi.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
index 31e36168f9d0f..ac52b1daf9914 100644
--- a/drivers/staging/media/imx/imx7-media-csi.c
+++ b/drivers/staging/media/imx/imx7-media-csi.c
@@ -499,6 +499,7 @@ static int imx7_csi_pad_link_validate(struct v4l2_subdev *sd,
 				      struct v4l2_subdev_format *sink_fmt)
 {
 	struct imx7_csi *csi = v4l2_get_subdevdata(sd);
+	struct media_entity *src;
 	struct media_pad *pad;
 	int ret;
 
@@ -509,11 +510,21 @@ static int imx7_csi_pad_link_validate(struct v4l2_subdev *sd,
 	if (!csi->src_sd)
 		return -EPIPE;
 
+	src = &csi->src_sd->entity;
+
+	/*
+	 * if the source is neither a CSI MUX or CSI-2 get the one directly
+	 * upstream from this CSI
+	 */
+	if (src->function != MEDIA_ENT_F_VID_IF_BRIDGE &&
+	    src->function != MEDIA_ENT_F_VID_MUX)
+		src = &csi->sd.entity;
+
 	/*
-	 * find the entity that is selected by the CSI mux. This is needed
+	 * find the entity that is selected by the source. This is needed
 	 * to distinguish between a parallel or CSI-2 pipeline.
 	 */
-	pad = imx_media_pipeline_pad(&csi->src_sd->entity, 0, 0, true);
+	pad = imx_media_pipeline_pad(src, 0, 0, true);
 	if (!pad)
 		return -ENODEV;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 178/663] media: ti-vpe: cal: fix write to unallocated memory
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 177/663] media: imx7: csi: Fix pad link validation Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 179/663] MIPS: properly stop .eh_frame generation Greg Kroah-Hartman
                   ` (485 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>

[ Upstream commit 5a402af5e19f215689e8bf3cc244c21d94eba3c4 ]

The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
of size cal_v4l2_async_subdev, otherwise access to
cal_v4l2_async_subdev->phy will go to unallocated memory.

Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier")
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/ti-vpe/cal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
index 59a0266b1f399..2eef245c31a17 100644
--- a/drivers/media/platform/ti-vpe/cal.c
+++ b/drivers/media/platform/ti-vpe/cal.c
@@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
  */
 
 struct cal_v4l2_async_subdev {
-	struct v4l2_async_subdev asd;
+	struct v4l2_async_subdev asd; /* Must be first */
 	struct cal_camerarx *phy;
 };
 
@@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal)
 		fwnode = of_fwnode_handle(phy->sensor_node);
 		asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier,
 							    fwnode,
-							    sizeof(*asd));
+							    sizeof(*casd));
 		if (IS_ERR(asd)) {
 			phy_err(phy, "Failed to add subdev to notifier\n");
 			ret = PTR_ERR(asd);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 179/663] MIPS: properly stop .eh_frame generation
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 178/663] media: ti-vpe: cal: fix write to unallocated memory Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 180/663] MIPS: Compare __SYNC_loongson3_war against 0 Greg Kroah-Hartman
                   ` (484 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Alexander Lobakin,
	Nathan Chancellor, Thomas Bogendoerfer, Sasha Levin

From: Alexander Lobakin <alobakin@pm.me>

[ Upstream commit 894ef530012fb5078466efdfb2c15d8b2f1565cd ]

Commit 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly") added
-fno-asynchronous-unwind-tables to KBUILD_CFLAGS to prevent compiler
from emitting .eh_frame symbols.
However, as MIPS heavily uses CFI, that's not enough. Use the
approach taken for x86 (as it also uses CFI) and explicitly put CFI
symbols into the .debug_frame section (except for VDSO).
This allows us to drop .eh_frame from DISCARDS as it's no longer
being generated.

Fixes: 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly")
Suggested-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/asm.h    | 18 ++++++++++++++++++
 arch/mips/kernel/vmlinux.lds.S |  1 -
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/asm.h b/arch/mips/include/asm/asm.h
index 3682d1a0bb808..ea4b62ece3366 100644
--- a/arch/mips/include/asm/asm.h
+++ b/arch/mips/include/asm/asm.h
@@ -20,10 +20,27 @@
 #include <asm/sgidefs.h>
 #include <asm/asm-eva.h>
 
+#ifndef __VDSO__
+/*
+ * Emit CFI data in .debug_frame sections, not .eh_frame sections.
+ * We don't do DWARF unwinding at runtime, so only the offline DWARF
+ * information is useful to anyone. Note we should change this if we
+ * ever decide to enable DWARF unwinding at runtime.
+ */
+#define CFI_SECTIONS	.cfi_sections .debug_frame
+#else
+ /*
+  * For the vDSO, emit both runtime unwind information and debug
+  * symbols for the .dbg file.
+  */
+#define CFI_SECTIONS
+#endif
+
 /*
  * LEAF - declare leaf routine
  */
 #define LEAF(symbol)					\
+		CFI_SECTIONS;				\
 		.globl	symbol;				\
 		.align	2;				\
 		.type	symbol, @function;		\
@@ -36,6 +53,7 @@ symbol:		.frame	sp, 0, ra;			\
  * NESTED - declare nested routine entry point
  */
 #define NESTED(symbol, framesize, rpc)			\
+		CFI_SECTIONS;				\
 		.globl	symbol;				\
 		.align	2;				\
 		.type	symbol, @function;		\
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 83e27a181206a..09fa4705ce8eb 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -224,6 +224,5 @@ SECTIONS
 		*(.options)
 		*(.pdr)
 		*(.reginfo)
-		*(.eh_frame)
 	}
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 682+ messages in thread

* [PATCH 5.10 180/663] MIPS: Compare __SYNC_loongson3_war against 0
  2021-03-01 16:04 [PATCH 5.10 000/663] 5.10.20-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2021-03-01 16:07 ` [PATCH 5.10 179/663] MIPS: properly stop .eh_frame generation Greg Kroah-Hartman
@ 2021-03-01 16:07 ` Greg Kroah-Hartman
  2021-03-01 16:07 ` [PATCH 5.10 181/663] drm/tegra: Fix reference leak when pm_runtime_get_sync() fails Greg Kroah-Hartman
                   ` (483 subsequent siblings)
  663 siblings, 0 replies; 682+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Nathan Chancellor,
	Nick Desaulniers, Thomas Bogendoerfer, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit 8790ccf8daf1a8c53b6cb8ce0c9a109274bd3fa8 ]

When building with clang when CONFIG_CPU_LOONGSON3_WORKAROUNDS is
enabled:

 In file included from lib/errseq.c:4:
 In file included from ./include/linux/atomic.h:7:
 ./arch/mips/include/asm/atomic.h:52:1: warning: converting the result of
 '<<' to a boolean always evaluates to true
 [-Wtautological-constant-compare]
 ATOMIC_OPS(atomic64, s64)
 ^
 ./arch/mips/include/asm/atomic.h:40:9: note: expanded from macro
 'ATOMIC_OPS'
         return cmpxchg(&v->counter, o, n);
                ^
 ./arch/mips/include/asm/cmpxchg.h:194:7: note: expanded from macro
 'cmpxchg'
         if (!__SYNC_loongson3_war)
              ^
 ./arch/mips/include/asm/sync.h:147:34: note: expanded from macro
 '__SYNC_loongson3_war'
 # define __SYNC_loongson3_war   (1 << 31)
                                    ^

While it is not wrong that the result of this shift is always true in a
boolean context, it is not a problem here. Regardless, the warning is
really noisy so rather than making the shift a boolean implicitly, use
it